payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/uploads/getFileFromUploadInstructions.js

@@ -0,0 +1,307 @@
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs';
+import { mkdir, rm } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { APIError } from '../errors/APIError.js';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+import { sanitizeUploadPrefix } from '../utilities/sanitizeUploadPrefix.js';
+import { verifyClientUploadReceipt } from './clientUploadReceipt.js';
+import { docWithFilenameExists } from './docWithFilenameExists.js';
+import { getFileContentRequirement, HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js';
+import { getImageSize } from './getImageSize.js';
+import { hasCropOrResizeEdit } from './hasCropOrResizeEdit.js';
+import { getStagedFile } from './stagedUpload.js';
+import { planTransformerPipeline } from './transformers/planTransformerPipeline.js';
+import { getUploadTransformerInternal } from './transformers/uploadTransformerBridge.js';
+export const getFileFromUploadInstructions = async ({ collectionSlug, file, req })=>{
+    if (!file || typeof file !== 'object' || typeof file.filename !== 'string' || typeof file.mimeType !== 'string' || !Number.isSafeInteger(file.size) || file.size < 0 || !file.uploadReference || typeof file.uploadReference !== 'object' || Array.isArray(file.uploadReference)) {
+        throw new APIError('Invalid upload reference.', 400);
+    }
+    /**
+   * Handlers fetch files uploaded to a storage provider. An uploadId points to a temporary file
+   * already stored by Payload, so no handler is needed.
+   */ if ('uploadId' in file.uploadReference) {
+        return getStagedFile({
+            collectionSlug,
+            req,
+            uploadReference: file.uploadReference
+        });
+    }
+    const uploadConfig = req.payload.collections[collectionSlug].config.upload;
+    let allowOverwrite = false;
+    if (uploadConfig?.uploadInstructions?.requiresUploadReceipt) {
+        const signedReceipt = 'signedReceipt' in file.uploadReference ? file.uploadReference.signedReceipt : undefined;
+        const receipt = verifyClientUploadReceipt({
+            collectionSlug,
+            filename: file.filename,
+            req,
+            signedReceipt
+        });
+        allowOverwrite = receipt.allowOverwrite === true;
+        file = {
+            ...file,
+            uploadReference: {
+                _objectKey: receipt._objectKey,
+                prefix: receipt.filePrefix,
+                signedReceipt
+            }
+        };
+    }
+    const prefix = 'prefix' in file.uploadReference && typeof file.uploadReference.prefix === 'string' ? file.uploadReference.prefix : undefined;
+    let sanitizedFilename;
+    try {
+        sanitizedFilename = sanitizeFilename(file.filename);
+    } catch  {
+        throw new APIError('Invalid upload reference.', 400);
+    }
+    if (sanitizedFilename !== file.filename || typeof prefix === 'string' && sanitizeUploadPrefix(prefix) !== prefix) {
+        throw new APIError('Invalid upload reference.', 400);
+    }
+    // Provider-backed references are submitted with the document request. They may only claim a
+    // new object identity; existing top-level and generated filenames already belong to another
+    // document and must continue through that document's read access checks.
+    if (!allowOverwrite && await docWithFilenameExists({
+        collectionSlug,
+        filename: file.filename,
+        matchAnyPrefix: true,
+        path: '',
+        prefix,
+        req
+    })) {
+        throw new APIError('Invalid upload reference.', 400);
+    }
+    if (!uploadConfig || !uploadConfig.handlers) {
+        throw new APIError('uploadConfig.handlers is not present for ' + collectionSlug);
+    }
+    const contentRequirement = getFileContentRequirement({
+        hasSizeEdits: requestHasSizeEdits(req),
+        hasTransformFileStages: await hasTransformFileStages({
+            collectionSlug,
+            mimeType: file.mimeType,
+            req
+        }),
+        mimeType: file.mimeType,
+        uploadConfig
+    });
+    // Nothing downstream reads this file's content - use the client-reported metadata directly
+    // instead of re-downloading a file that, for a chunked upload, can be far larger than
+    // the server's available memory or disk.
+    if (contentRequirement === 'none') {
+        return {
+            name: file.filename,
+            data: Buffer.alloc(0),
+            mimetype: file.mimeType,
+            size: file.size,
+            uploadReference: file.uploadReference
+        };
+    }
+    if (contentRequirement === 'header') {
+        const headerFile = await fetchHeaderOnly({
+            collectionSlug,
+            file,
+            req,
+            uploadConfig
+        });
+        if (headerFile) {
+            return headerFile;
+        }
+    // The header wasn't enough to determine the image's dimensions - fall through to a full fetch.
+    }
+    const response = await fetchUploadResponse({
+        collectionSlug,
+        file,
+        req,
+        uploadConfig
+    });
+    const tempFilePath = await streamResponseToTempFile({
+        req,
+        response
+    });
+    req.context ??= {};
+    req.context._payloadClientUploadTempFile = true;
+    return {
+        name: file.filename,
+        data: Buffer.alloc(0),
+        mimetype: response.headers.get('Content-Type') || file.mimeType,
+        size: file.size,
+        tempFilePath,
+        uploadReference: file.uploadReference
+    };
+};
+/**
+ * Whether the request's `uploadEdits` query param carries a crop or resize edit - reads the raw
+ * `req.query.uploadEdits`, since a full parse (with its `data`/`originalDoc` focal-point
+ * fallback, done in generateFileData.ts) isn't available yet at this point in the request
+ * lifecycle.
+ */ const requestHasSizeEdits = (req)=>{
+    const uploadEdits = req.query?.uploadEdits;
+    if (typeof uploadEdits !== 'object' || uploadEdits === null) {
+        return false;
+    }
+    return hasCropOrResizeEdit(uploadEdits);
+};
+/**
+ * Whether a transformer that reads the whole file will run `transformFile` on this upload. A
+ * bridge transformer (e.g. `sharpTransformer`) is excluded: it projects what it needs onto the
+ * sanitized upload config (`hasImageAdjustments`, `variants`) at startup instead.
+ */ const hasTransformFileStages = async ({ collectionSlug, mimeType, req })=>{
+    const transformers = req.payload.config.upload?.transformers ?? [];
+    if (transformers.length === 0) {
+        return false;
+    }
+    const pipeline = await planTransformerPipeline({
+        args: {
+            collectionSlug,
+            mimeType,
+            operation: 'upload',
+            req
+        },
+        capability: 'transformFile',
+        transformers
+    });
+    return pipeline.some((transformer)=>!getUploadTransformerInternal(transformer)?.prepareUpload);
+};
+/**
+ * Fetches only the first `HEADER_PROBE_BYTE_LENGTH` bytes of the upload (via a best-effort byte
+ * range request) and uses them to probe an image's dimensions, without downloading the rest of
+ * the file. Returns null if that isn't enough to determine the dimensions, so the caller can
+ * fall back to a full fetch.
+ */ const fetchHeaderOnly = async ({ collectionSlug, file, req, uploadConfig })=>{
+    const response = await fetchUploadResponse({
+        collectionSlug,
+        file,
+        rangeHeader: `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`,
+        req,
+        uploadConfig
+    });
+    const headerBuffer = await readBoundedPrefix(response, HEADER_PROBE_BYTE_LENGTH);
+    try {
+        await getImageSize({
+            file: {
+                name: file.filename,
+                data: headerBuffer,
+                mimetype: file.mimeType,
+                size: file.size
+            }
+        });
+    } catch  {
+        return null;
+    }
+    return {
+        name: file.filename,
+        data: headerBuffer,
+        mimetype: response.headers.get('Content-Type') || file.mimeType,
+        size: file.size,
+        uploadReference: file.uploadReference
+    };
+};
+/**
+ * Runs the collection's upload handlers, following a single redirect if one is returned.
+ * `rangeHeader`, when passed, is a best-effort hint - handlers that ignore it simply return the
+ * full file, which callers must still bound their own reads against.
+ */ const fetchUploadResponse = async ({ collectionSlug, file, rangeHeader, req, uploadConfig })=>{
+    const scopedReq = rangeHeader ? withRangeHeader(req, rangeHeader) : req;
+    let response = null;
+    let error;
+    for (const handler of uploadConfig.handlers){
+        try {
+            const result = await handler(scopedReq, {
+                doc: null,
+                params: {
+                    collection: collectionSlug,
+                    filename: file.filename,
+                    uploadReference: file.uploadReference
+                }
+            });
+            if (result) {
+                response = result;
+                break;
+            }
+        } catch (err) {
+            error = err;
+        }
+    }
+    if (!response) {
+        if (error) {
+            req.payload.logger.error(error);
+        }
+        throw new APIError('Expected response from the upload handler.');
+    }
+    if (response.status >= 300 && response.status < 400) {
+        const redirectUrl = response.headers.get('Location');
+        if (redirectUrl) {
+            response = await fetch(redirectUrl);
+        }
+    }
+    return response;
+};
+/**
+ * Overrides `req.headers` with a `Range` header while leaving the real incoming request
+ * untouched. Uses a Proxy, rather than cloning `req`, because `req` is a native `Request`
+ * instance at runtime - accessors like `.signal` are brand-checked against `req`'s internal
+ * slots, so a plain clone (e.g. `Object.create(req)`) throws once a handler reads one of them.
+ * Forwarding reads through `Reflect.get(req, prop, req)` keeps `this` bound to the real `req`
+ * so those accessors keep working.
+ */ const withRangeHeader = (req, rangeHeader)=>{
+    const headers = new Headers(req.headers);
+    headers.set('range', rangeHeader);
+    return new Proxy(req, {
+        get (target, prop) {
+            return prop === 'headers' ? headers : Reflect.get(target, prop, target);
+        }
+    });
+};
+/**
+ * Reads at most `maxBytes` from the response body, then cancels the reader - so a handler that
+ * ignores the range hint and starts streaming the whole file is still cut short on our end.
+ */ const readBoundedPrefix = async (response, maxBytes)=>{
+    if (!response.body) {
+        return Buffer.alloc(0);
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        while(total < maxBytes){
+            const { done, value } = await reader.read();
+            if (done || !value) {
+                break;
+            }
+            const remaining = maxBytes - total;
+            const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value;
+            chunks.push(Buffer.from(chunk));
+            total += chunk.byteLength;
+        }
+    } finally{
+        await reader.cancel().catch(()=>{});
+    }
+    return Buffer.concat(chunks, total);
+};
+/**
+ * Streams the fetched upload straight to disk instead of buffering it in memory. A client upload
+ * (e.g. Azure's chunkLargeFiles) can be far larger than the server's available memory, so this
+ * avoids re-downloading the whole file into a single in-memory buffer just to read it back out.
+ */ const streamResponseToTempFile = async ({ req, response })=>{
+    if (!response.body) {
+        throw new APIError('Expected a response body from the upload handler.');
+    }
+    const tempFileDir = req.payload.config.upload?.tempFileDir || os.tmpdir();
+    await mkdir(tempFileDir, {
+        recursive: true
+    });
+    const tempFilePath = path.join(tempFileDir, `payload-client-upload-${randomUUID()}`);
+    try {
+        await pipeline(Readable.fromWeb(response.body), fs.createWriteStream(tempFilePath));
+    } catch (error) {
+        await rm(tempFilePath, {
+            force: true
+        });
+        throw error;
+    }
+    return tempFilePath;
+};
+
+//# sourceMappingURL=getFileFromUploadInstructions.js.map

package/dist/uploads/getFileFromUploadInstructions.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileFromUploadInstructions.ts"],"sourcesContent":["import type { ReadableStream } from 'node:stream/web'\n\nimport { randomUUID } from 'node:crypto'\nimport fs from 'node:fs'\nimport { mkdir, rm } from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\nimport { Readable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\n\nimport type { PayloadRequest } from '../types/index.js'\nimport type { SanitizedUploadConfig, UploadEdits, UploadInstructions } from './types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\nimport { sanitizeUploadPrefix } from '../utilities/sanitizeUploadPrefix.js'\nimport { verifyClientUploadReceipt } from './clientUploadReceipt.js'\nimport { docWithFilenameExists } from './docWithFilenameExists.js'\nimport { getFileContentRequirement, HEADER_PROBE_BYTE_LENGTH } from './getFileContentRequirement.js'\nimport { getImageSize } from './getImageSize.js'\nimport { hasCropOrResizeEdit } from './hasCropOrResizeEdit.js'\nimport { getStagedFile } from './stagedUpload.js'\nimport { planTransformerPipeline } from './transformers/planTransformerPipeline.js'\nimport { getUploadTransformerInternal } from './transformers/uploadTransformerBridge.js'\n\nexport const getFileFromUploadInstructions = async ({\n  collectionSlug,\n  file,\n  req,\n}: {\n  collectionSlug: string\n  file: UploadInstructions['file']\n  req: PayloadRequest\n}): Promise<NonNullable<PayloadRequest['file']>> => {\n  if (\n    !file ||\n    typeof file !== 'object' ||\n    typeof file.filename !== 'string' ||\n    typeof file.mimeType !== 'string' ||\n    !Number.isSafeInteger(file.size) ||\n    file.size < 0 ||\n    !file.uploadReference ||\n    typeof file.uploadReference !== 'object' ||\n    Array.isArray(file.uploadReference)\n  ) {\n    throw new APIError('Invalid upload reference.', 400)\n  }\n\n  /**\n   * Handlers fetch files uploaded to a storage provider. An uploadId points to a temporary file\n   * already stored by Payload, so no handler is needed.\n   */\n  if ('uploadId' in file.uploadReference) {\n    return getStagedFile({ collectionSlug, req, uploadReference: file.uploadReference })\n  }\n\n  const uploadConfig = req.payload.collections[collectionSlug]!.config.upload\n  let allowOverwrite = false\n\n  if (uploadConfig?.uploadInstructions?.requiresUploadReceipt) {\n    const signedReceipt =\n      'signedReceipt' in file.uploadReference ? file.uploadReference.signedReceipt : undefined\n    const receipt = verifyClientUploadReceipt({\n      collectionSlug,\n      filename: file.filename,\n      req,\n      signedReceipt,\n    })\n    allowOverwrite = receipt.allowOverwrite === true\n    file = {\n      ...file,\n      uploadReference: {\n        _objectKey: receipt._objectKey,\n        prefix: receipt.filePrefix,\n        signedReceipt,\n      },\n    }\n  }\n\n  const prefix =\n    'prefix' in file.uploadReference && typeof file.uploadReference.prefix === 'string'\n      ? file.uploadReference.prefix\n      : undefined\n\n  let sanitizedFilename: string\n\n  try {\n    sanitizedFilename = sanitizeFilename(file.filename)\n  } catch {\n    throw new APIError('Invalid upload reference.', 400)\n  }\n\n  if (\n    sanitizedFilename !== file.filename ||\n    (typeof prefix === 'string' && sanitizeUploadPrefix(prefix) !== prefix)\n  ) {\n    throw new APIError('Invalid upload reference.', 400)\n  }\n\n  // Provider-backed references are submitted with the document request. They may only claim a\n  // new object identity; existing top-level and generated filenames already belong to another\n  // document and must continue through that document's read access checks.\n  if (\n    !allowOverwrite &&\n    (await docWithFilenameExists({\n      collectionSlug,\n      filename: file.filename,\n      matchAnyPrefix: true,\n      path: '',\n      prefix,\n      req,\n    }))\n  ) {\n    throw new APIError('Invalid upload reference.', 400)\n  }\n\n  if (!uploadConfig || !uploadConfig.handlers) {\n    throw new APIError('uploadConfig.handlers is not present for ' + collectionSlug)\n  }\n\n  const contentRequirement = getFileContentRequirement({\n    hasSizeEdits: requestHasSizeEdits(req),\n    hasTransformFileStages: await hasTransformFileStages({\n      collectionSlug,\n      mimeType: file.mimeType,\n      req,\n    }),\n    mimeType: file.mimeType,\n    uploadConfig,\n  })\n\n  // Nothing downstream reads this file's content - use the client-reported metadata directly\n  // instead of re-downloading a file that, for a chunked upload, can be far larger than\n  // the server's available memory or disk.\n  if (contentRequirement === 'none') {\n    return {\n      name: file.filename,\n      data: Buffer.alloc(0),\n      mimetype: file.mimeType,\n      size: file.size,\n      uploadReference: file.uploadReference,\n    }\n  }\n\n  if (contentRequirement === 'header') {\n    const headerFile = await fetchHeaderOnly({ collectionSlug, file, req, uploadConfig })\n    if (headerFile) {\n      return headerFile\n    }\n    // The header wasn't enough to determine the image's dimensions - fall through to a full fetch.\n  }\n\n  const response = await fetchUploadResponse({ collectionSlug, file, req, uploadConfig })\n\n  const tempFilePath = await streamResponseToTempFile({ req, response })\n  req.context ??= {}\n  req.context._payloadClientUploadTempFile = true\n\n  return {\n    name: file.filename,\n    data: Buffer.alloc(0),\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n    tempFilePath,\n    uploadReference: file.uploadReference,\n  }\n}\n\n/**\n * Whether the request's `uploadEdits` query param carries a crop or resize edit - reads the raw\n * `req.query.uploadEdits`, since a full parse (with its `data`/`originalDoc` focal-point\n * fallback, done in generateFileData.ts) isn't available yet at this point in the request\n * lifecycle.\n */\nconst requestHasSizeEdits = (req: PayloadRequest): boolean => {\n  const uploadEdits = req.query?.uploadEdits\n  if (typeof uploadEdits !== 'object' || uploadEdits === null) {\n    return false\n  }\n\n  return hasCropOrResizeEdit(uploadEdits as UploadEdits)\n}\n\n/**\n * Whether a transformer that reads the whole file will run `transformFile` on this upload. A\n * bridge transformer (e.g. `sharpTransformer`) is excluded: it projects what it needs onto the\n * sanitized upload config (`hasImageAdjustments`, `variants`) at startup instead.\n */\nconst hasTransformFileStages = async ({\n  collectionSlug,\n  mimeType,\n  req,\n}: {\n  collectionSlug: string\n  mimeType: string\n  req: PayloadRequest\n}): Promise<boolean> => {\n  const transformers = req.payload.config.upload?.transformers ?? []\n\n  if (transformers.length === 0) {\n    return false\n  }\n\n  const pipeline = await planTransformerPipeline({\n    args: { collectionSlug, mimeType, operation: 'upload', req },\n    capability: 'transformFile',\n    transformers,\n  })\n\n  return pipeline.some((transformer) => !getUploadTransformerInternal(transformer)?.prepareUpload)\n}\n\n/**\n * Fetches only the first `HEADER_PROBE_BYTE_LENGTH` bytes of the upload (via a best-effort byte\n * range request) and uses them to probe an image's dimensions, without downloading the rest of\n * the file. Returns null if that isn't enough to determine the dimensions, so the caller can\n * fall back to a full fetch.\n */\nconst fetchHeaderOnly = async ({\n  collectionSlug,\n  file,\n  req,\n  uploadConfig,\n}: {\n  collectionSlug: string\n  file: UploadInstructions['file']\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<NonNullable<PayloadRequest['file']> | null> => {\n  const response = await fetchUploadResponse({\n    collectionSlug,\n    file,\n    rangeHeader: `bytes=0-${HEADER_PROBE_BYTE_LENGTH - 1}`,\n    req,\n    uploadConfig,\n  })\n\n  const headerBuffer = await readBoundedPrefix(response, HEADER_PROBE_BYTE_LENGTH)\n\n  try {\n    await getImageSize({\n      file: {\n        name: file.filename,\n        data: headerBuffer,\n        mimetype: file.mimeType,\n        size: file.size,\n      },\n    })\n  } catch {\n    return null\n  }\n\n  return {\n    name: file.filename,\n    data: headerBuffer,\n    mimetype: response.headers.get('Content-Type') || file.mimeType,\n    size: file.size,\n    uploadReference: file.uploadReference,\n  }\n}\n\n/**\n * Runs the collection's upload handlers, following a single redirect if one is returned.\n * `rangeHeader`, when passed, is a best-effort hint - handlers that ignore it simply return the\n * full file, which callers must still bound their own reads against.\n */\nconst fetchUploadResponse = async ({\n  collectionSlug,\n  file,\n  rangeHeader,\n  req,\n  uploadConfig,\n}: {\n  collectionSlug: string\n  file: UploadInstructions['file']\n  rangeHeader?: string\n  req: PayloadRequest\n  uploadConfig: SanitizedUploadConfig\n}): Promise<Response> => {\n  const scopedReq = rangeHeader ? withRangeHeader(req, rangeHeader) : req\n\n  let response: null | Response = null\n  let error: unknown\n\n  for (const handler of uploadConfig.handlers!) {\n    try {\n      const result = await handler(scopedReq, {\n        doc: null!,\n        params: {\n          collection: collectionSlug,\n          filename: file.filename,\n          uploadReference: file.uploadReference,\n        },\n      })\n      if (result) {\n        response = result\n        /**\n         * - If a handler returns a Response, the response will be sent to the client and no further handlers will be run.\n         * - If a handler returns null, the next handler will be run.\n         *\n         * @see packages/payload/src/uploads/types.ts\n         */\n        break\n      }\n    } catch (err) {\n      error = err\n    }\n  }\n\n  if (!response) {\n    if (error) {\n      req.payload.logger.error(error)\n    }\n\n    throw new APIError('Expected response from the upload handler.')\n  }\n\n  if (response.status >= 300 && response.status < 400) {\n    const redirectUrl = response.headers.get('Location')\n    if (redirectUrl) {\n      response = await fetch(redirectUrl)\n    }\n  }\n\n  return response\n}\n\n/**\n * Overrides `req.headers` with a `Range` header while leaving the real incoming request\n * untouched. Uses a Proxy, rather than cloning `req`, because `req` is a native `Request`\n * instance at runtime - accessors like `.signal` are brand-checked against `req`'s internal\n * slots, so a plain clone (e.g. `Object.create(req)`) throws once a handler reads one of them.\n * Forwarding reads through `Reflect.get(req, prop, req)` keeps `this` bound to the real `req`\n * so those accessors keep working.\n */\nconst withRangeHeader = (req: PayloadRequest, rangeHeader: string): PayloadRequest => {\n  const headers = new Headers(req.headers)\n  headers.set('range', rangeHeader)\n\n  return new Proxy(req, {\n    get(target, prop) {\n      return prop === 'headers' ? headers : Reflect.get(target, prop, target)\n    },\n  })\n}\n\n/**\n * Reads at most `maxBytes` from the response body, then cancels the reader - so a handler that\n * ignores the range hint and starts streaming the whole file is still cut short on our end.\n */\nconst readBoundedPrefix = async (response: Response, maxBytes: number): Promise<Buffer> => {\n  if (!response.body) {\n    return Buffer.alloc(0)\n  }\n\n  const reader = response.body.getReader()\n  const chunks: Buffer[] = []\n  let total = 0\n\n  try {\n    while (total < maxBytes) {\n      const { done, value } = await reader.read()\n      if (done || !value) {\n        break\n      }\n\n      const remaining = maxBytes - total\n      const chunk = value.byteLength > remaining ? value.subarray(0, remaining) : value\n      chunks.push(Buffer.from(chunk))\n      total += chunk.byteLength\n    }\n  } finally {\n    await reader.cancel().catch(() => {})\n  }\n\n  return Buffer.concat(chunks, total)\n}\n\n/**\n * Streams the fetched upload straight to disk instead of buffering it in memory. A client upload\n * (e.g. Azure's chunkLargeFiles) can be far larger than the server's available memory, so this\n * avoids re-downloading the whole file into a single in-memory buffer just to read it back out.\n */\nconst streamResponseToTempFile = async ({\n  req,\n  response,\n}: {\n  req: PayloadRequest\n  response: Response\n}): Promise<string> => {\n  if (!response.body) {\n    throw new APIError('Expected a response body from the upload handler.')\n  }\n\n  const tempFileDir = req.payload.config.upload?.tempFileDir || os.tmpdir()\n  await mkdir(tempFileDir, { recursive: true })\n  const tempFilePath = path.join(tempFileDir, `payload-client-upload-${randomUUID()}`)\n\n  try {\n    await pipeline(\n      Readable.fromWeb(response.body as ReadableStream<Uint8Array>),\n      fs.createWriteStream(tempFilePath),\n    )\n  } catch (error) {\n    await rm(tempFilePath, { force: true })\n    throw error\n  }\n\n  return tempFilePath\n}\n"],"names":["randomUUID","fs","mkdir","rm","os","path","Readable","pipeline","APIError","sanitizeFilename","sanitizeUploadPrefix","verifyClientUploadReceipt","docWithFilenameExists","getFileContentRequirement","HEADER_PROBE_BYTE_LENGTH","getImageSize","hasCropOrResizeEdit","getStagedFile","planTransformerPipeline","getUploadTransformerInternal","getFileFromUploadInstructions","collectionSlug","file","req","filename","mimeType","Number","isSafeInteger","size","uploadReference","Array","isArray","uploadConfig","payload","collections","config","upload","allowOverwrite","uploadInstructions","requiresUploadReceipt","signedReceipt","undefined","receipt","_objectKey","prefix","filePrefix","sanitizedFilename","matchAnyPrefix","handlers","contentRequirement","hasSizeEdits","requestHasSizeEdits","hasTransformFileStages","name","data","Buffer","alloc","mimetype","headerFile","fetchHeaderOnly","response","fetchUploadResponse","tempFilePath","streamResponseToTempFile","context","_payloadClientUploadTempFile","headers","get","uploadEdits","query","transformers","length","args","operation","capability","some","transformer","prepareUpload","rangeHeader","headerBuffer","readBoundedPrefix","scopedReq","withRangeHeader","error","handler","result","doc","params","collection","err","logger","status","redirectUrl","fetch","Headers","set","Proxy","target","prop","Reflect","maxBytes","body","reader","getReader","chunks","total","done","value","read","remaining","chunk","byteLength","subarray","push","from","cancel","catch","concat","tempFileDir","tmpdir","recursive","join","fromWeb","createWriteStream","force"],"mappings":"AAEA,SAASA,UAAU,QAAQ,cAAa;AACxC,OAAOC,QAAQ,UAAS;AACxB,SAASC,KAAK,EAAEC,EAAE,QAAQ,mBAAkB;AAC5C,OAAOC,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAC5B,SAASC,QAAQ,QAAQ,cAAa;AACtC,SAASC,QAAQ,QAAQ,uBAAsB;AAK/C,SAASC,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,gBAAgB,QAAQ,mCAAkC;AACnE,SAASC,oBAAoB,QAAQ,uCAAsC;AAC3E,SAASC,yBAAyB,QAAQ,2BAA0B;AACpE,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,yBAAyB,EAAEC,wBAAwB,QAAQ,iCAAgC;AACpG,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,mBAAmB,QAAQ,2BAA0B;AAC9D,SAASC,aAAa,QAAQ,oBAAmB;AACjD,SAASC,uBAAuB,QAAQ,4CAA2C;AACnF,SAASC,4BAA4B,QAAQ,4CAA2C;AAExF,OAAO,MAAMC,gCAAgC,OAAO,EAClDC,cAAc,EACdC,IAAI,EACJC,GAAG,EAKJ;IACC,IACE,CAACD,QACD,OAAOA,SAAS,YAChB,OAAOA,KAAKE,QAAQ,KAAK,YACzB,OAAOF,KAAKG,QAAQ,KAAK,YACzB,CAACC,OAAOC,aAAa,CAACL,KAAKM,IAAI,KAC/BN,KAAKM,IAAI,GAAG,KACZ,CAACN,KAAKO,eAAe,IACrB,OAAOP,KAAKO,eAAe,KAAK,YAChCC,MAAMC,OAAO,CAACT,KAAKO,eAAe,GAClC;QACA,MAAM,IAAIrB,SAAS,6BAA6B;IAClD;IAEA;;;GAGC,GACD,IAAI,cAAcc,KAAKO,eAAe,EAAE;QACtC,OAAOZ,cAAc;YAAEI;YAAgBE;YAAKM,iBAAiBP,KAAKO,eAAe;QAAC;IACpF;IAEA,MAAMG,eAAeT,IAAIU,OAAO,CAACC,WAAW,CAACb,eAAe,CAAEc,MAAM,CAACC,MAAM;IAC3E,IAAIC,iBAAiB;IAErB,IAAIL,cAAcM,oBAAoBC,uBAAuB;QAC3D,MAAMC,gBACJ,mBAAmBlB,KAAKO,eAAe,GAAGP,KAAKO,eAAe,CAACW,aAAa,GAAGC;QACjF,MAAMC,UAAU/B,0BAA0B;YACxCU;YACAG,UAAUF,KAAKE,QAAQ;YACvBD;YACAiB;QACF;QACAH,iBAAiBK,QAAQL,cAAc,KAAK;QAC5Cf,OAAO;YACL,GAAGA,IAAI;YACPO,iBAAiB;gBACfc,YAAYD,QAAQC,UAAU;gBAC9BC,QAAQF,QAAQG,UAAU;gBAC1BL;YACF;QACF;IACF;IAEA,MAAMI,SACJ,YAAYtB,KAAKO,eAAe,IAAI,OAAOP,KAAKO,eAAe,CAACe,MAAM,KAAK,WACvEtB,KAAKO,eAAe,CAACe,MAAM,GAC3BH;IAEN,IAAIK;IAEJ,IAAI;QACFA,oBAAoBrC,iBAAiBa,KAAKE,QAAQ;IACpD,EAAE,OAAM;QACN,MAAM,IAAIhB,SAAS,6BAA6B;IAClD;IAEA,IACEsC,sBAAsBxB,KAAKE,QAAQ,IAClC,OAAOoB,WAAW,YAAYlC,qBAAqBkC,YAAYA,QAChE;QACA,MAAM,IAAIpC,SAAS,6BAA6B;IAClD;IAEA,4FAA4F;IAC5F,4FAA4F;IAC5F,yEAAyE;IACzE,IACE,CAAC6B,kBACA,MAAMzB,sBAAsB;QAC3BS;QACAG,UAAUF,KAAKE,QAAQ;QACvBuB,gBAAgB;QAChB1C,MAAM;QACNuC;QACArB;IACF,IACA;QACA,MAAM,IAAIf,SAAS,6BAA6B;IAClD;IAEA,IAAI,CAACwB,gBAAgB,CAACA,aAAagB,QAAQ,EAAE;QAC3C,MAAM,IAAIxC,SAAS,8CAA8Ca;IACnE;IAEA,MAAM4B,qBAAqBpC,0BAA0B;QACnDqC,cAAcC,oBAAoB5B;QAClC6B,wBAAwB,MAAMA,uBAAuB;YACnD/B;YACAI,UAAUH,KAAKG,QAAQ;YACvBF;QACF;QACAE,UAAUH,KAAKG,QAAQ;QACvBO;IACF;IAEA,2FAA2F;IAC3F,sFAAsF;IACtF,yCAAyC;IACzC,IAAIiB,uBAAuB,QAAQ;QACjC,OAAO;YACLI,MAAM/B,KAAKE,QAAQ;YACnB8B,MAAMC,OAAOC,KAAK,CAAC;YACnBC,UAAUnC,KAAKG,QAAQ;YACvBG,MAAMN,KAAKM,IAAI;YACfC,iBAAiBP,KAAKO,eAAe;QACvC;IACF;IAEA,IAAIoB,uBAAuB,UAAU;QACnC,MAAMS,aAAa,MAAMC,gBAAgB;YAAEtC;YAAgBC;YAAMC;YAAKS;QAAa;QACnF,IAAI0B,YAAY;YACd,OAAOA;QACT;IACA,+FAA+F;IACjG;IAEA,MAAME,WAAW,MAAMC,oBAAoB;QAAExC;QAAgBC;QAAMC;QAAKS;IAAa;IAErF,MAAM8B,eAAe,MAAMC,yBAAyB;QAAExC;QAAKqC;IAAS;IACpErC,IAAIyC,OAAO,KAAK,CAAC;IACjBzC,IAAIyC,OAAO,CAACC,4BAA4B,GAAG;IAE3C,OAAO;QACLZ,MAAM/B,KAAKE,QAAQ;QACnB8B,MAAMC,OAAOC,KAAK,CAAC;QACnBC,UAAUG,SAASM,OAAO,CAACC,GAAG,CAAC,mBAAmB7C,KAAKG,QAAQ;QAC/DG,MAAMN,KAAKM,IAAI;QACfkC;QACAjC,iBAAiBP,KAAKO,eAAe;IACvC;AACF,EAAC;AAED;;;;;CAKC,GACD,MAAMsB,sBAAsB,CAAC5B;IAC3B,MAAM6C,cAAc7C,IAAI8C,KAAK,EAAED;IAC/B,IAAI,OAAOA,gBAAgB,YAAYA,gBAAgB,MAAM;QAC3D,OAAO;IACT;IAEA,OAAOpD,oBAAoBoD;AAC7B;AAEA;;;;CAIC,GACD,MAAMhB,yBAAyB,OAAO,EACpC/B,cAAc,EACdI,QAAQ,EACRF,GAAG,EAKJ;IACC,MAAM+C,eAAe/C,IAAIU,OAAO,CAACE,MAAM,CAACC,MAAM,EAAEkC,gBAAgB,EAAE;IAElE,IAAIA,aAAaC,MAAM,KAAK,GAAG;QAC7B,OAAO;IACT;IAEA,MAAMhE,WAAW,MAAMW,wBAAwB;QAC7CsD,MAAM;YAAEnD;YAAgBI;YAAUgD,WAAW;YAAUlD;QAAI;QAC3DmD,YAAY;QACZJ;IACF;IAEA,OAAO/D,SAASoE,IAAI,CAAC,CAACC,cAAgB,CAACzD,6BAA6ByD,cAAcC;AACpF;AAEA;;;;;CAKC,GACD,MAAMlB,kBAAkB,OAAO,EAC7BtC,cAAc,EACdC,IAAI,EACJC,GAAG,EACHS,YAAY,EAMb;IACC,MAAM4B,WAAW,MAAMC,oBAAoB;QACzCxC;QACAC;QACAwD,aAAa,CAAC,QAAQ,EAAEhE,2BAA2B,GAAG;QACtDS;QACAS;IACF;IAEA,MAAM+C,eAAe,MAAMC,kBAAkBpB,UAAU9C;IAEvD,IAAI;QACF,MAAMC,aAAa;YACjBO,MAAM;gBACJ+B,MAAM/B,KAAKE,QAAQ;gBACnB8B,MAAMyB;gBACNtB,UAAUnC,KAAKG,QAAQ;gBACvBG,MAAMN,KAAKM,IAAI;YACjB;QACF;IACF,EAAE,OAAM;QACN,OAAO;IACT;IAEA,OAAO;QACLyB,MAAM/B,KAAKE,QAAQ;QACnB8B,MAAMyB;QACNtB,UAAUG,SAASM,OAAO,CAACC,GAAG,CAAC,mBAAmB7C,KAAKG,QAAQ;QAC/DG,MAAMN,KAAKM,IAAI;QACfC,iBAAiBP,KAAKO,eAAe;IACvC;AACF;AAEA;;;;CAIC,GACD,MAAMgC,sBAAsB,OAAO,EACjCxC,cAAc,EACdC,IAAI,EACJwD,WAAW,EACXvD,GAAG,EACHS,YAAY,EAOb;IACC,MAAMiD,YAAYH,cAAcI,gBAAgB3D,KAAKuD,eAAevD;IAEpE,IAAIqC,WAA4B;IAChC,IAAIuB;IAEJ,KAAK,MAAMC,WAAWpD,aAAagB,QAAQ,CAAG;QAC5C,IAAI;YACF,MAAMqC,SAAS,MAAMD,QAAQH,WAAW;gBACtCK,KAAK;gBACLC,QAAQ;oBACNC,YAAYnE;oBACZG,UAAUF,KAAKE,QAAQ;oBACvBK,iBAAiBP,KAAKO,eAAe;gBACvC;YACF;YACA,IAAIwD,QAAQ;gBACVzB,WAAWyB;gBAOX;YACF;QACF,EAAE,OAAOI,KAAK;YACZN,QAAQM;QACV;IACF;IAEA,IAAI,CAAC7B,UAAU;QACb,IAAIuB,OAAO;YACT5D,IAAIU,OAAO,CAACyD,MAAM,CAACP,KAAK,CAACA;QAC3B;QAEA,MAAM,IAAI3E,SAAS;IACrB;IAEA,IAAIoD,SAAS+B,MAAM,IAAI,OAAO/B,SAAS+B,MAAM,GAAG,KAAK;QACnD,MAAMC,cAAchC,SAASM,OAAO,CAACC,GAAG,CAAC;QACzC,IAAIyB,aAAa;YACfhC,WAAW,MAAMiC,MAAMD;QACzB;IACF;IAEA,OAAOhC;AACT;AAEA;;;;;;;CAOC,GACD,MAAMsB,kBAAkB,CAAC3D,KAAqBuD;IAC5C,MAAMZ,UAAU,IAAI4B,QAAQvE,IAAI2C,OAAO;IACvCA,QAAQ6B,GAAG,CAAC,SAASjB;IAErB,OAAO,IAAIkB,MAAMzE,KAAK;QACpB4C,KAAI8B,MAAM,EAAEC,IAAI;YACd,OAAOA,SAAS,YAAYhC,UAAUiC,QAAQhC,GAAG,CAAC8B,QAAQC,MAAMD;QAClE;IACF;AACF;AAEA;;;CAGC,GACD,MAAMjB,oBAAoB,OAAOpB,UAAoBwC;IACnD,IAAI,CAACxC,SAASyC,IAAI,EAAE;QAClB,OAAO9C,OAAOC,KAAK,CAAC;IACtB;IAEA,MAAM8C,SAAS1C,SAASyC,IAAI,CAACE,SAAS;IACtC,MAAMC,SAAmB,EAAE;IAC3B,IAAIC,QAAQ;IAEZ,IAAI;QACF,MAAOA,QAAQL,SAAU;YACvB,MAAM,EAAEM,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAML,OAAOM,IAAI;YACzC,IAAIF,QAAQ,CAACC,OAAO;gBAClB;YACF;YAEA,MAAME,YAAYT,WAAWK;YAC7B,MAAMK,QAAQH,MAAMI,UAAU,GAAGF,YAAYF,MAAMK,QAAQ,CAAC,GAAGH,aAAaF;YAC5EH,OAAOS,IAAI,CAAC1D,OAAO2D,IAAI,CAACJ;YACxBL,SAASK,MAAMC,UAAU;QAC3B;IACF,SAAU;QACR,MAAMT,OAAOa,MAAM,GAAGC,KAAK,CAAC,KAAO;IACrC;IAEA,OAAO7D,OAAO8D,MAAM,CAACb,QAAQC;AAC/B;AAEA;;;;CAIC,GACD,MAAM1C,2BAA2B,OAAO,EACtCxC,GAAG,EACHqC,QAAQ,EAIT;IACC,IAAI,CAACA,SAASyC,IAAI,EAAE;QAClB,MAAM,IAAI7F,SAAS;IACrB;IAEA,MAAM8G,cAAc/F,IAAIU,OAAO,CAACE,MAAM,CAACC,MAAM,EAAEkF,eAAelH,GAAGmH,MAAM;IACvE,MAAMrH,MAAMoH,aAAa;QAAEE,WAAW;IAAK;IAC3C,MAAM1D,eAAezD,KAAKoH,IAAI,CAACH,aAAa,CAAC,sBAAsB,EAAEtH,cAAc;IAEnF,IAAI;QACF,MAAMO,SACJD,SAASoH,OAAO,CAAC9D,SAASyC,IAAI,GAC9BpG,GAAG0H,iBAAiB,CAAC7D;IAEzB,EAAE,OAAOqB,OAAO;QACd,MAAMhF,GAAG2D,cAAc;YAAE8D,OAAO;QAAK;QACrC,MAAMzC;IACR;IAEA,OAAOrB;AACT"}

package/dist/uploads/getFileTypeFallback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAAA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAiBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}
+{"version":3,"file":"getFileTypeFallback.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeFallback.ts"],"names":[],"mappings":"AAEA,KAAK,UAAU,GAAG;IAChB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAkBD,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,UAOlD,CAAA"}

package/dist/uploads/getFileTypeFallback.js

@@ -1,3 +1,4 @@
+import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js';
 const extensionMap = {
     css: 'text/css',
     csv: 'text/csv',
@@ -7,11 +8,12 @@ const extensionMap = {
     json: 'application/json',
     md: 'text/markdown',
     svg: 'image/svg+xml',
+    xhtml: 'application/xhtml+xml',
     xml: 'application/xml',
     yml: 'application/x-yaml'
 };
 export const getFileTypeFallback = (path)=>{
-    const ext = path.split('.').pop() || 'txt';
+    const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt';
     return {
         ext,
         mime: extensionMap[ext] || 'text/plain'

package/dist/uploads/getFileTypeFallback.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["type ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = path.split('.').pop() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["extensionMap","css","csv","htm","html","js","json","md","svg","xml","yml","getFileTypeFallback","path","ext","split","pop","mime"],"mappings":"AAKA,MAAMA,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMD,KAAKE,KAAK,CAAC,KAAKC,GAAG,MAAM;IAErC,OAAO;QACLF;QACAG,MAAMhB,YAAY,CAACa,IAAI,IAAI;IAC7B;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/getFileTypeFallback.ts"],"sourcesContent":["import { getFileExtension, getSanitizedUploadFilename } from './getFileTypeIdentity.js'\n\ntype ReturnType = {\n  ext: string\n  mime: string\n}\n\nconst extensionMap: {\n  [ext: string]: string\n} = {\n  css: 'text/css',\n  csv: 'text/csv',\n  htm: 'text/html',\n  html: 'text/html',\n  js: 'application/javascript',\n  json: 'application/json',\n  md: 'text/markdown',\n  svg: 'image/svg+xml',\n  xhtml: 'application/xhtml+xml',\n  xml: 'application/xml',\n  yml: 'application/x-yaml',\n}\n\nexport const getFileTypeFallback = (path: string): ReturnType => {\n  const ext = getFileExtension(getSanitizedUploadFilename(path)).toLowerCase() || 'txt'\n\n  return {\n    ext,\n    mime: extensionMap[ext] || 'text/plain',\n  }\n}\n"],"names":["getFileExtension","getSanitizedUploadFilename","extensionMap","css","csv","htm","html","js","json","md","svg","xhtml","xml","yml","getFileTypeFallback","path","ext","toLowerCase","mime"],"mappings":"AAAA,SAASA,gBAAgB,EAAEC,0BAA0B,QAAQ,2BAA0B;AAOvF,MAAMC,eAEF;IACFC,KAAK;IACLC,KAAK;IACLC,KAAK;IACLC,MAAM;IACNC,IAAI;IACJC,MAAM;IACNC,IAAI;IACJC,KAAK;IACLC,OAAO;IACPC,KAAK;IACLC,KAAK;AACP;AAEA,OAAO,MAAMC,sBAAsB,CAACC;IAClC,MAAMC,MAAMhB,iBAAiBC,2BAA2Bc,OAAOE,WAAW,MAAM;IAEhF,OAAO;QACLD;QACAE,MAAMhB,YAAY,CAACc,IAAI,IAAI;IAC7B;AACF,EAAC"}

package/dist/uploads/getFileTypeIdentity.d.ts

@@ -0,0 +1,19 @@
+export declare const getFileExtension: (filename: string) => string;
+export declare const getSanitizedUploadFilename: (filename: string, outputExtension?: string) => string;
+export declare const getMimeTypeEssence: (mimeType?: null | string) => string;
+export declare const isSvgMimeType: (mimeType?: null | string) => boolean;
+export declare const isXmlMimeType: (mimeType?: null | string) => boolean;
+export declare const isSvgUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const isXmlUpload: ({ filename, mimeType, }: {
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+export declare const uploadRequiresServerValidation: (upload: {
+    allowRestrictedFileTypes?: boolean;
+    filename: string;
+    mimeType?: null | string;
+}) => boolean;
+//# sourceMappingURL=getFileTypeIdentity.d.ts.map

package/dist/uploads/getFileTypeIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getFileTypeIdentity.d.ts","sourceRoot":"","sources":["../../src/uploads/getFileTypeIdentity.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,gBAAgB,aAAc,MAAM,KAAG,MASnD,CAAA;AAED,eAAO,MAAM,0BAA0B,aAAc,MAAM,oBAAoB,MAAM,KAAG,MAOvF,CAAA;AAED,eAAO,MAAM,kBAAkB,cAAe,IAAI,GAAG,MAAM,KAAG,MAQ7D,CAAA;AAED,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OACP,CAAA;AAElD,eAAO,MAAM,aAAa,cAAe,IAAI,GAAG,MAAM,KAAG,OAQxD,CAAA;AAED,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,WAAW,4BAGrB;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAEqB,CAAA;AAEzB,eAAO,MAAM,8BAA8B,WAAY;IACrD,wBAAwB,CAAC,EAAE,OAAO,CAAA;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;CACzB,KAAG,OAA2F,CAAA"}

package/dist/uploads/getFileTypeIdentity.js

@@ -0,0 +1,34 @@
+import sanitize from 'sanitize-filename';
+import { sanitizeFilename } from '../utilities/sanitizeFilename.js';
+export const getFileExtension = (filename)=>{
+    if (!filename.includes('.')) {
+        return '';
+    }
+    const extension = filename.split('.').pop() || '';
+    const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1);
+    return extensionWithoutSuffix;
+};
+export const getSanitizedUploadFilename = (filename, outputExtension)=>{
+    const basename = sanitizeFilename(filename);
+    const sourceExtension = getFileExtension(basename);
+    const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename);
+    const extension = outputExtension ?? sourceExtension;
+    return `${baseFilename}${extension ? `.${extension}` : ''}`;
+};
+export const getMimeTypeEssence = (mimeType)=>{
+    if (!mimeType) {
+        return '';
+    }
+    const [essence = ''] = mimeType.split(';', 1);
+    return essence.trim().toLowerCase();
+};
+export const isSvgMimeType = (mimeType)=>getMimeTypeEssence(mimeType) === 'image/svg+xml';
+export const isXmlMimeType = (mimeType)=>{
+    const mimeTypeEssence = getMimeTypeEssence(mimeType);
+    return mimeTypeEssence === 'application/xml' || mimeTypeEssence === 'text/xml' || mimeTypeEssence.endsWith('+xml');
+};
+export const isSvgUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' || isSvgMimeType(mimeType);
+export const isXmlUpload = ({ filename, mimeType })=>getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' || isXmlMimeType(mimeType);
+export const uploadRequiresServerValidation = (upload)=>!upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload));
+
+//# sourceMappingURL=getFileTypeIdentity.js.map

package/dist/uploads/getFileTypeIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/getFileTypeIdentity.ts"],"sourcesContent":["import sanitize from 'sanitize-filename'\n\nimport { sanitizeFilename } from '../utilities/sanitizeFilename.js'\n\nexport const getFileExtension = (filename: string): string => {\n  if (!filename.includes('.')) {\n    return ''\n  }\n\n  const extension = filename.split('.').pop() || ''\n  const [extensionWithoutSuffix = ''] = extension.split(/[?#]/, 1)\n\n  return extensionWithoutSuffix\n}\n\nexport const getSanitizedUploadFilename = (filename: string, outputExtension?: string): string => {\n  const basename = sanitizeFilename(filename)\n  const sourceExtension = getFileExtension(basename)\n  const baseFilename = sanitize(basename.substring(0, basename.lastIndexOf('.')) || basename)\n  const extension = outputExtension ?? sourceExtension\n\n  return `${baseFilename}${extension ? `.${extension}` : ''}`\n}\n\nexport const getMimeTypeEssence = (mimeType?: null | string): string => {\n  if (!mimeType) {\n    return ''\n  }\n\n  const [essence = ''] = mimeType.split(';', 1)\n\n  return essence.trim().toLowerCase()\n}\n\nexport const isSvgMimeType = (mimeType?: null | string): boolean =>\n  getMimeTypeEssence(mimeType) === 'image/svg+xml'\n\nexport const isXmlMimeType = (mimeType?: null | string): boolean => {\n  const mimeTypeEssence = getMimeTypeEssence(mimeType)\n\n  return (\n    mimeTypeEssence === 'application/xml' ||\n    mimeTypeEssence === 'text/xml' ||\n    mimeTypeEssence.endsWith('+xml')\n  )\n}\n\nexport const isSvgUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'svg' ||\n  isSvgMimeType(mimeType)\n\nexport const isXmlUpload = ({\n  filename,\n  mimeType,\n}: {\n  filename: string\n  mimeType?: null | string\n}): boolean =>\n  getFileExtension(getSanitizedUploadFilename(filename)).toLowerCase() === 'xml' ||\n  isXmlMimeType(mimeType)\n\nexport const uploadRequiresServerValidation = (upload: {\n  allowRestrictedFileTypes?: boolean\n  filename: string\n  mimeType?: null | string\n}): boolean => !upload.allowRestrictedFileTypes && (isSvgUpload(upload) || isXmlUpload(upload))\n"],"names":["sanitize","sanitizeFilename","getFileExtension","filename","includes","extension","split","pop","extensionWithoutSuffix","getSanitizedUploadFilename","outputExtension","basename","sourceExtension","baseFilename","substring","lastIndexOf","getMimeTypeEssence","mimeType","essence","trim","toLowerCase","isSvgMimeType","isXmlMimeType","mimeTypeEssence","endsWith","isSvgUpload","isXmlUpload","uploadRequiresServerValidation","upload","allowRestrictedFileTypes"],"mappings":"AAAA,OAAOA,cAAc,oBAAmB;AAExC,SAASC,gBAAgB,QAAQ,mCAAkC;AAEnE,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,IAAI,CAACA,SAASC,QAAQ,CAAC,MAAM;QAC3B,OAAO;IACT;IAEA,MAAMC,YAAYF,SAASG,KAAK,CAAC,KAAKC,GAAG,MAAM;IAC/C,MAAM,CAACC,yBAAyB,EAAE,CAAC,GAAGH,UAAUC,KAAK,CAAC,QAAQ;IAE9D,OAAOE;AACT,EAAC;AAED,OAAO,MAAMC,6BAA6B,CAACN,UAAkBO;IAC3D,MAAMC,WAAWV,iBAAiBE;IAClC,MAAMS,kBAAkBV,iBAAiBS;IACzC,MAAME,eAAeb,SAASW,SAASG,SAAS,CAAC,GAAGH,SAASI,WAAW,CAAC,SAASJ;IAClF,MAAMN,YAAYK,mBAAmBE;IAErC,OAAO,GAAGC,eAAeR,YAAY,CAAC,CAAC,EAAEA,WAAW,GAAG,IAAI;AAC7D,EAAC;AAED,OAAO,MAAMW,qBAAqB,CAACC;IACjC,IAAI,CAACA,UAAU;QACb,OAAO;IACT;IAEA,MAAM,CAACC,UAAU,EAAE,CAAC,GAAGD,SAASX,KAAK,CAAC,KAAK;IAE3C,OAAOY,QAAQC,IAAI,GAAGC,WAAW;AACnC,EAAC;AAED,OAAO,MAAMC,gBAAgB,CAACJ,WAC5BD,mBAAmBC,cAAc,gBAAe;AAElD,OAAO,MAAMK,gBAAgB,CAACL;IAC5B,MAAMM,kBAAkBP,mBAAmBC;IAE3C,OACEM,oBAAoB,qBACpBA,oBAAoB,cACpBA,gBAAgBC,QAAQ,CAAC;AAE7B,EAAC;AAED,OAAO,MAAMC,cAAc,CAAC,EAC1BtB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEC,cAAcJ,UAAS;AAEzB,OAAO,MAAMS,cAAc,CAAC,EAC1BvB,QAAQ,EACRc,QAAQ,EAIT,GACCf,iBAAiBO,2BAA2BN,WAAWiB,WAAW,OAAO,SACzEE,cAAcL,UAAS;AAEzB,OAAO,MAAMU,iCAAiC,CAACC,SAIhC,CAACA,OAAOC,wBAAwB,IAAKJ,CAAAA,YAAYG,WAAWF,YAAYE,OAAM,EAAE"}

package/dist/uploads/getImageSize.d.ts

@@ -1,4 +1,11 @@
 import type { PayloadRequest } from '../types/index.js';
 import type { ProbedImageSize } from './types.js';
-export declare function getImageSize(file: PayloadRequest['file']): Promise<ProbedImageSize>;
+/**
+ * Reads an uploaded file's dimensions via the dependency-free probe. Throws
+ * if the buffer isn't a recognized/parseable image format — callers that
+ * don't already know the file is an image should catch and ignore.
+ */
+export declare function getImageSize({ file, }: {
+    file: PayloadRequest['file'];
+}): Promise<ProbedImageSize>;
 //# sourceMappingURL=getImageSize.d.ts.map

package/dist/uploads/getImageSize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getImageSize.d.ts","sourceRoot":"","sources":["../../src/uploads/getImageSize.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAIjD,wBAAsB,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAmBzF"}
+{"version":3,"file":"getImageSize.d.ts","sourceRoot":"","sources":["../../src/uploads/getImageSize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAIjD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,EACjC,IAAI,GACL,EAAE;IACD,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,GAAG,OAAO,CAAC,eAAe,CAAC,CAS3B"}

package/dist/uploads/getImageSize.js

@@ -1,23 +1,15 @@
-import fs from 'fs/promises';
-import { imageSize } from 'image-size';
-import { imageSizeFromFile } from 'image-size/fromFile';
-import { temporaryFileTask } from './tempFile.js';
-export async function getImageSize(file) {
-    if (file?.tempFilePath) {
-        return imageSizeFromFile(file.tempFilePath);
+import { probeImageSize, probeImageSizeFromPath } from './probeImageSize.js';
+/**
+ * Reads an uploaded file's dimensions via the dependency-free probe. Throws
+ * if the buffer isn't a recognized/parseable image format — callers that
+ * don't already know the file is an image should catch and ignore.
+ */ export async function getImageSize({ file }) {
+    // `tempFilePath` may be an empty string when the file is held in memory
+    const tempFilePath = file?.tempFilePath || undefined;
+    if (tempFilePath) {
+        return probeImageSizeFromPath(tempFilePath);
     }
-    // Tiff file do not support buffers or streams, so we must write to file first
-    // then retrieve dimensions. https://github.com/image-size/image-size/issues/103
-    if (file?.mimetype === 'image/tiff') {
-        const dimensions = await temporaryFileTask(async (filepath)=>{
-            await fs.writeFile(filepath, file.data);
-            return imageSizeFromFile(filepath);
-        }, {
-            extension: 'tiff'
-        });
-        return dimensions;
-    }
-    return imageSize(file.data);
+    return probeImageSize(file.data);
 }
 
 //# sourceMappingURL=getImageSize.js.map

package/dist/uploads/getImageSize.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/getImageSize.ts"],"sourcesContent":["import fs from 'fs/promises'\nimport { imageSize } from 'image-size'\nimport { imageSizeFromFile } from 'image-size/fromFile'\n\nimport type { PayloadRequest } from '../types/index.js'\nimport type { ProbedImageSize } from './types.js'\n\nimport { temporaryFileTask } from './tempFile.js'\n\nexport async function getImageSize(file: PayloadRequest['file']): Promise<ProbedImageSize> {\n  if (file?.tempFilePath) {\n    return imageSizeFromFile(file.tempFilePath)\n  }\n\n  // Tiff file do not support buffers or streams, so we must write to file first\n  // then retrieve dimensions. https://github.com/image-size/image-size/issues/103\n  if (file?.mimetype === 'image/tiff') {\n    const dimensions = await temporaryFileTask(\n      async (filepath: string) => {\n        await fs.writeFile(filepath, file.data)\n        return imageSizeFromFile(filepath)\n      },\n      { extension: 'tiff' },\n    )\n    return dimensions\n  }\n\n  return imageSize(file!.data)\n}\n"],"names":["fs","imageSize","imageSizeFromFile","temporaryFileTask","getImageSize","file","tempFilePath","mimetype","dimensions","filepath","writeFile","data","extension"],"mappings":"AAAA,OAAOA,QAAQ,cAAa;AAC5B,SAASC,SAAS,QAAQ,aAAY;AACtC,SAASC,iBAAiB,QAAQ,sBAAqB;AAKvD,SAASC,iBAAiB,QAAQ,gBAAe;AAEjD,OAAO,eAAeC,aAAaC,IAA4B;IAC7D,IAAIA,MAAMC,cAAc;QACtB,OAAOJ,kBAAkBG,KAAKC,YAAY;IAC5C;IAEA,8EAA8E;IAC9E,gFAAgF;IAChF,IAAID,MAAME,aAAa,cAAc;QACnC,MAAMC,aAAa,MAAML,kBACvB,OAAOM;YACL,MAAMT,GAAGU,SAAS,CAACD,UAAUJ,KAAKM,IAAI;YACtC,OAAOT,kBAAkBO;QAC3B,GACA;YAAEG,WAAW;QAAO;QAEtB,OAAOJ;IACT;IAEA,OAAOP,UAAUI,KAAMM,IAAI;AAC7B"}
+{"version":3,"sources":["../../src/uploads/getImageSize.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { ProbedImageSize } from './types.js'\n\nimport { probeImageSize, probeImageSizeFromPath } from './probeImageSize.js'\n\n/**\n * Reads an uploaded file's dimensions via the dependency-free probe. Throws\n * if the buffer isn't a recognized/parseable image format — callers that\n * don't already know the file is an image should catch and ignore.\n */\nexport async function getImageSize({\n  file,\n}: {\n  file: PayloadRequest['file']\n}): Promise<ProbedImageSize> {\n  // `tempFilePath` may be an empty string when the file is held in memory\n  const tempFilePath = file?.tempFilePath || undefined\n\n  if (tempFilePath) {\n    return probeImageSizeFromPath(tempFilePath)\n  }\n\n  return probeImageSize(file!.data)\n}\n"],"names":["probeImageSize","probeImageSizeFromPath","getImageSize","file","tempFilePath","undefined","data"],"mappings":"AAGA,SAASA,cAAc,EAAEC,sBAAsB,QAAQ,sBAAqB;AAE5E;;;;CAIC,GACD,OAAO,eAAeC,aAAa,EACjCC,IAAI,EAGL;IACC,wEAAwE;IACxE,MAAMC,eAAeD,MAAMC,gBAAgBC;IAE3C,IAAID,cAAc;QAChB,OAAOH,uBAAuBG;IAChC;IAEA,OAAOJ,eAAeG,KAAMG,IAAI;AAClC"}

package/dist/uploads/hasCropOrResizeEdit.d.ts

@@ -0,0 +1,7 @@
+import type { UploadEdits } from './types.js';
+/**
+ * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as
+ * opposed to `focalPoint`, which does not.
+ */
+export declare const hasCropOrResizeEdit: (uploadEdits: undefined | UploadEdits) => boolean;
+//# sourceMappingURL=hasCropOrResizeEdit.d.ts.map

package/dist/uploads/hasCropOrResizeEdit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasCropOrResizeEdit.d.ts","sourceRoot":"","sources":["../../src/uploads/hasCropOrResizeEdit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C;;;GAGG;AACH,eAAO,MAAM,mBAAmB,gBAAiB,SAAS,GAAG,WAAW,KAAG,OACc,CAAA"}

package/dist/uploads/hasCropOrResizeEdit.js

@@ -0,0 +1,6 @@
+/**
+ * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as
+ * opposed to `focalPoint`, which does not.
+ */ export const hasCropOrResizeEdit = (uploadEdits)=>Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels);
+
+//# sourceMappingURL=hasCropOrResizeEdit.js.map

package/dist/uploads/hasCropOrResizeEdit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/hasCropOrResizeEdit.ts"],"sourcesContent":["import type { UploadEdits } from './types.js'\n\n/**\n * Whether upload edits change the image's pixel dimensions (crop or an explicit resize), as\n * opposed to `focalPoint`, which does not.\n */\nexport const hasCropOrResizeEdit = (uploadEdits: undefined | UploadEdits): boolean =>\n  Boolean(uploadEdits?.crop || uploadEdits?.heightInPixels || uploadEdits?.widthInPixels)\n"],"names":["hasCropOrResizeEdit","uploadEdits","Boolean","crop","heightInPixels","widthInPixels"],"mappings":"AAEA;;;CAGC,GACD,OAAO,MAAMA,sBAAsB,CAACC,cAClCC,QAAQD,aAAaE,QAAQF,aAAaG,kBAAkBH,aAAaI,eAAc"}

package/dist/uploads/hasFullFileContents.d.ts

@@ -0,0 +1,13 @@
+/**
+ * True when the upload's bytes are fully available for processing - either wholly in-memory
+ * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial
+ * in-memory probe alongside it. Bounded header-only probes returned by
+ * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on
+ * complete content.
+ */
+export declare function hasFullFileContents(file: {
+    data: Buffer;
+    size: number;
+    tempFilePath?: string;
+}): boolean;
+//# sourceMappingURL=hasFullFileContents.d.ts.map

package/dist/uploads/hasFullFileContents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hasFullFileContents.d.ts","sourceRoot":"","sources":["../../src/uploads/hasFullFileContents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,GAAG,OAAO,CAGV"}

package/dist/uploads/hasFullFileContents.js

@@ -0,0 +1,12 @@
+/**
+ * True when the upload's bytes are fully available for processing - either wholly in-memory
+ * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial
+ * in-memory probe alongside it. Bounded header-only probes returned by
+ * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on
+ * complete content.
+ */ export function hasFullFileContents(file) {
+    const isCompleteTempFile = Boolean(file.tempFilePath) && (!file.data || file.data.length === 0);
+    return isCompleteTempFile || file.data.length === file.size;
+}
+
+//# sourceMappingURL=hasFullFileContents.js.map

package/dist/uploads/hasFullFileContents.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/hasFullFileContents.ts"],"sourcesContent":["/**\n * True when the upload's bytes are fully available for processing - either wholly in-memory\n * (data.length matches the declared size) or wholly on disk at tempFilePath with no partial\n * in-memory probe alongside it. Bounded header-only probes returned by\n * getFileFromUploadInstructions therefore report false, so callers can gate Sharp routing on\n * complete content.\n */\nexport function hasFullFileContents(file: {\n  data: Buffer\n  size: number\n  tempFilePath?: string\n}): boolean {\n  const isCompleteTempFile = Boolean(file.tempFilePath) && (!file.data || file.data.length === 0)\n  return isCompleteTempFile || file.data.length === file.size\n}\n"],"names":["hasFullFileContents","file","isCompleteTempFile","Boolean","tempFilePath","data","length","size"],"mappings":"AAAA;;;;;;CAMC,GACD,OAAO,SAASA,oBAAoBC,IAInC;IACC,MAAMC,qBAAqBC,QAAQF,KAAKG,YAAY,KAAM,CAAA,CAACH,KAAKI,IAAI,IAAIJ,KAAKI,IAAI,CAACC,MAAM,KAAK,CAAA;IAC7F,OAAOJ,sBAAsBD,KAAKI,IAAI,CAACC,MAAM,KAAKL,KAAKM,IAAI;AAC7D"}

package/dist/uploads/isAnimatedImage.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Whether sharp needs to read every frame/page of this mime type (rather than just the first) to
+ * process it correctly - used to decide whether a file needs its full bytes fetched/processed
+ * even without any resize/format/trim adjustments configured, and whether sharp should be asked
+ * to read all frames when it does run.
+ */
+export declare function isAnimatedImage(mimeType: string): boolean;
+//# sourceMappingURL=isAnimatedImage.d.ts.map

package/dist/uploads/isAnimatedImage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"isAnimatedImage.d.ts","sourceRoot":"","sources":["../../src/uploads/isAnimatedImage.ts"],"names":[],"mappings":"AASA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/uploads/isAnimatedImage.js

@@ -0,0 +1,22 @@
+// Matches the formats sharp's own `animated` input option documents as supported (reading every
+// frame/page instead of just the first): https://sharp.pixelplumbing.com/api-constructor - "Set to
+// true to read all frames/pages of an animated image (GIF, WebP, TIFF)". AVIF is deliberately
+// excluded even though the format itself supports animation: this sharp version's AVIF encoder
+// silently flattens `join({ animated: true })` frames into a single tall static image instead of
+// a multi-page sequence (verified directly - the output always comes back as `pages: 1`), so
+// there's no working animated-AVIF path to account for here.
+const ANIMATED_IMAGE_MIME_TYPES = [
+    'image/gif',
+    'image/tiff',
+    'image/webp'
+];
+/**
+ * Whether sharp needs to read every frame/page of this mime type (rather than just the first) to
+ * process it correctly - used to decide whether a file needs its full bytes fetched/processed
+ * even without any resize/format/trim adjustments configured, and whether sharp should be asked
+ * to read all frames when it does run.
+ */ export function isAnimatedImage(mimeType) {
+    return ANIMATED_IMAGE_MIME_TYPES.includes(mimeType);
+}
+
+//# sourceMappingURL=isAnimatedImage.js.map