payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/uploads/safeFetch.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(new Error(`Blocked unsafe attempt to ${hostname}`), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nlet safeDispatcher: Agent | undefined\n\nconst getSafeDispatcher = (): Agent => {\n  if (!safeDispatcher) {\n    safeDispatcher = new Agent({ connect: { lookup: ssrfFilterInterceptor } })\n  }\n  return safeDispatcher\n}\n\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw new Error(`Blocked unsafe attempt to ${hostname}`)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: getSafeDispatcher(),\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","hostname","options","callback","err","address","family","ips","Array","isArray","map","a","some","Error","safeDispatcher","getSafeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACN,OAAOO,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBR,OAAOS,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACC,UAAUC,SAASC;IAChEX,0BAA0BL,MAAM,CAACc,UAAUC,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAAClB,KAAO,CAACD,SAASC,MAAM;gBACnCS,SAAS,IAAIU,MAAM,CAAC,0BAA0B,EAAEZ,UAAU,GAAGI,SAASC;gBACtE;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,IAAIQ;AAEJ,MAAMC,oBAAoB;IACxB,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,IAAIzB,MAAM;YAAE2B,SAAS;gBAAE7B,QAAQa;YAAsB;QAAE;IAC1E;IACA,OAAOc;AACT;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAejB,QAAQ,GAAGgB;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAIlB,WAAWmB,IAAInB,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAASqB,UAAU,CAAC,QAAQrB,SAASsB,QAAQ,CAAC,MAAM;YACtDtB,WAAWA,SAASuB,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAIpC,OAAOO,OAAO,CAACM,WAAW;YAC5B,IAAI,CAACR,SAASQ,WAAW;gBACvB,MAAM,IAAIY,MAAM,CAAC,0BAA0B,EAAEZ,UAAU;YACzD;QACF;QACA,OAAQ,MAAMV,YAAY6B,KAAK;YAC7B,GAAGlB,OAAO;YACVuB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBd,OAAO;YAC1B,IAAIc,MAAMC,KAAK,YAAYf,SAASc,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIjB,MAAMc,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAIP,MAAM,CAAC,qBAAqB,EAAEkB,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}
+{"version":3,"sources":["../../src/uploads/safeFetch.ts"],"sourcesContent":["import type { LookupFunction } from 'net'\n\nimport { lookup } from 'dns'\nimport ipaddr from 'ipaddr.js'\nimport { Agent, fetch as undiciFetch } from 'undici'\n\n/**\n * @internal this is used to mock the IP `lookup` function in integration tests\n */\nexport const _internal_safeFetchGlobal = {\n  lookup,\n}\n\nconst buildBlockedFetchError = (hostname: string): Error =>\n  new Error(\n    `Blocked unsafe attempt to ${hostname}. This host resolves to a private or internal address. ` +\n      `If this is a trusted destination, allowlist it via the upload collection's \"skipSafeFetch\" option ` +\n      `(https://payloadcms.com/docs/upload/overview#skip-safe-fetch).`,\n  )\n\nconst isSafeIp = (ip: string) => {\n  try {\n    if (!ip) {\n      return false\n    }\n\n    if (!ipaddr.isValid(ip)) {\n      return false\n    }\n\n    const parsedIpAddress = ipaddr.parse(ip)\n    const range = parsedIpAddress.range()\n    if (range !== 'unicast') {\n      return false // Private IP Range\n    }\n  } catch (ignore) {\n    return false\n  }\n  return true\n}\n\nconst ssrfFilterInterceptor: LookupFunction = (hostname, options, callback) => {\n  _internal_safeFetchGlobal.lookup(hostname, options, (err, address, family) => {\n    if (err) {\n      callback(err, address, family)\n    } else {\n      let ips = [] as string[]\n      if (Array.isArray(address)) {\n        ips = address.map((a) => a.address)\n      } else {\n        ips = [address]\n      }\n\n      if (ips.some((ip) => !isSafeIp(ip))) {\n        callback(buildBlockedFetchError(hostname), address, family)\n        return\n      }\n\n      callback(null, address, family)\n    }\n  })\n}\n\nlet safeDispatcher: Agent | undefined\n\nconst getSafeDispatcher = (): Agent => {\n  if (!safeDispatcher) {\n    safeDispatcher = new Agent({ connect: { lookup: ssrfFilterInterceptor } })\n  }\n  return safeDispatcher\n}\n\n/**\n * A \"safe\" version of undici's fetch that prevents SSRF attacks.\n *\n * - Utilizes a custom dispatcher that filters out requests to unsafe IP addresses.\n * - Validates domain names by resolving them to IP addresses and checking if they're safe.\n * - Undici was used because it supported interceptors as well as \"credentials: include\". Native fetch\n */\nexport const safeFetch = async (...args: Parameters<typeof undiciFetch>): Promise<Response> => {\n  const [unverifiedUrl, options] = args\n\n  try {\n    const url = new URL(unverifiedUrl)\n\n    let hostname = url.hostname\n\n    // Strip brackets from IPv6 addresses (e.g., \"[::1]\" => \"::1\")\n    if (hostname.startsWith('[') && hostname.endsWith(']')) {\n      hostname = hostname.slice(1, -1)\n    }\n\n    if (ipaddr.isValid(hostname)) {\n      if (!isSafeIp(hostname)) {\n        throw buildBlockedFetchError(hostname)\n      }\n    }\n    return (await undiciFetch(url, {\n      ...options,\n      dispatcher: getSafeDispatcher(),\n      redirect: 'manual', // Prevent automatic redirects\n    })) as unknown as Response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.cause instanceof Error && error.cause.message.includes('unsafe')) {\n        // Errors thrown from within interceptors always have 'fetch error' as the message\n        // The desired message we want to bubble up is in the cause\n        throw new Error(error.cause.message)\n      } else {\n        let stringifiedUrl: string | undefined = undefined\n        if (typeof unverifiedUrl === 'string') {\n          stringifiedUrl = unverifiedUrl\n        } else if (unverifiedUrl instanceof URL) {\n          stringifiedUrl = unverifiedUrl.toString()\n        } else if (unverifiedUrl instanceof Request) {\n          stringifiedUrl = unverifiedUrl.url\n        }\n\n        throw new Error(`Failed to fetch from ${stringifiedUrl}, ${error.message}`)\n      }\n    }\n    throw error\n  }\n}\n"],"names":["lookup","ipaddr","Agent","fetch","undiciFetch","_internal_safeFetchGlobal","buildBlockedFetchError","hostname","Error","isSafeIp","ip","isValid","parsedIpAddress","parse","range","ignore","ssrfFilterInterceptor","options","callback","err","address","family","ips","Array","isArray","map","a","some","safeDispatcher","getSafeDispatcher","connect","safeFetch","args","unverifiedUrl","url","URL","startsWith","endsWith","slice","dispatcher","redirect","error","cause","message","includes","stringifiedUrl","undefined","toString","Request"],"mappings":"AAEA,SAASA,MAAM,QAAQ,MAAK;AAC5B,OAAOC,YAAY,YAAW;AAC9B,SAASC,KAAK,EAAEC,SAASC,WAAW,QAAQ,SAAQ;AAEpD;;CAEC,GACD,OAAO,MAAMC,4BAA4B;IACvCL;AACF,EAAC;AAED,MAAMM,yBAAyB,CAACC,WAC9B,IAAIC,MACF,CAAC,0BAA0B,EAAED,SAAS,uDAAuD,CAAC,GAC5F,CAAC,kGAAkG,CAAC,GACpG,CAAC,8DAA8D,CAAC;AAGtE,MAAME,WAAW,CAACC;IAChB,IAAI;QACF,IAAI,CAACA,IAAI;YACP,OAAO;QACT;QAEA,IAAI,CAACT,OAAOU,OAAO,CAACD,KAAK;YACvB,OAAO;QACT;QAEA,MAAME,kBAAkBX,OAAOY,KAAK,CAACH;QACrC,MAAMI,QAAQF,gBAAgBE,KAAK;QACnC,IAAIA,UAAU,WAAW;YACvB,OAAO,MAAM,mBAAmB;;QAClC;IACF,EAAE,OAAOC,QAAQ;QACf,OAAO;IACT;IACA,OAAO;AACT;AAEA,MAAMC,wBAAwC,CAACT,UAAUU,SAASC;IAChEb,0BAA0BL,MAAM,CAACO,UAAUU,SAAS,CAACE,KAAKC,SAASC;QACjE,IAAIF,KAAK;YACPD,SAASC,KAAKC,SAASC;QACzB,OAAO;YACL,IAAIC,MAAM,EAAE;YACZ,IAAIC,MAAMC,OAAO,CAACJ,UAAU;gBAC1BE,MAAMF,QAAQK,GAAG,CAAC,CAACC,IAAMA,EAAEN,OAAO;YACpC,OAAO;gBACLE,MAAM;oBAACF;iBAAQ;YACjB;YAEA,IAAIE,IAAIK,IAAI,CAAC,CAACjB,KAAO,CAACD,SAASC,MAAM;gBACnCQ,SAASZ,uBAAuBC,WAAWa,SAASC;gBACpD;YACF;YAEAH,SAAS,MAAME,SAASC;QAC1B;IACF;AACF;AAEA,IAAIO;AAEJ,MAAMC,oBAAoB;IACxB,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,IAAI1B,MAAM;YAAE4B,SAAS;gBAAE9B,QAAQgB;YAAsB;QAAE;IAC1E;IACA,OAAOY;AACT;AAEA;;;;;;CAMC,GACD,OAAO,MAAMG,YAAY,OAAO,GAAGC;IACjC,MAAM,CAACC,eAAehB,QAAQ,GAAGe;IAEjC,IAAI;QACF,MAAME,MAAM,IAAIC,IAAIF;QAEpB,IAAI1B,WAAW2B,IAAI3B,QAAQ;QAE3B,8DAA8D;QAC9D,IAAIA,SAAS6B,UAAU,CAAC,QAAQ7B,SAAS8B,QAAQ,CAAC,MAAM;YACtD9B,WAAWA,SAAS+B,KAAK,CAAC,GAAG,CAAC;QAChC;QAEA,IAAIrC,OAAOU,OAAO,CAACJ,WAAW;YAC5B,IAAI,CAACE,SAASF,WAAW;gBACvB,MAAMD,uBAAuBC;YAC/B;QACF;QACA,OAAQ,MAAMH,YAAY8B,KAAK;YAC7B,GAAGjB,OAAO;YACVsB,YAAYV;YACZW,UAAU;QACZ;IACF,EAAE,OAAOC,OAAO;QACd,IAAIA,iBAAiBjC,OAAO;YAC1B,IAAIiC,MAAMC,KAAK,YAAYlC,SAASiC,MAAMC,KAAK,CAACC,OAAO,CAACC,QAAQ,CAAC,WAAW;gBAC1E,kFAAkF;gBAClF,2DAA2D;gBAC3D,MAAM,IAAIpC,MAAMiC,MAAMC,KAAK,CAACC,OAAO;YACrC,OAAO;gBACL,IAAIE,iBAAqCC;gBACzC,IAAI,OAAOb,kBAAkB,UAAU;oBACrCY,iBAAiBZ;gBACnB,OAAO,IAAIA,yBAAyBE,KAAK;oBACvCU,iBAAiBZ,cAAcc,QAAQ;gBACzC,OAAO,IAAId,yBAAyBe,SAAS;oBAC3CH,iBAAiBZ,cAAcC,GAAG;gBACpC;gBAEA,MAAM,IAAI1B,MAAM,CAAC,qBAAqB,EAAEqC,eAAe,EAAE,EAAEJ,MAAME,OAAO,EAAE;YAC5E;QACF;QACA,MAAMF;IACR;AACF,EAAC"}

package/dist/uploads/sanitizeUploadData.d.ts

@@ -0,0 +1,26 @@
+import type { FlattenedField } from '../fields/config/types.js';
+type Operation = 'create' | 'update';
+export type ExternalUploadSource = {
+    filename: string;
+    url: string;
+};
+type UploadDataOptions = {
+    locale?: string;
+    localizedProperties?: Set<string>;
+};
+export declare const getExternalUploadSource: (data: unknown) => ExternalUploadSource | undefined;
+export declare const getUploadDestination: ({ data, file, }: {
+    data: unknown;
+    file: {
+        uploadReference?: unknown;
+    } | null | undefined;
+}) => {
+    objectKey?: string;
+    prefix?: string;
+};
+export declare const getLocalizedUploadProperties: (fields: FlattenedField[]) => Set<string>;
+export declare const sanitizeUploadData: <T>(data: T, operation: Operation) => T;
+export declare const mergeUploadDataWithDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export declare const restoreUploadDataFromDocument: <T>(data: T, document: unknown, options?: UploadDataOptions) => T;
+export {};
+//# sourceMappingURL=sanitizeUploadData.d.ts.map

package/dist/uploads/sanitizeUploadData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizeUploadData.d.ts","sourceRoot":"","sources":["../../src/uploads/sanitizeUploadData.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAI/D,KAAK,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEpC,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,GAAG,EAAE,MAAM,CAAA;CACZ,CAAA;AAED,KAAK,iBAAiB,GAAG;IACvB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAClC,CAAA;AAQD,eAAO,MAAM,uBAAuB,SAAU,OAAO,KAAG,oBAAoB,GAAG,SAS9E,CAAA;AAKD,eAAO,MAAM,oBAAoB,oBAG9B;IACD,IAAI,EAAE,OAAO,CAAA;IACb,IAAI,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAA;CACvD,KAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAoBxC,CAAA;AAcD,eAAO,MAAM,4BAA4B,WAAY,cAAc,EAAE,KAAG,GAAG,CAAC,MAAM,CAUjF,CAAA;AAqBD,eAAO,MAAM,kBAAkB,GAAI,CAAC,QAAQ,CAAC,aAAa,SAAS,KAAG,CA4BrE,CAAA;AAQD,eAAO,MAAM,2BAA2B,GAAI,CAAC,QACrC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CA8BF,CAAA;AAiBD,eAAO,MAAM,6BAA6B,GAAI,CAAC,QACvC,CAAC,YACG,OAAO,YACR,iBAAiB,KACzB,CAeF,CAAA"}

package/dist/uploads/sanitizeUploadData.js

@@ -0,0 +1,161 @@
+import path from 'path';
+import { APIError } from '../errors/APIError.js';
+const hasOwnProperty = (value, key)=>Object.prototype.hasOwnProperty.call(value, key);
+const isRecord = (value)=>typeof value === 'object' && value !== null && !Array.isArray(value);
+export const getExternalUploadSource = (data)=>{
+    if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {
+        return undefined;
+    }
+    return {
+        filename: data.filename,
+        url: data.url
+    };
+};
+// Resolves the server-owned upload destination for a document write. For provider uploads the
+// prefix and key segment come from the verified upload reference; for server uploads (including
+// staged uploads) the prefix falls back to the submitted document data and there is no key segment.
+export const getUploadDestination = ({ data, file })=>{
+    if (!file) {
+        return {};
+    }
+    const submittedPrefix = isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined;
+    const { uploadReference } = file;
+    // A staged upload only identifies server-owned temporary bytes, so its final destination still
+    // comes from the accompanying document data, the same as a plain server upload.
+    if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {
+        return {
+            prefix: submittedPrefix
+        };
+    }
+    return {
+        objectKey: typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,
+        prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined
+    };
+};
+const getDocumentProperty = (document, property, { locale, localizedProperties })=>{
+    const value = document[property];
+    return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value;
+};
+// Accepts flattened fields so localized identity fields declared inside presentational
+// containers (row/collapsible/unnamed tabs) are still detected — those live at the document
+// root data level but are nested in the config tree, so walking `fields` alone would miss them.
+export const getLocalizedUploadProperties = (fields)=>{
+    const localizedProperties = new Set();
+    for (const field of fields){
+        if ('name' in field && field.localized) {
+            localizedProperties.add(field.name);
+        }
+    }
+    return localizedProperties;
+};
+// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to
+// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string
+// values are ignored here because they are removed by the caller anyway.
+const validateFilename = (filename)=>{
+    if (typeof filename !== 'string') {
+        return;
+    }
+    const pathSegments = filename.replace(/\\/g, '/').split('/');
+    if (path.posix.isAbsolute(filename) || path.win32.isAbsolute(filename) || pathSegments.includes('..')) {
+        throw new APIError('Invalid filename.', 400);
+    }
+};
+export const sanitizeUploadData = (data, operation)=>{
+    if (!isRecord(data)) {
+        return data;
+    }
+    validateFilename(data.filename);
+    if (isRecord(data.variants)) {
+        for (const sizeData of Object.values(data.variants)){
+            if (isRecord(sizeData)) {
+                validateFilename(sizeData.filename);
+            }
+        }
+    }
+    const sanitizedData = {
+        ...data
+    };
+    delete sanitizedData.filename;
+    delete sanitizedData.variants;
+    delete sanitizedData.url;
+    // Server-owned; never accepted from the caller.
+    delete sanitizedData._objectKey;
+    // On update, `prefix` is restored from the stored document (file identity); kept on create.
+    if (operation === 'update') {
+        delete sanitizedData.prefix;
+    }
+    return sanitizedData;
+};
+// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,
+// `url`, `variants`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,
+// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`
+// are user-editable crop input, and the rest are regenerated by generateFileData when a file is
+// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full
+// tuple below.
+export const mergeUploadDataWithDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const mergedData = {
+        ...data
+    };
+    for (const property of [
+        '_objectKey',
+        'filename',
+        'prefix',
+        'url'
+    ]){
+        if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {
+            mergedData[property] = getDocumentProperty(document, property, options);
+        }
+    }
+    const documentSizes = getDocumentProperty(document, 'variants', options);
+    if (!hasOwnProperty(data, 'variants') && hasOwnProperty(document, 'variants')) {
+        mergedData.variants = documentSizes;
+    } else if (isRecord(data.variants) && isRecord(documentSizes)) {
+        const mergedSizes = {
+            ...documentSizes
+        };
+        for (const [sizeName, sizeData] of Object.entries(data.variants)){
+            const documentSize = documentSizes[sizeName];
+            mergedSizes[sizeName] = isRecord(sizeData) && isRecord(documentSize) ? {
+                ...documentSize,
+                ...sizeData
+            } : sizeData;
+        }
+        mergedData.variants = mergedSizes;
+    }
+    return mergedData;
+};
+const uploadDerivedProperties = [
+    '_objectKey',
+    'filename',
+    'filesize',
+    'focalX',
+    'focalY',
+    'height',
+    'mimeType',
+    'prefix',
+    'variants',
+    'thumbnailURL',
+    'url',
+    'width'
+];
+export const restoreUploadDataFromDocument = (data, document, options = {})=>{
+    if (!isRecord(data) || !isRecord(document)) {
+        return data;
+    }
+    const restoredData = {
+        ...data
+    };
+    for (const property of uploadDerivedProperties){
+        if (hasOwnProperty(document, property)) {
+            restoredData[property] = getDocumentProperty(document, property, options);
+        } else {
+            delete restoredData[property];
+        }
+    }
+    return restoredData;
+};
+
+//# sourceMappingURL=sanitizeUploadData.js.map

package/dist/uploads/sanitizeUploadData.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/sanitizeUploadData.ts"],"sourcesContent":["import path from 'path'\n\nimport type { FlattenedField } from '../fields/config/types.js'\n\nimport { APIError } from '../errors/APIError.js'\n\ntype Operation = 'create' | 'update'\n\nexport type ExternalUploadSource = {\n  filename: string\n  url: string\n}\n\ntype UploadDataOptions = {\n  locale?: string\n  localizedProperties?: Set<string>\n}\n\nconst hasOwnProperty = (value: Record<string, unknown>, key: string): boolean =>\n  Object.prototype.hasOwnProperty.call(value, key)\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === 'object' && value !== null && !Array.isArray(value)\n\nexport const getExternalUploadSource = (data: unknown): ExternalUploadSource | undefined => {\n  if (!isRecord(data) || typeof data.filename !== 'string' || typeof data.url !== 'string') {\n    return undefined\n  }\n\n  return {\n    filename: data.filename,\n    url: data.url,\n  }\n}\n\n// Resolves the server-owned upload destination for a document write. For provider uploads the\n// prefix and key segment come from the verified upload reference; for server uploads (including\n// staged uploads) the prefix falls back to the submitted document data and there is no key segment.\nexport const getUploadDestination = ({\n  data,\n  file,\n}: {\n  data: unknown\n  file: { uploadReference?: unknown } | null | undefined\n}): { objectKey?: string; prefix?: string } => {\n  if (!file) {\n    return {}\n  }\n\n  const submittedPrefix =\n    isRecord(data) && typeof data.prefix === 'string' ? data.prefix : undefined\n  const { uploadReference } = file\n\n  // A staged upload only identifies server-owned temporary bytes, so its final destination still\n  // comes from the accompanying document data, the same as a plain server upload.\n  if (!isRecord(uploadReference) || 'uploadId' in uploadReference) {\n    return { prefix: submittedPrefix }\n  }\n\n  return {\n    objectKey:\n      typeof uploadReference._objectKey === 'string' ? uploadReference._objectKey : undefined,\n    prefix: typeof uploadReference.prefix === 'string' ? uploadReference.prefix : undefined,\n  }\n}\n\nconst getDocumentProperty = (\n  document: Record<string, unknown>,\n  property: string,\n  { locale, localizedProperties }: UploadDataOptions,\n): unknown => {\n  const value = document[property]\n  return locale && localizedProperties?.has(property) && isRecord(value) ? value[locale] : value\n}\n\n// Accepts flattened fields so localized identity fields declared inside presentational\n// containers (row/collapsible/unnamed tabs) are still detected — those live at the document\n// root data level but are nested in the config tree, so walking `fields` alone would miss them.\nexport const getLocalizedUploadProperties = (fields: FlattenedField[]): Set<string> => {\n  const localizedProperties = new Set<string>()\n\n  for (const field of fields) {\n    if ('name' in field && (field as { localized?: boolean }).localized) {\n      localizedProperties.add(field.name)\n    }\n  }\n\n  return localizedProperties\n}\n\n// The submitted filename is stripped by sanitizeUploadData regardless, so this only exists to\n// reject path-traversal attempts loudly (400) instead of silently dropping them. Non-string\n// values are ignored here because they are removed by the caller anyway.\nconst validateFilename = (filename: unknown): void => {\n  if (typeof filename !== 'string') {\n    return\n  }\n\n  const pathSegments = filename.replace(/\\\\/g, '/').split('/')\n\n  if (\n    path.posix.isAbsolute(filename) ||\n    path.win32.isAbsolute(filename) ||\n    pathSegments.includes('..')\n  ) {\n    throw new APIError('Invalid filename.', 400)\n  }\n}\n\nexport const sanitizeUploadData = <T>(data: T, operation: Operation): T => {\n  if (!isRecord(data)) {\n    return data\n  }\n\n  validateFilename(data.filename)\n\n  if (isRecord(data.variants)) {\n    for (const sizeData of Object.values(data.variants)) {\n      if (isRecord(sizeData)) {\n        validateFilename(sizeData.filename)\n      }\n    }\n  }\n\n  const sanitizedData: Record<string, unknown> = { ...data }\n  delete sanitizedData.filename\n  delete sanitizedData.variants\n  delete sanitizedData.url\n  // Server-owned; never accepted from the caller.\n  delete sanitizedData._objectKey\n\n  // On update, `prefix` is restored from the stored document (file identity); kept on create.\n  if (operation === 'update') {\n    delete sanitizedData.prefix\n  }\n\n  return sanitizedData as T\n}\n\n// Restores only the identity fields that select/serve a stored object (`filename`, `prefix`,\n// `url`, `variants`). Other generated-but-derived fields (`thumbnailURL`, `filesize`, `height`,\n// `width`, `mimeType`, `focalX`/`focalY`) are intentionally left as submitted: `focalX`/`focalY`\n// are user-editable crop input, and the rest are regenerated by generateFileData when a file is\n// written. Compare with restoreUploadDataFromDocument (version restore), which re-binds the full\n// tuple below.\nexport const mergeUploadDataWithDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const mergedData: Record<string, unknown> = { ...data }\n\n  for (const property of ['_objectKey', 'filename', 'prefix', 'url']) {\n    if (!hasOwnProperty(data, property) && hasOwnProperty(document, property)) {\n      mergedData[property] = getDocumentProperty(document, property, options)\n    }\n  }\n\n  const documentSizes = getDocumentProperty(document, 'variants', options)\n  if (!hasOwnProperty(data, 'variants') && hasOwnProperty(document, 'variants')) {\n    mergedData.variants = documentSizes\n  } else if (isRecord(data.variants) && isRecord(documentSizes)) {\n    const mergedSizes: Record<string, unknown> = { ...documentSizes }\n\n    for (const [sizeName, sizeData] of Object.entries(data.variants)) {\n      const documentSize = documentSizes[sizeName]\n\n      mergedSizes[sizeName] =\n        isRecord(sizeData) && isRecord(documentSize) ? { ...documentSize, ...sizeData } : sizeData\n    }\n\n    mergedData.variants = mergedSizes\n  }\n\n  return mergedData as T\n}\n\nconst uploadDerivedProperties = [\n  '_objectKey',\n  'filename',\n  'filesize',\n  'focalX',\n  'focalY',\n  'height',\n  'mimeType',\n  'prefix',\n  'variants',\n  'thumbnailURL',\n  'url',\n  'width',\n] as const\n\nexport const restoreUploadDataFromDocument = <T>(\n  data: T,\n  document: unknown,\n  options: UploadDataOptions = {},\n): T => {\n  if (!isRecord(data) || !isRecord(document)) {\n    return data\n  }\n\n  const restoredData: Record<string, unknown> = { ...data }\n  for (const property of uploadDerivedProperties) {\n    if (hasOwnProperty(document, property)) {\n      restoredData[property] = getDocumentProperty(document, property, options)\n    } else {\n      delete restoredData[property]\n    }\n  }\n\n  return restoredData as T\n}\n"],"names":["path","APIError","hasOwnProperty","value","key","Object","prototype","call","isRecord","Array","isArray","getExternalUploadSource","data","filename","url","undefined","getUploadDestination","file","submittedPrefix","prefix","uploadReference","objectKey","_objectKey","getDocumentProperty","document","property","locale","localizedProperties","has","getLocalizedUploadProperties","fields","Set","field","localized","add","name","validateFilename","pathSegments","replace","split","posix","isAbsolute","win32","includes","sanitizeUploadData","operation","variants","sizeData","values","sanitizedData","mergeUploadDataWithDocument","options","mergedData","documentSizes","mergedSizes","sizeName","entries","documentSize","uploadDerivedProperties","restoreUploadDataFromDocument","restoredData"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,SAASC,QAAQ,QAAQ,wBAAuB;AAchD,MAAMC,iBAAiB,CAACC,OAAgCC,MACtDC,OAAOC,SAAS,CAACJ,cAAc,CAACK,IAAI,CAACJ,OAAOC;AAE9C,MAAMI,WAAW,CAACL,QAChB,OAAOA,UAAU,YAAYA,UAAU,QAAQ,CAACM,MAAMC,OAAO,CAACP;AAEhE,OAAO,MAAMQ,0BAA0B,CAACC;IACtC,IAAI,CAACJ,SAASI,SAAS,OAAOA,KAAKC,QAAQ,KAAK,YAAY,OAAOD,KAAKE,GAAG,KAAK,UAAU;QACxF,OAAOC;IACT;IAEA,OAAO;QACLF,UAAUD,KAAKC,QAAQ;QACvBC,KAAKF,KAAKE,GAAG;IACf;AACF,EAAC;AAED,8FAA8F;AAC9F,gGAAgG;AAChG,oGAAoG;AACpG,OAAO,MAAME,uBAAuB,CAAC,EACnCJ,IAAI,EACJK,IAAI,EAIL;IACC,IAAI,CAACA,MAAM;QACT,OAAO,CAAC;IACV;IAEA,MAAMC,kBACJV,SAASI,SAAS,OAAOA,KAAKO,MAAM,KAAK,WAAWP,KAAKO,MAAM,GAAGJ;IACpE,MAAM,EAAEK,eAAe,EAAE,GAAGH;IAE5B,+FAA+F;IAC/F,gFAAgF;IAChF,IAAI,CAACT,SAASY,oBAAoB,cAAcA,iBAAiB;QAC/D,OAAO;YAAED,QAAQD;QAAgB;IACnC;IAEA,OAAO;QACLG,WACE,OAAOD,gBAAgBE,UAAU,KAAK,WAAWF,gBAAgBE,UAAU,GAAGP;QAChFI,QAAQ,OAAOC,gBAAgBD,MAAM,KAAK,WAAWC,gBAAgBD,MAAM,GAAGJ;IAChF;AACF,EAAC;AAED,MAAMQ,sBAAsB,CAC1BC,UACAC,UACA,EAAEC,MAAM,EAAEC,mBAAmB,EAAqB;IAElD,MAAMxB,QAAQqB,QAAQ,CAACC,SAAS;IAChC,OAAOC,UAAUC,qBAAqBC,IAAIH,aAAajB,SAASL,SAASA,KAAK,CAACuB,OAAO,GAAGvB;AAC3F;AAEA,uFAAuF;AACvF,4FAA4F;AAC5F,gGAAgG;AAChG,OAAO,MAAM0B,+BAA+B,CAACC;IAC3C,MAAMH,sBAAsB,IAAII;IAEhC,KAAK,MAAMC,SAASF,OAAQ;QAC1B,IAAI,UAAUE,SAAS,AAACA,MAAkCC,SAAS,EAAE;YACnEN,oBAAoBO,GAAG,CAACF,MAAMG,IAAI;QACpC;IACF;IAEA,OAAOR;AACT,EAAC;AAED,8FAA8F;AAC9F,4FAA4F;AAC5F,yEAAyE;AACzE,MAAMS,mBAAmB,CAACvB;IACxB,IAAI,OAAOA,aAAa,UAAU;QAChC;IACF;IAEA,MAAMwB,eAAexB,SAASyB,OAAO,CAAC,OAAO,KAAKC,KAAK,CAAC;IAExD,IACEvC,KAAKwC,KAAK,CAACC,UAAU,CAAC5B,aACtBb,KAAK0C,KAAK,CAACD,UAAU,CAAC5B,aACtBwB,aAAaM,QAAQ,CAAC,OACtB;QACA,MAAM,IAAI1C,SAAS,qBAAqB;IAC1C;AACF;AAEA,OAAO,MAAM2C,qBAAqB,CAAIhC,MAASiC;IAC7C,IAAI,CAACrC,SAASI,OAAO;QACnB,OAAOA;IACT;IAEAwB,iBAAiBxB,KAAKC,QAAQ;IAE9B,IAAIL,SAASI,KAAKkC,QAAQ,GAAG;QAC3B,KAAK,MAAMC,YAAY1C,OAAO2C,MAAM,CAACpC,KAAKkC,QAAQ,EAAG;YACnD,IAAItC,SAASuC,WAAW;gBACtBX,iBAAiBW,SAASlC,QAAQ;YACpC;QACF;IACF;IAEA,MAAMoC,gBAAyC;QAAE,GAAGrC,IAAI;IAAC;IACzD,OAAOqC,cAAcpC,QAAQ;IAC7B,OAAOoC,cAAcH,QAAQ;IAC7B,OAAOG,cAAcnC,GAAG;IACxB,gDAAgD;IAChD,OAAOmC,cAAc3B,UAAU;IAE/B,4FAA4F;IAC5F,IAAIuB,cAAc,UAAU;QAC1B,OAAOI,cAAc9B,MAAM;IAC7B;IAEA,OAAO8B;AACT,EAAC;AAED,6FAA6F;AAC7F,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,eAAe;AACf,OAAO,MAAMC,8BAA8B,CACzCtC,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMwC,aAAsC;QAAE,GAAGxC,IAAI;IAAC;IAEtD,KAAK,MAAMa,YAAY;QAAC;QAAc;QAAY;QAAU;KAAM,CAAE;QAClE,IAAI,CAACvB,eAAeU,MAAMa,aAAavB,eAAesB,UAAUC,WAAW;YACzE2B,UAAU,CAAC3B,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACjE;IACF;IAEA,MAAME,gBAAgB9B,oBAAoBC,UAAU,YAAY2B;IAChE,IAAI,CAACjD,eAAeU,MAAM,eAAeV,eAAesB,UAAU,aAAa;QAC7E4B,WAAWN,QAAQ,GAAGO;IACxB,OAAO,IAAI7C,SAASI,KAAKkC,QAAQ,KAAKtC,SAAS6C,gBAAgB;QAC7D,MAAMC,cAAuC;YAAE,GAAGD,aAAa;QAAC;QAEhE,KAAK,MAAM,CAACE,UAAUR,SAAS,IAAI1C,OAAOmD,OAAO,CAAC5C,KAAKkC,QAAQ,EAAG;YAChE,MAAMW,eAAeJ,aAAa,CAACE,SAAS;YAE5CD,WAAW,CAACC,SAAS,GACnB/C,SAASuC,aAAavC,SAASiD,gBAAgB;gBAAE,GAAGA,YAAY;gBAAE,GAAGV,QAAQ;YAAC,IAAIA;QACtF;QAEAK,WAAWN,QAAQ,GAAGQ;IACxB;IAEA,OAAOF;AACT,EAAC;AAED,MAAMM,0BAA0B;IAC9B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,MAAMC,gCAAgC,CAC3C/C,MACAY,UACA2B,UAA6B,CAAC,CAAC;IAE/B,IAAI,CAAC3C,SAASI,SAAS,CAACJ,SAASgB,WAAW;QAC1C,OAAOZ;IACT;IAEA,MAAMgD,eAAwC;QAAE,GAAGhD,IAAI;IAAC;IACxD,KAAK,MAAMa,YAAYiC,wBAAyB;QAC9C,IAAIxD,eAAesB,UAAUC,WAAW;YACtCmC,YAAY,CAACnC,SAAS,GAAGF,oBAAoBC,UAAUC,UAAU0B;QACnE,OAAO;YACL,OAAOS,YAAY,CAACnC,SAAS;QAC/B;IACF;IAEA,OAAOmC;AACT,EAAC"}

package/dist/uploads/stagedUpload.d.ts

@@ -0,0 +1,27 @@
+import type { PayloadHandler } from '../config/types.js';
+import type { PayloadRequest } from '../types/index.js';
+import type { File, UploadInstructions, UploadInstructionsRequest } from './types.js';
+/**
+ * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value
+ * is later passed to a document create or update request.
+ */
+export declare const generateStagedUploadInstructions: ({ collectionSlug, docPrefix, filename, filesize, mimeType, req, }: {
+    req: PayloadRequest;
+} & UploadInstructionsRequest) => Promise<UploadInstructions>;
+/**
+ * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only
+ * becomes available when its size exactly matches the size in the upload ID.
+ */
+export declare const uploadStagedFile: PayloadHandler;
+/** Removes a temporary upload that the client no longer needs. */
+export declare const deleteStagedFile: PayloadHandler;
+/**
+ * Loads a completed staged file for a document request. Only the same user and collection can use
+ * it, and the temporary file is deleted after it is read.
+ */
+export declare const getStagedFile: ({ collectionSlug, req, uploadReference, }: {
+    collectionSlug: string;
+    req: PayloadRequest;
+    uploadReference: unknown;
+}) => Promise<File>;
+//# sourceMappingURL=stagedUpload.d.ts.map

package/dist/uploads/stagedUpload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stagedUpload.d.ts","sourceRoot":"","sources":["../../src/uploads/stagedUpload.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAOrF;;;GAGG;AACH,eAAO,MAAM,gCAAgC,sEAO1C;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,GAAG,yBAAyB,KAAG,OAAO,CAAC,kBAAkB,CAsClF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,cA0D9B,CAAA;AAED,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,cAO9B,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,8CAIvB;IACD,cAAc,EAAE,MAAM,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,eAAe,EAAE,OAAO,CAAA;CACzB,KAAG,OAAO,CAAC,IAAI,CAyCf,CAAA"}

package/dist/uploads/stagedUpload.js

@@ -0,0 +1,197 @@
+import { jwtVerify } from 'jose';
+import { randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { jwtSign } from '../auth/jwt.js';
+import { APIError, Forbidden } from '../errors/index.js';
+import { formatAdminURL } from '../utilities/formatAdminURL.js';
+import { checkFileRestrictions } from './checkFileRestrictions.js';
+/**
+ * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value
+ * is later passed to a document create or update request.
+ */ export const generateStagedUploadInstructions = async ({ collectionSlug, docPrefix, filename, filesize, mimeType, req })=>{
+    await removeExpiredUploads(req, collectionSlug);
+    const { token: uploadId } = await jwtSign({
+        fieldsToSign: {
+            id: randomUUID(),
+            collectionSlug,
+            docPrefix,
+            filename,
+            filesize,
+            mimeType,
+            user: getUser(req)
+        },
+        secret: req.payload.secret,
+        tokenExpiration
+    });
+    return {
+        type: 'http',
+        file: {
+            filename,
+            mimeType,
+            size: filesize,
+            uploadReference: {
+                uploadId
+            }
+        },
+        request: {
+            headers: {
+                'Content-Length': String(filesize),
+                'Content-Type': mimeType
+            },
+            method: 'PUT',
+            url: formatAdminURL({
+                apiRoute: req.payload.config.routes.api,
+                path: `/upload-instructions/${uploadId}`,
+                serverURL: req.payload.config.serverURL
+            })
+        }
+    };
+};
+/**
+ * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only
+ * becomes available when its size exactly matches the size in the upload ID.
+ */ export const uploadStagedFile = async (req)=>{
+    const upload = await verifyUploadID(req, req.routeParams?.uploadId);
+    const directory = await getUploadDirectory(req, upload.collectionSlug);
+    const uploadPath = path.join(directory, upload.id);
+    const temporaryPath = `${uploadPath}.${randomUUID()}.part`;
+    const file = await fs.open(temporaryPath, 'wx');
+    let uploadedSize = 0;
+    try {
+        try {
+            const reader = req.body?.getReader();
+            while(reader){
+                const { done, value } = await reader.read();
+                if (done) {
+                    break;
+                }
+                uploadedSize += value.byteLength;
+                if (uploadedSize > upload.filesize) {
+                    throw new APIError('Uploaded file is larger than expected.', 400);
+                }
+                let offset = 0;
+                while(offset < value.byteLength){
+                    const { bytesWritten } = await file.write(value, offset);
+                    offset += bytesWritten;
+                }
+            }
+            if (uploadedSize !== upload.filesize) {
+                throw new APIError('Uploaded file size does not match the expected size.', 400);
+            }
+        } finally{
+            await file.close();
+        }
+        const collection = req.payload.collections[upload.collectionSlug].config;
+        await checkFileRestrictions({
+            collection,
+            file: {
+                name: upload.filename,
+                data: Buffer.alloc(0),
+                mimetype: upload.mimeType,
+                size: upload.filesize,
+                tempFilePath: temporaryPath
+            },
+            req
+        });
+        await fs.rename(temporaryPath, uploadPath);
+    } catch (error) {
+        await fs.rm(temporaryPath, {
+            force: true
+        });
+        throw error;
+    }
+    return new Response(null, {
+        status: 204
+    });
+};
+/** Removes a temporary upload that the client no longer needs. */ export const deleteStagedFile = async (req)=>{
+    const upload = await verifyUploadID(req, req.routeParams?.uploadId);
+    const directory = await getUploadDirectory(req, upload.collectionSlug);
+    await fs.rm(path.join(directory, upload.id), {
+        force: true
+    });
+    return new Response(null, {
+        status: 204
+    });
+};
+/**
+ * Loads a completed staged file for a document request. Only the same user and collection can use
+ * it, and the temporary file is deleted after it is read.
+ */ export const getStagedFile = async ({ collectionSlug, req, uploadReference })=>{
+    if (!uploadReference || typeof uploadReference !== 'object' || Array.isArray(uploadReference) || !('uploadId' in uploadReference) || typeof uploadReference.uploadId !== 'string') {
+        throw new APIError('Invalid staged upload.', 400);
+    }
+    const { uploadId } = uploadReference;
+    const upload = await verifyUploadID(req, uploadId);
+    if (upload.collectionSlug !== collectionSlug || upload.user !== getUser(req)) {
+        throw new Forbidden(req.t);
+    }
+    const directory = await getUploadDirectory(req, upload.collectionSlug);
+    const tempFilePath = path.join(directory, upload.id);
+    let data;
+    try {
+        data = await fs.readFile(tempFilePath);
+    } catch  {
+        throw new APIError('Staged upload was not found.', 400);
+    }
+    if (data.length !== upload.filesize) {
+        await fs.rm(tempFilePath, {
+            force: true
+        });
+        throw new APIError('Staged upload is incomplete.', 400);
+    }
+    await fs.rm(tempFilePath, {
+        force: true
+    });
+    return {
+        name: upload.filename,
+        data,
+        mimetype: upload.mimeType,
+        size: data.length
+    };
+};
+/**
+ * Staged uploads hold a file temporarily until a document create or update uses it. The signed
+ * upload ID remembers which file and user the upload belongs to.
+ */ const tokenExpiration = 60 * 60;
+const getUser = (req)=>req.user ? `${req.user.collection}:${String(req.user.id)}` : null;
+/** Returns the hidden folder where temporary uploads for this collection are stored. */ const getUploadDirectory = async (req, collectionSlug)=>{
+    const upload = req.payload.collections[collectionSlug]?.config.upload;
+    const directory = path.resolve(upload && !upload.disableLocalStorage ? upload.staticDir || collectionSlug : req.payload.config.upload.tempFileDir || os.tmpdir(), '.payload-staged-uploads');
+    await fs.mkdir(directory, {
+        recursive: true
+    });
+    return directory;
+};
+/** Removes temporary files older than the one-hour upload window. */ const removeExpiredUploads = async (req, collectionSlug)=>{
+    const directory = await getUploadDirectory(req, collectionSlug);
+    const expiresBefore = Date.now() - tokenExpiration * 1000;
+    for (const filename of (await fs.readdir(directory))){
+        const filePath = path.join(directory, filename);
+        const stats = await fs.stat(filePath).catch(()=>null);
+        if (stats && stats.mtimeMs < expiresBefore) {
+            await fs.rm(filePath, {
+                force: true
+            });
+        }
+    }
+};
+/** Verifies that an upload ID was signed by Payload, has not expired, and contains valid details. */ const verifyUploadID = async (req, uploadID)=>{
+    try {
+        if (typeof uploadID !== 'string') {
+            throw new Error();
+        }
+        const secret = new TextEncoder().encode(req.payload.secret);
+        const { payload } = await jwtVerify(uploadID, secret);
+        if (typeof payload.id !== 'string' || !/^[\da-f-]{36}$/i.test(payload.id) || typeof payload.collectionSlug !== 'string' || typeof payload.filename !== 'string' || !Number.isSafeInteger(payload.filesize) || payload.filesize < 0 || typeof payload.mimeType !== 'string' || payload.user !== null && typeof payload.user !== 'string') {
+            throw new Error();
+        }
+        return payload;
+    } catch  {
+        throw new APIError('Invalid or expired staged upload.', 400);
+    }
+};
+
+//# sourceMappingURL=stagedUpload.js.map

package/dist/uploads/stagedUpload.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/stagedUpload.ts"],"sourcesContent":["import { jwtVerify } from 'jose'\nimport { randomUUID } from 'node:crypto'\nimport fs from 'node:fs/promises'\nimport os from 'node:os'\nimport path from 'node:path'\n\nimport type { PayloadHandler } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\nimport type { File, UploadInstructions, UploadInstructionsRequest } from './types.js'\n\nimport { jwtSign } from '../auth/jwt.js'\nimport { APIError, Forbidden } from '../errors/index.js'\nimport { formatAdminURL } from '../utilities/formatAdminURL.js'\nimport { checkFileRestrictions } from './checkFileRestrictions.js'\n\n/**\n * Creates a signed, one-hour URL where the client can send the file bytes. The returned file value\n * is later passed to a document create or update request.\n */\nexport const generateStagedUploadInstructions = async ({\n  collectionSlug,\n  docPrefix,\n  filename,\n  filesize,\n  mimeType,\n  req,\n}: { req: PayloadRequest } & UploadInstructionsRequest): Promise<UploadInstructions> => {\n  await removeExpiredUploads(req, collectionSlug)\n\n  const { token: uploadId } = await jwtSign({\n    fieldsToSign: {\n      id: randomUUID(),\n      collectionSlug,\n      docPrefix,\n      filename,\n      filesize,\n      mimeType,\n      user: getUser(req),\n    },\n    secret: req.payload.secret,\n    tokenExpiration,\n  })\n\n  return {\n    type: 'http',\n    file: {\n      filename,\n      mimeType,\n      size: filesize,\n      uploadReference: { uploadId },\n    },\n    request: {\n      headers: {\n        'Content-Length': String(filesize),\n        'Content-Type': mimeType,\n      },\n      method: 'PUT',\n      url: formatAdminURL({\n        apiRoute: req.payload.config.routes.api,\n        path: `/upload-instructions/${uploadId}`,\n        serverURL: req.payload.config.serverURL,\n      }),\n    },\n  }\n}\n\n/**\n * Saves the bytes sent to a signed upload URL. The file is written as a partial file first and only\n * becomes available when its size exactly matches the size in the upload ID.\n */\nexport const uploadStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const uploadPath = path.join(directory, upload.id)\n  const temporaryPath = `${uploadPath}.${randomUUID()}.part`\n  const file = await fs.open(temporaryPath, 'wx')\n  let uploadedSize = 0\n\n  try {\n    try {\n      const reader = req.body?.getReader()\n\n      while (reader) {\n        const { done, value } = await reader.read()\n\n        if (done) {\n          break\n        }\n\n        uploadedSize += value.byteLength\n        if (uploadedSize > upload.filesize) {\n          throw new APIError('Uploaded file is larger than expected.', 400)\n        }\n\n        let offset = 0\n        while (offset < value.byteLength) {\n          const { bytesWritten } = await file.write(value, offset)\n          offset += bytesWritten\n        }\n      }\n\n      if (uploadedSize !== upload.filesize) {\n        throw new APIError('Uploaded file size does not match the expected size.', 400)\n      }\n    } finally {\n      await file.close()\n    }\n\n    const collection = req.payload.collections[upload.collectionSlug]!.config\n    await checkFileRestrictions({\n      collection,\n      file: {\n        name: upload.filename,\n        data: Buffer.alloc(0),\n        mimetype: upload.mimeType,\n        size: upload.filesize,\n        tempFilePath: temporaryPath,\n      },\n      req,\n    })\n\n    await fs.rename(temporaryPath, uploadPath)\n  } catch (error) {\n    await fs.rm(temporaryPath, { force: true })\n    throw error\n  }\n\n  return new Response(null, { status: 204 })\n}\n\n/** Removes a temporary upload that the client no longer needs. */\nexport const deleteStagedFile: PayloadHandler = async (req) => {\n  const upload = await verifyUploadID(req, req.routeParams?.uploadId)\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n\n  await fs.rm(path.join(directory, upload.id), { force: true })\n\n  return new Response(null, { status: 204 })\n}\n\n/**\n * Loads a completed staged file for a document request. Only the same user and collection can use\n * it, and the temporary file is deleted after it is read.\n */\nexport const getStagedFile = async ({\n  collectionSlug,\n  req,\n  uploadReference,\n}: {\n  collectionSlug: string\n  req: PayloadRequest\n  uploadReference: unknown\n}): Promise<File> => {\n  if (\n    !uploadReference ||\n    typeof uploadReference !== 'object' ||\n    Array.isArray(uploadReference) ||\n    !('uploadId' in uploadReference) ||\n    typeof uploadReference.uploadId !== 'string'\n  ) {\n    throw new APIError('Invalid staged upload.', 400)\n  }\n\n  const { uploadId } = uploadReference\n  const upload = await verifyUploadID(req, uploadId)\n\n  if (upload.collectionSlug !== collectionSlug || upload.user !== getUser(req)) {\n    throw new Forbidden(req.t)\n  }\n\n  const directory = await getUploadDirectory(req, upload.collectionSlug)\n  const tempFilePath = path.join(directory, upload.id)\n  let data: Buffer\n\n  try {\n    data = await fs.readFile(tempFilePath)\n  } catch {\n    throw new APIError('Staged upload was not found.', 400)\n  }\n\n  if (data.length !== upload.filesize) {\n    await fs.rm(tempFilePath, { force: true })\n    throw new APIError('Staged upload is incomplete.', 400)\n  }\n\n  await fs.rm(tempFilePath, { force: true })\n\n  return {\n    name: upload.filename,\n    data,\n    mimetype: upload.mimeType,\n    size: data.length,\n  }\n}\n\n/**\n * Staged uploads hold a file temporarily until a document create or update uses it. The signed\n * upload ID remembers which file and user the upload belongs to.\n */\nconst tokenExpiration = 60 * 60\n\n/** The file details stored inside the signed upload ID. */\ntype StagedUploadToken = {\n  id: string\n  user: null | string\n} & UploadInstructionsRequest\n\nconst getUser = (req: PayloadRequest) =>\n  req.user ? `${req.user.collection}:${String(req.user.id)}` : null\n\n/** Returns the hidden folder where temporary uploads for this collection are stored. */\nconst getUploadDirectory = async (req: PayloadRequest, collectionSlug: string) => {\n  const upload = req.payload.collections[collectionSlug]?.config.upload\n  const directory = path.resolve(\n    upload && !upload.disableLocalStorage\n      ? upload.staticDir || collectionSlug\n      : req.payload.config.upload.tempFileDir || os.tmpdir(),\n    '.payload-staged-uploads',\n  )\n\n  await fs.mkdir(directory, { recursive: true })\n\n  return directory\n}\n\n/** Removes temporary files older than the one-hour upload window. */\nconst removeExpiredUploads = async (req: PayloadRequest, collectionSlug: string) => {\n  const directory = await getUploadDirectory(req, collectionSlug)\n  const expiresBefore = Date.now() - tokenExpiration * 1000\n\n  for (const filename of await fs.readdir(directory)) {\n    const filePath = path.join(directory, filename)\n    const stats = await fs.stat(filePath).catch(() => null)\n\n    if (stats && stats.mtimeMs < expiresBefore) {\n      await fs.rm(filePath, { force: true })\n    }\n  }\n}\n\n/** Verifies that an upload ID was signed by Payload, has not expired, and contains valid details. */\nconst verifyUploadID = async (\n  req: PayloadRequest,\n  uploadID: unknown,\n): Promise<StagedUploadToken> => {\n  try {\n    if (typeof uploadID !== 'string') {\n      throw new Error()\n    }\n\n    const secret = new TextEncoder().encode(req.payload.secret)\n    const { payload } = await jwtVerify<StagedUploadToken>(uploadID, secret)\n\n    if (\n      typeof payload.id !== 'string' ||\n      !/^[\\da-f-]{36}$/i.test(payload.id) ||\n      typeof payload.collectionSlug !== 'string' ||\n      typeof payload.filename !== 'string' ||\n      !Number.isSafeInteger(payload.filesize) ||\n      payload.filesize < 0 ||\n      typeof payload.mimeType !== 'string' ||\n      (payload.user !== null && typeof payload.user !== 'string')\n    ) {\n      throw new Error()\n    }\n\n    return payload as StagedUploadToken\n  } catch {\n    throw new APIError('Invalid or expired staged upload.', 400)\n  }\n}\n"],"names":["jwtVerify","randomUUID","fs","os","path","jwtSign","APIError","Forbidden","formatAdminURL","checkFileRestrictions","generateStagedUploadInstructions","collectionSlug","docPrefix","filename","filesize","mimeType","req","removeExpiredUploads","token","uploadId","fieldsToSign","id","user","getUser","secret","payload","tokenExpiration","type","file","size","uploadReference","request","headers","String","method","url","apiRoute","config","routes","api","serverURL","uploadStagedFile","upload","verifyUploadID","routeParams","directory","getUploadDirectory","uploadPath","join","temporaryPath","open","uploadedSize","reader","body","getReader","done","value","read","byteLength","offset","bytesWritten","write","close","collection","collections","name","data","Buffer","alloc","mimetype","tempFilePath","rename","error","rm","force","Response","status","deleteStagedFile","getStagedFile","Array","isArray","t","readFile","length","resolve","disableLocalStorage","staticDir","tempFileDir","tmpdir","mkdir","recursive","expiresBefore","Date","now","readdir","filePath","stats","stat","catch","mtimeMs","uploadID","Error","TextEncoder","encode","test","Number","isSafeInteger"],"mappings":"AAAA,SAASA,SAAS,QAAQ,OAAM;AAChC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,QAAQ,mBAAkB;AACjC,OAAOC,QAAQ,UAAS;AACxB,OAAOC,UAAU,YAAW;AAM5B,SAASC,OAAO,QAAQ,iBAAgB;AACxC,SAASC,QAAQ,EAAEC,SAAS,QAAQ,qBAAoB;AACxD,SAASC,cAAc,QAAQ,iCAAgC;AAC/D,SAASC,qBAAqB,QAAQ,6BAA4B;AAElE;;;CAGC,GACD,OAAO,MAAMC,mCAAmC,OAAO,EACrDC,cAAc,EACdC,SAAS,EACTC,QAAQ,EACRC,QAAQ,EACRC,QAAQ,EACRC,GAAG,EACiD;IACpD,MAAMC,qBAAqBD,KAAKL;IAEhC,MAAM,EAAEO,OAAOC,QAAQ,EAAE,GAAG,MAAMd,QAAQ;QACxCe,cAAc;YACZC,IAAIpB;YACJU;YACAC;YACAC;YACAC;YACAC;YACAO,MAAMC,QAAQP;QAChB;QACAQ,QAAQR,IAAIS,OAAO,CAACD,MAAM;QAC1BE;IACF;IAEA,OAAO;QACLC,MAAM;QACNC,MAAM;YACJf;YACAE;YACAc,MAAMf;YACNgB,iBAAiB;gBAAEX;YAAS;QAC9B;QACAY,SAAS;YACPC,SAAS;gBACP,kBAAkBC,OAAOnB;gBACzB,gBAAgBC;YAClB;YACAmB,QAAQ;YACRC,KAAK3B,eAAe;gBAClB4B,UAAUpB,IAAIS,OAAO,CAACY,MAAM,CAACC,MAAM,CAACC,GAAG;gBACvCnC,MAAM,CAAC,qBAAqB,EAAEe,UAAU;gBACxCqB,WAAWxB,IAAIS,OAAO,CAACY,MAAM,CAACG,SAAS;YACzC;QACF;IACF;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,mBAAmC,OAAOzB;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAMoC,aAAa3C,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACjD,MAAM4B,gBAAgB,GAAGF,WAAW,CAAC,EAAE9C,aAAa,KAAK,CAAC;IAC1D,MAAM2B,OAAO,MAAM1B,GAAGgD,IAAI,CAACD,eAAe;IAC1C,IAAIE,eAAe;IAEnB,IAAI;QACF,IAAI;YACF,MAAMC,SAASpC,IAAIqC,IAAI,EAAEC;YAEzB,MAAOF,OAAQ;gBACb,MAAM,EAAEG,IAAI,EAAEC,KAAK,EAAE,GAAG,MAAMJ,OAAOK,IAAI;gBAEzC,IAAIF,MAAM;oBACR;gBACF;gBAEAJ,gBAAgBK,MAAME,UAAU;gBAChC,IAAIP,eAAeT,OAAO5B,QAAQ,EAAE;oBAClC,MAAM,IAAIR,SAAS,0CAA0C;gBAC/D;gBAEA,IAAIqD,SAAS;gBACb,MAAOA,SAASH,MAAME,UAAU,CAAE;oBAChC,MAAM,EAAEE,YAAY,EAAE,GAAG,MAAMhC,KAAKiC,KAAK,CAACL,OAAOG;oBACjDA,UAAUC;gBACZ;YACF;YAEA,IAAIT,iBAAiBT,OAAO5B,QAAQ,EAAE;gBACpC,MAAM,IAAIR,SAAS,wDAAwD;YAC7E;QACF,SAAU;YACR,MAAMsB,KAAKkC,KAAK;QAClB;QAEA,MAAMC,aAAa/C,IAAIS,OAAO,CAACuC,WAAW,CAACtB,OAAO/B,cAAc,CAAC,CAAE0B,MAAM;QACzE,MAAM5B,sBAAsB;YAC1BsD;YACAnC,MAAM;gBACJqC,MAAMvB,OAAO7B,QAAQ;gBACrBqD,MAAMC,OAAOC,KAAK,CAAC;gBACnBC,UAAU3B,OAAO3B,QAAQ;gBACzBc,MAAMa,OAAO5B,QAAQ;gBACrBwD,cAAcrB;YAChB;YACAjC;QACF;QAEA,MAAMd,GAAGqE,MAAM,CAACtB,eAAeF;IACjC,EAAE,OAAOyB,OAAO;QACd,MAAMtE,GAAGuE,EAAE,CAACxB,eAAe;YAAEyB,OAAO;QAAK;QACzC,MAAMF;IACR;IAEA,OAAO,IAAIG,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED,gEAAgE,GAChE,OAAO,MAAMC,mBAAmC,OAAO7D;IACrD,MAAM0B,SAAS,MAAMC,eAAe3B,KAAKA,IAAI4B,WAAW,EAAEzB;IAC1D,MAAM0B,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IAErE,MAAMT,GAAGuE,EAAE,CAACrE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE,GAAG;QAAEqD,OAAO;IAAK;IAE3D,OAAO,IAAIC,SAAS,MAAM;QAAEC,QAAQ;IAAI;AAC1C,EAAC;AAED;;;CAGC,GACD,OAAO,MAAME,gBAAgB,OAAO,EAClCnE,cAAc,EACdK,GAAG,EACHc,eAAe,EAKhB;IACC,IACE,CAACA,mBACD,OAAOA,oBAAoB,YAC3BiD,MAAMC,OAAO,CAAClD,oBACd,CAAE,CAAA,cAAcA,eAAc,KAC9B,OAAOA,gBAAgBX,QAAQ,KAAK,UACpC;QACA,MAAM,IAAIb,SAAS,0BAA0B;IAC/C;IAEA,MAAM,EAAEa,QAAQ,EAAE,GAAGW;IACrB,MAAMY,SAAS,MAAMC,eAAe3B,KAAKG;IAEzC,IAAIuB,OAAO/B,cAAc,KAAKA,kBAAkB+B,OAAOpB,IAAI,KAAKC,QAAQP,MAAM;QAC5E,MAAM,IAAIT,UAAUS,IAAIiE,CAAC;IAC3B;IAEA,MAAMpC,YAAY,MAAMC,mBAAmB9B,KAAK0B,OAAO/B,cAAc;IACrE,MAAM2D,eAAelE,KAAK4C,IAAI,CAACH,WAAWH,OAAOrB,EAAE;IACnD,IAAI6C;IAEJ,IAAI;QACFA,OAAO,MAAMhE,GAAGgF,QAAQ,CAACZ;IAC3B,EAAE,OAAM;QACN,MAAM,IAAIhE,SAAS,gCAAgC;IACrD;IAEA,IAAI4D,KAAKiB,MAAM,KAAKzC,OAAO5B,QAAQ,EAAE;QACnC,MAAMZ,GAAGuE,EAAE,CAACH,cAAc;YAAEI,OAAO;QAAK;QACxC,MAAM,IAAIpE,SAAS,gCAAgC;IACrD;IAEA,MAAMJ,GAAGuE,EAAE,CAACH,cAAc;QAAEI,OAAO;IAAK;IAExC,OAAO;QACLT,MAAMvB,OAAO7B,QAAQ;QACrBqD;QACAG,UAAU3B,OAAO3B,QAAQ;QACzBc,MAAMqC,KAAKiB,MAAM;IACnB;AACF,EAAC;AAED;;;CAGC,GACD,MAAMzD,kBAAkB,KAAK;AAQ7B,MAAMH,UAAU,CAACP,MACfA,IAAIM,IAAI,GAAG,GAAGN,IAAIM,IAAI,CAACyC,UAAU,CAAC,CAAC,EAAE9B,OAAOjB,IAAIM,IAAI,CAACD,EAAE,GAAG,GAAG;AAE/D,sFAAsF,GACtF,MAAMyB,qBAAqB,OAAO9B,KAAqBL;IACrD,MAAM+B,SAAS1B,IAAIS,OAAO,CAACuC,WAAW,CAACrD,eAAe,EAAE0B,OAAOK;IAC/D,MAAMG,YAAYzC,KAAKgF,OAAO,CAC5B1C,UAAU,CAACA,OAAO2C,mBAAmB,GACjC3C,OAAO4C,SAAS,IAAI3E,iBACpBK,IAAIS,OAAO,CAACY,MAAM,CAACK,MAAM,CAAC6C,WAAW,IAAIpF,GAAGqF,MAAM,IACtD;IAGF,MAAMtF,GAAGuF,KAAK,CAAC5C,WAAW;QAAE6C,WAAW;IAAK;IAE5C,OAAO7C;AACT;AAEA,mEAAmE,GACnE,MAAM5B,uBAAuB,OAAOD,KAAqBL;IACvD,MAAMkC,YAAY,MAAMC,mBAAmB9B,KAAKL;IAChD,MAAMgF,gBAAgBC,KAAKC,GAAG,KAAKnE,kBAAkB;IAErD,KAAK,MAAMb,YAAY,CAAA,MAAMX,GAAG4F,OAAO,CAACjD,UAAS,EAAG;QAClD,MAAMkD,WAAW3F,KAAK4C,IAAI,CAACH,WAAWhC;QACtC,MAAMmF,QAAQ,MAAM9F,GAAG+F,IAAI,CAACF,UAAUG,KAAK,CAAC,IAAM;QAElD,IAAIF,SAASA,MAAMG,OAAO,GAAGR,eAAe;YAC1C,MAAMzF,GAAGuE,EAAE,CAACsB,UAAU;gBAAErB,OAAO;YAAK;QACtC;IACF;AACF;AAEA,mGAAmG,GACnG,MAAM/B,iBAAiB,OACrB3B,KACAoF;IAEA,IAAI;QACF,IAAI,OAAOA,aAAa,UAAU;YAChC,MAAM,IAAIC;QACZ;QAEA,MAAM7E,SAAS,IAAI8E,cAAcC,MAAM,CAACvF,IAAIS,OAAO,CAACD,MAAM;QAC1D,MAAM,EAAEC,OAAO,EAAE,GAAG,MAAMzB,UAA6BoG,UAAU5E;QAEjE,IACE,OAAOC,QAAQJ,EAAE,KAAK,YACtB,CAAC,kBAAkBmF,IAAI,CAAC/E,QAAQJ,EAAE,KAClC,OAAOI,QAAQd,cAAc,KAAK,YAClC,OAAOc,QAAQZ,QAAQ,KAAK,YAC5B,CAAC4F,OAAOC,aAAa,CAACjF,QAAQX,QAAQ,KACtCW,QAAQX,QAAQ,GAAG,KACnB,OAAOW,QAAQV,QAAQ,KAAK,YAC3BU,QAAQH,IAAI,KAAK,QAAQ,OAAOG,QAAQH,IAAI,KAAK,UAClD;YACA,MAAM,IAAI+E;QACZ;QAEA,OAAO5E;IACT,EAAE,OAAM;QACN,MAAM,IAAInB,SAAS,qCAAqC;IAC1D;AACF"}

package/dist/uploads/transformers/createLazySourceGetter.d.ts

@@ -0,0 +1,15 @@
+export type LazySourceGetter = {
+    get: () => Promise<Response>;
+    wasCalled: () => boolean;
+};
+/**
+ * Wraps a source-retrieval function so it runs at most once: the first `get()`
+ * call performs the retrieval, and every later call rejects with a
+ * `TransformerContractError` — including while the first call is still pending,
+ * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,
+ * since the underlying body is normally a single-use stream.
+ */
+export declare function createLazySourceGetter({ retrieve, }: {
+    retrieve: () => Promise<Response>;
+}): LazySourceGetter;
+//# sourceMappingURL=createLazySourceGetter.d.ts.map

package/dist/uploads/transformers/createLazySourceGetter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createLazySourceGetter.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/createLazySourceGetter.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5B,SAAS,EAAE,MAAM,OAAO,CAAA;CACzB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClC,GAAG,gBAAgB,CAiBnB"}

package/dist/uploads/transformers/createLazySourceGetter.js

@@ -0,0 +1,22 @@
+import { TransformerContractError } from '../../errors/TransformerContractError.js';
+/**
+ * Wraps a source-retrieval function so it runs at most once: the first `get()`
+ * call performs the retrieval, and every later call rejects with a
+ * `TransformerContractError` — including while the first call is still pending,
+ * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,
+ * since the underlying body is normally a single-use stream.
+ */ export function createLazySourceGetter({ retrieve }) {
+    let wasCalled = false;
+    return {
+        get: async ()=>{
+            if (wasCalled) {
+                throw new TransformerContractError('A transformer stage attempted to call getSourceFile more than once.');
+            }
+            wasCalled = true;
+            return retrieve();
+        },
+        wasCalled: ()=>wasCalled
+    };
+}
+
+//# sourceMappingURL=createLazySourceGetter.js.map

package/dist/uploads/transformers/createLazySourceGetter.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/createLazySourceGetter.ts"],"sourcesContent":["import { TransformerContractError } from '../../errors/TransformerContractError.js'\n\nexport type LazySourceGetter = {\n  get: () => Promise<Response>\n  wasCalled: () => boolean\n}\n\n/**\n * Wraps a source-retrieval function so it runs at most once: the first `get()`\n * call performs the retrieval, and every later call rejects with a\n * `TransformerContractError` — including while the first call is still pending,\n * or after it has rejected. Deliberately doesn't memoize a reusable `Response`,\n * since the underlying body is normally a single-use stream.\n */\nexport function createLazySourceGetter({\n  retrieve,\n}: {\n  retrieve: () => Promise<Response>\n}): LazySourceGetter {\n  let wasCalled = false\n\n  return {\n    get: async () => {\n      if (wasCalled) {\n        throw new TransformerContractError(\n          'A transformer stage attempted to call getSourceFile more than once.',\n        )\n      }\n\n      wasCalled = true\n\n      return retrieve()\n    },\n    wasCalled: () => wasCalled,\n  }\n}\n"],"names":["TransformerContractError","createLazySourceGetter","retrieve","wasCalled","get"],"mappings":"AAAA,SAASA,wBAAwB,QAAQ,2CAA0C;AAOnF;;;;;;CAMC,GACD,OAAO,SAASC,uBAAuB,EACrCC,QAAQ,EAGT;IACC,IAAIC,YAAY;IAEhB,OAAO;QACLC,KAAK;YACH,IAAID,WAAW;gBACb,MAAM,IAAIH,yBACR;YAEJ;YAEAG,YAAY;YAEZ,OAAOD;QACT;QACAC,WAAW,IAAMA;IACnB;AACF"}

package/dist/uploads/transformers/finalizeFileResponse.d.ts

@@ -0,0 +1,14 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+/**
+ * The single header pass for the dynamic-transform response path. Unlike the
+ * existing `serve` path — where a collection's `modifyResponseHeaders` can still
+ * win on any header it touches, including CORS — mandatory CORS and security
+ * headers are asserted last here, so they are never overridable.
+ */
+export declare function finalizeFileResponse({ collection, req, response, }: {
+    collection: Collection;
+    req: PayloadRequest;
+    response: Response;
+}): Response;
+//# sourceMappingURL=finalizeFileResponse.d.ts.map

package/dist/uploads/transformers/finalizeFileResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finalizeFileResponse.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/finalizeFileResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAa1D;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,GAAG,EACH,QAAQ,GACT,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;IACnB,QAAQ,EAAE,QAAQ,CAAA;CACnB,GAAG,QAAQ,CA2CX"}

package/dist/uploads/transformers/finalizeFileResponse.js

@@ -0,0 +1,49 @@
+import { headersWithCors } from '../../utilities/headersWithCors.js';
+import { isXmlMimeType } from '../getFileTypeIdentity.js';
+import { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js';
+const MANDATORY_CORS_HEADER_NAMES = [
+    'Access-Control-Allow-Methods',
+    'Access-Control-Allow-Headers',
+    'Access-Control-Allow-Origin',
+    'Access-Control-Allow-Credentials'
+];
+/**
+ * The single header pass for the dynamic-transform response path. Unlike the
+ * existing `serve` path — where a collection's `modifyResponseHeaders` can still
+ * win on any header it touches, including CORS — mandatory CORS and security
+ * headers are asserted last here, so they are never overridable.
+ */ export function finalizeFileResponse({ collection, req, response }) {
+    const headers = new Headers(response.headers);
+    const sourceContentType = headers.get('Content-Type');
+    const modifyResponseHeaders = collection.config.upload ? collection.config.upload.modifyResponseHeaders : undefined;
+    const modifiedHeaders = typeof modifyResponseHeaders === 'function' ? modifyResponseHeaders({
+        headers
+    }) || headers : headers;
+    // Check the content type both before and after `modifyResponseHeaders`, so the hook
+    // can neither introduce an XML type nor relabel one to escape the policy.
+    const isXml = isXmlMimeType(sourceContentType) || isXmlMimeType(modifiedHeaders.get('Content-Type'));
+    if (isXml) {
+        modifiedHeaders.set('Content-Security-Policy', uploadContentSecurityPolicy);
+    }
+    for (const corsHeaderName of MANDATORY_CORS_HEADER_NAMES){
+        modifiedHeaders.delete(corsHeaderName);
+    }
+    const finalHeaders = headersWithCors({
+        headers: modifiedHeaders,
+        req
+    });
+    const isHeadRequest = req.method === 'HEAD';
+    if (isHeadRequest && response.body && !response.body.locked) {
+        void response.body.cancel().catch(()=>{
+        // A clean-up failure must not prevent the HEAD response.
+        });
+    }
+    const body = isHeadRequest ? null : response.body;
+    return new Response(body, {
+        headers: finalHeaders,
+        status: response.status,
+        statusText: response.statusText
+    });
+}
+
+//# sourceMappingURL=finalizeFileResponse.js.map