payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/uploads/transformers/finalizeFileResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/finalizeFileResponse.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\n\nimport { headersWithCors } from '../../utilities/headersWithCors.js'\nimport { isXmlMimeType } from '../getFileTypeIdentity.js'\nimport { uploadContentSecurityPolicy } from '../uploadContentSecurityPolicy.js'\n\nconst MANDATORY_CORS_HEADER_NAMES = [\n  'Access-Control-Allow-Methods',\n  'Access-Control-Allow-Headers',\n  'Access-Control-Allow-Origin',\n  'Access-Control-Allow-Credentials',\n]\n\n/**\n * The single header pass for the dynamic-transform response path. Unlike the\n * existing `serve` path — where a collection's `modifyResponseHeaders` can still\n * win on any header it touches, including CORS — mandatory CORS and security\n * headers are asserted last here, so they are never overridable.\n */\nexport function finalizeFileResponse({\n  collection,\n  req,\n  response,\n}: {\n  collection: Collection\n  req: PayloadRequest\n  response: Response\n}): Response {\n  const headers = new Headers(response.headers)\n  const sourceContentType = headers.get('Content-Type')\n\n  const modifyResponseHeaders = collection.config.upload\n    ? collection.config.upload.modifyResponseHeaders\n    : undefined\n\n  const modifiedHeaders =\n    typeof modifyResponseHeaders === 'function'\n      ? modifyResponseHeaders({ headers }) || headers\n      : headers\n\n  // Check the content type both before and after `modifyResponseHeaders`, so the hook\n  // can neither introduce an XML type nor relabel one to escape the policy.\n  const isXml =\n    isXmlMimeType(sourceContentType) || isXmlMimeType(modifiedHeaders.get('Content-Type'))\n\n  if (isXml) {\n    modifiedHeaders.set('Content-Security-Policy', uploadContentSecurityPolicy)\n  }\n\n  for (const corsHeaderName of MANDATORY_CORS_HEADER_NAMES) {\n    modifiedHeaders.delete(corsHeaderName)\n  }\n\n  const finalHeaders = headersWithCors({ headers: modifiedHeaders, req })\n\n  const isHeadRequest = req.method === 'HEAD'\n\n  if (isHeadRequest && response.body && !response.body.locked) {\n    void response.body.cancel().catch(() => {\n      // A clean-up failure must not prevent the HEAD response.\n    })\n  }\n\n  const body = isHeadRequest ? null : response.body\n\n  return new Response(body, {\n    headers: finalHeaders,\n    status: response.status,\n    statusText: response.statusText,\n  })\n}\n"],"names":["headersWithCors","isXmlMimeType","uploadContentSecurityPolicy","MANDATORY_CORS_HEADER_NAMES","finalizeFileResponse","collection","req","response","headers","Headers","sourceContentType","get","modifyResponseHeaders","config","upload","undefined","modifiedHeaders","isXml","set","corsHeaderName","delete","finalHeaders","isHeadRequest","method","body","locked","cancel","catch","Response","status","statusText"],"mappings":"AAGA,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,2BAA2B,QAAQ,oCAAmC;AAE/E,MAAMC,8BAA8B;IAClC;IACA;IACA;IACA;CACD;AAED;;;;;CAKC,GACD,OAAO,SAASC,qBAAqB,EACnCC,UAAU,EACVC,GAAG,EACHC,QAAQ,EAKT;IACC,MAAMC,UAAU,IAAIC,QAAQF,SAASC,OAAO;IAC5C,MAAME,oBAAoBF,QAAQG,GAAG,CAAC;IAEtC,MAAMC,wBAAwBP,WAAWQ,MAAM,CAACC,MAAM,GAClDT,WAAWQ,MAAM,CAACC,MAAM,CAACF,qBAAqB,GAC9CG;IAEJ,MAAMC,kBACJ,OAAOJ,0BAA0B,aAC7BA,sBAAsB;QAAEJ;IAAQ,MAAMA,UACtCA;IAEN,oFAAoF;IACpF,0EAA0E;IAC1E,MAAMS,QACJhB,cAAcS,sBAAsBT,cAAce,gBAAgBL,GAAG,CAAC;IAExE,IAAIM,OAAO;QACTD,gBAAgBE,GAAG,CAAC,2BAA2BhB;IACjD;IAEA,KAAK,MAAMiB,kBAAkBhB,4BAA6B;QACxDa,gBAAgBI,MAAM,CAACD;IACzB;IAEA,MAAME,eAAerB,gBAAgB;QAAEQ,SAASQ;QAAiBV;IAAI;IAErE,MAAMgB,gBAAgBhB,IAAIiB,MAAM,KAAK;IAErC,IAAID,iBAAiBf,SAASiB,IAAI,IAAI,CAACjB,SAASiB,IAAI,CAACC,MAAM,EAAE;QAC3D,KAAKlB,SAASiB,IAAI,CAACE,MAAM,GAAGC,KAAK,CAAC;QAChC,yDAAyD;QAC3D;IACF;IAEA,MAAMH,OAAOF,gBAAgB,OAAOf,SAASiB,IAAI;IAEjD,OAAO,IAAII,SAASJ,MAAM;QACxBhB,SAASa;QACTQ,QAAQtB,SAASsB,MAAM;QACvBC,YAAYvB,SAASuB,UAAU;IACjC;AACF"}

package/dist/uploads/transformers/getSourceFileResponse.d.ts

@@ -0,0 +1,16 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+import type { ResolvedUploadDocument } from './resolveUploadDocument.js';
+/**
+ * Payload's internal source-retrieval used by a request transformer's lazy
+ * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs
+ * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.
+ */
+export declare function getSourceFileResponse({ collection, document, filename, prefix, req, }: {
+    collection: Collection;
+    document: ResolvedUploadDocument;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
+//# sourceMappingURL=getSourceFileResponse.d.ts.map

package/dist/uploads/transformers/getSourceFileResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getSourceFileResponse.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/getSourceFileResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AAIxE;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,sBAAsB,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CASpB"}

package/dist/uploads/transformers/getSourceFileResponse.js

@@ -0,0 +1,17 @@
+import { retrieveFileResponse } from '../endpoints/getFile.js';
+/**
+ * Payload's internal source-retrieval used by a request transformer's lazy
+ * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs
+ * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.
+ */ export async function getSourceFileResponse({ collection, document, filename, prefix, req }) {
+    return retrieveFileResponse({
+        collection,
+        doc: document,
+        filename,
+        operation: 'transform',
+        prefix,
+        req
+    });
+}
+
+//# sourceMappingURL=getSourceFileResponse.js.map

package/dist/uploads/transformers/getSourceFileResponse.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/getSourceFileResponse.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { ResolvedUploadDocument } from './resolveUploadDocument.js'\n\nimport { retrieveFileResponse } from '../endpoints/getFile.js'\n\n/**\n * Payload's internal source-retrieval used by a request transformer's lazy\n * `getSourceFile` getter. A thin wrapper over the same handler-loop/local-fs\n * logic the ordinary `read` endpoint uses, called with `operation: 'transform'`.\n */\nexport async function getSourceFileResponse({\n  collection,\n  document,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  document: ResolvedUploadDocument\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<Response> {\n  return retrieveFileResponse({\n    collection,\n    doc: document,\n    filename,\n    operation: 'transform',\n    prefix,\n    req,\n  })\n}\n"],"names":["retrieveFileResponse","getSourceFileResponse","collection","document","filename","prefix","req","doc","operation"],"mappings":"AAIA,SAASA,oBAAoB,QAAQ,0BAAyB;AAE9D;;;;CAIC,GACD,OAAO,eAAeC,sBAAsB,EAC1CC,UAAU,EACVC,QAAQ,EACRC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAOJ;IACC,OAAON,qBAAqB;QAC1BE;QACAK,KAAKJ;QACLC;QACAI,WAAW;QACXH;QACAC;IACF;AACF"}

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts

@@ -0,0 +1,18 @@
+import type { Collection } from '../../collections/config/types.js';
+import type { PayloadRequest } from '../../types/index.js';
+/**
+ * Orchestrates a dynamic file request end to end: resolve the document, plan the
+ * request-capable transformer pipeline from the requested file's authoritative
+ * MIME type (the primary file or the matched image size), enforce
+ * transform-aware read access, then run every eligible transformer in declaration
+ * order against a lazily-fetched source. Called from `getFileHandler` only when at
+ * least one transformer is configured — the zero-transformer path never reaches
+ * this function.
+ */
+export declare function handleDynamicFileRequest({ collection, filename, prefix, req, }: {
+    collection: Collection;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<Response>;
+//# sourceMappingURL=handleDynamicFileRequest.d.ts.map

package/dist/uploads/transformers/handleDynamicFileRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handleDynamicFileRequest.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/handleDynamicFileRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAgB1D;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,EAC7C,UAAU,EACV,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsGpB"}

package/dist/uploads/transformers/handleDynamicFileRequest.js

@@ -0,0 +1,277 @@
+import { Forbidden } from '../../errors/Forbidden.js';
+import { NotFound } from '../../errors/NotFound.js';
+import { TransformerContractError } from '../../errors/TransformerContractError.js';
+import { checkFileAccess } from '../checkFileAccess.js';
+import { retrieveFileResponse } from '../endpoints/getFile.js';
+import { createLazySourceGetter } from './createLazySourceGetter.js';
+import { finalizeFileResponse } from './finalizeFileResponse.js';
+import { getSourceFileResponse } from './getSourceFileResponse.js';
+import { getCandidateTransformers, planTransformerPipeline } from './planTransformerPipeline.js';
+import { getRequestedFile, resolveUploadDocument } from './resolveUploadDocument.js';
+import { withFileTransformAccessContext } from './withFileTransformAccessContext.js';
+/**
+ * Orchestrates a dynamic file request end to end: resolve the document, plan the
+ * request-capable transformer pipeline from the requested file's authoritative
+ * MIME type (the primary file or the matched image size), enforce
+ * transform-aware read access, then run every eligible transformer in declaration
+ * order against a lazily-fetched source. Called from `getFileHandler` only when at
+ * least one transformer is configured — the zero-transformer path never reaches
+ * this function.
+ */ export async function handleDynamicFileRequest({ collection, filename, prefix, req }) {
+    const resolvedDocument = await resolveUploadDocument({
+        collection,
+        filename,
+        prefix,
+        req
+    });
+    if (!resolvedDocument) {
+        // There's no mimeType to plan a pipeline from, so both access modes must pass
+        // before admitting the file doesn't exist — otherwise the status code would leak
+        // file existence to an access function keyed on req.fileTransform.
+        for (const isTransform of [
+            true,
+            false
+        ]){
+            await withFileTransformAccessContext({
+                callback: ()=>checkFileAccess({
+                        collection,
+                        filename,
+                        prefix,
+                        req
+                    }),
+                isTransform,
+                req
+            });
+        }
+        throw new NotFound(req.t);
+    }
+    const { document, pipeline } = await authorizeDocument({
+        collection,
+        filename,
+        prefix,
+        req,
+        resolvedDocument
+    });
+    const requestedFile = getRequestedFile({
+        document,
+        filename
+    });
+    const source = createLazySourceGetter({
+        retrieve: ()=>getSourceFileResponse({
+                collection,
+                document,
+                filename,
+                prefix,
+                req
+            })
+    });
+    let currentResponse;
+    // Each stage has its own controller so a discarded body can be closed even when the
+    // transformer locked it with a reader. Every remaining controller is aborted on failure.
+    const handedOutBodyControllers = new Map();
+    const discardResponse = async (response)=>{
+        await cancelUnusedBody(response);
+        handedOutBodyControllers.get(response)?.abort();
+        handedOutBodyControllers.delete(response);
+    };
+    try {
+        for (const transformer of pipeline){
+            const previousResponse = currentResponse;
+            let handedOutResponse;
+            const handedOutBodyController = new AbortController();
+            const stageSource = createLazySourceGetter({
+                retrieve: async ()=>{
+                    handedOutResponse = withAbortableBody({
+                        response: currentResponse ?? await source.get(),
+                        signal: handedOutBodyController.signal
+                    });
+                    handedOutBodyControllers.set(handedOutResponse, handedOutBodyController);
+                    return handedOutResponse;
+                }
+            });
+            const result = await transformer.handleRequest({
+                collectionSlug: collection.config.slug,
+                documentID: document.id,
+                filename: requestedFile.filename,
+                getSourceFile: stageSource.get,
+                mimeType: requestedFile.mimeType,
+                req
+            });
+            if (result.response) {
+                if (handedOutResponse && result.response !== handedOutResponse) {
+                    await discardResponse(handedOutResponse);
+                } else if (previousResponse && result.response !== previousResponse) {
+                    await discardResponse(previousResponse);
+                }
+                currentResponse = result.response;
+            } else if (stageSource.wasCalled()) {
+                throw new TransformerContractError('A transformer that consumes its source must return a response.');
+            }
+            if (result.status === 'complete') {
+                return finalizeFileResponse({
+                    collection,
+                    req,
+                    response: currentResponse
+                });
+            }
+        }
+    } catch (err) {
+        req.payload.logger.error({
+            err,
+            msg: 'Error running the file transformer pipeline'
+        });
+        for (const handedOutBodyController of handedOutBodyControllers.values()){
+            handedOutBodyController.abort(err);
+        }
+        await cancelUnusedBody(currentResponse);
+        throw err;
+    }
+    if (currentResponse) {
+        return finalizeFileResponse({
+            collection,
+            req,
+            response: currentResponse
+        });
+    }
+    // No transformer produced a response — serve the original file through the
+    // normal path (Range/ETag/redirect support, existing `modifyResponseHeaders` order).
+    return retrieveFileResponse({
+        collection,
+        doc: document,
+        filename,
+        prefix,
+        req
+    });
+}
+/**
+ * Re-wraps `response` so its body can be cancelled through `signal`, closing the underlying
+ * source stream (file handle, storage connection) regardless of who holds a reader on it.
+ */ function withAbortableBody({ response, signal }) {
+    if (!response.body) {
+        return response;
+    }
+    return new Response(response.body.pipeThrough(new TransformStream(), {
+        signal
+    }), {
+        headers: response.headers,
+        status: response.status,
+        statusText: response.statusText
+    });
+}
+/**
+ * Cancels a response body nothing has started reading. A locked body was handed to a transformer
+ * through `withAbortableBody`, and is closed by aborting its signal instead.
+ */ async function cancelUnusedBody(response) {
+    if (!response?.body || response.body.locked) {
+        return;
+    }
+    try {
+        await response.body.cancel();
+    } catch  {
+    // A clean-up failure must not replace the pipeline result or error.
+    }
+}
+function planRequestPipeline({ collection, document, filename, req }) {
+    return planTransformerPipeline({
+        args: {
+            collectionSlug: collection.config.slug,
+            documentID: document.id,
+            mimeType: getRequestedFile({
+                document,
+                filename
+            }).mimeType,
+            operation: 'request',
+            req
+        },
+        capability: 'handleRequest',
+        transformers: req.payload.config.upload.transformers
+    });
+}
+/**
+ * Decides which document is served and which pipeline runs, checking read access
+ * before any application-defined transformer code (`canTransform`) executes.
+ *
+ * 1. The first access mode comes from MIME matching alone: a transform-aware check
+ *    when any transformer could handle the file, otherwise an ordinary read.
+ * 2. If the transform-aware check is denied, an ordinary read may still be allowed
+ *    (e.g. public originals, signed-in-only variants), so that mode is tried next.
+ * 3. Only once a check has passed does `canTransform` plan the real pipeline.
+ * 4. The access mode the final pipeline requires must itself have passed — a
+ *    "variants only" policy must not leak the original when no transformer applies.
+ *
+ * `resolveUploadDocument` is unfiltered, so without a `prefix` it can match a
+ * document the user can't read that shares the filename (filenames are only
+ * unique per prefix). Whenever `checkFileAccess` returns a document, that
+ * authorized document is the one served — storage adapters trust `doc` to
+ * resolve the object key.
+ */ async function authorizeDocument({ collection, filename, prefix, req, resolvedDocument }) {
+    const accessResults = new Map();
+    const checkAccess = ({ isTransform })=>{
+        if (!accessResults.has(isTransform)) {
+            accessResults.set(isTransform, withFileTransformAccessContext({
+                callback: ()=>checkFileAccess({
+                        collection,
+                        filename,
+                        prefix,
+                        req
+                    }),
+                isTransform,
+                req
+            }).then((document)=>({
+                    document: document,
+                    isAllowed: true
+                }), (err)=>{
+                if (err instanceof Forbidden) {
+                    return {
+                        isAllowed: false
+                    };
+                }
+                throw err;
+            }));
+        }
+        return accessResults.get(isTransform);
+    };
+    const hasCandidateTransformers = getCandidateTransformers({
+        capability: 'handleRequest',
+        mimeType: getRequestedFile({
+            document: resolvedDocument,
+            filename
+        }).mimeType,
+        transformers: req.payload.config.upload.transformers
+    }).length > 0;
+    let isTransformAccess = hasCandidateTransformers;
+    let access = await checkAccess({
+        isTransform: isTransformAccess
+    });
+    if (!access.isAllowed && isTransformAccess) {
+        isTransformAccess = false;
+        access = await checkAccess({
+            isTransform: isTransformAccess
+        });
+    }
+    if (!access.isAllowed) {
+        throw new Forbidden(req.t);
+    }
+    const document = access.document && access.document.id !== resolvedDocument.id ? access.document : resolvedDocument;
+    const pipeline = await planRequestPipeline({
+        collection,
+        document,
+        filename,
+        req
+    });
+    const isTransform = pipeline.length > 0;
+    if (isTransform !== isTransformAccess) {
+        const requiredAccess = await checkAccess({
+            isTransform
+        });
+        if (!requiredAccess.isAllowed || requiredAccess.document && requiredAccess.document.id !== document.id) {
+            throw new Forbidden(req.t);
+        }
+    }
+    return {
+        document,
+        pipeline
+    };
+}
+
+//# sourceMappingURL=handleDynamicFileRequest.js.map

package/dist/uploads/transformers/handleDynamicFileRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/handleDynamicFileRequest.ts"],"sourcesContent":["import type { Collection } from '../../collections/config/types.js'\nimport type { PayloadRequest } from '../../types/index.js'\nimport type { ResolvedUploadDocument } from './resolveUploadDocument.js'\nimport type { UploadTransformer } from './types.js'\n\nimport { Forbidden } from '../../errors/Forbidden.js'\nimport { NotFound } from '../../errors/NotFound.js'\nimport { TransformerContractError } from '../../errors/TransformerContractError.js'\nimport { checkFileAccess } from '../checkFileAccess.js'\nimport { retrieveFileResponse } from '../endpoints/getFile.js'\nimport { createLazySourceGetter } from './createLazySourceGetter.js'\nimport { finalizeFileResponse } from './finalizeFileResponse.js'\nimport { getSourceFileResponse } from './getSourceFileResponse.js'\nimport { getCandidateTransformers, planTransformerPipeline } from './planTransformerPipeline.js'\nimport { getRequestedFile, resolveUploadDocument } from './resolveUploadDocument.js'\nimport { withFileTransformAccessContext } from './withFileTransformAccessContext.js'\n\n/**\n * Orchestrates a dynamic file request end to end: resolve the document, plan the\n * request-capable transformer pipeline from the requested file's authoritative\n * MIME type (the primary file or the matched image size), enforce\n * transform-aware read access, then run every eligible transformer in declaration\n * order against a lazily-fetched source. Called from `getFileHandler` only when at\n * least one transformer is configured — the zero-transformer path never reaches\n * this function.\n */\nexport async function handleDynamicFileRequest({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<Response> {\n  const resolvedDocument = await resolveUploadDocument({ collection, filename, prefix, req })\n\n  if (!resolvedDocument) {\n    // There's no mimeType to plan a pipeline from, so both access modes must pass\n    // before admitting the file doesn't exist — otherwise the status code would leak\n    // file existence to an access function keyed on req.fileTransform.\n    for (const isTransform of [true, false]) {\n      await withFileTransformAccessContext({\n        callback: () => checkFileAccess({ collection, filename, prefix, req }),\n        isTransform,\n        req,\n      })\n    }\n    throw new NotFound(req.t)\n  }\n\n  const { document, pipeline } = await authorizeDocument({\n    collection,\n    filename,\n    prefix,\n    req,\n    resolvedDocument,\n  })\n\n  const requestedFile = getRequestedFile({ document, filename })\n\n  const source = createLazySourceGetter({\n    retrieve: () => getSourceFileResponse({ collection, document, filename, prefix, req }),\n  })\n\n  let currentResponse: Response | undefined\n  // Each stage has its own controller so a discarded body can be closed even when the\n  // transformer locked it with a reader. Every remaining controller is aborted on failure.\n  const handedOutBodyControllers = new Map<Response, AbortController>()\n\n  const discardResponse = async (response: Response): Promise<void> => {\n    await cancelUnusedBody(response)\n    handedOutBodyControllers.get(response)?.abort()\n    handedOutBodyControllers.delete(response)\n  }\n\n  try {\n    for (const transformer of pipeline) {\n      const previousResponse = currentResponse\n      let handedOutResponse: Response | undefined\n      const handedOutBodyController = new AbortController()\n      const stageSource = createLazySourceGetter({\n        retrieve: async () => {\n          handedOutResponse = withAbortableBody({\n            response: currentResponse ?? (await source.get()),\n            signal: handedOutBodyController.signal,\n          })\n          handedOutBodyControllers.set(handedOutResponse, handedOutBodyController)\n\n          return handedOutResponse\n        },\n      })\n\n      const result = await transformer.handleRequest!({\n        collectionSlug: collection.config.slug,\n        documentID: document.id,\n        filename: requestedFile.filename,\n        getSourceFile: stageSource.get,\n        mimeType: requestedFile.mimeType,\n        req,\n      })\n\n      if (result.response) {\n        if (handedOutResponse && result.response !== handedOutResponse) {\n          await discardResponse(handedOutResponse)\n        } else if (previousResponse && result.response !== previousResponse) {\n          await discardResponse(previousResponse)\n        }\n\n        currentResponse = result.response\n      } else if (stageSource.wasCalled()) {\n        throw new TransformerContractError(\n          'A transformer that consumes its source must return a response.',\n        )\n      }\n\n      if (result.status === 'complete') {\n        return finalizeFileResponse({ collection, req, response: currentResponse! })\n      }\n    }\n  } catch (err) {\n    req.payload.logger.error({ err, msg: 'Error running the file transformer pipeline' })\n    for (const handedOutBodyController of handedOutBodyControllers.values()) {\n      handedOutBodyController.abort(err)\n    }\n    await cancelUnusedBody(currentResponse)\n    throw err\n  }\n\n  if (currentResponse) {\n    return finalizeFileResponse({ collection, req, response: currentResponse })\n  }\n\n  // No transformer produced a response — serve the original file through the\n  // normal path (Range/ETag/redirect support, existing `modifyResponseHeaders` order).\n  return retrieveFileResponse({ collection, doc: document, filename, prefix, req })\n}\n\n/**\n * Re-wraps `response` so its body can be cancelled through `signal`, closing the underlying\n * source stream (file handle, storage connection) regardless of who holds a reader on it.\n */\nfunction withAbortableBody({\n  response,\n  signal,\n}: {\n  response: Response\n  signal: AbortSignal\n}): Response {\n  if (!response.body) {\n    return response\n  }\n\n  return new Response(response.body.pipeThrough(new TransformStream(), { signal }), {\n    headers: response.headers,\n    status: response.status,\n    statusText: response.statusText,\n  })\n}\n\n/**\n * Cancels a response body nothing has started reading. A locked body was handed to a transformer\n * through `withAbortableBody`, and is closed by aborting its signal instead.\n */\nasync function cancelUnusedBody(response: Response | undefined): Promise<void> {\n  if (!response?.body || response.body.locked) {\n    return\n  }\n\n  try {\n    await response.body.cancel()\n  } catch {\n    // A clean-up failure must not replace the pipeline result or error.\n  }\n}\n\nfunction planRequestPipeline({\n  collection,\n  document,\n  filename,\n  req,\n}: {\n  collection: Collection\n  document: ResolvedUploadDocument\n  filename: string\n  req: PayloadRequest\n}): Promise<UploadTransformer[]> {\n  return planTransformerPipeline({\n    args: {\n      collectionSlug: collection.config.slug,\n      documentID: document.id,\n      mimeType: getRequestedFile({ document, filename }).mimeType,\n      operation: 'request',\n      req,\n    },\n    capability: 'handleRequest',\n    transformers: req.payload.config.upload.transformers,\n  })\n}\n\ntype AccessResult = { document?: ResolvedUploadDocument; isAllowed: true } | { isAllowed: false }\n\n/**\n * Decides which document is served and which pipeline runs, checking read access\n * before any application-defined transformer code (`canTransform`) executes.\n *\n * 1. The first access mode comes from MIME matching alone: a transform-aware check\n *    when any transformer could handle the file, otherwise an ordinary read.\n * 2. If the transform-aware check is denied, an ordinary read may still be allowed\n *    (e.g. public originals, signed-in-only variants), so that mode is tried next.\n * 3. Only once a check has passed does `canTransform` plan the real pipeline.\n * 4. The access mode the final pipeline requires must itself have passed — a\n *    \"variants only\" policy must not leak the original when no transformer applies.\n *\n * `resolveUploadDocument` is unfiltered, so without a `prefix` it can match a\n * document the user can't read that shares the filename (filenames are only\n * unique per prefix). Whenever `checkFileAccess` returns a document, that\n * authorized document is the one served — storage adapters trust `doc` to\n * resolve the object key.\n */\nasync function authorizeDocument({\n  collection,\n  filename,\n  prefix,\n  req,\n  resolvedDocument,\n}: {\n  collection: Collection\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n  resolvedDocument: ResolvedUploadDocument\n}): Promise<{ document: ResolvedUploadDocument; pipeline: UploadTransformer[] }> {\n  const accessResults = new Map<boolean, Promise<AccessResult>>()\n\n  const checkAccess = ({ isTransform }: { isTransform: boolean }): Promise<AccessResult> => {\n    if (!accessResults.has(isTransform)) {\n      accessResults.set(\n        isTransform,\n        withFileTransformAccessContext({\n          callback: () => checkFileAccess({ collection, filename, prefix, req }),\n          isTransform,\n          req,\n        }).then(\n          (document) => ({\n            document: document as ResolvedUploadDocument | undefined,\n            isAllowed: true as const,\n          }),\n          (err: unknown) => {\n            if (err instanceof Forbidden) {\n              return { isAllowed: false as const }\n            }\n\n            throw err\n          },\n        ),\n      )\n    }\n\n    return accessResults.get(isTransform)!\n  }\n\n  const hasCandidateTransformers =\n    getCandidateTransformers({\n      capability: 'handleRequest',\n      mimeType: getRequestedFile({ document: resolvedDocument, filename }).mimeType,\n      transformers: req.payload.config.upload.transformers,\n    }).length > 0\n\n  let isTransformAccess = hasCandidateTransformers\n  let access = await checkAccess({ isTransform: isTransformAccess })\n\n  if (!access.isAllowed && isTransformAccess) {\n    isTransformAccess = false\n    access = await checkAccess({ isTransform: isTransformAccess })\n  }\n\n  if (!access.isAllowed) {\n    throw new Forbidden(req.t)\n  }\n\n  const document =\n    access.document && access.document.id !== resolvedDocument.id\n      ? access.document\n      : resolvedDocument\n\n  const pipeline = await planRequestPipeline({ collection, document, filename, req })\n  const isTransform = pipeline.length > 0\n\n  if (isTransform !== isTransformAccess) {\n    const requiredAccess = await checkAccess({ isTransform })\n\n    if (\n      !requiredAccess.isAllowed ||\n      (requiredAccess.document && requiredAccess.document.id !== document.id)\n    ) {\n      throw new Forbidden(req.t)\n    }\n  }\n\n  return { document, pipeline }\n}\n"],"names":["Forbidden","NotFound","TransformerContractError","checkFileAccess","retrieveFileResponse","createLazySourceGetter","finalizeFileResponse","getSourceFileResponse","getCandidateTransformers","planTransformerPipeline","getRequestedFile","resolveUploadDocument","withFileTransformAccessContext","handleDynamicFileRequest","collection","filename","prefix","req","resolvedDocument","isTransform","callback","t","document","pipeline","authorizeDocument","requestedFile","source","retrieve","currentResponse","handedOutBodyControllers","Map","discardResponse","response","cancelUnusedBody","get","abort","delete","transformer","previousResponse","handedOutResponse","handedOutBodyController","AbortController","stageSource","withAbortableBody","signal","set","result","handleRequest","collectionSlug","config","slug","documentID","id","getSourceFile","mimeType","wasCalled","status","err","payload","logger","error","msg","values","doc","body","Response","pipeThrough","TransformStream","headers","statusText","locked","cancel","planRequestPipeline","args","operation","capability","transformers","upload","accessResults","checkAccess","has","then","isAllowed","hasCandidateTransformers","length","isTransformAccess","access","requiredAccess"],"mappings":"AAKA,SAASA,SAAS,QAAQ,4BAA2B;AACrD,SAASC,QAAQ,QAAQ,2BAA0B;AACnD,SAASC,wBAAwB,QAAQ,2CAA0C;AACnF,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,oBAAoB,QAAQ,0BAAyB;AAC9D,SAASC,sBAAsB,QAAQ,8BAA6B;AACpE,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,wBAAwB,EAAEC,uBAAuB,QAAQ,+BAA8B;AAChG,SAASC,gBAAgB,EAAEC,qBAAqB,QAAQ,6BAA4B;AACpF,SAASC,8BAA8B,QAAQ,sCAAqC;AAEpF;;;;;;;;CAQC,GACD,OAAO,eAAeC,yBAAyB,EAC7CC,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,MAAMC,mBAAmB,MAAMP,sBAAsB;QAAEG;QAAYC;QAAUC;QAAQC;IAAI;IAEzF,IAAI,CAACC,kBAAkB;QACrB,8EAA8E;QAC9E,iFAAiF;QACjF,mEAAmE;QACnE,KAAK,MAAMC,eAAe;YAAC;YAAM;SAAM,CAAE;YACvC,MAAMP,+BAA+B;gBACnCQ,UAAU,IAAMjB,gBAAgB;wBAAEW;wBAAYC;wBAAUC;wBAAQC;oBAAI;gBACpEE;gBACAF;YACF;QACF;QACA,MAAM,IAAIhB,SAASgB,IAAII,CAAC;IAC1B;IAEA,MAAM,EAAEC,QAAQ,EAAEC,QAAQ,EAAE,GAAG,MAAMC,kBAAkB;QACrDV;QACAC;QACAC;QACAC;QACAC;IACF;IAEA,MAAMO,gBAAgBf,iBAAiB;QAAEY;QAAUP;IAAS;IAE5D,MAAMW,SAASrB,uBAAuB;QACpCsB,UAAU,IAAMpB,sBAAsB;gBAAEO;gBAAYQ;gBAAUP;gBAAUC;gBAAQC;YAAI;IACtF;IAEA,IAAIW;IACJ,oFAAoF;IACpF,yFAAyF;IACzF,MAAMC,2BAA2B,IAAIC;IAErC,MAAMC,kBAAkB,OAAOC;QAC7B,MAAMC,iBAAiBD;QACvBH,yBAAyBK,GAAG,CAACF,WAAWG;QACxCN,yBAAyBO,MAAM,CAACJ;IAClC;IAEA,IAAI;QACF,KAAK,MAAMK,eAAed,SAAU;YAClC,MAAMe,mBAAmBV;YACzB,IAAIW;YACJ,MAAMC,0BAA0B,IAAIC;YACpC,MAAMC,cAAcrC,uBAAuB;gBACzCsB,UAAU;oBACRY,oBAAoBI,kBAAkB;wBACpCX,UAAUJ,mBAAoB,MAAMF,OAAOQ,GAAG;wBAC9CU,QAAQJ,wBAAwBI,MAAM;oBACxC;oBACAf,yBAAyBgB,GAAG,CAACN,mBAAmBC;oBAEhD,OAAOD;gBACT;YACF;YAEA,MAAMO,SAAS,MAAMT,YAAYU,aAAa,CAAE;gBAC9CC,gBAAgBlC,WAAWmC,MAAM,CAACC,IAAI;gBACtCC,YAAY7B,SAAS8B,EAAE;gBACvBrC,UAAUU,cAAcV,QAAQ;gBAChCsC,eAAeX,YAAYR,GAAG;gBAC9BoB,UAAU7B,cAAc6B,QAAQ;gBAChCrC;YACF;YAEA,IAAI6B,OAAOd,QAAQ,EAAE;gBACnB,IAAIO,qBAAqBO,OAAOd,QAAQ,KAAKO,mBAAmB;oBAC9D,MAAMR,gBAAgBQ;gBACxB,OAAO,IAAID,oBAAoBQ,OAAOd,QAAQ,KAAKM,kBAAkB;oBACnE,MAAMP,gBAAgBO;gBACxB;gBAEAV,kBAAkBkB,OAAOd,QAAQ;YACnC,OAAO,IAAIU,YAAYa,SAAS,IAAI;gBAClC,MAAM,IAAIrD,yBACR;YAEJ;YAEA,IAAI4C,OAAOU,MAAM,KAAK,YAAY;gBAChC,OAAOlD,qBAAqB;oBAAEQ;oBAAYG;oBAAKe,UAAUJ;gBAAiB;YAC5E;QACF;IACF,EAAE,OAAO6B,KAAK;QACZxC,IAAIyC,OAAO,CAACC,MAAM,CAACC,KAAK,CAAC;YAAEH;YAAKI,KAAK;QAA8C;QACnF,KAAK,MAAMrB,2BAA2BX,yBAAyBiC,MAAM,GAAI;YACvEtB,wBAAwBL,KAAK,CAACsB;QAChC;QACA,MAAMxB,iBAAiBL;QACvB,MAAM6B;IACR;IAEA,IAAI7B,iBAAiB;QACnB,OAAOtB,qBAAqB;YAAEQ;YAAYG;YAAKe,UAAUJ;QAAgB;IAC3E;IAEA,2EAA2E;IAC3E,qFAAqF;IACrF,OAAOxB,qBAAqB;QAAEU;QAAYiD,KAAKzC;QAAUP;QAAUC;QAAQC;IAAI;AACjF;AAEA;;;CAGC,GACD,SAAS0B,kBAAkB,EACzBX,QAAQ,EACRY,MAAM,EAIP;IACC,IAAI,CAACZ,SAASgC,IAAI,EAAE;QAClB,OAAOhC;IACT;IAEA,OAAO,IAAIiC,SAASjC,SAASgC,IAAI,CAACE,WAAW,CAAC,IAAIC,mBAAmB;QAAEvB;IAAO,IAAI;QAChFwB,SAASpC,SAASoC,OAAO;QACzBZ,QAAQxB,SAASwB,MAAM;QACvBa,YAAYrC,SAASqC,UAAU;IACjC;AACF;AAEA;;;CAGC,GACD,eAAepC,iBAAiBD,QAA8B;IAC5D,IAAI,CAACA,UAAUgC,QAAQhC,SAASgC,IAAI,CAACM,MAAM,EAAE;QAC3C;IACF;IAEA,IAAI;QACF,MAAMtC,SAASgC,IAAI,CAACO,MAAM;IAC5B,EAAE,OAAM;IACN,oEAAoE;IACtE;AACF;AAEA,SAASC,oBAAoB,EAC3B1D,UAAU,EACVQ,QAAQ,EACRP,QAAQ,EACRE,GAAG,EAMJ;IACC,OAAOR,wBAAwB;QAC7BgE,MAAM;YACJzB,gBAAgBlC,WAAWmC,MAAM,CAACC,IAAI;YACtCC,YAAY7B,SAAS8B,EAAE;YACvBE,UAAU5C,iBAAiB;gBAAEY;gBAAUP;YAAS,GAAGuC,QAAQ;YAC3DoB,WAAW;YACXzD;QACF;QACA0D,YAAY;QACZC,cAAc3D,IAAIyC,OAAO,CAACT,MAAM,CAAC4B,MAAM,CAACD,YAAY;IACtD;AACF;AAIA;;;;;;;;;;;;;;;;;CAiBC,GACD,eAAepD,kBAAkB,EAC/BV,UAAU,EACVC,QAAQ,EACRC,MAAM,EACNC,GAAG,EACHC,gBAAgB,EAOjB;IACC,MAAM4D,gBAAgB,IAAIhD;IAE1B,MAAMiD,cAAc,CAAC,EAAE5D,WAAW,EAA4B;QAC5D,IAAI,CAAC2D,cAAcE,GAAG,CAAC7D,cAAc;YACnC2D,cAAcjC,GAAG,CACf1B,aACAP,+BAA+B;gBAC7BQ,UAAU,IAAMjB,gBAAgB;wBAAEW;wBAAYC;wBAAUC;wBAAQC;oBAAI;gBACpEE;gBACAF;YACF,GAAGgE,IAAI,CACL,CAAC3D,WAAc,CAAA;oBACbA,UAAUA;oBACV4D,WAAW;gBACb,CAAA,GACA,CAACzB;gBACC,IAAIA,eAAezD,WAAW;oBAC5B,OAAO;wBAAEkF,WAAW;oBAAe;gBACrC;gBAEA,MAAMzB;YACR;QAGN;QAEA,OAAOqB,cAAc5C,GAAG,CAACf;IAC3B;IAEA,MAAMgE,2BACJ3E,yBAAyB;QACvBmE,YAAY;QACZrB,UAAU5C,iBAAiB;YAAEY,UAAUJ;YAAkBH;QAAS,GAAGuC,QAAQ;QAC7EsB,cAAc3D,IAAIyC,OAAO,CAACT,MAAM,CAAC4B,MAAM,CAACD,YAAY;IACtD,GAAGQ,MAAM,GAAG;IAEd,IAAIC,oBAAoBF;IACxB,IAAIG,SAAS,MAAMP,YAAY;QAAE5D,aAAakE;IAAkB;IAEhE,IAAI,CAACC,OAAOJ,SAAS,IAAIG,mBAAmB;QAC1CA,oBAAoB;QACpBC,SAAS,MAAMP,YAAY;YAAE5D,aAAakE;QAAkB;IAC9D;IAEA,IAAI,CAACC,OAAOJ,SAAS,EAAE;QACrB,MAAM,IAAIlF,UAAUiB,IAAII,CAAC;IAC3B;IAEA,MAAMC,WACJgE,OAAOhE,QAAQ,IAAIgE,OAAOhE,QAAQ,CAAC8B,EAAE,KAAKlC,iBAAiBkC,EAAE,GACzDkC,OAAOhE,QAAQ,GACfJ;IAEN,MAAMK,WAAW,MAAMiD,oBAAoB;QAAE1D;QAAYQ;QAAUP;QAAUE;IAAI;IACjF,MAAME,cAAcI,SAAS6D,MAAM,GAAG;IAEtC,IAAIjE,gBAAgBkE,mBAAmB;QACrC,MAAME,iBAAiB,MAAMR,YAAY;YAAE5D;QAAY;QAEvD,IACE,CAACoE,eAAeL,SAAS,IACxBK,eAAejE,QAAQ,IAAIiE,eAAejE,QAAQ,CAAC8B,EAAE,KAAK9B,SAAS8B,EAAE,EACtE;YACA,MAAM,IAAIpD,UAAUiB,IAAII,CAAC;QAC3B;IACF;IAEA,OAAO;QAAEC;QAAUC;IAAS;AAC9B"}

package/dist/uploads/transformers/matchesMimeType.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Matches an authoritative MIME type against a transformer-declared MIME pattern:
+ * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching
+ * every type and subtype). Defensive by design — malformed input returns `false`
+ * rather than throwing; startup validation owns rejecting malformed configured patterns.
+ */
+export declare function matchesMimeType({ mimeType, pattern, }: {
+    mimeType: string;
+    pattern: string;
+}): boolean;
+//# sourceMappingURL=matchesMimeType.d.ts.map

package/dist/uploads/transformers/matchesMimeType.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"matchesMimeType.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/matchesMimeType.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAC9B,QAAQ,EACR,OAAO,GACR,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB,GAAG,OAAO,CAuCV"}

package/dist/uploads/transformers/matchesMimeType.js

@@ -0,0 +1,39 @@
+function normalize(value) {
+    return value.trim().toLowerCase();
+}
+/**
+ * Matches an authoritative MIME type against a transformer-declared MIME pattern:
+ * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching
+ * every type and subtype). Defensive by design — malformed input returns `false`
+ * rather than throwing; startup validation owns rejecting malformed configured patterns.
+ */ export function matchesMimeType({ mimeType, pattern }) {
+    if (typeof pattern !== 'string' || typeof mimeType !== 'string') {
+        return false;
+    }
+    const normalizedPattern = normalize(pattern);
+    const normalizedMimeType = normalize(mimeType);
+    if (normalizedPattern === '*/*') {
+        return true;
+    }
+    const patternParts = normalizedPattern.split('/');
+    if (patternParts.length !== 2 || patternParts.some((part)=>part.length === 0)) {
+        return false;
+    }
+    const [patternType, patternSubtype] = patternParts;
+    // "*/*" is the only valid full wildcard — a wildcard type with a concrete
+    // subtype (e.g. "*/png") is invalid.
+    if (patternType === '*') {
+        return false;
+    }
+    const mimeParts = normalizedMimeType.split('/');
+    if (mimeParts.length !== 2) {
+        return false;
+    }
+    const [mimeTypeSegment, mimeSubtypeSegment] = mimeParts;
+    if (patternType !== mimeTypeSegment) {
+        return false;
+    }
+    return patternSubtype === '*' || patternSubtype === mimeSubtypeSegment;
+}
+
+//# sourceMappingURL=matchesMimeType.js.map

package/dist/uploads/transformers/matchesMimeType.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/matchesMimeType.ts"],"sourcesContent":["function normalize(value: string): string {\n  return value.trim().toLowerCase()\n}\n\n/**\n * Matches an authoritative MIME type against a transformer-declared MIME pattern:\n * an exact value, a category wildcard (`image/*`), or the universal wildcard (matching\n * every type and subtype). Defensive by design — malformed input returns `false`\n * rather than throwing; startup validation owns rejecting malformed configured patterns.\n */\nexport function matchesMimeType({\n  mimeType,\n  pattern,\n}: {\n  mimeType: string\n  pattern: string\n}): boolean {\n  if (typeof pattern !== 'string' || typeof mimeType !== 'string') {\n    return false\n  }\n\n  const normalizedPattern = normalize(pattern)\n  const normalizedMimeType = normalize(mimeType)\n\n  if (normalizedPattern === '*/*') {\n    return true\n  }\n\n  const patternParts = normalizedPattern.split('/')\n\n  if (patternParts.length !== 2 || patternParts.some((part) => part.length === 0)) {\n    return false\n  }\n\n  const [patternType, patternSubtype] = patternParts\n\n  // \"*/*\" is the only valid full wildcard — a wildcard type with a concrete\n  // subtype (e.g. \"*/png\") is invalid.\n  if (patternType === '*') {\n    return false\n  }\n\n  const mimeParts = normalizedMimeType.split('/')\n\n  if (mimeParts.length !== 2) {\n    return false\n  }\n\n  const [mimeTypeSegment, mimeSubtypeSegment] = mimeParts\n\n  if (patternType !== mimeTypeSegment) {\n    return false\n  }\n\n  return patternSubtype === '*' || patternSubtype === mimeSubtypeSegment\n}\n"],"names":["normalize","value","trim","toLowerCase","matchesMimeType","mimeType","pattern","normalizedPattern","normalizedMimeType","patternParts","split","length","some","part","patternType","patternSubtype","mimeParts","mimeTypeSegment","mimeSubtypeSegment"],"mappings":"AAAA,SAASA,UAAUC,KAAa;IAC9B,OAAOA,MAAMC,IAAI,GAAGC,WAAW;AACjC;AAEA;;;;;CAKC,GACD,OAAO,SAASC,gBAAgB,EAC9BC,QAAQ,EACRC,OAAO,EAIR;IACC,IAAI,OAAOA,YAAY,YAAY,OAAOD,aAAa,UAAU;QAC/D,OAAO;IACT;IAEA,MAAME,oBAAoBP,UAAUM;IACpC,MAAME,qBAAqBR,UAAUK;IAErC,IAAIE,sBAAsB,OAAO;QAC/B,OAAO;IACT;IAEA,MAAME,eAAeF,kBAAkBG,KAAK,CAAC;IAE7C,IAAID,aAAaE,MAAM,KAAK,KAAKF,aAAaG,IAAI,CAAC,CAACC,OAASA,KAAKF,MAAM,KAAK,IAAI;QAC/E,OAAO;IACT;IAEA,MAAM,CAACG,aAAaC,eAAe,GAAGN;IAEtC,0EAA0E;IAC1E,qCAAqC;IACrC,IAAIK,gBAAgB,KAAK;QACvB,OAAO;IACT;IAEA,MAAME,YAAYR,mBAAmBE,KAAK,CAAC;IAE3C,IAAIM,UAAUL,MAAM,KAAK,GAAG;QAC1B,OAAO;IACT;IAEA,MAAM,CAACM,iBAAiBC,mBAAmB,GAAGF;IAE9C,IAAIF,gBAAgBG,iBAAiB;QACnC,OAAO;IACT;IAEA,OAAOF,mBAAmB,OAAOA,mBAAmBG;AACtD"}

package/dist/uploads/transformers/planTransformerPipeline.d.ts

@@ -0,0 +1,26 @@
+import type { CanTransformArgs, UploadTransformer } from './types.js';
+/**
+ * Builds the fixed, ordered list of transformers eligible for one upload or
+ * dynamic-request operation. Pure and side-effect-free beyond invoking each
+ * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`
+ * and performs no storage or access work. A thrown/rejected `canTransform` aborts
+ * planning immediately rather than being treated as `false`.
+ */
+export declare function planTransformerPipeline({ args, capability, transformers, }: {
+    args: CanTransformArgs;
+    capability: TransformerCapability;
+    transformers: UploadTransformer[];
+}): Promise<UploadTransformer[]>;
+/**
+ * The transformers that implement `capability` and declare a MIME pattern matching
+ * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,
+ * so it is safe to call before access control has been checked.
+ */
+export declare function getCandidateTransformers({ capability, mimeType, transformers, }: {
+    capability: TransformerCapability;
+    mimeType: string;
+    transformers: UploadTransformer[];
+}): UploadTransformer[];
+type TransformerCapability = 'handleRequest' | 'transformFile';
+export {};
+//# sourceMappingURL=planTransformerPipeline.d.ts.map

package/dist/uploads/transformers/planTransformerPipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"planTransformerPipeline.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/planTransformerPipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAIrE;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,IAAI,EACJ,UAAU,EACV,YAAY,GACb,EAAE;IACD,IAAI,EAAE,gBAAgB,CAAA;IACtB,UAAU,EAAE,qBAAqB,CAAA;IACjC,YAAY,EAAE,iBAAiB,EAAE,CAAA;CAClC,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAoB/B;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EACvC,UAAU,EACV,QAAQ,EACR,YAAY,GACb,EAAE;IACD,UAAU,EAAE,qBAAqB,CAAA;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,iBAAiB,EAAE,CAAA;CAClC,GAAG,iBAAiB,EAAE,CAMtB;AAED,KAAK,qBAAqB,GAAG,eAAe,GAAG,eAAe,CAAA"}

package/dist/uploads/transformers/planTransformerPipeline.js

@@ -0,0 +1,36 @@
+import { matchesMimeType } from './matchesMimeType.js';
+/**
+ * Builds the fixed, ordered list of transformers eligible for one upload or
+ * dynamic-request operation. Pure and side-effect-free beyond invoking each
+ * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`
+ * and performs no storage or access work. A thrown/rejected `canTransform` aborts
+ * planning immediately rather than being treated as `false`.
+ */ export async function planTransformerPipeline({ args, capability, transformers }) {
+    const pipeline = [];
+    for (const transformer of getCandidateTransformers({
+        capability,
+        mimeType: args.mimeType,
+        transformers
+    })){
+        if (typeof transformer.canTransform === 'function') {
+            const isEligible = await transformer.canTransform(args);
+            if (!isEligible) {
+                continue;
+            }
+        }
+        pipeline.push(transformer);
+    }
+    return pipeline;
+}
+/**
+ * The transformers that implement `capability` and declare a MIME pattern matching
+ * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,
+ * so it is safe to call before access control has been checked.
+ */ export function getCandidateTransformers({ capability, mimeType, transformers }) {
+    return transformers.filter((transformer)=>typeof transformer[capability] === 'function' && transformer.mimeTypes.some((pattern)=>matchesMimeType({
+                mimeType,
+                pattern
+            })));
+}
+
+//# sourceMappingURL=planTransformerPipeline.js.map

package/dist/uploads/transformers/planTransformerPipeline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/uploads/transformers/planTransformerPipeline.ts"],"sourcesContent":["import type { CanTransformArgs, UploadTransformer } from './types.js'\n\nimport { matchesMimeType } from './matchesMimeType.js'\n\n/**\n * Builds the fixed, ordered list of transformers eligible for one upload or\n * dynamic-request operation. Pure and side-effect-free beyond invoking each\n * candidate's own `canTransform`: it never calls `transformFile`/`handleRequest`\n * and performs no storage or access work. A thrown/rejected `canTransform` aborts\n * planning immediately rather than being treated as `false`.\n */\nexport async function planTransformerPipeline({\n  args,\n  capability,\n  transformers,\n}: {\n  args: CanTransformArgs\n  capability: TransformerCapability\n  transformers: UploadTransformer[]\n}): Promise<UploadTransformer[]> {\n  const pipeline: UploadTransformer[] = []\n\n  for (const transformer of getCandidateTransformers({\n    capability,\n    mimeType: args.mimeType,\n    transformers,\n  })) {\n    if (typeof transformer.canTransform === 'function') {\n      const isEligible = await transformer.canTransform(args)\n\n      if (!isEligible) {\n        continue\n      }\n    }\n\n    pipeline.push(transformer)\n  }\n\n  return pipeline\n}\n\n/**\n * The transformers that implement `capability` and declare a MIME pattern matching\n * `mimeType`, before `canTransform` narrows them. Runs no application-defined code,\n * so it is safe to call before access control has been checked.\n */\nexport function getCandidateTransformers({\n  capability,\n  mimeType,\n  transformers,\n}: {\n  capability: TransformerCapability\n  mimeType: string\n  transformers: UploadTransformer[]\n}): UploadTransformer[] {\n  return transformers.filter(\n    (transformer) =>\n      typeof transformer[capability] === 'function' &&\n      transformer.mimeTypes.some((pattern) => matchesMimeType({ mimeType, pattern })),\n  )\n}\n\ntype TransformerCapability = 'handleRequest' | 'transformFile'\n"],"names":["matchesMimeType","planTransformerPipeline","args","capability","transformers","pipeline","transformer","getCandidateTransformers","mimeType","canTransform","isEligible","push","filter","mimeTypes","some","pattern"],"mappings":"AAEA,SAASA,eAAe,QAAQ,uBAAsB;AAEtD;;;;;;CAMC,GACD,OAAO,eAAeC,wBAAwB,EAC5CC,IAAI,EACJC,UAAU,EACVC,YAAY,EAKb;IACC,MAAMC,WAAgC,EAAE;IAExC,KAAK,MAAMC,eAAeC,yBAAyB;QACjDJ;QACAK,UAAUN,KAAKM,QAAQ;QACvBJ;IACF,GAAI;QACF,IAAI,OAAOE,YAAYG,YAAY,KAAK,YAAY;YAClD,MAAMC,aAAa,MAAMJ,YAAYG,YAAY,CAACP;YAElD,IAAI,CAACQ,YAAY;gBACf;YACF;QACF;QAEAL,SAASM,IAAI,CAACL;IAChB;IAEA,OAAOD;AACT;AAEA;;;;CAIC,GACD,OAAO,SAASE,yBAAyB,EACvCJ,UAAU,EACVK,QAAQ,EACRJ,YAAY,EAKb;IACC,OAAOA,aAAaQ,MAAM,CACxB,CAACN,cACC,OAAOA,WAAW,CAACH,WAAW,KAAK,cACnCG,YAAYO,SAAS,CAACC,IAAI,CAAC,CAACC,UAAYf,gBAAgB;gBAAEQ;gBAAUO;YAAQ;AAElF"}

package/dist/uploads/transformers/resolveUploadDocument.d.ts

@@ -0,0 +1,46 @@
+import type { Collection, TypeWithID } from '../../collections/config/types.js';
+import type { PayloadRequest, Where } from '../../types/index.js';
+export type ResolvedUploadDocument = {
+    filename: string;
+    mimeType: string;
+    variants?: Record<string, {
+        filename?: null | string;
+        mimeType?: null | string;
+    } | null>;
+} & TypeWithID;
+/**
+ * The primary filename, or a configured legacy image size's filename, both match.
+ * Shared with `checkFileAccess.ts` so the two lookups can't drift apart.
+ */
+export declare function buildFilenameWhere({ filename, variants, }: {
+    filename: string;
+    variants?: {
+        name: string;
+    }[];
+}): Where;
+/**
+ * The `filename` and `mimeType` of the file a request actually targets: the
+ * primary file, or the legacy image size whose filename matched (a size can be
+ * stored in a different format than the primary file via `formatOptions`).
+ */
+export declare function getRequestedFile({ document, filename, }: {
+    document: ResolvedUploadDocument;
+    filename: string;
+}): {
+    filename: string;
+    mimeType: string;
+};
+/**
+ * Finds the upload document matching a filename (or one of its configured legacy
+ * image sizes) and an optional storage `prefix`, without applying any access-control
+ * filtering. Runs unconditionally — no `constraints.length` fast path — because
+ * it's only ever called when at least one transformer is configured, and pipeline
+ * planning needs the document's authoritative `mimeType` before access is enforced.
+ */
+export declare function resolveUploadDocument({ collection, filename, prefix, req, }: {
+    collection: Collection;
+    filename: string;
+    prefix?: string;
+    req: PayloadRequest;
+}): Promise<ResolvedUploadDocument | undefined>;
+//# sourceMappingURL=resolveUploadDocument.d.ts.map

package/dist/uploads/transformers/resolveUploadDocument.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveUploadDocument.d.ts","sourceRoot":"","sources":["../../../src/uploads/transformers/resolveUploadDocument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAIjE,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC,CAAA;CACzF,GAAG,UAAU,CAAA;AAEd;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EACjC,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC9B,GAAG,KAAK,CAYR;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,EAC/B,QAAQ,EACR,QAAQ,GACT,EAAE;IACD,QAAQ,EAAE,sBAAsB,CAAA;IAChC,QAAQ,EAAE,MAAM,CAAA;CACjB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAUzC;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,UAAU,EACV,QAAQ,EACR,MAAM,EACN,GAAG,GACJ,EAAE;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAoB9C"}