payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/uploads/validateSvg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateSvg.d.ts","sourceRoot":"","sources":["../../src/uploads/validateSvg.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAqDnD"}
+{"version":3,"file":"validateSvg.d.ts","sourceRoot":"","sources":["../../src/uploads/validateSvg.ts"],"names":[],"mappings":"AAuEA,MAAM,MAAM,aAAa,GAAG;IAC1B,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAmMD,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAiBxD;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACnC,OAAO,CAAC,aAAa,CAAC,CAiCxB;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/uploads/validateSvg.js

@@ -1,46 +1,286 @@
-/**
- * Validate SVG content for security vulnerabilities
- * Detects and blocks malicious patterns commonly used in SVG-based attacks
- */ export function validateSvg(buffer) {
+import { createReadStream } from 'fs';
+import sax from 'sax';
+import { TextDecoder } from 'util';
+const SVG_NAMESPACE = 'http://www.w3.org/2000/svg';
+const blockedElements = new Set([
+    'embed',
+    'foreignobject',
+    'iframe',
+    'object',
+    'script'
+]);
+const animationElements = new Set([
+    'animate',
+    'animatemotion',
+    'animatetransform',
+    'set'
+]);
+const animationValueAttributes = new Set([
+    'by',
+    'from',
+    'to',
+    'values'
+]);
+const urlAttributes = new Set([
+    'data',
+    'href',
+    'src'
+]);
+const urlFunctionAttributes = new Set([
+    'clip-path',
+    'cursor',
+    'fill',
+    'filter',
+    'marker',
+    'marker-end',
+    'marker-mid',
+    'marker-start',
+    'mask',
+    'stroke'
+]);
+const getLocalName = (name)=>{
+    const separator = name.lastIndexOf(':');
+    return (separator === -1 ? name : name.slice(separator + 1)).toLowerCase();
+};
+const getPrefix = (name)=>{
+    const separator = name.indexOf(':');
+    return separator === -1 ? '' : name.slice(0, separator);
+};
+const hasBlockedURL = (value)=>{
+    let normalizedValue = '';
+    for (const character of value){
+        const codePoint = character.codePointAt(0);
+        if (codePoint && codePoint > 0x20 && codePoint !== 0x7f) {
+            normalizedValue += character;
+        }
+    }
+    normalizedValue = normalizedValue.toLowerCase();
+    return normalizedValue.includes('javascript:') || normalizedValue.includes('data:text/html') || normalizedValue.includes('data:image/svg+xml');
+};
+const decodeCSSValue = (value)=>value.replace(/\/\*[\s\S]*?\*\//g, '').replace(/\\\r\n|\\[\n\r\f]/g, '').replace(/\\([\da-f]{1,6})\s?|\\(.)/gi, (_match, hexadecimal, escapedCharacter)=>{
+        if (hexadecimal) {
+            const codePoint = Number.parseInt(hexadecimal, 16);
+            return codePoint > 0 && codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : '';
+        }
+        return escapedCharacter || '';
+    });
+const hasBlockedStyles = (value)=>{
+    const decodedValue = decodeCSSValue(value);
+    return decodedValue.toLowerCase().includes('@import') || hasBlockedURL(decodedValue);
+};
+const getXMLDecoder = (buffer)=>{
+    if (buffer[0] === 0xff && buffer[1] === 0xfe || buffer[0] === 0x3c && buffer[1] === 0x00 && buffer[2] === 0x3f && buffer[3] === 0x00) {
+        return new TextDecoder('utf-16le');
+    }
+    if (buffer[0] === 0xfe && buffer[1] === 0xff || buffer[0] === 0x00 && buffer[1] === 0x3c && buffer[2] === 0x00 && buffer[3] === 0x3f) {
+        return new TextDecoder('utf-16be');
+    }
+    return new TextDecoder('utf-8');
+};
+const createSvgInspector = ()=>{
+    // sax's namespace mode walks prototype chains at every close tag. Payload only needs to resolve
+    // the root SVG namespace; active descendants and attributes are checked by local name.
+    const saxWithBufferLength = sax;
+    const maxBufferLength = saxWithBufferLength.MAX_BUFFER_LENGTH;
+    let parser;
+    try {
+        saxWithBufferLength.MAX_BUFFER_LENGTH = Number.POSITIVE_INFINITY;
+        parser = sax.parser(true, {
+            position: false,
+            strictEntities: true,
+            xmlns: false
+        });
+    } finally{
+        saxWithBufferLength.MAX_BUFFER_LENGTH = maxBufferLength;
+    }
+    let attributes = [];
+    const elementNames = [];
+    let isSafe = true;
+    let isSvg = false;
+    let isValid = true;
+    let rootElementSeen = false;
+    let styleContent = null;
+    let styleElementDepth = 0;
+    parser.onerror = (error)=>{
+        throw error;
+    };
+    parser.onprocessinginstruction = ({ name })=>{
+        if (name.toLowerCase() === 'xml-stylesheet') {
+            isSafe = false;
+        }
+    };
+    parser.ondoctype = (doctype)=>{
+        if (doctype.includes('[') || /<!entity/i.test(doctype)) {
+            isSafe = false;
+        }
+    };
+    parser.onopentagstart = (tag)=>{
+        attributes = [];
+        // sax stores attributes in a normal object and calls its hasOwnProperty method. Use a guarded
+        // null-prototype object so valid XML attributes with object-property names remain supported.
+        const saxAttributes = Object.create(null);
+        tag.attributes = new Proxy(saxAttributes, {
+            get: (target, property, receiver)=>{
+                if (property === 'hasOwnProperty') {
+                    return (name)=>Object.prototype.hasOwnProperty.call(target, name);
+                }
+                return Reflect.get(target, property, receiver);
+            }
+        });
+    };
+    parser.onattribute = (attribute)=>{
+        attributes.push(attribute);
+    };
+    parser.onopentag = (tag)=>{
+        const localName = getLocalName(tag.name);
+        elementNames.push(localName);
+        if (!rootElementSeen) {
+            rootElementSeen = true;
+            const prefix = getPrefix(tag.name);
+            const namespaceAttribute = prefix ? `xmlns:${prefix}` : 'xmlns';
+            const namespace = attributes.find(({ name })=>name === namespaceAttribute)?.value;
+            isSvg = localName === 'svg' && namespace === SVG_NAMESPACE;
+            if (!isSvg) {
+                isSafe = false;
+            }
+        }
+        if (blockedElements.has(localName)) {
+            isSafe = false;
+        }
+        if (localName === 'style') {
+            styleElementDepth += 1;
+            if (styleElementDepth === 1) {
+                styleContent = '';
+            }
+        }
+        if (animationElements.has(localName)) {
+            const targetAttribute = attributes.find(({ name })=>getLocalName(name).toLowerCase() === 'attributename')?.value.trim();
+            const targetName = targetAttribute ? getLocalName(targetAttribute) : '';
+            const values = attributes.filter(({ name })=>animationValueAttributes.has(getLocalName(name))).map(({ value })=>value).join(';');
+            if (/^on[a-z]/.test(targetName) || urlAttributes.has(targetName) && hasBlockedURL(values) || targetName === 'style' && hasBlockedStyles(values) || urlFunctionAttributes.has(targetName) && hasBlockedStyles(values)) {
+                isSafe = false;
+            }
+        }
+        for (const attribute of attributes){
+            const attributeName = getLocalName(attribute.name);
+            if (/^on[a-z]/.test(attributeName)) {
+                isSafe = false;
+            }
+            if (attributeName === 'style' && hasBlockedStyles(attribute.value)) {
+                isSafe = false;
+            }
+            if (urlAttributes.has(attributeName) && hasBlockedURL(attribute.value)) {
+                isSafe = false;
+            }
+            if (urlFunctionAttributes.has(attributeName) && /url\s*\(/i.test(attribute.value) && hasBlockedStyles(attribute.value)) {
+                isSafe = false;
+            }
+        }
+    };
+    parser.onclosetag = ()=>{
+        if (elementNames.pop() === 'style') {
+            if (styleElementDepth === 1 && styleContent && hasBlockedStyles(styleContent)) {
+                isSafe = false;
+            }
+            styleElementDepth -= 1;
+            if (styleElementDepth === 0) {
+                styleContent = null;
+            }
+        }
+    };
+    const collectStyleContent = (value)=>{
+        if (styleElementDepth > 0 && styleContent !== null) {
+            styleContent += value;
+        }
+    };
+    parser.ontext = collectStyleContent;
+    parser.oncdata = collectStyleContent;
+    return {
+        close: ()=>{
+            parser.close();
+            if (!rootElementSeen) {
+                throw new Error('Missing root element');
+            }
+        },
+        getResult: ()=>({
+                isSafe: rootElementSeen && isSafe && isValid,
+                isSvg,
+                isValid
+            }),
+        hasNonSvgRoot: ()=>rootElementSeen && !isSvg,
+        markInvalid: ()=>{
+            isValid = false;
+        },
+        write: (value)=>parser.write(value)
+    };
+};
+export function inspectSvg(buffer) {
+    const inspector = createSvgInspector();
+    const decoder = getXMLDecoder(buffer);
     try {
-        const content = buffer.toString('utf8');
-        const dangerousPatterns = [
-            // Script tags
-            /<script[\s>]/i,
-            /<\/script>/i,
-            // Event handlers (onclick, onload, onerror, etc.)
-            /\son\w+\s*=/i,
-            // JavaScript URLs
-            /javascript:/i,
-            /data:text\/html/i,
-            // Foreign objects (can embed HTML)
-            /<foreignObject[\s>]/i,
-            // Embedded iframes
-            /<iframe[\s>]/i,
-            // Embedded objects and embeds
-            /<object[\s>]/i,
-            /<embed[\s>]/i,
-            // Base64 encoded scripts (common obfuscation technique)
-            /data:image\/svg\+xml;base64,[\w+/]*PHNjcmlwdA/i,
-            // XLink href with javascript (deprecated but still dangerous)
-            /xlink:href\s*=\s*["']javascript:/i,
-            // Import statements
-            /@import/i,
-            // External resource references that could be dangerous
-            /<!ENTITY/i,
-            /<!DOCTYPE[^>]*\[/i,
-            // Attempt to use CDATA to hide scripts
-            /<!\[CDATA\[[\s\S]*<script/i
-        ];
-        for (const pattern of dangerousPatterns){
-            if (pattern.test(content)) {
-                return false;
-            }
-        }
-        return true;
+        for(let offset = 0; offset < buffer.length; offset += 64 * 1024){
+            inspector.write(decoder.decode(buffer.subarray(offset, offset + 64 * 1024), {
+                stream: true
+            }));
+            if (inspector.hasNonSvgRoot()) {
+                return inspector.getResult();
+            }
+        }
+        inspector.write(decoder.decode());
+        inspector.close();
+        return inspector.getResult();
     } catch (_error) {
-        return false;
+        inspector.markInvalid();
+        return {
+            ...inspector.getResult(),
+            isSafe: false
+        };
     }
 }
+export async function inspectSvgFile(filePath, options) {
+    const inspector = createSvgInspector();
+    let decoder = null;
+    let prefix = Buffer.alloc(0);
+    try {
+        for await (const chunk of createReadStream(filePath, options)){
+            let content = chunk;
+            if (!decoder) {
+                prefix = Buffer.concat([
+                    prefix,
+                    content
+                ]);
+                if (prefix.length < 4) {
+                    continue;
+                }
+                decoder = getXMLDecoder(prefix);
+                content = prefix;
+            }
+            inspector.write(decoder.decode(content, {
+                stream: true
+            }));
+            if (inspector.hasNonSvgRoot()) {
+                return inspector.getResult();
+            }
+        }
+        decoder ??= getXMLDecoder(prefix);
+        if (prefix.length > 0 && prefix.length < 4) {
+            inspector.write(decoder.decode(prefix, {
+                stream: true
+            }));
+        }
+        inspector.write(decoder.decode());
+        inspector.close();
+        return inspector.getResult();
+    } catch (_error) {
+        inspector.markInvalid();
+        return {
+            ...inspector.getResult(),
+            isSafe: false
+        };
+    }
+}
+/** Validate SVG content by parsing its XML structure and rejecting active content. */ export function validateSvg(buffer) {
+    return inspectSvg(buffer).isSafe;
+}
 
 //# sourceMappingURL=validateSvg.js.map

package/dist/uploads/validateSvg.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["/**\n * Validate SVG content for security vulnerabilities\n * Detects and blocks malicious patterns commonly used in SVG-based attacks\n */\nexport function validateSvg(buffer: Buffer): boolean {\n  try {\n    const content = buffer.toString('utf8')\n\n    const dangerousPatterns = [\n      // Script tags\n      /<script[\\s>]/i,\n      /<\\/script>/i,\n\n      // Event handlers (onclick, onload, onerror, etc.)\n      /\\son\\w+\\s*=/i,\n\n      // JavaScript URLs\n      /javascript:/i,\n      /data:text\\/html/i,\n\n      // Foreign objects (can embed HTML)\n      /<foreignObject[\\s>]/i,\n\n      // Embedded iframes\n      /<iframe[\\s>]/i,\n\n      // Embedded objects and embeds\n      /<object[\\s>]/i,\n      /<embed[\\s>]/i,\n\n      // Base64 encoded scripts (common obfuscation technique)\n      /data:image\\/svg\\+xml;base64,[\\w+/]*PHNjcmlwdA/i, // <script in base64\n\n      // XLink href with javascript (deprecated but still dangerous)\n      /xlink:href\\s*=\\s*[\"']javascript:/i,\n\n      // Import statements\n      /@import/i,\n\n      // External resource references that could be dangerous\n      /<!ENTITY/i,\n      /<!DOCTYPE[^>]*\\[/i, // DOCTYPE with internal subset\n\n      // Attempt to use CDATA to hide scripts\n      /<!\\[CDATA\\[[\\s\\S]*<script/i,\n    ]\n\n    for (const pattern of dangerousPatterns) {\n      if (pattern.test(content)) {\n        return false\n      }\n    }\n\n    return true\n  } catch (_error) {\n    return false\n  }\n}\n"],"names":["validateSvg","buffer","content","toString","dangerousPatterns","pattern","test","_error"],"mappings":"AAAA;;;CAGC,GACD,OAAO,SAASA,YAAYC,MAAc;IACxC,IAAI;QACF,MAAMC,UAAUD,OAAOE,QAAQ,CAAC;QAEhC,MAAMC,oBAAoB;YACxB,cAAc;YACd;YACA;YAEA,kDAAkD;YAClD;YAEA,kBAAkB;YAClB;YACA;YAEA,mCAAmC;YACnC;YAEA,mBAAmB;YACnB;YAEA,8BAA8B;YAC9B;YACA;YAEA,wDAAwD;YACxD;YAEA,8DAA8D;YAC9D;YAEA,oBAAoB;YACpB;YAEA,uDAAuD;YACvD;YACA;YAEA,uCAAuC;YACvC;SACD;QAED,KAAK,MAAMC,WAAWD,kBAAmB;YACvC,IAAIC,QAAQC,IAAI,CAACJ,UAAU;gBACzB,OAAO;YACT;QACF;QAEA,OAAO;IACT,EAAE,OAAOK,QAAQ;QACf,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/uploads/validateSvg.ts"],"sourcesContent":["import { createReadStream } from 'fs'\nimport sax, { type SAXOptions } from 'sax'\nimport { TextDecoder } from 'util'\n\nconst SVG_NAMESPACE = 'http://www.w3.org/2000/svg'\n\nconst blockedElements = new Set(['embed', 'foreignobject', 'iframe', 'object', 'script'])\nconst animationElements = new Set(['animate', 'animatemotion', 'animatetransform', 'set'])\nconst animationValueAttributes = new Set(['by', 'from', 'to', 'values'])\nconst urlAttributes = new Set(['data', 'href', 'src'])\nconst urlFunctionAttributes = new Set([\n  'clip-path',\n  'cursor',\n  'fill',\n  'filter',\n  'marker',\n  'marker-end',\n  'marker-mid',\n  'marker-start',\n  'mask',\n  'stroke',\n])\n\nconst getLocalName = (name: string): string => {\n  const separator = name.lastIndexOf(':')\n  return (separator === -1 ? name : name.slice(separator + 1)).toLowerCase()\n}\n\nconst getPrefix = (name: string): string => {\n  const separator = name.indexOf(':')\n  return separator === -1 ? '' : name.slice(0, separator)\n}\n\nconst hasBlockedURL = (value: string): boolean => {\n  let normalizedValue = ''\n\n  for (const character of value) {\n    const codePoint = character.codePointAt(0)\n    if (codePoint && codePoint > 0x20 && codePoint !== 0x7f) {\n      normalizedValue += character\n    }\n  }\n\n  normalizedValue = normalizedValue.toLowerCase()\n\n  return (\n    normalizedValue.includes('javascript:') ||\n    normalizedValue.includes('data:text/html') ||\n    normalizedValue.includes('data:image/svg+xml')\n  )\n}\n\nconst decodeCSSValue = (value: string): string =>\n  value\n    .replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n    .replace(/\\\\\\r\\n|\\\\[\\n\\r\\f]/g, '')\n    .replace(/\\\\([\\da-f]{1,6})\\s?|\\\\(.)/gi, (_match, hexadecimal, escapedCharacter) => {\n      if (hexadecimal) {\n        const codePoint = Number.parseInt(hexadecimal, 16)\n        return codePoint > 0 && codePoint <= 0x10ffff ? String.fromCodePoint(codePoint) : ''\n      }\n\n      return escapedCharacter || ''\n    })\n\nconst hasBlockedStyles = (value: string): boolean => {\n  const decodedValue = decodeCSSValue(value)\n\n  return decodedValue.toLowerCase().includes('@import') || hasBlockedURL(decodedValue)\n}\n\nexport type SvgInspection = {\n  isSafe: boolean\n  isSvg: boolean\n  isValid: boolean\n}\n\nconst getXMLDecoder = (buffer: Buffer): TextDecoder => {\n  if (\n    (buffer[0] === 0xff && buffer[1] === 0xfe) ||\n    (buffer[0] === 0x3c && buffer[1] === 0x00 && buffer[2] === 0x3f && buffer[3] === 0x00)\n  ) {\n    return new TextDecoder('utf-16le')\n  }\n\n  if (\n    (buffer[0] === 0xfe && buffer[1] === 0xff) ||\n    (buffer[0] === 0x00 && buffer[1] === 0x3c && buffer[2] === 0x00 && buffer[3] === 0x3f)\n  ) {\n    return new TextDecoder('utf-16be')\n  }\n\n  return new TextDecoder('utf-8')\n}\n\nconst createSvgInspector = () => {\n  // sax's namespace mode walks prototype chains at every close tag. Payload only needs to resolve\n  // the root SVG namespace; active descendants and attributes are checked by local name.\n  const saxWithBufferLength = sax as { MAX_BUFFER_LENGTH: number } & typeof sax\n  const maxBufferLength = saxWithBufferLength.MAX_BUFFER_LENGTH\n  let parser: ReturnType<typeof sax.parser>\n  try {\n    saxWithBufferLength.MAX_BUFFER_LENGTH = Number.POSITIVE_INFINITY\n    parser = sax.parser(true, {\n      position: false,\n      strictEntities: true,\n      xmlns: false,\n    } as { strictEntities: boolean } & SAXOptions)\n  } finally {\n    saxWithBufferLength.MAX_BUFFER_LENGTH = maxBufferLength\n  }\n\n  let attributes: Array<{ name: string; value: string }> = []\n  const elementNames: string[] = []\n  let isSafe = true\n  let isSvg = false\n  let isValid = true\n  let rootElementSeen = false\n  let styleContent: null | string = null\n  let styleElementDepth = 0\n\n  parser.onerror = (error) => {\n    throw error\n  }\n\n  parser.onprocessinginstruction = ({ name }) => {\n    if (name.toLowerCase() === 'xml-stylesheet') {\n      isSafe = false\n    }\n  }\n\n  parser.ondoctype = (doctype) => {\n    if (doctype.includes('[') || /<!entity/i.test(doctype)) {\n      isSafe = false\n    }\n  }\n\n  parser.onopentagstart = (tag) => {\n    attributes = []\n\n    // sax stores attributes in a normal object and calls its hasOwnProperty method. Use a guarded\n    // null-prototype object so valid XML attributes with object-property names remain supported.\n    const saxAttributes = Object.create(null) as typeof tag.attributes\n    tag.attributes = new Proxy(saxAttributes, {\n      get: (target, property, receiver) => {\n        if (property === 'hasOwnProperty') {\n          return (name: string) => Object.prototype.hasOwnProperty.call(target, name)\n        }\n\n        return Reflect.get(target, property, receiver)\n      },\n    })\n  }\n\n  parser.onattribute = (attribute) => {\n    attributes.push(attribute)\n  }\n\n  parser.onopentag = (tag) => {\n    const localName = getLocalName(tag.name)\n    elementNames.push(localName)\n\n    if (!rootElementSeen) {\n      rootElementSeen = true\n      const prefix = getPrefix(tag.name)\n      const namespaceAttribute = prefix ? `xmlns:${prefix}` : 'xmlns'\n      const namespace = attributes.find(({ name }) => name === namespaceAttribute)?.value\n      isSvg = localName === 'svg' && namespace === SVG_NAMESPACE\n      if (!isSvg) {\n        isSafe = false\n      }\n    }\n\n    if (blockedElements.has(localName)) {\n      isSafe = false\n    }\n\n    if (localName === 'style') {\n      styleElementDepth += 1\n      if (styleElementDepth === 1) {\n        styleContent = ''\n      }\n    }\n\n    if (animationElements.has(localName)) {\n      const targetAttribute = attributes\n        .find(({ name }) => getLocalName(name).toLowerCase() === 'attributename')\n        ?.value.trim()\n      const targetName = targetAttribute ? getLocalName(targetAttribute) : ''\n      const values = attributes\n        .filter(({ name }) => animationValueAttributes.has(getLocalName(name)))\n        .map(({ value }) => value)\n        .join(';')\n\n      if (\n        /^on[a-z]/.test(targetName) ||\n        (urlAttributes.has(targetName) && hasBlockedURL(values)) ||\n        (targetName === 'style' && hasBlockedStyles(values)) ||\n        (urlFunctionAttributes.has(targetName) && hasBlockedStyles(values))\n      ) {\n        isSafe = false\n      }\n    }\n\n    for (const attribute of attributes) {\n      const attributeName = getLocalName(attribute.name)\n\n      if (/^on[a-z]/.test(attributeName)) {\n        isSafe = false\n      }\n\n      if (attributeName === 'style' && hasBlockedStyles(attribute.value)) {\n        isSafe = false\n      }\n\n      if (urlAttributes.has(attributeName) && hasBlockedURL(attribute.value)) {\n        isSafe = false\n      }\n\n      if (\n        urlFunctionAttributes.has(attributeName) &&\n        /url\\s*\\(/i.test(attribute.value) &&\n        hasBlockedStyles(attribute.value)\n      ) {\n        isSafe = false\n      }\n    }\n  }\n\n  parser.onclosetag = () => {\n    if (elementNames.pop() === 'style') {\n      if (styleElementDepth === 1 && styleContent && hasBlockedStyles(styleContent)) {\n        isSafe = false\n      }\n      styleElementDepth -= 1\n      if (styleElementDepth === 0) {\n        styleContent = null\n      }\n    }\n  }\n\n  const collectStyleContent = (value: string) => {\n    if (styleElementDepth > 0 && styleContent !== null) {\n      styleContent += value\n    }\n  }\n\n  parser.ontext = collectStyleContent\n  parser.oncdata = collectStyleContent\n\n  return {\n    close: () => {\n      parser.close()\n      if (!rootElementSeen) {\n        throw new Error('Missing root element')\n      }\n    },\n    getResult: (): SvgInspection => ({\n      isSafe: rootElementSeen && isSafe && isValid,\n      isSvg,\n      isValid,\n    }),\n    hasNonSvgRoot: (): boolean => rootElementSeen && !isSvg,\n    markInvalid: () => {\n      isValid = false\n    },\n    write: (value: string) => parser.write(value),\n  }\n}\n\nexport function inspectSvg(buffer: Buffer): SvgInspection {\n  const inspector = createSvgInspector()\n  const decoder = getXMLDecoder(buffer)\n  try {\n    for (let offset = 0; offset < buffer.length; offset += 64 * 1024) {\n      inspector.write(decoder.decode(buffer.subarray(offset, offset + 64 * 1024), { stream: true }))\n      if (inspector.hasNonSvgRoot()) {\n        return inspector.getResult()\n      }\n    }\n    inspector.write(decoder.decode())\n    inspector.close()\n    return inspector.getResult()\n  } catch (_error) {\n    inspector.markInvalid()\n    return { ...inspector.getResult(), isSafe: false }\n  }\n}\n\nexport async function inspectSvgFile(\n  filePath: string,\n  options?: { highWaterMark?: number },\n): Promise<SvgInspection> {\n  const inspector = createSvgInspector()\n  let decoder: null | TextDecoder = null\n  let prefix = Buffer.alloc(0)\n\n  try {\n    for await (const chunk of createReadStream(filePath, options)) {\n      let content: Buffer = chunk\n      if (!decoder) {\n        prefix = Buffer.concat([prefix, content])\n        if (prefix.length < 4) {\n          continue\n        }\n        decoder = getXMLDecoder(prefix)\n        content = prefix\n      }\n\n      inspector.write(decoder.decode(content, { stream: true }))\n      if (inspector.hasNonSvgRoot()) {\n        return inspector.getResult()\n      }\n    }\n    decoder ??= getXMLDecoder(prefix)\n    if (prefix.length > 0 && prefix.length < 4) {\n      inspector.write(decoder.decode(prefix, { stream: true }))\n    }\n    inspector.write(decoder.decode())\n    inspector.close()\n    return inspector.getResult()\n  } catch (_error) {\n    inspector.markInvalid()\n    return { ...inspector.getResult(), isSafe: false }\n  }\n}\n\n/** Validate SVG content by parsing its XML structure and rejecting active content. */\nexport function validateSvg(buffer: Buffer): boolean {\n  return inspectSvg(buffer).isSafe\n}\n"],"names":["createReadStream","sax","TextDecoder","SVG_NAMESPACE","blockedElements","Set","animationElements","animationValueAttributes","urlAttributes","urlFunctionAttributes","getLocalName","name","separator","lastIndexOf","slice","toLowerCase","getPrefix","indexOf","hasBlockedURL","value","normalizedValue","character","codePoint","codePointAt","includes","decodeCSSValue","replace","_match","hexadecimal","escapedCharacter","Number","parseInt","String","fromCodePoint","hasBlockedStyles","decodedValue","getXMLDecoder","buffer","createSvgInspector","saxWithBufferLength","maxBufferLength","MAX_BUFFER_LENGTH","parser","POSITIVE_INFINITY","position","strictEntities","xmlns","attributes","elementNames","isSafe","isSvg","isValid","rootElementSeen","styleContent","styleElementDepth","onerror","error","onprocessinginstruction","ondoctype","doctype","test","onopentagstart","tag","saxAttributes","Object","create","Proxy","get","target","property","receiver","prototype","hasOwnProperty","call","Reflect","onattribute","attribute","push","onopentag","localName","prefix","namespaceAttribute","namespace","find","has","targetAttribute","trim","targetName","values","filter","map","join","attributeName","onclosetag","pop","collectStyleContent","ontext","oncdata","close","Error","getResult","hasNonSvgRoot","markInvalid","write","inspectSvg","inspector","decoder","offset","length","decode","subarray","stream","_error","inspectSvgFile","filePath","options","Buffer","alloc","chunk","content","concat","validateSvg"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,KAAI;AACrC,OAAOC,SAA8B,MAAK;AAC1C,SAASC,WAAW,QAAQ,OAAM;AAElC,MAAMC,gBAAgB;AAEtB,MAAMC,kBAAkB,IAAIC,IAAI;IAAC;IAAS;IAAiB;IAAU;IAAU;CAAS;AACxF,MAAMC,oBAAoB,IAAID,IAAI;IAAC;IAAW;IAAiB;IAAoB;CAAM;AACzF,MAAME,2BAA2B,IAAIF,IAAI;IAAC;IAAM;IAAQ;IAAM;CAAS;AACvE,MAAMG,gBAAgB,IAAIH,IAAI;IAAC;IAAQ;IAAQ;CAAM;AACrD,MAAMI,wBAAwB,IAAIJ,IAAI;IACpC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,MAAMK,eAAe,CAACC;IACpB,MAAMC,YAAYD,KAAKE,WAAW,CAAC;IACnC,OAAO,AAACD,CAAAA,cAAc,CAAC,IAAID,OAAOA,KAAKG,KAAK,CAACF,YAAY,EAAC,EAAGG,WAAW;AAC1E;AAEA,MAAMC,YAAY,CAACL;IACjB,MAAMC,YAAYD,KAAKM,OAAO,CAAC;IAC/B,OAAOL,cAAc,CAAC,IAAI,KAAKD,KAAKG,KAAK,CAAC,GAAGF;AAC/C;AAEA,MAAMM,gBAAgB,CAACC;IACrB,IAAIC,kBAAkB;IAEtB,KAAK,MAAMC,aAAaF,MAAO;QAC7B,MAAMG,YAAYD,UAAUE,WAAW,CAAC;QACxC,IAAID,aAAaA,YAAY,QAAQA,cAAc,MAAM;YACvDF,mBAAmBC;QACrB;IACF;IAEAD,kBAAkBA,gBAAgBL,WAAW;IAE7C,OACEK,gBAAgBI,QAAQ,CAAC,kBACzBJ,gBAAgBI,QAAQ,CAAC,qBACzBJ,gBAAgBI,QAAQ,CAAC;AAE7B;AAEA,MAAMC,iBAAiB,CAACN,QACtBA,MACGO,OAAO,CAAC,qBAAqB,IAC7BA,OAAO,CAAC,sBAAsB,IAC9BA,OAAO,CAAC,+BAA+B,CAACC,QAAQC,aAAaC;QAC5D,IAAID,aAAa;YACf,MAAMN,YAAYQ,OAAOC,QAAQ,CAACH,aAAa;YAC/C,OAAON,YAAY,KAAKA,aAAa,WAAWU,OAAOC,aAAa,CAACX,aAAa;QACpF;QAEA,OAAOO,oBAAoB;IAC7B;AAEJ,MAAMK,mBAAmB,CAACf;IACxB,MAAMgB,eAAeV,eAAeN;IAEpC,OAAOgB,aAAapB,WAAW,GAAGS,QAAQ,CAAC,cAAcN,cAAciB;AACzE;AAQA,MAAMC,gBAAgB,CAACC;IACrB,IACE,AAACA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QACpCA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,MACjF;QACA,OAAO,IAAInC,YAAY;IACzB;IAEA,IACE,AAACmC,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QACpCA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,QAAQA,MAAM,CAAC,EAAE,KAAK,MACjF;QACA,OAAO,IAAInC,YAAY;IACzB;IAEA,OAAO,IAAIA,YAAY;AACzB;AAEA,MAAMoC,qBAAqB;IACzB,gGAAgG;IAChG,uFAAuF;IACvF,MAAMC,sBAAsBtC;IAC5B,MAAMuC,kBAAkBD,oBAAoBE,iBAAiB;IAC7D,IAAIC;IACJ,IAAI;QACFH,oBAAoBE,iBAAiB,GAAGX,OAAOa,iBAAiB;QAChED,SAASzC,IAAIyC,MAAM,CAAC,MAAM;YACxBE,UAAU;YACVC,gBAAgB;YAChBC,OAAO;QACT;IACF,SAAU;QACRP,oBAAoBE,iBAAiB,GAAGD;IAC1C;IAEA,IAAIO,aAAqD,EAAE;IAC3D,MAAMC,eAAyB,EAAE;IACjC,IAAIC,SAAS;IACb,IAAIC,QAAQ;IACZ,IAAIC,UAAU;IACd,IAAIC,kBAAkB;IACtB,IAAIC,eAA8B;IAClC,IAAIC,oBAAoB;IAExBZ,OAAOa,OAAO,GAAG,CAACC;QAChB,MAAMA;IACR;IAEAd,OAAOe,uBAAuB,GAAG,CAAC,EAAE9C,IAAI,EAAE;QACxC,IAAIA,KAAKI,WAAW,OAAO,kBAAkB;YAC3CkC,SAAS;QACX;IACF;IAEAP,OAAOgB,SAAS,GAAG,CAACC;QAClB,IAAIA,QAAQnC,QAAQ,CAAC,QAAQ,YAAYoC,IAAI,CAACD,UAAU;YACtDV,SAAS;QACX;IACF;IAEAP,OAAOmB,cAAc,GAAG,CAACC;QACvBf,aAAa,EAAE;QAEf,8FAA8F;QAC9F,6FAA6F;QAC7F,MAAMgB,gBAAgBC,OAAOC,MAAM,CAAC;QACpCH,IAAIf,UAAU,GAAG,IAAImB,MAAMH,eAAe;YACxCI,KAAK,CAACC,QAAQC,UAAUC;gBACtB,IAAID,aAAa,kBAAkB;oBACjC,OAAO,CAAC1D,OAAiBqD,OAAOO,SAAS,CAACC,cAAc,CAACC,IAAI,CAACL,QAAQzD;gBACxE;gBAEA,OAAO+D,QAAQP,GAAG,CAACC,QAAQC,UAAUC;YACvC;QACF;IACF;IAEA5B,OAAOiC,WAAW,GAAG,CAACC;QACpB7B,WAAW8B,IAAI,CAACD;IAClB;IAEAlC,OAAOoC,SAAS,GAAG,CAAChB;QAClB,MAAMiB,YAAYrE,aAAaoD,IAAInD,IAAI;QACvCqC,aAAa6B,IAAI,CAACE;QAElB,IAAI,CAAC3B,iBAAiB;YACpBA,kBAAkB;YAClB,MAAM4B,SAAShE,UAAU8C,IAAInD,IAAI;YACjC,MAAMsE,qBAAqBD,SAAS,CAAC,MAAM,EAAEA,QAAQ,GAAG;YACxD,MAAME,YAAYnC,WAAWoC,IAAI,CAAC,CAAC,EAAExE,IAAI,EAAE,GAAKA,SAASsE,qBAAqB9D;YAC9E+B,QAAQ6B,cAAc,SAASG,cAAc/E;YAC7C,IAAI,CAAC+C,OAAO;gBACVD,SAAS;YACX;QACF;QAEA,IAAI7C,gBAAgBgF,GAAG,CAACL,YAAY;YAClC9B,SAAS;QACX;QAEA,IAAI8B,cAAc,SAAS;YACzBzB,qBAAqB;YACrB,IAAIA,sBAAsB,GAAG;gBAC3BD,eAAe;YACjB;QACF;QAEA,IAAI/C,kBAAkB8E,GAAG,CAACL,YAAY;YACpC,MAAMM,kBAAkBtC,WACrBoC,IAAI,CAAC,CAAC,EAAExE,IAAI,EAAE,GAAKD,aAAaC,MAAMI,WAAW,OAAO,kBACvDI,MAAMmE;YACV,MAAMC,aAAaF,kBAAkB3E,aAAa2E,mBAAmB;YACrE,MAAMG,SAASzC,WACZ0C,MAAM,CAAC,CAAC,EAAE9E,IAAI,EAAE,GAAKJ,yBAAyB6E,GAAG,CAAC1E,aAAaC,QAC/D+E,GAAG,CAAC,CAAC,EAAEvE,KAAK,EAAE,GAAKA,OACnBwE,IAAI,CAAC;YAER,IACE,WAAW/B,IAAI,CAAC2B,eACf/E,cAAc4E,GAAG,CAACG,eAAerE,cAAcsE,WAC/CD,eAAe,WAAWrD,iBAAiBsD,WAC3C/E,sBAAsB2E,GAAG,CAACG,eAAerD,iBAAiBsD,SAC3D;gBACAvC,SAAS;YACX;QACF;QAEA,KAAK,MAAM2B,aAAa7B,WAAY;YAClC,MAAM6C,gBAAgBlF,aAAakE,UAAUjE,IAAI;YAEjD,IAAI,WAAWiD,IAAI,CAACgC,gBAAgB;gBAClC3C,SAAS;YACX;YAEA,IAAI2C,kBAAkB,WAAW1D,iBAAiB0C,UAAUzD,KAAK,GAAG;gBAClE8B,SAAS;YACX;YAEA,IAAIzC,cAAc4E,GAAG,CAACQ,kBAAkB1E,cAAc0D,UAAUzD,KAAK,GAAG;gBACtE8B,SAAS;YACX;YAEA,IACExC,sBAAsB2E,GAAG,CAACQ,kBAC1B,YAAYhC,IAAI,CAACgB,UAAUzD,KAAK,KAChCe,iBAAiB0C,UAAUzD,KAAK,GAChC;gBACA8B,SAAS;YACX;QACF;IACF;IAEAP,OAAOmD,UAAU,GAAG;QAClB,IAAI7C,aAAa8C,GAAG,OAAO,SAAS;YAClC,IAAIxC,sBAAsB,KAAKD,gBAAgBnB,iBAAiBmB,eAAe;gBAC7EJ,SAAS;YACX;YACAK,qBAAqB;YACrB,IAAIA,sBAAsB,GAAG;gBAC3BD,eAAe;YACjB;QACF;IACF;IAEA,MAAM0C,sBAAsB,CAAC5E;QAC3B,IAAImC,oBAAoB,KAAKD,iBAAiB,MAAM;YAClDA,gBAAgBlC;QAClB;IACF;IAEAuB,OAAOsD,MAAM,GAAGD;IAChBrD,OAAOuD,OAAO,GAAGF;IAEjB,OAAO;QACLG,OAAO;YACLxD,OAAOwD,KAAK;YACZ,IAAI,CAAC9C,iBAAiB;gBACpB,MAAM,IAAI+C,MAAM;YAClB;QACF;QACAC,WAAW,IAAsB,CAAA;gBAC/BnD,QAAQG,mBAAmBH,UAAUE;gBACrCD;gBACAC;YACF,CAAA;QACAkD,eAAe,IAAejD,mBAAmB,CAACF;QAClDoD,aAAa;YACXnD,UAAU;QACZ;QACAoD,OAAO,CAACpF,QAAkBuB,OAAO6D,KAAK,CAACpF;IACzC;AACF;AAEA,OAAO,SAASqF,WAAWnE,MAAc;IACvC,MAAMoE,YAAYnE;IAClB,MAAMoE,UAAUtE,cAAcC;IAC9B,IAAI;QACF,IAAK,IAAIsE,SAAS,GAAGA,SAAStE,OAAOuE,MAAM,EAAED,UAAU,KAAK,KAAM;YAChEF,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAACxE,OAAOyE,QAAQ,CAACH,QAAQA,SAAS,KAAK,OAAO;gBAAEI,QAAQ;YAAK;YAC3F,IAAIN,UAAUJ,aAAa,IAAI;gBAC7B,OAAOI,UAAUL,SAAS;YAC5B;QACF;QACAK,UAAUF,KAAK,CAACG,QAAQG,MAAM;QAC9BJ,UAAUP,KAAK;QACf,OAAOO,UAAUL,SAAS;IAC5B,EAAE,OAAOY,QAAQ;QACfP,UAAUH,WAAW;QACrB,OAAO;YAAE,GAAGG,UAAUL,SAAS,EAAE;YAAEnD,QAAQ;QAAM;IACnD;AACF;AAEA,OAAO,eAAegE,eACpBC,QAAgB,EAChBC,OAAoC;IAEpC,MAAMV,YAAYnE;IAClB,IAAIoE,UAA8B;IAClC,IAAI1B,SAASoC,OAAOC,KAAK,CAAC;IAE1B,IAAI;QACF,WAAW,MAAMC,SAAStH,iBAAiBkH,UAAUC,SAAU;YAC7D,IAAII,UAAkBD;YACtB,IAAI,CAACZ,SAAS;gBACZ1B,SAASoC,OAAOI,MAAM,CAAC;oBAACxC;oBAAQuC;iBAAQ;gBACxC,IAAIvC,OAAO4B,MAAM,GAAG,GAAG;oBACrB;gBACF;gBACAF,UAAUtE,cAAc4C;gBACxBuC,UAAUvC;YACZ;YAEAyB,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAACU,SAAS;gBAAER,QAAQ;YAAK;YACvD,IAAIN,UAAUJ,aAAa,IAAI;gBAC7B,OAAOI,UAAUL,SAAS;YAC5B;QACF;QACAM,YAAYtE,cAAc4C;QAC1B,IAAIA,OAAO4B,MAAM,GAAG,KAAK5B,OAAO4B,MAAM,GAAG,GAAG;YAC1CH,UAAUF,KAAK,CAACG,QAAQG,MAAM,CAAC7B,QAAQ;gBAAE+B,QAAQ;YAAK;QACxD;QACAN,UAAUF,KAAK,CAACG,QAAQG,MAAM;QAC9BJ,UAAUP,KAAK;QACf,OAAOO,UAAUL,SAAS;IAC5B,EAAE,OAAOY,QAAQ;QACfP,UAAUH,WAAW;QACrB,OAAO;YAAE,GAAGG,UAAUL,SAAS,EAAE;YAAEnD,QAAQ;QAAM;IACnD;AACF;AAEA,oFAAoF,GACpF,OAAO,SAASwE,YAAYpF,MAAc;IACxC,OAAOmE,WAAWnE,QAAQY,MAAM;AAClC"}

package/dist/uploads/validateUploadFilename.d.ts

@@ -0,0 +1,3 @@
+import type { Validate } from '../fields/config/types.js';
+export declare const validateUploadFilename: Validate;
+//# sourceMappingURL=validateUploadFilename.d.ts.map

package/dist/uploads/validateUploadFilename.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateUploadFilename.d.ts","sourceRoot":"","sources":["../../src/uploads/validateUploadFilename.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAA;AAEzD,eAAO,MAAM,sBAAsB,EAAE,QAgBpC,CAAA"}

package/dist/uploads/validateUploadFilename.js

@@ -0,0 +1,13 @@
+import path from 'path';
+export const validateUploadFilename = (value)=>{
+    if (!value) {
+        return true;
+    }
+    const normalizedFilename = value.replaceAll('\\', '/');
+    if (path.posix.isAbsolute(normalizedFilename) || path.win32.isAbsolute(value) || normalizedFilename.split('/').includes('..')) {
+        return 'Invalid filename';
+    }
+    return true;
+};
+
+//# sourceMappingURL=validateUploadFilename.js.map

package/dist/uploads/validateUploadFilename.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateUploadFilename.ts"],"sourcesContent":["import path from 'path'\n\nimport type { Validate } from '../fields/config/types.js'\n\nexport const validateUploadFilename: Validate = (value: null | string | undefined) => {\n  if (!value) {\n    return true\n  }\n\n  const normalizedFilename = value.replaceAll('\\\\', '/')\n\n  if (\n    path.posix.isAbsolute(normalizedFilename) ||\n    path.win32.isAbsolute(value) ||\n    normalizedFilename.split('/').includes('..')\n  ) {\n    return 'Invalid filename'\n  }\n\n  return true\n}\n"],"names":["path","validateUploadFilename","value","normalizedFilename","replaceAll","posix","isAbsolute","win32","split","includes"],"mappings":"AAAA,OAAOA,UAAU,OAAM;AAIvB,OAAO,MAAMC,yBAAmC,CAACC;IAC/C,IAAI,CAACA,OAAO;QACV,OAAO;IACT;IAEA,MAAMC,qBAAqBD,MAAME,UAAU,CAAC,MAAM;IAElD,IACEJ,KAAKK,KAAK,CAACC,UAAU,CAACH,uBACtBH,KAAKO,KAAK,CAACD,UAAU,CAACJ,UACtBC,mBAAmBK,KAAK,CAAC,KAAKC,QAAQ,CAAC,OACvC;QACA,OAAO;IACT;IAEA,OAAO;AACT,EAAC"}

package/dist/uploads/validateUploadURL.d.ts

@@ -0,0 +1,13 @@
+import type { UploadConfig } from './types.js';
+/**
+ * Validates the initial URL and collection policy before downloading a new URL upload.
+ * MCP and the Admin proxy require an explicit allow-list. The local CLI may omit one,
+ * but still respects `pasteURL: false` and any configured allow-list.
+ * For example, an allowed `https://cdn.example.com/image.png` returns a parsed URL.
+ */
+export declare const validateUploadURL: ({ requireAllowList, uploadConfig, url, }: {
+    requireAllowList?: boolean;
+    uploadConfig?: UploadConfig;
+    url: string;
+}) => URL;
+//# sourceMappingURL=validateUploadURL.d.ts.map

package/dist/uploads/validateUploadURL.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateUploadURL.d.ts","sourceRoot":"","sources":["../../src/uploads/validateUploadURL.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAK9C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,6CAI3B;IACD,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,YAAY,CAAC,EAAE,YAAY,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;CACZ,KAAG,GAgCH,CAAA"}

package/dist/uploads/validateUploadURL.js

@@ -0,0 +1,37 @@
+import { APIError } from '../errors/APIError.js';
+import { isURLAllowed } from '../utilities/isURLAllowed.js';
+/**
+ * Validates the initial URL and collection policy before downloading a new URL upload.
+ * MCP and the Admin proxy require an explicit allow-list. The local CLI may omit one,
+ * but still respects `pasteURL: false` and any configured allow-list.
+ * For example, an allowed `https://cdn.example.com/image.png` returns a parsed URL.
+ */ export const validateUploadURL = ({ requireAllowList = true, uploadConfig, url })=>{
+    if (!uploadConfig) {
+        throw new APIError('This collection does not support file uploads.', 400);
+    }
+    if (uploadConfig.pasteURL === false) {
+        throw new APIError('Uploading files from URLs is disabled for this collection.', 400);
+    }
+    const allowList = uploadConfig.pasteURL?.allowList;
+    if (requireAllowList && !Array.isArray(allowList)) {
+        throw new APIError('Server-side URL uploads require upload.pasteURL.allowList.', 400);
+    }
+    let parsedURL;
+    try {
+        parsedURL = new URL(url);
+    } catch  {
+        throw new APIError('A valid URL string is required.', 400);
+    }
+    if (![
+        'http:',
+        'https:'
+    ].includes(parsedURL.protocol)) {
+        throw new APIError('File URLs must use http or https.', 400);
+    }
+    if (allowList && !isURLAllowed(parsedURL.href, allowList)) {
+        throw new APIError('The provided file URL is not allowed.', 400);
+    }
+    return parsedURL;
+};
+
+//# sourceMappingURL=validateUploadURL.js.map

package/dist/uploads/validateUploadURL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/uploads/validateUploadURL.ts"],"sourcesContent":["import type { UploadConfig } from './types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { isURLAllowed } from '../utilities/isURLAllowed.js'\n\n/**\n * Validates the initial URL and collection policy before downloading a new URL upload.\n * MCP and the Admin proxy require an explicit allow-list. The local CLI may omit one,\n * but still respects `pasteURL: false` and any configured allow-list.\n * For example, an allowed `https://cdn.example.com/image.png` returns a parsed URL.\n */\nexport const validateUploadURL = ({\n  requireAllowList = true,\n  uploadConfig,\n  url,\n}: {\n  requireAllowList?: boolean\n  uploadConfig?: UploadConfig\n  url: string\n}): URL => {\n  if (!uploadConfig) {\n    throw new APIError('This collection does not support file uploads.', 400)\n  }\n\n  if (uploadConfig.pasteURL === false) {\n    throw new APIError('Uploading files from URLs is disabled for this collection.', 400)\n  }\n\n  const allowList = uploadConfig.pasteURL?.allowList\n\n  if (requireAllowList && !Array.isArray(allowList)) {\n    throw new APIError('Server-side URL uploads require upload.pasteURL.allowList.', 400)\n  }\n\n  let parsedURL: URL\n\n  try {\n    parsedURL = new URL(url)\n  } catch {\n    throw new APIError('A valid URL string is required.', 400)\n  }\n\n  if (!['http:', 'https:'].includes(parsedURL.protocol)) {\n    throw new APIError('File URLs must use http or https.', 400)\n  }\n\n  if (allowList && !isURLAllowed(parsedURL.href, allowList)) {\n    throw new APIError('The provided file URL is not allowed.', 400)\n  }\n\n  return parsedURL\n}\n"],"names":["APIError","isURLAllowed","validateUploadURL","requireAllowList","uploadConfig","url","pasteURL","allowList","Array","isArray","parsedURL","URL","includes","protocol","href"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,YAAY,QAAQ,+BAA8B;AAE3D;;;;;CAKC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,mBAAmB,IAAI,EACvBC,YAAY,EACZC,GAAG,EAKJ;IACC,IAAI,CAACD,cAAc;QACjB,MAAM,IAAIJ,SAAS,kDAAkD;IACvE;IAEA,IAAII,aAAaE,QAAQ,KAAK,OAAO;QACnC,MAAM,IAAIN,SAAS,8DAA8D;IACnF;IAEA,MAAMO,YAAYH,aAAaE,QAAQ,EAAEC;IAEzC,IAAIJ,oBAAoB,CAACK,MAAMC,OAAO,CAACF,YAAY;QACjD,MAAM,IAAIP,SAAS,8DAA8D;IACnF;IAEA,IAAIU;IAEJ,IAAI;QACFA,YAAY,IAAIC,IAAIN;IACtB,EAAE,OAAM;QACN,MAAM,IAAIL,SAAS,mCAAmC;IACxD;IAEA,IAAI,CAAC;QAAC;QAAS;KAAS,CAACY,QAAQ,CAACF,UAAUG,QAAQ,GAAG;QACrD,MAAM,IAAIb,SAAS,qCAAqC;IAC1D;IAEA,IAAIO,aAAa,CAACN,aAAaS,UAAUI,IAAI,EAAEP,YAAY;QACzD,MAAM,IAAIP,SAAS,yCAAyC;IAC9D;IAEA,OAAOU;AACT,EAAC"}

package/dist/utilities/addDataAndFileToRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"addDataAndFileToRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/addDataAndFileToRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAKvD,KAAK,uBAAuB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBA8GrC,CAAA"}
+{"version":3,"file":"addDataAndFileToRequest.d.ts","sourceRoot":"","sources":["../../src/utilities/addDataAndFileToRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAOvD,KAAK,uBAAuB,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,uBAAuB,EAAE,uBA4ErC,CAAA"}

package/dist/utilities/addDataAndFileToRequest.js

@@ -1,5 +1,6 @@
 import { APIError } from '../errors/APIError.js';
 import { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js';
+import { getFileFromUploadInstructions } from '../uploads/getFileFromUploadInstructions.js';
 /**
  * Mutates the Request, appending 'data' and 'file' if found
  */ export const addDataAndFileToRequest = async (req)=>{
@@ -50,57 +51,24 @@ import { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js
                 req.data = JSON.parse(fields._payload);
             }
             if (!req.file && fields?.file && typeof fields?.file === 'string') {
-                let directUpload, filename, mimeType, size;
-                const collectionSlug = req.routeParams?.collection;
+                let uploadedFile;
                 try {
-                    ;
-                    ({ directUpload, filename, mimeType, size } = JSON.parse(fields.file));
+                    uploadedFile = JSON.parse(fields.file);
                 } catch  {
                     throw new APIError('A file name is required.', 400);
                 }
-                const uploadConfig = req.payload.collections[collectionSlug].config.upload;
-                if (!uploadConfig.handlers) {
-                    throw new APIError('uploadConfig.handlers is not present for ' + collectionSlug);
+                // The collection must come from the route, never from the request body: the body
+                // is client-controlled and would select another collection's upload handlers.
+                const collectionSlug = typeof req.routeParams?.collection === 'string' ? req.routeParams.collection : undefined;
+                const uploadConfig = collectionSlug ? req.payload.collections[collectionSlug]?.config.upload : undefined;
+                if (!collectionSlug || !uploadConfig) {
+                    throw new APIError('Invalid upload collection.', 400);
                 }
-                let response = null;
-                let error;
-                for (const handler of uploadConfig.handlers){
-                    try {
-                        const result = await handler(req, {
-                            doc: null,
-                            params: {
-                                collection: collectionSlug,
-                                directUpload,
-                                filename
-                            }
-                        });
-                        if (result) {
-                            response = result;
-                        }
-                    // If we couldn't get the file from that handler, save the error and try other.
-                    } catch (err) {
-                        error = err;
-                    }
-                }
-                if (!response) {
-                    if (error) {
-                        payload.logger.error(error);
-                    }
-                    throw new APIError('Expected response from the upload handler.');
-                }
-                if (response.status >= 300 && response.status < 400) {
-                    const redirectUrl = response.headers.get('Location');
-                    if (redirectUrl) {
-                        response = await fetch(redirectUrl);
-                    }
-                }
-                req.file = {
-                    name: filename,
-                    data: Buffer.from(await response.arrayBuffer()),
-                    directUpload,
-                    mimetype: response.headers.get('Content-Type') || mimeType,
-                    size
-                };
+                req.file = await getFileFromUploadInstructions({
+                    collectionSlug,
+                    file: uploadedFile,
+                    req
+                });
             }
         }
     }

package/dist/utilities/addDataAndFileToRequest.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js'\n\ntype AddDataAndFileToRequest = (req: PayloadRequest) => Promise<void>\n\n/**\n * Mutates the Request, appending 'data' and 'file' if found\n */\nexport const addDataAndFileToRequest: AddDataAndFileToRequest = async (req) => {\n  const { body, headers, method, payload } = req\n\n  if (method && ['PATCH', 'POST', 'PUT'].includes(method.toUpperCase()) && body) {\n    const [contentType] = (headers.get('Content-Type') || '').split(';', 1)\n    const bodyByteSize = parseInt(req.headers.get('Content-Length') || '0', 10)\n    const hasBodyStream = req.body !== null\n\n    if (contentType === 'application/json') {\n      try {\n        const text = await req.text?.()\n        const data = text ? JSON.parse(text) : {}\n        req.data = data\n        // @ts-expect-error attach json method to request\n        req.json = () => Promise.resolve(data)\n      } catch (error) {\n        if (error instanceof SyntaxError) {\n          throw new APIError('Invalid JSON', 400)\n        }\n        req.payload.logger.error(error)\n        throw error\n      }\n    } else if ((bodyByteSize || hasBodyStream) && contentType?.includes('multipart/')) {\n      const { error, fields, files } = await processMultipartFormdata({\n        options: {\n          ...(payload.config.bodyParser || {}),\n          ...(payload.config.upload || {}),\n        },\n        request: req as Request,\n      })\n\n      if (error) {\n        throw new APIError(error.message)\n      }\n\n      // Set all files on req.files for access by hooks\n      if (files) {\n        req.files = files\n        // Backwards compatibility: set req.file for standard upload collections\n        // Guard: if multiple files share the field name \"file\", files.file is an array — skip\n        if (files.file && !Array.isArray(files.file)) {\n          req.file = files.file\n        }\n      }\n\n      if (fields?._payload && typeof fields._payload === 'string') {\n        req.data = JSON.parse(fields._payload)\n      }\n\n      if (!req.file && fields?.file && typeof fields?.file === 'string') {\n        let directUpload, filename, mimeType, size\n        const collectionSlug = req.routeParams?.collection as string\n        try {\n          ;({ directUpload, filename, mimeType, size } = JSON.parse(fields.file))\n        } catch {\n          throw new APIError('A file name is required.', 400)\n        }\n        const uploadConfig = req.payload.collections[collectionSlug]!.config.upload\n\n        if (!uploadConfig.handlers) {\n          throw new APIError('uploadConfig.handlers is not present for ' + collectionSlug)\n        }\n\n        let response: null | Response = null\n        let error: unknown\n\n        for (const handler of uploadConfig.handlers) {\n          try {\n            const result = await handler(req, {\n              doc: null!,\n              params: {\n                collection: collectionSlug,\n                directUpload,\n                filename,\n              },\n            })\n            if (result) {\n              response = result\n            }\n            // If we couldn't get the file from that handler, save the error and try other.\n          } catch (err) {\n            error = err\n          }\n        }\n\n        if (!response) {\n          if (error) {\n            payload.logger.error(error)\n          }\n\n          throw new APIError('Expected response from the upload handler.')\n        }\n\n        if (response.status >= 300 && response.status < 400) {\n          const redirectUrl = response.headers.get('Location')\n          if (redirectUrl) {\n            response = await fetch(redirectUrl)\n          }\n        }\n\n        req.file = {\n          name: filename,\n          data: Buffer.from(await response.arrayBuffer()),\n          directUpload,\n          mimetype: response.headers.get('Content-Type') || mimeType,\n          size,\n        }\n      }\n    }\n  }\n}\n"],"names":["APIError","processMultipartFormdata","addDataAndFileToRequest","req","body","headers","method","payload","includes","toUpperCase","contentType","get","split","bodyByteSize","parseInt","hasBodyStream","text","data","JSON","parse","json","Promise","resolve","error","SyntaxError","logger","fields","files","options","config","bodyParser","upload","request","message","file","Array","isArray","_payload","directUpload","filename","mimeType","size","collectionSlug","routeParams","collection","uploadConfig","collections","handlers","response","handler","result","doc","params","err","status","redirectUrl","fetch","name","Buffer","from","arrayBuffer","mimetype"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,wBAAwB,QAAQ,yCAAwC;AAIjF;;CAEC,GACD,OAAO,MAAMC,0BAAmD,OAAOC;IACrE,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGJ;IAE3C,IAAIG,UAAU;QAAC;QAAS;QAAQ;KAAM,CAACE,QAAQ,CAACF,OAAOG,WAAW,OAAOL,MAAM;QAC7E,MAAM,CAACM,YAAY,GAAG,AAACL,CAAAA,QAAQM,GAAG,CAAC,mBAAmB,EAAC,EAAGC,KAAK,CAAC,KAAK;QACrE,MAAMC,eAAeC,SAASX,IAAIE,OAAO,CAACM,GAAG,CAAC,qBAAqB,KAAK;QACxE,MAAMI,gBAAgBZ,IAAIC,IAAI,KAAK;QAEnC,IAAIM,gBAAgB,oBAAoB;YACtC,IAAI;gBACF,MAAMM,OAAO,MAAMb,IAAIa,IAAI;gBAC3B,MAAMC,OAAOD,OAAOE,KAAKC,KAAK,CAACH,QAAQ,CAAC;gBACxCb,IAAIc,IAAI,GAAGA;gBACX,iDAAiD;gBACjDd,IAAIiB,IAAI,GAAG,IAAMC,QAAQC,OAAO,CAACL;YACnC,EAAE,OAAOM,OAAO;gBACd,IAAIA,iBAAiBC,aAAa;oBAChC,MAAM,IAAIxB,SAAS,gBAAgB;gBACrC;gBACAG,IAAII,OAAO,CAACkB,MAAM,CAACF,KAAK,CAACA;gBACzB,MAAMA;YACR;QACF,OAAO,IAAI,AAACV,CAAAA,gBAAgBE,aAAY,KAAML,aAAaF,SAAS,eAAe;YACjF,MAAM,EAAEe,KAAK,EAAEG,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAM1B,yBAAyB;gBAC9D2B,SAAS;oBACP,GAAIrB,QAAQsB,MAAM,CAACC,UAAU,IAAI,CAAC,CAAC;oBACnC,GAAIvB,QAAQsB,MAAM,CAACE,MAAM,IAAI,CAAC,CAAC;gBACjC;gBACAC,SAAS7B;YACX;YAEA,IAAIoB,OAAO;gBACT,MAAM,IAAIvB,SAASuB,MAAMU,OAAO;YAClC;YAEA,iDAAiD;YACjD,IAAIN,OAAO;gBACTxB,IAAIwB,KAAK,GAAGA;gBACZ,wEAAwE;gBACxE,sFAAsF;gBACtF,IAAIA,MAAMO,IAAI,IAAI,CAACC,MAAMC,OAAO,CAACT,MAAMO,IAAI,GAAG;oBAC5C/B,IAAI+B,IAAI,GAAGP,MAAMO,IAAI;gBACvB;YACF;YAEA,IAAIR,QAAQW,YAAY,OAAOX,OAAOW,QAAQ,KAAK,UAAU;gBAC3DlC,IAAIc,IAAI,GAAGC,KAAKC,KAAK,CAACO,OAAOW,QAAQ;YACvC;YAEA,IAAI,CAAClC,IAAI+B,IAAI,IAAIR,QAAQQ,QAAQ,OAAOR,QAAQQ,SAAS,UAAU;gBACjE,IAAII,cAAcC,UAAUC,UAAUC;gBACtC,MAAMC,iBAAiBvC,IAAIwC,WAAW,EAAEC;gBACxC,IAAI;;oBACA,CAAA,EAAEN,YAAY,EAAEC,QAAQ,EAAEC,QAAQ,EAAEC,IAAI,EAAE,GAAGvB,KAAKC,KAAK,CAACO,OAAOQ,IAAI,CAAA;gBACvE,EAAE,OAAM;oBACN,MAAM,IAAIlC,SAAS,4BAA4B;gBACjD;gBACA,MAAM6C,eAAe1C,IAAII,OAAO,CAACuC,WAAW,CAACJ,eAAe,CAAEb,MAAM,CAACE,MAAM;gBAE3E,IAAI,CAACc,aAAaE,QAAQ,EAAE;oBAC1B,MAAM,IAAI/C,SAAS,8CAA8C0C;gBACnE;gBAEA,IAAIM,WAA4B;gBAChC,IAAIzB;gBAEJ,KAAK,MAAM0B,WAAWJ,aAAaE,QAAQ,CAAE;oBAC3C,IAAI;wBACF,MAAMG,SAAS,MAAMD,QAAQ9C,KAAK;4BAChCgD,KAAK;4BACLC,QAAQ;gCACNR,YAAYF;gCACZJ;gCACAC;4BACF;wBACF;wBACA,IAAIW,QAAQ;4BACVF,WAAWE;wBACb;oBACA,+EAA+E;oBACjF,EAAE,OAAOG,KAAK;wBACZ9B,QAAQ8B;oBACV;gBACF;gBAEA,IAAI,CAACL,UAAU;oBACb,IAAIzB,OAAO;wBACThB,QAAQkB,MAAM,CAACF,KAAK,CAACA;oBACvB;oBAEA,MAAM,IAAIvB,SAAS;gBACrB;gBAEA,IAAIgD,SAASM,MAAM,IAAI,OAAON,SAASM,MAAM,GAAG,KAAK;oBACnD,MAAMC,cAAcP,SAAS3C,OAAO,CAACM,GAAG,CAAC;oBACzC,IAAI4C,aAAa;wBACfP,WAAW,MAAMQ,MAAMD;oBACzB;gBACF;gBAEApD,IAAI+B,IAAI,GAAG;oBACTuB,MAAMlB;oBACNtB,MAAMyC,OAAOC,IAAI,CAAC,MAAMX,SAASY,WAAW;oBAC5CtB;oBACAuB,UAAUb,SAAS3C,OAAO,CAACM,GAAG,CAAC,mBAAmB6B;oBAClDC;gBACF;YACF;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/addDataAndFileToRequest.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\nimport type { UploadInstructions } from '../uploads/types.js'\n\nimport { APIError } from '../errors/APIError.js'\nimport { processMultipartFormdata } from '../uploads/fetchAPI-multipart/index.js'\nimport { getFileFromUploadInstructions } from '../uploads/getFileFromUploadInstructions.js'\n\ntype AddDataAndFileToRequest = (req: PayloadRequest) => Promise<void>\n\n/**\n * Mutates the Request, appending 'data' and 'file' if found\n */\nexport const addDataAndFileToRequest: AddDataAndFileToRequest = async (req) => {\n  const { body, headers, method, payload } = req\n\n  if (method && ['PATCH', 'POST', 'PUT'].includes(method.toUpperCase()) && body) {\n    const [contentType] = (headers.get('Content-Type') || '').split(';', 1)\n    const bodyByteSize = parseInt(req.headers.get('Content-Length') || '0', 10)\n    const hasBodyStream = req.body !== null\n\n    if (contentType === 'application/json') {\n      try {\n        const text = await req.text?.()\n        const data = text ? JSON.parse(text) : {}\n        req.data = data\n        // @ts-expect-error attach json method to request\n        req.json = () => Promise.resolve(data)\n      } catch (error) {\n        if (error instanceof SyntaxError) {\n          throw new APIError('Invalid JSON', 400)\n        }\n        req.payload.logger.error(error)\n        throw error\n      }\n    } else if ((bodyByteSize || hasBodyStream) && contentType?.includes('multipart/')) {\n      const { error, fields, files } = await processMultipartFormdata({\n        options: {\n          ...(payload.config.bodyParser || {}),\n          ...(payload.config.upload || {}),\n        },\n        request: req as Request,\n      })\n\n      if (error) {\n        throw new APIError(error.message)\n      }\n\n      // Set all files on req.files for access by hooks\n      if (files) {\n        req.files = files\n        // Backwards compatibility: set req.file for standard upload collections\n        // Guard: if multiple files share the field name \"file\", files.file is an array — skip\n        if (files.file && !Array.isArray(files.file)) {\n          req.file = files.file\n        }\n      }\n\n      if (fields?._payload && typeof fields._payload === 'string') {\n        req.data = JSON.parse(fields._payload)\n      }\n\n      if (!req.file && fields?.file && typeof fields?.file === 'string') {\n        let uploadedFile: UploadInstructions['file']\n        try {\n          uploadedFile = JSON.parse(fields.file)\n        } catch {\n          throw new APIError('A file name is required.', 400)\n        }\n        // The collection must come from the route, never from the request body: the body\n        // is client-controlled and would select another collection's upload handlers.\n        const collectionSlug =\n          typeof req.routeParams?.collection === 'string' ? req.routeParams.collection : undefined\n        const uploadConfig = collectionSlug\n          ? req.payload.collections[collectionSlug]?.config.upload\n          : undefined\n\n        if (!collectionSlug || !uploadConfig) {\n          throw new APIError('Invalid upload collection.', 400)\n        }\n\n        req.file = await getFileFromUploadInstructions({\n          collectionSlug,\n          file: uploadedFile,\n          req,\n        })\n      }\n    }\n  }\n}\n"],"names":["APIError","processMultipartFormdata","getFileFromUploadInstructions","addDataAndFileToRequest","req","body","headers","method","payload","includes","toUpperCase","contentType","get","split","bodyByteSize","parseInt","hasBodyStream","text","data","JSON","parse","json","Promise","resolve","error","SyntaxError","logger","fields","files","options","config","bodyParser","upload","request","message","file","Array","isArray","_payload","uploadedFile","collectionSlug","routeParams","collection","undefined","uploadConfig","collections"],"mappings":"AAGA,SAASA,QAAQ,QAAQ,wBAAuB;AAChD,SAASC,wBAAwB,QAAQ,yCAAwC;AACjF,SAASC,6BAA6B,QAAQ,8CAA6C;AAI3F;;CAEC,GACD,OAAO,MAAMC,0BAAmD,OAAOC;IACrE,MAAM,EAAEC,IAAI,EAAEC,OAAO,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGJ;IAE3C,IAAIG,UAAU;QAAC;QAAS;QAAQ;KAAM,CAACE,QAAQ,CAACF,OAAOG,WAAW,OAAOL,MAAM;QAC7E,MAAM,CAACM,YAAY,GAAG,AAACL,CAAAA,QAAQM,GAAG,CAAC,mBAAmB,EAAC,EAAGC,KAAK,CAAC,KAAK;QACrE,MAAMC,eAAeC,SAASX,IAAIE,OAAO,CAACM,GAAG,CAAC,qBAAqB,KAAK;QACxE,MAAMI,gBAAgBZ,IAAIC,IAAI,KAAK;QAEnC,IAAIM,gBAAgB,oBAAoB;YACtC,IAAI;gBACF,MAAMM,OAAO,MAAMb,IAAIa,IAAI;gBAC3B,MAAMC,OAAOD,OAAOE,KAAKC,KAAK,CAACH,QAAQ,CAAC;gBACxCb,IAAIc,IAAI,GAAGA;gBACX,iDAAiD;gBACjDd,IAAIiB,IAAI,GAAG,IAAMC,QAAQC,OAAO,CAACL;YACnC,EAAE,OAAOM,OAAO;gBACd,IAAIA,iBAAiBC,aAAa;oBAChC,MAAM,IAAIzB,SAAS,gBAAgB;gBACrC;gBACAI,IAAII,OAAO,CAACkB,MAAM,CAACF,KAAK,CAACA;gBACzB,MAAMA;YACR;QACF,OAAO,IAAI,AAACV,CAAAA,gBAAgBE,aAAY,KAAML,aAAaF,SAAS,eAAe;YACjF,MAAM,EAAEe,KAAK,EAAEG,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAM3B,yBAAyB;gBAC9D4B,SAAS;oBACP,GAAIrB,QAAQsB,MAAM,CAACC,UAAU,IAAI,CAAC,CAAC;oBACnC,GAAIvB,QAAQsB,MAAM,CAACE,MAAM,IAAI,CAAC,CAAC;gBACjC;gBACAC,SAAS7B;YACX;YAEA,IAAIoB,OAAO;gBACT,MAAM,IAAIxB,SAASwB,MAAMU,OAAO;YAClC;YAEA,iDAAiD;YACjD,IAAIN,OAAO;gBACTxB,IAAIwB,KAAK,GAAGA;gBACZ,wEAAwE;gBACxE,sFAAsF;gBACtF,IAAIA,MAAMO,IAAI,IAAI,CAACC,MAAMC,OAAO,CAACT,MAAMO,IAAI,GAAG;oBAC5C/B,IAAI+B,IAAI,GAAGP,MAAMO,IAAI;gBACvB;YACF;YAEA,IAAIR,QAAQW,YAAY,OAAOX,OAAOW,QAAQ,KAAK,UAAU;gBAC3DlC,IAAIc,IAAI,GAAGC,KAAKC,KAAK,CAACO,OAAOW,QAAQ;YACvC;YAEA,IAAI,CAAClC,IAAI+B,IAAI,IAAIR,QAAQQ,QAAQ,OAAOR,QAAQQ,SAAS,UAAU;gBACjE,IAAII;gBACJ,IAAI;oBACFA,eAAepB,KAAKC,KAAK,CAACO,OAAOQ,IAAI;gBACvC,EAAE,OAAM;oBACN,MAAM,IAAInC,SAAS,4BAA4B;gBACjD;gBACA,iFAAiF;gBACjF,8EAA8E;gBAC9E,MAAMwC,iBACJ,OAAOpC,IAAIqC,WAAW,EAAEC,eAAe,WAAWtC,IAAIqC,WAAW,CAACC,UAAU,GAAGC;gBACjF,MAAMC,eAAeJ,iBACjBpC,IAAII,OAAO,CAACqC,WAAW,CAACL,eAAe,EAAEV,OAAOE,SAChDW;gBAEJ,IAAI,CAACH,kBAAkB,CAACI,cAAc;oBACpC,MAAM,IAAI5C,SAAS,8BAA8B;gBACnD;gBAEAI,IAAI+B,IAAI,GAAG,MAAMjC,8BAA8B;oBAC7CsC;oBACAL,MAAMI;oBACNnC;gBACF;YACF;QACF;IACF;AACF,EAAC"}

package/dist/utilities/appendNonTrashedFilter.d.ts

@@ -1,7 +1,7 @@
 import type { Where } from '../types/index.js';
 export declare const appendNonTrashedFilter: ({ deletedAtPath, enableTrash, trash, where, }: {
     deletedAtPath?: string;
-    enableTrash: boolean;
+    enableTrash?: boolean;
     trash?: boolean;
     where: Where;
 }) => Where;

package/dist/utilities/appendNonTrashedFilter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appendNonTrashedFilter.d.ts","sourceRoot":"","sources":["../../src/utilities/appendNonTrashedFilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C,eAAO,MAAM,sBAAsB,kDAKhC;IACD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,KAAK,CAAA;CACb,KAAG,KAmBH,CAAA"}
+{"version":3,"file":"appendNonTrashedFilter.d.ts","sourceRoot":"","sources":["../../src/utilities/appendNonTrashedFilter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C,eAAO,MAAM,sBAAsB,kDAKhC;IACD,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,KAAK,CAAA;CACb,KAAG,KAmBH,CAAA"}

package/dist/utilities/appendNonTrashedFilter.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/appendNonTrashedFilter.ts"],"sourcesContent":["import type { Where } from '../types/index.js'\n\nexport const appendNonTrashedFilter = ({\n  deletedAtPath = 'deletedAt',\n  enableTrash,\n  trash,\n  where,\n}: {\n  deletedAtPath?: string\n  enableTrash: boolean\n  trash?: boolean\n  where: Where\n}): Where => {\n  if (!enableTrash || trash) {\n    return where\n  }\n\n  const notTrashedFilter = {\n    [deletedAtPath]: { exists: false },\n  }\n\n  if (where?.and) {\n    return {\n      ...where,\n      and: [...where.and, notTrashedFilter],\n    }\n  }\n\n  return {\n    and: [notTrashedFilter, ...(where ? [where] : [])],\n  }\n}\n"],"names":["appendNonTrashedFilter","deletedAtPath","enableTrash","trash","where","notTrashedFilter","exists","and"],"mappings":"AAEA,OAAO,MAAMA,yBAAyB,CAAC,EACrCC,gBAAgB,WAAW,EAC3BC,WAAW,EACXC,KAAK,EACLC,KAAK,EAMN;IACC,IAAI,CAACF,eAAeC,OAAO;QACzB,OAAOC;IACT;IAEA,MAAMC,mBAAmB;QACvB,CAACJ,cAAc,EAAE;YAAEK,QAAQ;QAAM;IACnC;IAEA,IAAIF,OAAOG,KAAK;QACd,OAAO;YACL,GAAGH,KAAK;YACRG,KAAK;mBAAIH,MAAMG,GAAG;gBAAEF;aAAiB;QACvC;IACF;IAEA,OAAO;QACLE,KAAK;YAACF;eAAsBD,QAAQ;gBAACA;aAAM,GAAG,EAAE;SAAE;IACpD;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/appendNonTrashedFilter.ts"],"sourcesContent":["import type { Where } from '../types/index.js'\n\nexport const appendNonTrashedFilter = ({\n  deletedAtPath = 'deletedAt',\n  enableTrash,\n  trash,\n  where,\n}: {\n  deletedAtPath?: string\n  enableTrash?: boolean\n  trash?: boolean\n  where: Where\n}): Where => {\n  if (!enableTrash || trash) {\n    return where\n  }\n\n  const notTrashedFilter = {\n    [deletedAtPath]: { exists: false },\n  }\n\n  if (where?.and) {\n    return {\n      ...where,\n      and: [...where.and, notTrashedFilter],\n    }\n  }\n\n  return {\n    and: [notTrashedFilter, ...(where ? [where] : [])],\n  }\n}\n"],"names":["appendNonTrashedFilter","deletedAtPath","enableTrash","trash","where","notTrashedFilter","exists","and"],"mappings":"AAEA,OAAO,MAAMA,yBAAyB,CAAC,EACrCC,gBAAgB,WAAW,EAC3BC,WAAW,EACXC,KAAK,EACLC,KAAK,EAMN;IACC,IAAI,CAACF,eAAeC,OAAO;QACzB,OAAOC;IACT;IAEA,MAAMC,mBAAmB;QACvB,CAACJ,cAAc,EAAE;YAAEK,QAAQ;QAAM;IACnC;IAEA,IAAIF,OAAOG,KAAK;QACd,OAAO;YACL,GAAGH,KAAK;YACRG,KAAK;mBAAIH,MAAMG,GAAG;gBAAEF;aAAiB;QACvC;IACF;IAEA,OAAO;QACLE,KAAK;YAACF;eAAsBD,QAAQ;gBAACA;aAAM,GAAG,EAAE;SAAE;IACpD;AACF,EAAC"}

package/dist/utilities/appendUploadSelectFields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"appendUploadSelectFields.d.ts","sourceRoot":"","sources":["../../src/utilities/appendUploadSelectFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEhG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kCAGlC;IACD,gBAAgB,EAAE,sBAAsB,GAAG,yBAAyB,CAAA;IACpE,MAAM,EAAE,UAAU,CAAA;CACnB,SAuCA,CAAA"}
+{"version":3,"file":"appendUploadSelectFields.d.ts","sourceRoot":"","sources":["../../src/utilities/appendUploadSelectFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAEhG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,kCAGlC;IACD,gBAAgB,EAAE,sBAAsB,GAAG,yBAAyB,CAAA;IACpE,MAAM,EAAE,UAAU,CAAA;CACnB,SAyCA,CAAA"}