pompelmi 1.15.0 → 1.17.0

package/README.md

@@ -89,12 +89,15 @@ Most integrations require parsing ClamAV's stdout with regex, managing a clamd d
 - Symbol-based verdicts (`Verdict.Clean` / `Verdict.Malicious` / `Verdict.ScanError`) — typo-proof comparisons
 - Full clamd support via the INSTREAM protocol — TCP (`host`/`port`) or UNIX socket (`socket`) with configurable timeout
 - Built-in helpers to install ClamAV and update virus definitions programmatically
-- Works with Express, Fastify, NestJS, Hono, and any other Node.js HTTP framework
-- Works with Node.js and Bun — uses `Bun.file()` for faster file reading when available
+- **Native ESM support** — `import { scan } from 'pompelmi'` works out of the box (dual CJS/ESM build)
+- **Deno support** — `import { scan } from 'npm:pompelmi'` — no install step required
+- **Cloudflare Workers** — via `@pompelmi/cloudflare` — Web APIs only, no Node.js built-ins
+- Works with Express, Fastify, NestJS, Hono, Remix, SvelteKit, and any other Node.js HTTP framework
+- Works with **Node.js • Bun • Deno • Cloudflare Workers**
 - Interactive demo at [pompelmi.app/demo](https://pompelmi.app/demo.html) — try before you install
 - Zero runtime dependencies — ships nothing but source code
 - Tested with EICAR standard antivirus test files
-- CommonJS module; TypeScript type declarations available inline
+- CommonJS + ESM module; TypeScript type declarations available inline
 
 See [how pompelmi compares](./docs/comparison.html) to other Node.js ClamAV integrations.
 
@@ -109,7 +112,10 @@ Official integration packages for popular frameworks:
 | [@pompelmi/nestjs](./packages/nestjs/) | NestJS | `npm i @pompelmi/nestjs` |
 | [@pompelmi/fastify](./packages/fastify/) | Fastify | `npm i @pompelmi/fastify` |
 | [@pompelmi/hono](./packages/hono/) | Hono | `npm i @pompelmi/hono` |
+| [@pompelmi/remix](./packages/remix/) | Remix | `npm i @pompelmi/remix` |
+| [@pompelmi/sveltekit](./packages/sveltekit/) | SvelteKit | `npm i @pompelmi/sveltekit` |
 | [@pompelmi/testing](./packages/testing/) | Jest/Vitest/Node | `npm i -D @pompelmi/testing` |
+| [@pompelmi/cloudflare](./packages/cloudflare/) | Cloudflare Workers | `npm i @pompelmi/cloudflare` |
 
 ### NestJS
 
@@ -155,12 +161,48 @@ app.use('/upload/*', pompelmiMiddleware({
 app.post('/upload', async (c) => c.json({ ok: true }))
 ```
 
+### Remix
+
+```ts
+import { unstable_parseMultipartFormData, json } from '@remix-run/node'
+import { pompelmiUploadHandler } from '@pompelmi/remix'
+
+export async function action({ request }) {
+  // Throws HTTP 422 automatically if malware is detected
+  const formData = await unstable_parseMultipartFormData(
+    request,
+    pompelmiUploadHandler({ host: 'localhost', port: 3310 })
+  )
+  const file = formData.get('file')
+  return json({ name: file.name, size: file.size, ok: true })
+}
+```
+
+### SvelteKit
+
+```ts
+// +page.server.ts
+import { scanUpload } from '@pompelmi/sveltekit'
+import type { Actions } from './$types'
+
+export const actions: Actions = {
+  default: async ({ request }) => {
+    const formData = await request.formData()
+    // Throws HTTP 422 automatically if malware is detected
+    await scanUpload(formData.get('file') as File, { host: 'localhost', port: 3310 })
+    return { success: true }
+  }
+}
+```
+
 ---
 
 ## Requirements
 
 - **Node.js** — any LTS release (no native addons, no C++ bindings)
 - **Bun** — fully supported; uses `Bun.file()` for faster file reading
+- **Deno** — import from `npm:pompelmi` — no install step required
+- **Cloudflare Workers** — via `@pompelmi/cloudflare` — connects to a remote clamd over TCP
 - **ClamAV** — must be installed on the host or reachable over TCP
 
 pompelmi does not bundle or automatically download ClamAV. Install it once per machine (see [Installing ClamAV](#installing-clamav)).
@@ -572,8 +614,8 @@ Please read [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md) before contributing. To r
 
 ## Coming soon
 
-- [ ] Cloudflare Workers support — edge-native scanning via the clamd TCP protocol
-- [ ] NestJS official module — `PompelmiModule.forRoot()` with injectable `PompelmiService`
+- [x] Cloudflare Workers support — `@pompelmi/cloudflare` ships in v1.17.0
+- [x] NestJS official module — `PompelmiModule.forRoot()` with injectable `PompelmiService`
 
 ---
 

package/deno.json

@@ -0,0 +1,5 @@
+{
+  "name": "@pompelmi/pompelmi",
+  "version": "1.17.0",
+  "exports": "./src/index.js"
+}

package/llms.txt

@@ -20,6 +20,18 @@ Options: `{ host?: string, port?: number, timeout?: number }`
 - Local mode: spawns `clamscan`, maps exit codes to verdicts
 - TCP mode: streams to clamd via INSTREAM protocol (set `host`)
 
+## Framework integrations
+
+Official packages for popular frameworks:
+
+- `@pompelmi/nestjs` — NestJS module (`PompelmiModule`, `PompelmiService`, `PompelmiInterceptor`)
+- `@pompelmi/fastify` — Fastify plugin (decorates `fastify.pompelmi` with scan/preHandler)
+- `@pompelmi/hono` — Hono middleware (`pompelmiMiddleware`) for Node.js, Bun, Cloudflare Workers
+- `@pompelmi/remix` — Remix upload handler (`pompelmiUploadHandler` for `unstable_parseMultipartFormData`)
+- `@pompelmi/sveltekit` — SvelteKit helper (`scanUpload`, `scanFormData` for +page.server.ts and +server.ts)
+- `@pompelmi/nextjs` — Next.js App Router / Pages Router helpers
+- `@pompelmi/testing` — test utilities (`mockClean`, `mockInfected`, `withMockedPompelmi`)
+
 ## Installation
 
 npm install pompelmi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pompelmi",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "ClamAV for humans — scan any file and get back Clean, Malicious, or ScanError. No daemons. No cloud. No native bindings.",
   "license": "ISC",
   "author": "pompelmi contributors",
@@ -28,16 +28,26 @@
     "fastify",
     "nestjs",
     "multer",
-    "zero-dependencies"
+    "zero-dependencies",
+    "remix",
+    "sveltekit",
+    "svelte"
   ],
   "type": "commonjs",
   "main": "./src/index.js",
+  "module": "./src/index.mjs",
   "types": "./types/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./src/index.mjs",
+      "require": "./src/index.js"
+    }
+  },
   "bin": {
     "pompelmi": "./bin/pompelmi.js"
   },
   "scripts": {
-    "test": "node --test test/unit.test.js && node --test packages/nestjs/test/index.test.js && node --test packages/fastify/test/index.test.js && node --test packages/nextjs/test/index.test.js && node --test packages/hono/test/index.test.js && node --test packages/testing/test/index.test.js && node test/scan.test.js",
+    "test": "node --test test/unit.test.js && node --test test/esm.test.mjs && node --test packages/nestjs/test/index.test.js && node --test packages/fastify/test/index.test.js && node --test packages/nextjs/test/index.test.js && node --test packages/hono/test/index.test.js && node --test packages/testing/test/index.test.js && node --test packages/remix/test/index.test.js && node --test packages/sveltekit/test/index.test.js && node --test packages/cloudflare/test/index.test.mjs && node test/scan.test.js",
     "lint": "eslint src/"
   },
   "publishConfig": {

package/packages/cloudflare/README.md

@@ -0,0 +1,94 @@
+# @pompelmi/cloudflare
+
+Scan file uploads for malware inside **Cloudflare Workers** using a remote [ClamAV](https://www.clamav.net/) (clamd) instance.
+
+Uses Web APIs only (`fetch`, `connect` from `cloudflare:sockets`) — no Node.js built-ins, fully compatible with the Workers Runtime.
+
+## Requirements
+
+Cloudflare Workers cannot run clamd locally. You need a **publicly reachable** clamd instance. Options:
+
+- A VPS running clamd with port 3310 open (add appropriate firewall rules).
+- A Cloudflare Tunnel ([cloudflared](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/)) pointing to a private clamd instance.
+
+> **Security note:** Restrict clamd access to your Worker's outbound IPs or use a shared secret at the application layer. Never expose clamd directly to the public internet without access controls.
+
+## Installation
+
+```
+npm i @pompelmi/cloudflare
+```
+
+## Usage
+
+```js
+import { scanBuffer, scanRequest } from '@pompelmi/cloudflare';
+
+export default {
+  async fetch(request, env) {
+    // Option A: scan the whole multipart form at once
+    const rejection = await scanRequest(request, {
+      host: env.CLAMAV_HOST,
+      port: parseInt(env.CLAMAV_PORT),
+    });
+    if (rejection) return rejection; // 422 or 500
+
+    return new Response('File accepted');
+  },
+};
+```
+
+Or scan an `ArrayBuffer` directly:
+
+```js
+import { scanBuffer } from '@pompelmi/cloudflare';
+
+export default {
+  async fetch(request, env) {
+    const formData = await request.formData();
+    const file = formData.get('file');
+    const buffer = await file.arrayBuffer();
+
+    const result = await scanBuffer(buffer, {
+      host: env.CLAMAV_HOST,
+      port: parseInt(env.CLAMAV_PORT),
+    });
+
+    if (result !== 'clean') {
+      return new Response('File rejected', { status: 422 });
+    }
+
+    return new Response('OK');
+  },
+};
+```
+
+## API
+
+### `scanBuffer(buffer, options)`
+
+| Parameter | Type | Description |
+|---|---|---|
+| `buffer` | `ArrayBuffer` | The file bytes to scan |
+| `options.host` | `string` | clamd hostname or IP (required) |
+| `options.port` | `number` | clamd port, typically `3310` (required) |
+| `options.timeout` | `number` | Read timeout in ms (default: `15000`) |
+
+Returns `Promise<'clean' | 'malicious' | 'error'>`.
+
+### `scanRequest(request, options)`
+
+Reads the multipart form field (default: `file`), scans it, and returns:
+- `null` — file is clean, proceed normally.
+- `Response(422)` — malicious file detected.
+- `Response(500)` — scan error (clamd unreachable, timeout, etc.).
+
+Additional option: `options.field` — form field name (default: `'file'`).
+
+## Wrangler configuration
+
+Copy [`wrangler.toml.example`](./wrangler.toml.example) to `wrangler.toml` and fill in your clamd host details.
+
+## License
+
+ISC

package/packages/cloudflare/index.d.ts

@@ -0,0 +1,50 @@
+/** Result returned by scanBuffer */
+export type ScanResult = 'clean' | 'malicious' | 'error';
+
+/** Options for connecting to a remote clamd instance */
+export interface CloudflareScanOptions {
+  /** Hostname or IP of the remote clamd instance */
+  host: string;
+  /** Port the remote clamd listens on (typically 3310) */
+  port: number;
+  /** Socket read timeout in milliseconds (default: 15000) */
+  timeout?: number;
+  /** Form field name to scan when using scanRequest (default: 'file') */
+  field?: string;
+}
+
+/**
+ * Scan an ArrayBuffer with a remote clamd instance using INSTREAM protocol.
+ * Uses Cloudflare's `connect()` socket API — no Node.js built-ins required.
+ *
+ * @example
+ * const result = await scanBuffer(await file.arrayBuffer(), {
+ *   host: env.CLAMAV_HOST,
+ *   port: parseInt(env.CLAMAV_PORT),
+ * });
+ */
+export declare function scanBuffer(
+  buffer: ArrayBuffer,
+  options: CloudflareScanOptions
+): Promise<ScanResult>;
+
+/**
+ * Scan a multipart form field from a Cloudflare Worker Request.
+ * Returns null if the file is clean, or an HTTP Response (422/500) otherwise.
+ *
+ * @example
+ * export default {
+ *   async fetch(request, env) {
+ *     const rejection = await scanRequest(request, {
+ *       host: env.CLAMAV_HOST,
+ *       port: parseInt(env.CLAMAV_PORT),
+ *     });
+ *     if (rejection) return rejection;
+ *     return new Response('OK');
+ *   }
+ * }
+ */
+export declare function scanRequest(
+  request: Request,
+  options: CloudflareScanOptions
+): Promise<Response | null>;

package/packages/cloudflare/index.js

@@ -0,0 +1,116 @@
+/**
+ * @pompelmi/cloudflare
+ *
+ * Connects to a remote clamd instance over TCP using Cloudflare's socket API.
+ * Uses Web APIs only — no Node.js built-ins.
+ *
+ * Requires `connect` from `cloudflare:sockets` (available in Workers Runtime ≥ 2023-03-01).
+ */
+
+const INSTREAM_CHUNK = 4096; // bytes per INSTREAM chunk
+const CLEAN_RESPONSE = /^stream: OK/;
+const MALICIOUS_RESPONSE = /^stream: (.+) FOUND/;
+
+/**
+ * Send a Buffer or ArrayBuffer to clamd via INSTREAM and return the raw
+ * response string.
+ *
+ * @param {ArrayBuffer} data
+ * @param {{ host: string, port: number, timeout?: number }} options
+ * @returns {Promise<string>}
+ */
+async function clamdInstream(data, { host, port, timeout = 15000 }) {
+  // eslint-disable-next-line no-undef
+  const { connect } = await import('cloudflare:sockets');
+  const socket = connect({ hostname: host, port });
+
+  const writer = socket.writable.getWriter();
+  const reader = socket.readable.getReader();
+
+  const bytes = data instanceof ArrayBuffer ? new Uint8Array(data) : data;
+
+  // Write INSTREAM command
+  const cmd = new TextEncoder().encode('zINSTREAM\0');
+  await writer.write(cmd);
+
+  // Stream data in chunks with 4-byte big-endian length prefix
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const end = Math.min(offset + INSTREAM_CHUNK, bytes.byteLength);
+    const chunk = bytes.subarray(offset, end);
+    const lenBuf = new ArrayBuffer(4);
+    new DataView(lenBuf).setUint32(0, chunk.byteLength, false);
+    await writer.write(new Uint8Array(lenBuf));
+    await writer.write(chunk);
+    offset = end;
+  }
+
+  // Write zero-length chunk to signal end of stream
+  const terminator = new Uint8Array([0, 0, 0, 0]);
+  await writer.write(terminator);
+  writer.releaseLock();
+
+  // Read response with timeout
+  const timeoutId = setTimeout(() => reader.cancel(), timeout);
+  let response = '';
+  const decoder = new TextDecoder();
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      response += decoder.decode(value, { stream: true });
+      if (response.includes('\n') || response.includes('\0')) break;
+    }
+  } finally {
+    clearTimeout(timeoutId);
+    reader.releaseLock();
+  }
+
+  await socket.close();
+  return response.trim().replace(/\0/g, '');
+}
+
+/**
+ * Scan an ArrayBuffer with a remote clamd instance.
+ *
+ * @param {ArrayBuffer} buffer
+ * @param {{ host: string, port: number, timeout?: number }} options
+ * @returns {Promise<'clean' | 'malicious' | 'error'>}
+ */
+export async function scanBuffer(buffer, options) {
+  if (!options || !options.host || !options.port) {
+    throw new Error('@pompelmi/cloudflare: options.host and options.port are required');
+  }
+  try {
+    const response = await clamdInstream(buffer, options);
+    if (CLEAN_RESPONSE.test(response)) return 'clean';
+    if (MALICIOUS_RESPONSE.test(response)) return 'malicious';
+    return 'error';
+  } catch {
+    return 'error';
+  }
+}
+
+/**
+ * Convenience Cloudflare Worker handler that reads a multipart form field,
+ * scans it, and returns HTTP 422 on malicious files.
+ *
+ * @param {Request} request
+ * @param {{ host: string, port: number, field?: string, timeout?: number }} options
+ * @returns {Promise<Response | null>} null if clean, Response if malicious/error
+ */
+export async function scanRequest(request, options) {
+  const field = options.field || 'file';
+  const formData = await request.formData();
+  const file = formData.get(field);
+  if (!file) return null;
+  const buffer = await file.arrayBuffer();
+  const result = await scanBuffer(buffer, options);
+  if (result === 'malicious') {
+    return new Response('File rejected: malicious content detected', { status: 422 });
+  }
+  if (result === 'error') {
+    return new Response('Scan error', { status: 500 });
+  }
+  return null;
+}

package/packages/cloudflare/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@pompelmi/cloudflare",
+  "version": "1.0.0",
+  "description": "pompelmi adapter for Cloudflare Workers — scan file uploads via a remote clamd instance using Web APIs only.",
+  "license": "ISC",
+  "author": "pompelmi contributors",
+  "homepage": "https://pompelmi.app",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pompelmi/pompelmi.git",
+    "directory": "packages/cloudflare"
+  },
+  "bugs": {
+    "url": "https://github.com/pompelmi/pompelmi/issues"
+  },
+  "keywords": [
+    "clamav",
+    "antivirus",
+    "virus-scan",
+    "malware",
+    "cloudflare",
+    "cloudflare-workers",
+    "file-upload",
+    "security"
+  ],
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./index.js"
+    }
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/packages/cloudflare/wrangler.toml.example

@@ -0,0 +1,13 @@
+name = "my-worker"
+main = "src/worker.js"
+compatibility_date = "2024-01-01"
+
+[vars]
+CLAMAV_HOST = "your-clamd-host.example.com"
+CLAMAV_PORT = "3310"
+
+# Cloudflare Workers require a publicly reachable clamd instance.
+# Options:
+#   1. Run clamd on a VPS and expose port 3310 (add firewall rules).
+#   2. Use a Cloudflare Tunnel (cloudflared) to expose a private clamd instance.
+#      See: https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/

package/packages/remix/README.md

@@ -0,0 +1,142 @@
+# @pompelmi/remix
+
+Remix upload handler for [pompelmi](https://pompelmi.app) — in-process ClamAV virus scanning with zero extra dependencies.
+
+Works with **Remix v1 and v2** on Node.js, and is compatible with the `unstable_parseMultipartFormData` API.
+
+## Installation
+
+```bash
+npm install @pompelmi/remix pompelmi
+```
+
+## Quick Start
+
+```ts
+import { unstable_parseMultipartFormData, json } from '@remix-run/node'
+import { pompelmiUploadHandler } from '@pompelmi/remix'
+import type { ActionFunctionArgs } from '@remix-run/node'
+
+export async function action({ request }: ActionFunctionArgs) {
+  const formData = await unstable_parseMultipartFormData(
+    request,
+    pompelmiUploadHandler({ host: 'localhost', port: 3310 })
+  )
+
+  const file = formData.get('file') as File
+  return json({ name: file.name, size: file.size, ok: true })
+}
+```
+
+If a malicious file is uploaded, `pompelmiUploadHandler` throws a `Response` with HTTP **422** — Remix catches it automatically and returns it to the client.
+
+## With an inner handler
+
+Chain with any Remix upload handler (e.g. `unstable_createFileUploadHandler`) to store clean files to disk:
+
+```ts
+import {
+  unstable_parseMultipartFormData,
+  unstable_createFileUploadHandler,
+  json,
+} from '@remix-run/node'
+import { pompelmiUploadHandler } from '@pompelmi/remix'
+
+const uploadToTmp = unstable_createFileUploadHandler({ directory: '/tmp/uploads' })
+
+export async function action({ request }) {
+  const formData = await unstable_parseMultipartFormData(
+    request,
+    pompelmiUploadHandler({
+      host: 'localhost',
+      port: 3310,
+      inner: uploadToTmp,   // called only if file is clean
+    })
+  )
+  const file = formData.get('file')  // NodeOnDiskFile from inner handler
+  return json({ ok: true })
+}
+```
+
+## Scan a specific field only
+
+Use `field` to restrict scanning to a single form field. Other file fields are passed through to `inner` (or returned as `File` objects) without scanning:
+
+```ts
+pompelmiUploadHandler({
+  host: 'localhost',
+  port: 3310,
+  field: 'avatar',  // only scan the 'avatar' field
+})
+```
+
+## Custom error response
+
+```ts
+pompelmiUploadHandler({
+  host: 'localhost',
+  port: 3310,
+  onInfected: ({ filename }) => {
+    console.warn(`Blocked malicious upload: ${filename}`)
+    throw new Response(
+      JSON.stringify({ error: 'Malware detected', filename }),
+      { status: 422, headers: { 'Content-Type': 'application/json' } }
+    )
+  },
+})
+```
+
+## Route example (full)
+
+```tsx
+// app/routes/upload.tsx
+import {
+  unstable_parseMultipartFormData,
+  json,
+  type ActionFunctionArgs,
+} from '@remix-run/node'
+import { Form, useActionData } from '@remix-run/react'
+import { pompelmiUploadHandler } from '@pompelmi/remix'
+
+export async function action({ request }: ActionFunctionArgs) {
+  // Throws HTTP 422 automatically if malware is detected
+  const formData = await unstable_parseMultipartFormData(
+    request,
+    pompelmiUploadHandler({ host: 'localhost', port: 3310 })
+  )
+
+  const file = formData.get('document') as File
+  if (!file) return json({ error: 'No file provided' }, { status: 400 })
+
+  return json({ name: file.name, size: file.size, ok: true })
+}
+
+export default function Upload() {
+  const data = useActionData<typeof action>()
+  return (
+    <Form method="post" encType="multipart/form-data">
+      <input type="file" name="document" />
+      <button type="submit">Upload</button>
+      {data?.ok && <p>Uploaded: {data.name} ({data.size} bytes)</p>}
+    </Form>
+  )
+}
+```
+
+## Configuration Reference
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `field` | `string` | — | Only scan this field; others pass through unscanned |
+| `inner` | `UploadHandler` | — | Inner handler for clean files (e.g. file-upload, memory) |
+| `host` | `string` | — | clamd hostname (enables TCP mode) |
+| `port` | `number` | `3310` | clamd port |
+| `socket` | `string` | — | UNIX domain socket path |
+| `timeout` | `number` | `15000` | Socket idle timeout in ms |
+| `retries` | `number` | `0` | Retry attempts |
+| `retryDelay` | `number` | `1000` | Delay between retries in ms |
+| `onInfected` | `Function` | — | Called with `{ name, filename }` when malware detected |
+
+## License
+
+ISC — see root [LICENSE](../../LICENSE).

package/packages/remix/index.d.ts

@@ -0,0 +1,50 @@
+import type { ScanOptions } from 'pompelmi';
+
+export interface UploadHandlerArgs {
+  name: string;
+  filename: string | undefined;
+  contentType: string;
+  data: AsyncIterable<Uint8Array>;
+}
+
+export type RemixUploadHandler = (args: UploadHandlerArgs) => Promise<File | string | undefined>;
+
+export interface PompelmiRemixOptions extends ScanOptions {
+  /**
+   * Only scan this form field name; other file fields are passed straight to `inner`.
+   * When omitted, all file fields are scanned.
+   */
+  field?: string;
+  /**
+   * Inner UploadHandler to call for clean files (e.g. unstable_createMemoryUploadHandler).
+   * When omitted, clean files are returned as Web API `File` objects.
+   */
+  inner?: RemixUploadHandler;
+  /**
+   * Called with `{ name, filename }` when a malicious file is detected.
+   * Must throw a Response (or return one that will be thrown by the caller).
+   * If omitted, throws an HTTP 422 Response automatically.
+   */
+  onInfected?: (args: { name: string; filename: string }) => never | Promise<never>;
+}
+
+/**
+ * Creates a Remix-compatible UploadHandler that scans each uploaded file with
+ * pompelmi before forwarding it to an optional inner handler.
+ *
+ * @example
+ * import { unstable_parseMultipartFormData } from '@remix-run/node'
+ * import { pompelmiUploadHandler } from '@pompelmi/remix'
+ *
+ * export async function action({ request }: ActionFunctionArgs) {
+ *   const formData = await unstable_parseMultipartFormData(
+ *     request,
+ *     pompelmiUploadHandler({ host: 'localhost', port: 3310 })
+ *   )
+ *   const file = formData.get('file') as File
+ *   return json({ name: file.name, size: file.size })
+ * }
+ */
+export function pompelmiUploadHandler(options?: PompelmiRemixOptions): RemixUploadHandler;
+
+export { Verdict } from 'pompelmi';

package/packages/remix/index.js

@@ -0,0 +1,96 @@
+'use strict';
+
+const { scanBuffer, Verdict } = require('pompelmi');
+
+// File is a global in Node 20+; on Node 18 it lives in node:buffer
+const NodeFile = globalThis.File ?? require('node:buffer').File;
+
+const SCAN_KEYS = ['host', 'port', 'socket', 'timeout', 'retries', 'retryDelay'];
+
+function buildScanOptions(options) {
+  const out = {};
+  for (const k of SCAN_KEYS) {
+    if (options[k] !== undefined) out[k] = options[k];
+  }
+  return out;
+}
+
+async function collectStream(data) {
+  const chunks = [];
+  for await (const chunk of data) {
+    chunks.push(chunk instanceof Buffer ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks);
+}
+
+/**
+ * Creates a Remix UploadHandler that scans each uploaded file with pompelmi
+ * before passing it to an optional inner handler.
+ *
+ * Usage in a Remix action:
+ *
+ *   import { unstable_parseMultipartFormData } from '@remix-run/node'
+ *   import { pompelmiUploadHandler } from '@pompelmi/remix'
+ *
+ *   export async function action({ request }) {
+ *     const formData = await unstable_parseMultipartFormData(
+ *       request,
+ *       pompelmiUploadHandler({ host: 'localhost', port: 3310 })
+ *     )
+ *     // file is guaranteed clean here
+ *   }
+ *
+ * @param {object}   [options]
+ * @param {string}   [options.field]           - Only scan this field; pass others through (default: scan all files).
+ * @param {Function} [options.inner]           - Inner UploadHandler for clean files. Defaults to storing as File.
+ * @param {string}   [options.host]            - clamd hostname.
+ * @param {number}   [options.port=3310]       - clamd port.
+ * @param {string}   [options.socket]          - UNIX socket path.
+ * @param {number}   [options.timeout=15000]   - Socket idle timeout in ms.
+ * @param {number}   [options.retries=0]       - Retry attempts.
+ * @param {number}   [options.retryDelay=1000] - Delay between retries in ms.
+ * @param {Function} [options.onInfected]      - Called with ({ name, filename }) when malware is detected.
+ *                                              Must throw or return a Response. Default throws HTTP 422.
+ */
+function pompelmiUploadHandler(options) {
+  const { field, inner, onInfected } = options || {};
+  const scanOptions = buildScanOptions(options || {});
+
+  return async function remixUploadHandler({ name, filename, contentType, data }) {
+    // Skip non-file fields (no filename) or fields not targeted
+    if (!filename || (field && name !== field)) {
+      if (typeof inner === 'function') {
+        return inner({ name, filename, contentType, data });
+      }
+      const buf = await collectStream(data);
+      // Text field (no filename) → return as string; file field → return as File
+      if (!filename) return buf.toString('utf8');
+      return new NodeFile([buf], filename, { type: contentType });
+    }
+
+    const buffer = await collectStream(data);
+
+    if (buffer.length > 0) {
+      const result = await scanBuffer(buffer, scanOptions);
+      if (result === Verdict.Malicious) {
+        if (typeof onInfected === 'function') {
+          return onInfected({ name, filename });
+        }
+        throw new Response(
+          JSON.stringify({ error: 'Malware detected', filename }),
+          { status: 422, headers: { 'Content-Type': 'application/json' } }
+        );
+      }
+    }
+
+    if (typeof inner === 'function') {
+      // Replay the buffer through the inner handler via an async generator
+      async function* replay() { yield buffer; }
+      return inner({ name, filename, contentType, data: replay() });
+    }
+
+    return new NodeFile([buffer], filename, { type: contentType });
+  };
+}
+
+module.exports = { pompelmiUploadHandler, Verdict };

package/packages/remix/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@pompelmi/remix",
+  "version": "1.0.0",
+  "description": "Remix upload handler for pompelmi — in-process ClamAV virus scanning with zero extra dependencies",
+  "license": "ISC",
+  "author": "pompelmi contributors",
+  "homepage": "https://pompelmi.app",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pompelmi/pompelmi.git",
+    "directory": "packages/remix"
+  },
+  "keywords": [
+    "remix",
+    "remix-run",
+    "upload-handler",
+    "clamav",
+    "antivirus",
+    "virus-scan",
+    "malware",
+    "file-upload",
+    "security",
+    "pompelmi",
+    "fullstack"
+  ],
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "scripts": {
+    "test": "node --test test/index.test.js"
+  },
+  "peerDependencies": {
+    "pompelmi": ">=1.15.0"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/packages/sveltekit/README.md

@@ -0,0 +1,138 @@
+# @pompelmi/sveltekit
+
+SvelteKit helper for [pompelmi](https://pompelmi.app) — in-process ClamAV virus scanning with zero extra dependencies.
+
+Works with both **+page.server.ts actions** and **+server.ts API routes** on Node.js.
+
+## Installation
+
+```bash
+npm install @pompelmi/sveltekit pompelmi
+```
+
+> **Requires** the [`@sveltejs/adapter-node`](https://kit.svelte.dev/docs/adapter-node) adapter. ClamAV is a Node.js process and cannot run on edge runtimes.
+
+## Quick Start
+
+### Form action (+page.server.ts)
+
+```ts
+import { scanUpload } from '@pompelmi/sveltekit'
+import type { Actions } from './$types'
+
+export const actions: Actions = {
+  default: async ({ request }) => {
+    const formData = await request.formData()
+    const file = formData.get('file') as File
+
+    // Throws HTTP 422 Response automatically if malware is detected
+    await scanUpload(file, { host: 'localhost', port: 3310 })
+
+    // File is guaranteed clean here — save to storage, etc.
+    return { success: true, name: file.name }
+  }
+}
+```
+
+If a malicious file is uploaded, `scanUpload` throws a `Response` with HTTP **422** and a JSON body `{ error: 'Malware detected', filename }`. SvelteKit's error boundary catches it automatically.
+
+### API route (+server.ts)
+
+```ts
+import { scanUpload } from '@pompelmi/sveltekit'
+import { json } from '@sveltejs/kit'
+import type { RequestHandler } from './$types'
+
+export const POST: RequestHandler = async ({ request }) => {
+  const formData = await request.formData()
+  const file = formData.get('file') as File
+
+  await scanUpload(file, { host: 'localhost', port: 3310 })
+
+  return json({ ok: true, name: file.name, size: file.size })
+}
+```
+
+## Scan all files in FormData
+
+Use `scanFormData` to scan every file field at once. Throws on the first malicious file:
+
+```ts
+import { scanFormData } from '@pompelmi/sveltekit'
+
+export const actions: Actions = {
+  default: async ({ request }) => {
+    const formData = await request.formData()
+
+    // Scans all File/Blob values; throws 422 if any is malicious
+    await scanFormData(formData, { host: 'localhost', port: 3310 })
+
+    return { success: true }
+  }
+}
+```
+
+## Custom error handling
+
+```ts
+import { scanUpload } from '@pompelmi/sveltekit'
+import { fail } from '@sveltejs/kit'
+
+export const actions: Actions = {
+  default: async ({ request }) => {
+    const formData = await request.formData()
+    const file = formData.get('file') as File
+
+    await scanUpload(file, {
+      host: 'localhost',
+      port: 3310,
+      onInfected: ({ filename }) => {
+        console.warn(`Blocked malicious upload: ${filename}`)
+        // Use SvelteKit's fail() to return a form error
+        throw fail(422, { error: `${filename} contains malware` })
+      },
+    })
+
+    return { success: true }
+  }
+}
+```
+
+## Route component example (full)
+
+```svelte
+<!-- src/routes/upload/+page.svelte -->
+<script lang="ts">
+  import { enhance } from '$app/forms'
+  import type { ActionData } from './$types'
+
+  export let form: ActionData
+</script>
+
+<form method="POST" enctype="multipart/form-data" use:enhance>
+  <input type="file" name="file" required />
+  <button type="submit">Upload & Scan</button>
+
+  {#if form?.error}
+    <p style="color: red">{form.error}</p>
+  {:else if form?.success}
+    <p>Uploaded: {form.name}</p>
+  {/if}
+</form>
+```
+
+## Configuration Reference
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `host` | `string` | — | clamd hostname (enables TCP mode) |
+| `port` | `number` | `3310` | clamd port |
+| `socket` | `string` | — | UNIX domain socket path |
+| `timeout` | `number` | `15000` | Socket idle timeout in ms |
+| `retries` | `number` | `0` | Retry attempts |
+| `retryDelay` | `number` | `1000` | Delay between retries in ms |
+| `onInfected` | `Function` | — | Called with `{ filename }` when malware detected; must throw |
+
+## License
+
+ISC — see root [LICENSE](../../LICENSE).

package/packages/sveltekit/index.d.ts

@@ -0,0 +1,59 @@
+import type { ScanOptions } from 'pompelmi';
+
+export interface PompelmiSvelteKitOptions extends ScanOptions {
+  /**
+   * Called with `{ filename }` when a malicious file is detected.
+   * Must throw (e.g. throw error(422, { message: 'Malware detected' })).
+   * If omitted, throws an HTTP 422 Response automatically.
+   */
+  onInfected?: (args: { filename: string }) => never | Promise<never>;
+}
+
+/**
+ * Scans an uploaded file with pompelmi inside a SvelteKit server action or
+ * API route (+page.server.ts / +server.ts). Throws HTTP 422 on malicious files.
+ *
+ * @example
+ * // +page.server.ts
+ * import { scanUpload } from '@pompelmi/sveltekit'
+ * import type { Actions } from './$types'
+ *
+ * export const actions: Actions = {
+ *   default: async ({ request }) => {
+ *     const formData = await request.formData()
+ *     await scanUpload(formData.get('file') as File, { host: 'localhost', port: 3310 })
+ *     return { success: true }
+ *   }
+ * }
+ *
+ * @example
+ * // +server.ts (API route)
+ * import { scanUpload } from '@pompelmi/sveltekit'
+ * import { json } from '@sveltejs/kit'
+ * import type { RequestHandler } from './$types'
+ *
+ * export const POST: RequestHandler = async ({ request }) => {
+ *   const formData = await request.formData()
+ *   await scanUpload(formData.get('file') as File, { host: 'localhost', port: 3310 })
+ *   return json({ ok: true })
+ * }
+ */
+export function scanUpload(
+  file: File | Blob | Buffer | null | undefined,
+  options?: PompelmiSvelteKitOptions
+): Promise<symbol>;
+
+/**
+ * Scans all File/Blob values in a FormData object.
+ * Throws HTTP 422 on the first malicious file found.
+ *
+ * @example
+ * const formData = await request.formData()
+ * await scanFormData(formData, { host: 'localhost', port: 3310 })
+ */
+export function scanFormData(
+  formData: FormData,
+  options?: PompelmiSvelteKitOptions
+): Promise<void>;
+
+export { Verdict } from 'pompelmi';

package/packages/sveltekit/index.js

@@ -0,0 +1,100 @@
+'use strict';
+
+const { scanBuffer, Verdict } = require('pompelmi');
+
+// File is a global in Node 20+; on Node 18 it lives in node:buffer
+const NodeFile = globalThis.File ?? require('node:buffer').File;
+
+const SCAN_KEYS = ['host', 'port', 'socket', 'timeout', 'retries', 'retryDelay'];
+
+function buildScanOptions(options) {
+  const out = {};
+  for (const k of SCAN_KEYS) {
+    if (options[k] !== undefined) out[k] = options[k];
+  }
+  return out;
+}
+
+async function toBuffer(file) {
+  if (Buffer.isBuffer(file)) return file;
+  if (file instanceof Uint8Array) return Buffer.from(file);
+  // Web API File / Blob
+  if (file && typeof file.arrayBuffer === 'function') {
+    return Buffer.from(await file.arrayBuffer());
+  }
+  return null;
+}
+
+/**
+ * Scans an uploaded file with pompelmi inside a SvelteKit server action or
+ * API route. Throws an HTTP 422 Response automatically on malicious files.
+ *
+ * Use in a +page.server.ts action or +server.ts route:
+ *
+ *   import { scanUpload } from '@pompelmi/sveltekit'
+ *
+ *   export const actions = {
+ *     default: async ({ request }) => {
+ *       const formData = await request.formData()
+ *       await scanUpload(formData.get('file'), { host: 'localhost', port: 3310 })
+ *       // file is guaranteed clean here
+ *       return { success: true }
+ *     }
+ *   }
+ *
+ * @param {File|Blob|Buffer}  file                  - The uploaded file to scan.
+ * @param {object}            [options]
+ * @param {string}            [options.host]        - clamd hostname (enables TCP mode).
+ * @param {number}            [options.port=3310]   - clamd port.
+ * @param {string}            [options.socket]      - UNIX domain socket path.
+ * @param {number}            [options.timeout]     - Socket idle timeout in ms.
+ * @param {number}            [options.retries]     - Retry attempts.
+ * @param {number}            [options.retryDelay]  - Delay between retries in ms.
+ * @param {Function}          [options.onInfected]  - Called with ({ filename }) when malware
+ *                                                   is detected. Must throw. Defaults to
+ *                                                   throwing HTTP 422 Response.
+ * @returns {Promise<symbol>} Verdict.Clean or Verdict.ScanError (never returns Verdict.Malicious).
+ */
+async function scanUpload(file, options) {
+  if (!file) return Verdict.Clean;
+
+  const scanOptions = buildScanOptions(options || {});
+  const buffer = await toBuffer(file);
+
+  if (!buffer || buffer.length === 0) return Verdict.Clean;
+
+  const result = await scanBuffer(buffer, scanOptions);
+
+  if (result === Verdict.Malicious) {
+    const filename = (file && typeof file.name === 'string') ? file.name : 'upload';
+    const onInfected = options && options.onInfected;
+    if (typeof onInfected === 'function') {
+      return onInfected({ filename });
+    }
+    throw new Response(
+      JSON.stringify({ error: 'Malware detected', filename }),
+      { status: 422, headers: { 'Content-Type': 'application/json' } }
+    );
+  }
+
+  return result;
+}
+
+/**
+ * Scans all File/Blob values in a FormData object. Throws on the first
+ * malicious file found.
+ *
+ * @param {FormData}  formData             - The parsed form data.
+ * @param {object}    [options]            - Same options as scanUpload.
+ * @returns {Promise<void>}
+ */
+async function scanFormData(formData, options) {
+  if (!formData || typeof formData.entries !== 'function') return;
+  for (const [, value] of formData.entries()) {
+    if (value instanceof NodeFile || (value && typeof value.arrayBuffer === 'function')) {
+      await scanUpload(value, options);
+    }
+  }
+}
+
+module.exports = { scanUpload, scanFormData, Verdict };

package/packages/sveltekit/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@pompelmi/sveltekit",
+  "version": "1.0.0",
+  "description": "SvelteKit helper for pompelmi — in-process ClamAV virus scanning with zero extra dependencies",
+  "license": "ISC",
+  "author": "pompelmi contributors",
+  "homepage": "https://pompelmi.app",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pompelmi/pompelmi.git",
+    "directory": "packages/sveltekit"
+  },
+  "keywords": [
+    "sveltekit",
+    "svelte",
+    "server-action",
+    "api-route",
+    "clamav",
+    "antivirus",
+    "virus-scan",
+    "malware",
+    "file-upload",
+    "security",
+    "pompelmi"
+  ],
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "scripts": {
+    "test": "node --test test/index.test.js"
+  },
+  "peerDependencies": {
+    "pompelmi": ">=1.15.0"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}

package/src/index.mjs

@@ -0,0 +1,19 @@
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+const pompelmi = require('./index.js');
+export const {
+  scan,
+  scanBuffer,
+  scanStream,
+  scanDirectory,
+  scanS3,
+  createPool,
+  watch,
+  middleware,
+  createScanner,
+  generateDashboard,
+  generateShareCard,
+  notify,
+  Verdict,
+} = pompelmi;
+export default pompelmi;