sporades 0.9.18 → 0.9.19

package/CHANGES.md

@@ -2,19 +2,21 @@
 
 ## Unreleased - 2026-09-11
 
-Changes since v0.9.17.
+Changes since v0.9.18.
 
-### 🐛 Bug Fixes
+### 🚀 Features
 
-- Reject caps below the configured envelope floor (bfb6bce1).
-- Fix query arguments containing multi-element arrays (#37) (8cfef157).
+- Allow trusted multipart admission to prohibit files (#39) (47602ddf).
 
 ### 📝 Documentation
 
-- Remove personal infrastructure from documentation and host fixture (628363b1).
-- Link log cap implementation PR (a0b2fb88).
-- Record log cap validation completion (675226cd).
-- Document shell quote handlers in SQL lexer census (#38) (125355ab).
+- Require explicit own data for multipart admission authority (3b118d0d).
+- Treat undefined multipart file permission as omitted (5cfe8aca).
+- Regenerate multipart admission API documentation (ac92dcf8).
+
+### 🧪 Tests
+
+- Verify file permission in packed admission declarations (0465c97f).
 
 ## v0.9.11 - 2026-09-02
 
@@ -109,3 +111,4 @@ generated artifacts, and documentation.
 
 
 
+

package/bin/sporades-host-helper.js

@@ -42587,7 +42587,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.18";
+var CLI_VERSION = "0.9.19";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([

package/bin/sporades.js

@@ -87363,7 +87363,7 @@ function idempotencyConflict(message = "Ingress claim conflicts with the complet
 function ingressAuthorityDenied() {
   return Object.assign(new Error("File ingress authority is unavailable."), { code: "INGRESS_AUTHORITY_DENIED" });
 }
-var ingressAuditCodes = /* @__PURE__ */ new Set(["INVALID_MULTIPART", "MULTIPART_LIMIT_EXCEEDED", "INVALID_MULTIPART_REQUEST_KEY", "INVALID_MULTIPART_PART_KEY", "INGRESS_AUTHORITY_DENIED", "INGRESS_LEASE_EXPIRED", "INGRESS_PATH_DENIED", "INGRESS_DESCRIPTOR_CONFLICT", "INGRESS_STAGING_INCOMPLETE", "INGRESS_ORPHAN_CLEANUP_FAILED", "FILE_PATH_EXISTS"]);
+var ingressAuditCodes = /* @__PURE__ */ new Set(["MULTIPART_ADMISSION_DENIED", "INVALID_MULTIPART", "MULTIPART_LIMIT_EXCEEDED", "INVALID_MULTIPART_REQUEST_KEY", "INVALID_MULTIPART_PART_KEY", "INGRESS_AUTHORITY_DENIED", "INGRESS_LEASE_EXPIRED", "INGRESS_PATH_DENIED", "INGRESS_DESCRIPTOR_CONFLICT", "INGRESS_STAGING_INCOMPLETE", "INGRESS_ORPHAN_CLEANUP_FAILED", "FILE_PATH_EXISTS"]);
 async function emitIngressAudit(database, event, data2) {
   try {
     await database.log?.emit?.({ category: "platform", event: `file.ingress.${event}`, level: event === "failed" || event === "cleanup-failed" ? "warn" : "info", message: "Multipart ingress lifecycle event", data: { schema: "v1", ...data2 } });
@@ -87391,7 +87391,7 @@ function multipartBoundary(contentType) {
   const validToken = /^[0-9A-Za-z'+_.-]+$/.test(value);
   return value.length <= 70 && validBchars && (quoted || validToken) ? value : null;
 }
-async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes) {
+async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes, allowFiles = true) {
   const boundary = Buffer.from(`--${boundaryText}`);
   const marker = Buffer.from(`\r
 --${boundaryText}`);
@@ -87421,10 +87421,10 @@ async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes
           break;
         }
         rawHeaders = pending.subarray(0, headerEnd).toString("latin1");
-        if (typeof maxPartBytes !== "number") {
-          const disposition = /^content-disposition:\s*form-data;\s*name="[^"]+"(?:;\s*filename="([^"]*)")?/im.exec(rawHeaders);
-          partLimit = disposition?.[1] !== void 0 ? maxPartBytes.file : maxPartBytes.field;
-        }
+        const disposition = /^content-disposition:\s*form-data;\s*name="[^"]+"(?:;\s*filename="([^"]*)")?/im.exec(rawHeaders);
+        const isFile = disposition?.[1] !== void 0;
+        if (isFile && !allowFiles) throw Object.assign(new Error("Multipart request was not admitted."), { code: "MULTIPART_ADMISSION_DENIED" });
+        if (typeof maxPartBytes !== "number") partLimit = isFile ? maxPartBytes.file : maxPartBytes.field;
         pending = pending.subarray(headerEnd + 4);
         pieces = [];
         size = 0;
@@ -87492,7 +87492,7 @@ async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes
   if (state === "closing" && pending.length === 0) return;
   throw Object.assign(new Error("Truncated multipart request."), { code: "INVALID_MULTIPART" });
 }
-async function stageMultipartIngress(database, endpoint, request, endpointRequest, actor, admittedAuthority) {
+async function stageMultipartIngress(database, endpoint, request, endpointRequest, actor, admittedAuthority, allowFiles = true) {
   let policy;
   try {
     policy = validateMultipartIngressPolicy(endpoint.options.body.multipart);
@@ -87525,7 +87525,7 @@ async function stageMultipartIngress(database, endpoint, request, endpointReques
   const wonReceipts = [];
   const streamingFileLimit = Math.min(Number(policy.maxFileBytes), Number(database.fileMaxSizeBytes));
   try {
-    for await (const part of multipartParts(request, boundary, maxBytes, { file: streamingFileLimit, field: policy.maxFieldBytes })) {
+    for await (const part of multipartParts(request, boundary, maxBytes, { file: streamingFileLimit, field: policy.maxFieldBytes }, allowFiles)) {
       const rawHeaders = part.rawHeaders;
       const body = part.body;
       if (rawHeaders.length > 16384) throw Object.assign(new Error("Multipart headers exceed limit."), { code: "MULTIPART_LIMIT_EXCEEDED" });
@@ -100638,7 +100638,12 @@ async function admitEndpointMultipart(database, endpoint, endpointRequest, admis
       }
     });
     const decision = await Promise.race([transaction, settlementAbort]).finally(removeSettlementAbort);
-    if (controller.signal.aborted || Date.now() >= deadline || !decision || typeof decision !== "object" || Array.isArray(decision) || Object.keys(decision).length !== 1 || typeof decision.allow !== "boolean" || decision.allow !== true) throw multipartAdmissionDenied();
+    if (controller.signal.aborted || Date.now() >= deadline || !decision || typeof decision !== "object" || Array.isArray(decision)) throw multipartAdmissionDenied();
+    const keys = Reflect.ownKeys(decision);
+    const allow = Object.getOwnPropertyDescriptor(decision, "allow");
+    const allowFiles = Object.getOwnPropertyDescriptor(decision, "allowFiles");
+    if (keys.some((key) => key !== "allow" && key !== "allowFiles") || !allow || !Object.prototype.hasOwnProperty.call(allow, "value") || allow.value !== true || allowFiles && (!Object.prototype.hasOwnProperty.call(allowFiles, "value") || allowFiles.value !== void 0 && typeof allowFiles.value !== "boolean")) throw multipartAdmissionDenied();
+    return allowFiles?.value !== false;
   } catch {
     throw multipartAdmissionDenied();
   } finally {
@@ -100693,16 +100698,17 @@ async function runEndpoint(database, endpoint, requestUrl, request) {
       const claimAuthority = endpointIngressClaimAuthority(endpoint);
       const admitted = accessKeyAdmission ?? session;
       let ingressAuthority;
+      let allowFiles = true;
       if (claimAuthority === "capsule-principal") {
         ingressAuthority = await admitCapsuleIngressPrincipal(database, endpoint, endpointRequest, request.signal);
       } else {
         if (!admitted?.auth?.isAuthenticated || admitted.auth.isGuest || isReservedAuthUserId(admitted.auth.userId)) throw commandError("Unauthenticated.", "Sign in with a linked human or service User and retry.", "UNAUTHENTICATED");
         const endpointSignal = request.signal ?? request.__sporadesEndpointSignal;
-        await admitEndpointMultipart(database, endpoint, endpointRequest, admitted, endpointSignal);
+        allowFiles = await admitEndpointMultipart(database, endpoint, endpointRequest, admitted, endpointSignal) !== false;
         if (endpointSignal?.aborted) throw multipartAdmissionDenied();
         ingressAuthority = Object.freeze({ kind: "actor", actorId: String(admitted.auth.userId), ownerId: String(admitted.auth.userId) });
       }
-      const payload = await stageMultipartIngress(database, endpoint, request, endpointRequest, admitted.auth, ingressAuthority);
+      const payload = await stageMultipartIngress(database, endpoint, request, endpointRequest, admitted.auth, ingressAuthority, allowFiles);
       endpointRequest = { ...endpointRequest, ...payload };
     } catch (error) {
       if (error?.code === "UNAUTHENTICATED") {
@@ -110759,7 +110765,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.18";
+var CLI_VERSION = "0.9.19";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.18";
+export declare const CLI_VERSION = "0.9.19";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.18";
+export const CLI_VERSION = "0.9.19";
 //# sourceMappingURL=cli-version.js.map

package/dist/file-ingress-runtime.d.ts

@@ -21,12 +21,12 @@ export declare function checkClamavRuntime(database: RecordLike): Promise<{
 export declare function multipartParts(request: AsyncIterable<Uint8Array>, boundaryText: string, maxWireBytes: number, maxPartBytes: number | {
     file: number;
     field: number;
-}): AsyncGenerator<{
+}, allowFiles?: boolean): AsyncGenerator<{
     rawHeaders: string;
     body: Buffer<ArrayBuffer>;
 }, void, unknown>;
 /** Parse only after endpoint credential admission. The bounded body is never exposed as an ordinary endpoint body. */
-export declare function stageMultipartIngress(database: RecordLike, endpoint: RecordLike, request: any, endpointRequest: RecordLike, actor: RecordLike, admittedAuthority?: RecordLike): Promise<{
+export declare function stageMultipartIngress(database: RecordLike, endpoint: RecordLike, request: any, endpointRequest: RecordLike, actor: RecordLike, admittedAuthority?: RecordLike, allowFiles?: boolean): Promise<{
     body: null;
     bodyBytes: Readonly<{
         byteLength: 0;

package/dist/file-ingress-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-ingress-runtime.d.ts","sourceRoot":"","sources":["../src/file-ingress-runtime.ts"],"names":[],"mappings":"AAWA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAWtC,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,WAAoN;AAgrBpR,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,oBAoF/E;AAoCD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAW5D;AAmCD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,WAE/D;AACD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAwB5D;AAMD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,WAmBxD;AAaD,eAAO,MAAM,uBAAuB,mBAElC,CAAC;AAgOH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,WAgDvD;AAmBD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,SAAa,WAAgQ;AACvV,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,SAAO;QAA6B,OAAO;YAAU,MAAM;GAAy2B;AA4Hx/B,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBASnH;AAOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,gBAkBjE;AACD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,iBAAuR;AACvV,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,UAAU;;GAA+jB;AAoD5nB,wBAAuB,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;;;kBAqB3K;AAED,sHAAsH;AACtH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,UAAU;;;;;;;;;;;;;;;;;;;GA2FnL;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,UAAU,cAiBhE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;iBAU9G,UAAU,WAAW,UAAU;;;;;;;;;sBAyD1B,UAAU;;;;6BASH,MAAM,WAAW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBzD;AAED,wGAAwG;AACxG,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,QAEpF;AAED,6FAA6F;AAC7F,wBAAsB,8BAA8B,CAAC,QAAQ,EAAE,UAAU,oBAQxE;AAED,4EAA4E;AAC5E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe,iBAsChG;AAwCD,wGAAwG;AACxG,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe;;;;;;;;;;IAuB3F"}
+{"version":3,"file":"file-ingress-runtime.d.ts","sourceRoot":"","sources":["../src/file-ingress-runtime.ts"],"names":[],"mappings":"AAWA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAWtC,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,WAAoN;AAgrBpR,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,UAAe,oBAoF/E;AAoCD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAW5D;AAmCD,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,MAAM,WAE/D;AACD,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,MAAM,WAwB5D;AAMD,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,WAmBxD;AAaD,eAAO,MAAM,uBAAuB,mBAElC,CAAC;AAgOH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,WAgDvD;AAmBD,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,UAAU,GAAG,IAAI,EAAE,GAAG,SAAa,WAAgQ;AACvV,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,SAAO;QAA6B,OAAO;YAAU,MAAM;GAAy2B;AA4Hx/B,wBAAsB,sBAAsB,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,oBASnH;AAOD,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,gBAkBjE;AACD,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,iBAAuR;AACvV,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,UAAU;;GAA+jB;AAoD5nB,wBAAuB,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAAE,UAAU,UAAO;;;kBA+B9L;AAED,sHAAsH;AACtH,wBAAsB,qBAAqB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE,UAAU,EAAE,UAAU,UAAO;;;;;;;;;;;;;;;;;;;GA2FtM;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,UAAU,cAiBhE;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU;iBAU9G,UAAU,WAAW,UAAU;;;;;;;;;sBAyD1B,UAAU;;;;6BASH,MAAM,WAAW,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBzD;AAED,wGAAwG;AACxG,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,QAEpF;AAED,6FAA6F;AAC7F,wBAAsB,8BAA8B,CAAC,QAAQ,EAAE,UAAU,oBAQxE;AAED,4EAA4E;AAC5E,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe,iBAsChG;AAwCD,wGAAwG;AACxG,wBAAsB,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,GAAE,UAAe;;;;;;;;;;IAuB3F"}

package/dist/file-ingress-runtime.js

@@ -2797,7 +2797,7 @@ function legacyDelimitedKeyFor(endpoint, requestKey, partKey, actor) { return `$
 function publicLease(row) { return Object.freeze({ leaseId: row.leaseId, partId: row.partId, fieldName: row.fieldName, name: row.name, type: row.type, declaredSize: null, size: row.size, expiresAt: row.expiresAt }); }
 function idempotencyConflict(message = "Ingress claim conflicts with the completed request.") { return Object.assign(new Error(message), { code: "IDEMPOTENCY_CONFLICT" }); }
 function ingressAuthorityDenied() { return Object.assign(new Error("File ingress authority is unavailable."), { code: "INGRESS_AUTHORITY_DENIED" }); }
-const ingressAuditCodes = new Set(["INVALID_MULTIPART", "MULTIPART_LIMIT_EXCEEDED", "INVALID_MULTIPART_REQUEST_KEY", "INVALID_MULTIPART_PART_KEY", "INGRESS_AUTHORITY_DENIED", "INGRESS_LEASE_EXPIRED", "INGRESS_PATH_DENIED", "INGRESS_DESCRIPTOR_CONFLICT", "INGRESS_STAGING_INCOMPLETE", "INGRESS_ORPHAN_CLEANUP_FAILED", "FILE_PATH_EXISTS"]);
+const ingressAuditCodes = new Set(["MULTIPART_ADMISSION_DENIED", "INVALID_MULTIPART", "MULTIPART_LIMIT_EXCEEDED", "INVALID_MULTIPART_REQUEST_KEY", "INVALID_MULTIPART_PART_KEY", "INGRESS_AUTHORITY_DENIED", "INGRESS_LEASE_EXPIRED", "INGRESS_PATH_DENIED", "INGRESS_DESCRIPTOR_CONFLICT", "INGRESS_STAGING_INCOMPLETE", "INGRESS_ORPHAN_CLEANUP_FAILED", "FILE_PATH_EXISTS"]);
 async function emitIngressAudit(database, event, data) {
     try {
         await database.log?.emit?.({ category: "platform", event: `file.ingress.${event}`, level: event === "failed" || event === "cleanup-failed" ? "warn" : "info", message: "Multipart ingress lifecycle event", data: { schema: "v1", ...data } });
@@ -2826,7 +2826,7 @@ function multipartBoundary(contentType) {
 }
 // Keeps only one completed part (never the aggregate request) in memory. The storage adapter
 // currently accepts complete bounded bytes; this is deliberately the narrowest streaming seam.
-export async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes) {
+export async function* multipartParts(request, boundaryText, maxWireBytes, maxPartBytes, allowFiles = true) {
     const boundary = Buffer.from(`--${boundaryText}`);
     const marker = Buffer.from(`\r\n--${boundaryText}`);
     let pending = Buffer.alloc(0);
@@ -2859,10 +2859,13 @@ export async function* multipartParts(request, boundaryText, maxWireBytes, maxPa
                     break;
                 }
                 rawHeaders = pending.subarray(0, headerEnd).toString("latin1");
-                if (typeof maxPartBytes !== "number") {
-                    const disposition = /^content-disposition:\s*form-data;\s*name="[^"]+"(?:;\s*filename="([^"]*)")?/im.exec(rawHeaders);
-                    partLimit = disposition?.[1] !== undefined ? maxPartBytes.file : maxPartBytes.field;
-                }
+                const disposition = /^content-disposition:\s*form-data;\s*name="[^"]+"(?:;\s*filename="([^"]*)")?/im.exec(rawHeaders);
+                const isFile = disposition?.[1] !== undefined;
+                // Admission applies at recognition, before buffering even an empty file.
+                if (isFile && !allowFiles)
+                    throw Object.assign(new Error("Multipart request was not admitted."), { code: "MULTIPART_ADMISSION_DENIED" });
+                if (typeof maxPartBytes !== "number")
+                    partLimit = isFile ? maxPartBytes.file : maxPartBytes.field;
                 pending = pending.subarray(headerEnd + 4);
                 pieces = [];
                 size = 0;
@@ -2941,7 +2944,7 @@ export async function* multipartParts(request, boundaryText, maxWireBytes, maxPa
     throw Object.assign(new Error("Truncated multipart request."), { code: "INVALID_MULTIPART" });
 }
 /** Parse only after endpoint credential admission. The bounded body is never exposed as an ordinary endpoint body. */
-export async function stageMultipartIngress(database, endpoint, request, endpointRequest, actor, admittedAuthority) {
+export async function stageMultipartIngress(database, endpoint, request, endpointRequest, actor, admittedAuthority, allowFiles = true) {
     let policy;
     try {
         policy = validateMultipartIngressPolicy(endpoint.options.body.multipart);
@@ -2978,7 +2981,7 @@ export async function stageMultipartIngress(database, endpoint, request, endpoin
     const wonReceipts = [];
     const streamingFileLimit = Math.min(Number(policy.maxFileBytes), Number(database.fileMaxSizeBytes));
     try {
-        for await (const part of multipartParts(request, boundary, maxBytes, { file: streamingFileLimit, field: policy.maxFieldBytes })) {
+        for await (const part of multipartParts(request, boundary, maxBytes, { file: streamingFileLimit, field: policy.maxFieldBytes }, allowFiles)) {
             const rawHeaders = part.rawHeaders;
             const body = part.body;
             if (rawHeaders.length > 16384)