Safe Filename

sanitize-filename is the npm package named for this job and has over 8 million weekly downloads. Run against Windows reserved device names it returns an EMPTY STRING: CON.txt, NUL.txt and COM1.tar.gz all sanitize to nothing. And path.join with an empty name resolves to the directory itself, so an upload or rename endpoint built on that default does not fail -- it targets the containing folder. Nothing throws.

Two more, verified by execution rather than quoted. A right-to-left override character passes through untouched, so a name can render to a human as though it ends in .txt while actually ending in .exe. And the NFC and NFD forms of one name produce byte-different strings that are visually identical, so a directory can hold both and a lookup for one silently misses the other -- which the user reports as the file disappearing.

THE RULE HERE: never return an empty string. That is the branch the incumbent gets wrong, and where returning nothing stops being a naming bug and becomes a write to the wrong location. Reserved names are RENAMED rather than erased, so the user's name survives and the write is safe on every platform.

Also handled: path traversal verified with path.resolve rather than a string check, trailing dots and spaces stripped because Windows does it silently at write time, length bounded in BYTES rather than characters, and truncation that never splits a multi-byte character.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function safeFilename(input: unknown, opts: SafeNameOptions = {}): SafeNameResult;
  export function wouldCollide(a: string, b: string): boolean;