@forumone/throughline 0.0.0-stage → 1.0.0-next.0

package/dist/media/svg.js

@@ -0,0 +1,241 @@
+/*
+Strip everything from an SVG that makes it a document rather than a picture.
+
+**Why this exists rather than Payload's `validateSvg`.** Payload ships one, and
+it does not run here. `checkFileRestrictions` — which holds both `validateSvg`
+and the `mimeTypes` allowlist — is called from `generateFileData` *after* an
+early return for uploads with no buffer, and `clientUploads: true` on
+`vercelBlobStorage` means the browser PUTs straight to Blob and the document
+arrives with metadata and no bytes. So on this deployment neither check runs.
+Payload's own denylist also skips an SVG carrying an XML prologue
+(`checkFileRestrictions.js` reclassifies those and calls `validateSvg` only in
+the branch below), which is the specific hole #486 F-05 describes.
+
+**An allowlist, not a denylist.** Elements and attributes not named here are
+removed. A denylist of "script and onclick" is a list of the tricks somebody had
+already thought of; SVG has `<foreignObject>`, `<set attributeName="onload">`,
+`javascript:` in an `href`, external `<use>`, entity declarations that read local
+files, and more arriving with each specification. What a logo needs is a small,
+closed set of shapes.
+
+**Sanitise rather than refuse**, because refusing an SVG that is 99% a logo and
+1% a stray `<metadata>` block teaches people to convert to PNG and lose the
+thing SVG is for. What is removed is reported, so the caller can say so.
+
+No dependency. A parser would be better at pathological input, and every option
+is either a browser DOM (not present on the server), a JSDOM-based sanitiser
+(large, and its own supply-chain surface), or an XML parser with the same
+entity-expansion problems this is guarding against. What runs here is a
+restrictive rewrite over a small grammar, and the tests are the argument for it.
+*/
+/** Elements a logo or icon legitimately contains. Everything else is removed. */
+const ALLOWED_ELEMENTS = new Set([
+    'circle',
+    'clippath',
+    'defs',
+    'ellipse',
+    'g',
+    'line',
+    'lineargradient',
+    'mask',
+    'path',
+    'polygon',
+    'polyline',
+    'radialgradient',
+    'rect',
+    'stop',
+    'svg',
+    'symbol',
+    'title',
+    'use',
+]);
+/**
+ * Attributes those elements may carry.
+ *
+ * Presentation attributes and geometry, and nothing that names a destination.
+ * `href` and `xlink:href` are absent deliberately: an external `<use>` pulls a
+ * document from somewhere else, and a `javascript:` href in an `<a>` is a
+ * script by another name. A logo referencing another file is not a logo.
+ */
+const ALLOWED_ATTRIBUTES = new Set([
+    'clip-path',
+    'clip-rule',
+    'cx',
+    'cy',
+    'd',
+    'fill',
+    'fill-opacity',
+    'fill-rule',
+    'gradienttransform',
+    'gradientunits',
+    'height',
+    'id',
+    'mask',
+    'offset',
+    'opacity',
+    'points',
+    'preserveaspectratio',
+    'r',
+    'rx',
+    'ry',
+    'stop-color',
+    'stop-opacity',
+    'stroke',
+    'stroke-dasharray',
+    'stroke-linecap',
+    'stroke-linejoin',
+    'stroke-miterlimit',
+    'stroke-opacity',
+    'stroke-width',
+    'style',
+    'transform',
+    'viewbox',
+    'width',
+    'x',
+    'x1',
+    'x2',
+    'xmlns',
+    'y',
+    'y1',
+    'y2',
+]);
+/**
+ * Rewrite an SVG to the allowlist above.
+ *
+ * `removed` is a set of short labels — `<script>`, `onload`, `href` — rather
+ * than the offending source, because the caller puts them in front of an editor
+ * and a truncated payload is neither reassuring nor useful.
+ */
+export function sanitizeSvg(source) {
+    const removed = new Set();
+    let svg = source;
+    /*
+    Comments first, and before anything else looks at the string. A comment can
+    contain a `>` or a partial tag, so a later pass that trusted tag boundaries
+    would read the wrong ones. Removing them also removes the usual hiding place
+    for a payload assembled by something downstream.
+    */
+    svg = svg.replace(/<!--[\s\S]*?-->/g, '');
+    /*
+    Doctype and entity declarations. `<!DOCTYPE svg [<!ENTITY xxe SYSTEM
+    "file:///etc/passwd">]>` is the XXE that makes a picture read a file, and
+    billion-laughs is the same construct pointed at memory. Nothing a logo needs
+    lives in a DTD.
+    */
+    svg = svg.replace(/<!DOCTYPE[\s\S]*?>/gi, () => {
+        removed.add('<!DOCTYPE>');
+        return '';
+    });
+    svg = svg.replace(/<!ENTITY[\s\S]*?>/gi, () => {
+        removed.add('<!ENTITY>');
+        return '';
+    });
+    /*
+    Elements that carry executable or embedded content, removed with their
+    contents rather than just their tags — an unwrapped `<script>` body is still
+    the script, sitting as text where a later consumer may find it.
+    */
+    for (const name of ['script', 'foreignObject', 'iframe', 'embed', 'object', 'annotation-xml']) {
+        const withContents = new RegExp(`<${name}\\b[\\s\\S]*?</${name}\\s*>`, 'gi');
+        const selfClosing = new RegExp(`<${name}\\b[^>]*/?>`, 'gi');
+        svg = svg.replace(withContents, () => {
+            removed.add(`<${name}>`);
+            return '';
+        });
+        svg = svg.replace(selfClosing, () => {
+            removed.add(`<${name}>`);
+            return '';
+        });
+    }
+    /*
+    `<style>` goes too, contents and all. CSS in an SVG can reach the network
+    through `@import` and `url()`, and a logo's colours belong on the shapes.
+    */
+    svg = svg.replace(/<style\b[\s\S]*?<\/style\s*>/gi, () => {
+        removed.add('<style>');
+        return '';
+    });
+    /*
+    `<animate>` and friends are removed for one specific reason rather than a
+    general dislike of animation: `<set attributeName="onload" to="alert(1)">`
+    writes an event handler onto its parent at run time, so an attribute filter
+    alone does not hold.
+    */
+    for (const name of ['animate', 'animateMotion', 'animateTransform', 'set']) {
+        svg = svg.replace(new RegExp(`<${name}\\b[^>]*/?>`, 'gi'), () => {
+            removed.add(`<${name}>`);
+            return '';
+        });
+        svg = svg.replace(new RegExp(`<${name}\\b[\\s\\S]*?</${name}\\s*>`, 'gi'), () => {
+            removed.add(`<${name}>`);
+            return '';
+        });
+    }
+    // Every remaining tag, filtered to the allowlist and its attributes cleaned.
+    svg = svg.replace(/<\/?([a-zA-Z][\w:-]*)((?:[^>"']|"[^"]*"|'[^']*')*)>/g, (tag, rawName, rawAttrs) => {
+        /*
+      Lowercase to *look up*, and emit what was written. SVG element and
+      attribute names are case-sensitive — `viewBox`, `linearGradient`,
+      `clipPath`, `preserveAspectRatio` — so a sanitiser that normalised case
+      would hand back a document that passes every check here and renders as
+      nothing, which is a worse failure than refusing it.
+      */
+        const name = String(rawName);
+        const lookup = name.toLowerCase();
+        if (!ALLOWED_ELEMENTS.has(lookup)) {
+            removed.add(`<${lookup}>`);
+            return '';
+        }
+        if (tag.startsWith('</'))
+            return `</${name}>`;
+        const attrs = String(rawAttrs);
+        const kept = [];
+        for (const match of attrs.matchAll(/([a-zA-Z_:][\w:.-]*)\s*=\s*("[^"]*"|'[^']*'|[^\s"'>]+)/g)) {
+            const attrName = match[1];
+            const attrLookup = attrName.toLowerCase();
+            const rawValue = match[2];
+            const value = rawValue.replace(/^["']|["']$/g, '');
+            if (!ALLOWED_ATTRIBUTES.has(attrLookup) || attrLookup.startsWith('on')) {
+                removed.add(attrLookup);
+                continue;
+            }
+            /*
+          A `style` that reaches the network is not styling. `url(` covers
+          `background-image`, `@import` covers a stylesheet, and both are the whole
+          of how CSS inside an SVG fetches anything.
+          */
+            if (attrLookup === 'style' && /url\s*\(|@import|expression\s*\(/i.test(value)) {
+                removed.add('style');
+                continue;
+            }
+            /*
+          A scheme smuggled past the attribute allowlist. Entities and control
+          characters are stripped before the test because `java&#115;cript:` and
+          `java\tscript:` both parse as the scheme in a browser and neither matches
+          a naive comparison.
+          */
+            const collapsed = value
+                .replace(/&#[xX]?[0-9a-fA-F]+;?/g, '')
+                // A NUL or a tab inside `java\u0000script:` is still the scheme to a
+                // browser, so stripping control characters is the point rather than
+                // an accident — which is what the rule below is there to catch.
+                // eslint-disable-next-line no-control-regex
+                .replace(/[\s\u0000-\u001F]/g, '');
+            if (/^(javascript|data|vbscript):/i.test(collapsed)) {
+                removed.add(attrLookup);
+                continue;
+            }
+            kept.push(`${attrName}=${rawValue.startsWith('"') || rawValue.startsWith("'") ? rawValue : `"${value}"`}`);
+        }
+        const selfClosing = attrs.trimEnd().endsWith('/') ? ' /' : '';
+        return kept.length > 0
+            ? `<${name} ${kept.join(' ')}${selfClosing}>`
+            : `<${name}${selfClosing}>`;
+    });
+    return { svg, removed: [...removed].sort() };
+}
+/** Whether a sanitised document still contains an `<svg>` root worth storing. */
+export function isRenderableSvg(svg) {
+    return /<svg[\s>]/i.test(svg);
+}
+//# sourceMappingURL=svg.js.map

package/dist/media/svg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg.js","sourceRoot":"","sources":["../../src/media/svg.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BE;AAEF,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,GAAG;IACH,MAAM;IACN,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,SAAS;IACT,UAAU;IACV,gBAAgB;IAChB,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,OAAO;IACP,KAAK;CACN,CAAC,CAAA;AAEF;;;;;;;GAOG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,WAAW;IACX,WAAW;IACX,IAAI;IACJ,IAAI;IACJ,GAAG;IACH,MAAM;IACN,cAAc;IACd,WAAW;IACX,mBAAmB;IACnB,eAAe;IACf,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,qBAAqB;IACrB,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,kBAAkB;IAClB,gBAAgB;IAChB,iBAAiB;IACjB,mBAAmB;IACnB,gBAAgB;IAChB,cAAc;IACd,OAAO;IACP,WAAW;IACX,SAAS;IACT,OAAO;IACP,GAAG;IACH,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,GAAG;IACH,IAAI;IACJ,IAAI;CACL,CAAC,CAAA;AASF;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;IACjC,IAAI,GAAG,GAAG,MAAM,CAAA;IAEhB;;;;;MAKE;IACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;IAEzC;;;;;MAKE;IACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC7C,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACzB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QACxB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF;;;;MAIE;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC9F,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,kBAAkB,IAAI,OAAO,EAAE,IAAI,CAAC,CAAA;QAC5E,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa,EAAE,IAAI,CAAC,CAAA;QAC3D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,EAAE;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;YACxB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE;YAClC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;YACxB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;MAGE;IACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACvD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACtB,OAAO,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;IAEF;;;;;MAKE;IACF,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,aAAa,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE;YAC9D,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;YACxB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,IAAI,kBAAkB,IAAI,OAAO,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAA;YACxB,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,6EAA6E;IAC7E,GAAG,GAAG,GAAG,CAAC,OAAO,CACf,sDAAsD,EACtD,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACzB;;;;;;QAMA;QACA,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;QAEjC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,CAAA;YAC1B,OAAO,EAAE,CAAA;QACX,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,IAAI,GAAG,CAAA;QAE7C,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAa,EAAE,CAAA;QAEzB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,QAAQ,CAChC,yDAAyD,CAC1D,EAAE,CAAC;YACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;YAC1B,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAA;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;YAC1B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAA;YAElD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACvB,SAAQ;YACV,CAAC;YAED;;;;YAIA;YACA,IAAI,UAAU,KAAK,OAAO,IAAI,mCAAmC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9E,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,SAAQ;YACV,CAAC;YAED;;;;;YAKA;YACA,MAAM,SAAS,GAAG,KAAK;iBACpB,OAAO,CAAC,wBAAwB,EAAE,EAAE,CAAC;gBACtC,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,4CAA4C;iBAC3C,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAA;YACpC,IAAI,+BAA+B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACvB,SAAQ;YACV,CAAC;YAED,IAAI,CAAC,IAAI,CACP,GAAG,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,EAAE,CAChG,CAAA;QACH,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,WAAW,GAAG;YAC7C,CAAC,CAAC,IAAI,IAAI,GAAG,WAAW,GAAG,CAAA;IAC/B,CAAC,CACF,CAAA;IAED,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAA;AAC9C,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/B,CAAC"}

package/dist/media/uploadKey.d.ts

@@ -0,0 +1,25 @@
+import type { Field } from 'payload';
+/**
+ * A folder for one upload: eight bytes, hex. Unguessable is the requirement, not
+ * uniqueness, and `randomBytes` rather than `Math.random` because this is the
+ * only thing between one upload and another's file.
+ */
+export declare function uniqueUploadPrefix(): string;
+/**
+ * The `prefix` field: generated once when the document's form is built, hidden,
+ * and read by the cloud-storage plugin. See the warning above before adding it
+ * to a collection that already has documents.
+ */
+export declare function uploadPrefixField(): Field;
+/** What a media document says about where its file is. */
+export interface KeyParts {
+    prefix?: string | null | undefined;
+    filename?: string | null | undefined;
+}
+/**
+ * The object key for a document's own file, through the plugin's `getFileKey`
+ * so it cannot drift from the key the plugin writes. `collectionPrefix` is the
+ * adapter's own `prefix` option, empty unless configured.
+ */
+export declare function storageKey({ prefix, filename }: KeyParts, collectionPrefix?: string): string;
+//# sourceMappingURL=uploadKey.d.ts.map

package/dist/media/uploadKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadKey.d.ts","sourceRoot":"","sources":["../../src/media/uploadKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAsCpC;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,IAAI,KAAK,CAOzC;AAED,0DAA0D;AAC1D,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CACrC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,gBAAgB,SAAK,GAAG,MAAM,CAIxF"}

package/dist/media/uploadKey.js

@@ -0,0 +1,70 @@
+import { randomBytes } from 'node:crypto';
+import { getFileKey } from '@payloadcms/plugin-cloud-storage/utilities';
+/*
+Where an upload's bytes go, and why every upload gets a folder of its own. From
+forumone-2026's `media/uploadKey.ts`.
+
+## The hole this closes
+
+With `@payloadcms/storage-vercel-blob`'s `clientUploads: true`, the browser PUTs
+straight to Blob with a token minted with `allowOverwrite: true`, hardcoded. So
+the object key is the whole of the access control: anything uploaded under a
+key that already exists **replaces** what is there. With the filename as the
+key, uploading `hero.mp4` a second time replaced the bytes every page using the
+first one showed, live, before any hook ran.
+
+A key nothing else can claim closes it. Two uploads of `hero.mp4` become
+`3f9a1c2e7b4d8a60/hero.mp4` and `c81d05f6a29e4b73/hero.mp4`, and the store stops
+being enumerable by guessing a filename.
+
+## Why a prefix rather than the adapter's random suffix
+
+`addRandomSuffix` returns one Blob-chosen pathname for the original and every
+generated size under a single key, and Payload flattens those so a crop's name
+lands on the document. The prefix is a first-class part of the cloud-storage
+plugin instead: `getFileKey` joins it, `generateURL` and `deleteFile` read it
+back off the document, and the name Payload records stays the editor's.
+
+## The one thing to be careful with
+
+**Existing documents must never acquire a prefix.** The plugin recomputes `url`
+from `prefix` on every read, and Payload fills a field's `defaultValue` whenever
+the stored value is `undefined`, so adding `uploadPrefixField` to a collection
+with documents would give every one of them a fresh folder on read, and every
+file would 404. The migration that adds the column must backfill `''`: an empty
+string is a value, so the default never fires, and `getFileKey` joins it to
+nothing.
+*/
+/**
+ * A folder for one upload: eight bytes, hex. Unguessable is the requirement, not
+ * uniqueness, and `randomBytes` rather than `Math.random` because this is the
+ * only thing between one upload and another's file.
+ */
+export function uniqueUploadPrefix() {
+    return randomBytes(8).toString('hex');
+}
+/**
+ * The `prefix` field: generated once when the document's form is built, hidden,
+ * and read by the cloud-storage plugin. See the warning above before adding it
+ * to a collection that already has documents.
+ */
+export function uploadPrefixField() {
+    return {
+        name: 'prefix',
+        type: 'text',
+        admin: { hidden: true, readOnly: true },
+        defaultValue: () => uniqueUploadPrefix(),
+    };
+}
+/**
+ * The object key for a document's own file, through the plugin's `getFileKey`
+ * so it cannot drift from the key the plugin writes. `collectionPrefix` is the
+ * adapter's own `prefix` option, empty unless configured.
+ */
+export function storageKey({ prefix, filename }, collectionPrefix = '') {
+    if (!filename)
+        return '';
+    const { fileKey } = getFileKey({ collectionPrefix, docPrefix: prefix ?? '', filename });
+    return fileKey;
+}
+//# sourceMappingURL=uploadKey.js.map

package/dist/media/uploadKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uploadKey.js","sourceRoot":"","sources":["../../src/media/uploadKey.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,4CAA4C,CAAA;AAGvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCE;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;QACvC,YAAY,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE;KACzC,CAAA;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAY,EAAE,gBAAgB,GAAG,EAAE;IAC9E,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAA;IACxB,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACvF,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/observability/collection.d.ts

@@ -0,0 +1,13 @@
+import type { Access, CollectionConfig } from 'payload';
+export declare const DEFAULT_JOB_FAILURES_SLUG = "job-failures";
+/** What kind of thing failed. Adding a value is a schema change and needs a migration. */
+export declare const JOB_FAILURE_KINDS: readonly ["job", "healthcheck"];
+export type JobFailureKind = (typeof JOB_FAILURE_KINDS)[number];
+export interface JobFailuresCollectionOptions {
+    /** Override the collection slug. Default: `'job-failures'`. */
+    slug?: string;
+    /** Read access. Default: users with the `admin` role. */
+    readAccess?: Access;
+}
+export declare function createJobFailuresCollection(options?: JobFailuresCollectionOptions): CollectionConfig;
+//# sourceMappingURL=collection.d.ts.map

package/dist/observability/collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../src/observability/collection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAgBvD,eAAO,MAAM,yBAAyB,iBAAiB,CAAA;AAEvD,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,iCAAkC,CAAA;AAChE,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE/D,MAAM,WAAW,4BAA4B;IAC3C,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAOD,wBAAgB,2BAA2B,CACzC,OAAO,GAAE,4BAAiC,GACzC,gBAAgB,CAuDlB"}

package/dist/observability/collection.js

@@ -0,0 +1,76 @@
+/*
+Where a background job's failure is recorded.
+
+Deliberately not the audit log. `audit-events` records who did what through
+an MCP tool — `mcpServer` and `mcpTool` are `NOT NULL`, and every row answers
+"which tool did this". A cron that ran out of retries is not an action anybody
+took; it is an operational fact, with its own fields (a run id, a triggering
+event) and its own lifetime (worth keeping for weeks, not forever). Giving it
+a fake MCP server name would make that column mean nothing.
+
+Read-only from outside the writer, like the audit log: the writer uses the
+Local API, which bypasses these access rules.
+*/
+export const DEFAULT_JOB_FAILURES_SLUG = 'job-failures';
+/** What kind of thing failed. Adding a value is a schema change and needs a migration. */
+export const JOB_FAILURE_KINDS = ['job', 'healthcheck'];
+const adminOnly = ({ req }) => {
+    const roles = req.user?.['roles'] ?? [];
+    return roles.includes('admin');
+};
+export function createJobFailuresCollection(options = {}) {
+    return {
+        slug: options.slug ?? DEFAULT_JOB_FAILURES_SLUG,
+        admin: {
+            useAsTitle: 'summary',
+            defaultColumns: ['createdAt', 'kind', 'source', 'message'],
+            description: 'Background jobs that ran out of retries, and healthchecks that failed. Read-only; written by the failure handlers.',
+        },
+        access: {
+            read: options.readAccess ?? adminOnly,
+            create: () => false,
+            update: () => false,
+            delete: () => false,
+        },
+        fields: [
+            {
+                name: 'createdAt',
+                type: 'date',
+                required: true,
+                defaultValue: () => new Date().toISOString(),
+                admin: { position: 'sidebar', readOnly: true },
+            },
+            {
+                name: 'kind',
+                type: 'select',
+                required: true,
+                options: JOB_FAILURE_KINDS.map((value) => ({ label: value, value })),
+            },
+            {
+                name: 'source',
+                type: 'text',
+                required: true,
+                admin: { description: 'The function or check that failed, e.g. an Inngest function id.' },
+            },
+            { name: 'summary', type: 'text', required: true },
+            { name: 'message', type: 'textarea', required: true },
+            { name: 'errorName', type: 'text' },
+            {
+                name: 'runId',
+                type: 'text',
+                admin: { description: "The run's id in the job runner, for finding it in its dashboard." },
+            },
+            { name: 'triggerEvent', type: 'text' },
+            {
+                name: 'details',
+                type: 'json',
+                admin: { description: 'For a healthcheck: every failed check and what it said.' },
+            },
+            { name: 'environment', type: 'text' },
+            { name: 'commit', type: 'text' },
+        ],
+        indexes: [{ fields: ['createdAt'] }, { fields: ['source', 'createdAt'] }],
+        timestamps: false,
+    };
+}
+//# sourceMappingURL=collection.js.map

package/dist/observability/collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.js","sourceRoot":"","sources":["../../src/observability/collection.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;EAYE;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAAG,cAAc,CAAA;AAEvD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAK,EAAE,aAAa,CAAU,CAAA;AAUhE,MAAM,SAAS,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACpC,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;IACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC,CAAA;AAED,MAAM,UAAU,2BAA2B,CACzC,UAAwC,EAAE;IAE1C,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,yBAAyB;QAC/C,KAAK,EAAE;YACL,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;YAC1D,WAAW,EACT,oHAAoH;SACvH;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,SAAS;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACrE;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,EAAE,WAAW,EAAE,iEAAiE,EAAE;aAC1F;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE;YACrD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;YACnC;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,kEAAkE,EAAE;aAC3F;YACD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;YACtC;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE;aAClF;YACD,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;SACjC;QACD,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QACzE,UAAU,EAAE,KAAK;KAClB,CAAA;AACH,CAAC"}

package/dist/observability/index.d.ts

@@ -0,0 +1,10 @@
+export { DEFAULT_REPORTED_HEADERS, ERROR_WEBHOOK_URL_ENV, NEVER_REPORTED_HEADERS, buildHealthcheckFailureReport, buildJobFailureReport, buildRequestErrorReport, clientPrefix, createErrorReporter, currentDeployment, describeErrorReporting, reportError, summariseReport, } from './report.js';
+export type { BuildJobFailureReportInput, BuildRequestErrorReportOptions, ErrorReport, ErrorReporter, ErrorReporterOptions, HealthcheckFailureReport, JobFailureReport, ReportDeployment, ReportableHeaders, RequestErrorReport, } from './report.js';
+export { DEFAULT_JOB_FAILURES_SLUG, JOB_FAILURE_KINDS, createJobFailuresCollection, } from './collection.js';
+export type { JobFailureKind, JobFailuresCollectionOptions } from './collection.js';
+export { createJobFailureWriter } from './writer.js';
+export type { JobFailureWriter, JobFailureWriterOptions } from './writer.js';
+export { getJobFailureWriter, jobFailuresPlugin } from './plugin.js';
+export type { JobFailuresPluginOptions } from './plugin.js';
+export { OBSERVABILITY_TOOLS, OBSERVABILITY_TOOL_DESCRIPTORS, createListJobFailuresTool, } from './tool.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/observability/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,YAAY,EACV,0BAA0B,EAC1B,8BAA8B,EAC9B,WAAW,EACX,aAAa,EACb,oBAAoB,EACpB,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AAEnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AACpD,YAAY,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AAE5E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpE,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAE3D,OAAO,EACL,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,WAAW,CAAA"}

package/dist/observability/index.js

@@ -0,0 +1,6 @@
+export { DEFAULT_REPORTED_HEADERS, ERROR_WEBHOOK_URL_ENV, NEVER_REPORTED_HEADERS, buildHealthcheckFailureReport, buildJobFailureReport, buildRequestErrorReport, clientPrefix, createErrorReporter, currentDeployment, describeErrorReporting, reportError, summariseReport, } from './report.js';
+export { DEFAULT_JOB_FAILURES_SLUG, JOB_FAILURE_KINDS, createJobFailuresCollection, } from './collection.js';
+export { createJobFailureWriter } from './writer.js';
+export { getJobFailureWriter, jobFailuresPlugin } from './plugin.js';
+export { OBSERVABILITY_TOOLS, OBSERVABILITY_TOOL_DESCRIPTORS, createListJobFailuresTool, } from './tool.js';
+//# sourceMappingURL=index.js.map

package/dist/observability/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/observability/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,aAAa,CAAA;AAcpB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAA;AAGpD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAGpE,OAAO,EACL,mBAAmB,EACnB,8BAA8B,EAC9B,yBAAyB,GAC1B,MAAM,WAAW,CAAA"}

package/dist/observability/plugin.d.ts

@@ -0,0 +1,24 @@
+import { type BaseCorePluginOptions, type CorePlugin } from '../plugin-contract/index.js';
+import { type JobFailuresCollectionOptions } from './collection.js';
+import { type JobFailureWriter } from './writer.js';
+import type { McpToolCollector } from '../mcp/collector.js';
+export interface JobFailuresPluginOptions extends BaseCorePluginOptions, JobFailuresCollectionOptions {
+    /** Where `list_job_failures` goes. Omit for no MCP tool. Must come before `mcpPlugin`. */
+    mcpTools?: McpToolCollector;
+}
+/**
+ * Adds the `job-failures` collection and attaches its writer to the Payload
+ * instance, where `getJobFailureWriter` — and the workflows package's failure
+ * handlers — find it.
+ */
+export declare const jobFailuresPlugin: CorePlugin<JobFailuresPluginOptions>;
+/**
+ * The writer `jobFailuresPlugin` attached, or `undefined` when the plugin is
+ * not registered.
+ *
+ * Unlike `getAuditWriter` this does not throw: it is called from failure
+ * handlers, which fall back to logging and reporting when there is nowhere
+ * to write.
+ */
+export declare function getJobFailureWriter(payload: object): JobFailureWriter | undefined;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/observability/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/observability/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EAEhB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAA+B,KAAK,4BAA4B,EAAE,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAA0B,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAG3E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAO3D,MAAM,WAAW,wBACf,SAAQ,qBAAqB,EAAE,4BAA4B;IAC3D,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC5B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,UAAU,CAAC,wBAAwB,CAwChE,CAAA;AAEH;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAEjF"}

package/dist/observability/plugin.js

@@ -0,0 +1,59 @@
+import { getPluginRegistry, } from '../plugin-contract/index.js';
+import { createJobFailuresCollection } from './collection.js';
+import { createJobFailureWriter } from './writer.js';
+import { defaultLogger } from '../logger/index.js';
+import { OBSERVABILITY_TOOL_DESCRIPTORS, createListJobFailuresTool } from './tool.js';
+const PLUGIN_ID = '@forumone/throughline/observability';
+const PLUGIN_VERSION = '0.1.0';
+const WRITER_SYMBOL = Symbol.for('@forumone/throughline/job-failure-writer');
+/**
+ * Adds the `job-failures` collection and attaches its writer to the Payload
+ * instance, where `getJobFailureWriter` — and the workflows package's failure
+ * handlers — find it.
+ */
+export const jobFailuresPlugin = (options) => (incomingConfig) => {
+    if (options.enabled === false)
+        return incomingConfig;
+    options.mcpTools?.declare(OBSERVABILITY_TOOL_DESCRIPTORS, { serverName: 'observability' });
+    return {
+        ...incomingConfig,
+        collections: [...(incomingConfig.collections ?? []), createJobFailuresCollection(options)],
+        onInit: async (payload) => {
+            if (incomingConfig.onInit)
+                await incomingConfig.onInit(payload);
+            Object.defineProperty(payload, WRITER_SYMBOL, {
+                value: createJobFailureWriter({
+                    payload,
+                    collectionSlug: options.slug,
+                    logger: options.logger ?? defaultLogger,
+                }),
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            options.mcpTools?.add([
+                createListJobFailuresTool({
+                    payload,
+                    ...(options.slug ? { slug: options.slug } : {}),
+                }),
+            ], { serverName: 'observability' });
+            getPluginRegistry(payload).register({
+                id: PLUGIN_ID,
+                version: PLUGIN_VERSION,
+                capabilities: ['job-failures'],
+            });
+        },
+    };
+};
+/**
+ * The writer `jobFailuresPlugin` attached, or `undefined` when the plugin is
+ * not registered.
+ *
+ * Unlike `getAuditWriter` this does not throw: it is called from failure
+ * handlers, which fall back to logging and reporting when there is nowhere
+ * to write.
+ */
+export function getJobFailureWriter(payload) {
+    return payload[WRITER_SYMBOL];
+}
+//# sourceMappingURL=plugin.js.map

package/dist/observability/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/observability/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,iBAAiB,GAClB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,2BAA2B,EAAqC,MAAM,iBAAiB,CAAA;AAChG,OAAO,EAAE,sBAAsB,EAAyB,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGlD,OAAO,EAAE,8BAA8B,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAErF,MAAM,SAAS,GAAG,qCAAqC,CAAA;AACvD,MAAM,cAAc,GAAG,OAAO,CAAA;AAC9B,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAA;AAQ5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEpD,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,8BAA8B,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAA;IAE1F,OAAO;QACL,GAAG,cAAc;QACjB,WAAW,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAC1F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,cAAc,CAAC,MAAM;gBAAE,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAE/D,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE;gBAC5C,KAAK,EAAE,sBAAsB,CAAC;oBAC5B,OAAO;oBACP,cAAc,EAAE,OAAO,CAAC,IAAI;oBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa;iBACxC,CAAC;gBACF,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,OAAO,CAAC,QAAQ,EAAE,GAAG,CACnB;gBACE,yBAAyB,CAAC;oBACxB,OAAO;oBACP,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAChD,CAAC;aAC+B,EACnC,EAAE,UAAU,EAAE,eAAe,EAAE,CAChC,CAAA;YAED,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;gBAClC,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,cAAc,CAAC;aAC/B,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,OAAQ,OAAmC,CAAC,aAAa,CAAiC,CAAA;AAC5F,CAAC"}