@humaan/payload-storage-imagekit 2.9.0 → 2.9.2

package/README.md

@@ -24,6 +24,24 @@ pnpm add @humaan/payload-storage-imagekit
 Payload `3.90.1` or newer is required. Use matching versions of `payload` and
 `@payloadcms/plugin-cloud-storage`.
 
+### Maintainer releases
+
+In **Actions → Start release**, set `release_branch` to the branch to release from
+(default: `main`). The version/changelog PR targets that branch. Stable `2.x`
+releases continue from `main`; for Payload v4, select `feat/payload-v4-beta`,
+`release_type: custom`, and `custom_version: 3.0.0-canary.0` (increment the canary
+number for subsequent releases). The v4 feature PR does not need to merge.
+
+Non-main releases must be prereleases. `canary` versions publish under the npm
+`canary` tag without changing `latest`, after the release commit passes push CI.
+For a publication dry run or receipt-based recovery, choose the same branch in
+**Publish release (automatic)**. Recovery still requires the original receipt run
+ID and the `publish` confirmation.
+
+The shared `humaan/actions@v2` update must be deployed first, and these caller
+workflow changes must be present on the selected branch. The `release` environment
+must permit that branch under its deployment policy.
+
 ## Usage
 
 ```ts
@@ -57,7 +75,7 @@ export default buildConfig({
 
 `imagekitStorage(options)` options:
 
-- `collections` (required): `Partial<Record<UploadCollectionSlug, true | { focalPoint?: boolean; private?: boolean }>>`. Use `true` for a normal (public) collection, `{ focalPoint: true }` to enable Payload's native focal-point picker for that collection, or `{ private: true }` to deliver the collection's files as ImageKit [private files](#private-files).
+- `collections` (required): `Partial<Record<UploadCollectionSlug, true | { fileSizeLimit?: number; focalPoint?: boolean; private?: boolean }>>`. Use `true` for a normal (public) collection, `{ focalPoint: true }` to enable Payload's native focal-point picker for that collection, `{ private: true }` to deliver the collection's files as ImageKit [private files](#private-files), or `{ fileSizeLimit }` to set a [per-collection upload size limit](#file-size-limits).
 - `folder` (required): root upload folder in ImageKit, e.g. `/payload-uploads`
 - `privateKey` (required): ImageKit private API key
 - `publicKey` (required): ImageKit public key
@@ -243,6 +261,39 @@ upload: {
 The adapter streams Payload temporary files to ImageKit for server-side uploads,
 rather than loading those files into a second buffer.
 
+## File size limits
+
+Payload's `upload.limits.fileSize` applies to every upload collection, including
+client uploads: the authorization endpoint rejects a larger file before ImageKit
+receives it, and the signed `"file.size"` check binds ImageKit to the authorized size.
+
+A collection's `fileSizeLimit` (bytes) applies on top of that limit, so it can only
+tighten it. Set Payload's limit to the largest size any collection allows, then lower
+it for the others:
+
+```ts
+export default buildConfig({
+  upload: {
+    limits: {
+      fileSize: 25 * 1024 * 1024,
+    },
+  },
+  plugins: [
+    imagekitStorage({
+      clientUploads: true,
+      collections: {
+        images: { fileSizeLimit: 10 * 1024 * 1024 },
+        videos: true,
+      },
+      // ...
+    }),
+  ],
+})
+```
+
+Client uploads that exceed a collection's limit are rejected at authorization. Server
+uploads are rejected before they are sent to ImageKit.
+
 ## Folder and account migration
 
 Use `migrateFolder` to copy referenced originals between folders or ImageKit accounts (e.g. staging to production). It updates the supplied Payload database in place and retains source assets.
@@ -318,6 +369,12 @@ paths are flattened into the destination collection folder; collisions are repor
 history and account-specific custom metadata schemas are not transferred. Run one migration per
 destination at a time; concurrent runs may report a conflict recoverable on a subsequent run.
 
+On MongoDB, migration updates use the database adapter directly so the old `_objectKey` can be
+removed in the same write as the new storage reference. Writing `null` would collide with the
+legacy sparse unique index. These metadata updates bypass Payload validation and change hooks,
+including cache revalidation; refresh application caches after the migration. Already uploaded
+files from an interrupted 2.9.0 migration can be recovered by rerunning with this fix.
+
 Run a migration script:
 
 ```bash

package/dist/endpoints/createImageKitUploadAuthHandler.d.ts

@@ -2,6 +2,7 @@ import type { ClientUploadsAccess } from '@payloadcms/plugin-cloud-storage/types
 import type { PayloadHandler, UploadCollectionSlug } from 'payload';
 import type { createImageKitClientUploadVerifier } from '../clientUploadVerification.js';
 type ImageKitUploadCollection = {
+    fileSizeLimit?: number;
     isPrivate: boolean;
     prefix: string;
 };

package/dist/endpoints/createImageKitUploadAuthHandler.js

@@ -5,9 +5,9 @@ import { APIError, Forbidden } from 'payload';
 import { assertClientUploadAccess, assertClientUploadAllowed, assertClientUploadFileSize, createClientUploadReceipt, getSafeFileName, verifyClientUploadReceipt } from 'payload/internal';
 import { getSanitizedUploadFilename, validateMimeType } from 'payload/shared';
 import { isImageKitReceiptContext } from '../clientUploads.js';
+import { assertWithinFileSizeLimit } from '../fileSizeLimit.js';
 import { createImageKitUploadToken } from '../imageKitUploadToken.js';
 const defaultAccess = ({ req })=>Boolean(req.user);
-const bytesToMB = (bytes)=>(bytes / 1024 / 1024).toFixed(2);
 const getMimeTypeEssence = (mimeType)=>(mimeType.split(';', 1)[0] || '').trim().toLowerCase();
 const getImageKitSafeFilename = (filename)=>getSanitizedUploadFilename(filename).replace(/[^\w.-]/g, '_');
 // ImageKit can't match Payload's `+xml` suffix rule, so name the XML-family types it may detect.
@@ -148,10 +148,8 @@ export const createImageKitUploadAuthHandler = ({ access = defaultAccess, collec
         if (allowedMimeTypes.length > 0 && !validateMimeType(expectedMimeType, allowedMimeTypes)) {
             throw new APIError(`File type ${expectedMimeType} is not allowed.`, 400);
         }
-        const filesizeLimit = req.payload.config.upload.limits?.fileSize;
-        if (typeof filesizeLimit === 'number' && Number.isFinite(filesizeLimit) && requestedSize > filesizeLimit) {
-            throw new APIError(`Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit)}MB, got: ${bytesToMB(requestedSize)}MB`, 400);
-        }
+        assertWithinFileSizeLimit(requestedSize, req.payload.config.upload.limits?.fileSize);
+        assertWithinFileSizeLimit(requestedSize, imageKitCollection.fileSizeLimit);
         const sanitizedFilename = await getSafeFileName({
             collectionSlug,
             desiredFilename: getImageKitSafeFilename(filename),

package/dist/endpoints/createImageKitUploadAuthHandler.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoints/createImageKitUploadAuthHandler.ts"],"sourcesContent":["import type { ClientUploadsAccess } from '@payloadcms/plugin-cloud-storage/types'\nimport type { PayloadHandler, UploadCollectionSlug } from 'payload'\n\nimport { buildUploadStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { randomUUID } from 'node:crypto'\nimport { posix } from 'node:path'\nimport { APIError, Forbidden } from 'payload'\nimport {\n  assertClientUploadAccess,\n  assertClientUploadAllowed,\n  assertClientUploadFileSize,\n  createClientUploadReceipt,\n  getSafeFileName,\n  verifyClientUploadReceipt,\n} from 'payload/internal'\nimport { getSanitizedUploadFilename, validateMimeType } from 'payload/shared'\n\nimport type {\n  ImageKitReceiptContext,\n  ImageKitUploadAuthorization,\n  ImageKitUploadCompletion,\n  ImageKitUploadPayload,\n} from '../clientUploads.js'\nimport type { createImageKitClientUploadVerifier } from '../clientUploadVerification.js'\n\nimport { isImageKitReceiptContext } from '../clientUploads.js'\nimport { createImageKitUploadToken } from '../imageKitUploadToken.js'\n\ntype ImageKitUploadCollection = {\n  isPrivate: boolean\n  prefix: string\n}\n\ntype CreateImageKitUploadAuthHandlerArgs = {\n  access?: ClientUploadsAccess\n  collections: Partial<Record<UploadCollectionSlug, ImageKitUploadCollection>>\n  privateKey: string\n  publicKey: string\n  verifyClientUpload: ReturnType<typeof createImageKitClientUploadVerifier>\n}\n\nconst defaultAccess: ClientUploadsAccess = ({ req }) => Boolean(req.user)\n\nconst bytesToMB = (bytes: number): string => (bytes / 1024 / 1024).toFixed(2)\n\nconst getMimeTypeEssence = (mimeType: string): string =>\n  (mimeType.split(';', 1)[0] || '').trim().toLowerCase()\n\nconst getImageKitSafeFilename = (filename: string): string =>\n  getSanitizedUploadFilename(filename).replace(/[^\\w.-]/g, '_')\n\n// ImageKit can't match Payload's `+xml` suffix rule, so name the XML-family types it may detect.\nconst XML_FAMILY_MIME_TYPES = [\n  'application/atom+xml',\n  'application/mathml+xml',\n  'application/rdf+xml',\n  'application/rss+xml',\n  'application/xhtml+xml',\n  'application/xml',\n  'application/xslt+xml',\n  'image/svg+xml',\n  'text/xml',\n]\n\n/**\n * ImageKit evaluates `file.mime` against its own content detection, which can differ from\n * the browser's extension-based type (e.g. `.xltm` is detected as `.xlsx`). Constrain the\n * detected type with the rules completion verification applies, not the browser's claim.\n */\nexport const getUploadChecks = ({\n  allowedMimeTypes,\n  allowRestrictedFileTypes,\n  filesize,\n}: {\n  allowedMimeTypes: string[]\n  allowRestrictedFileTypes: boolean\n  filesize: number\n}): string => {\n  const checks = [`\"file.size\" = ${filesize}`]\n  // Mirror Payload's validateMimeType, which drops the first `*` and matches by prefix.\n  // Entries with quotes or backslashes can't prefix a valid MIME type, so omit them.\n  const prefixes = allowedMimeTypes\n    .map((mimeType) => mimeType.replace('*', ''))\n    .filter((prefix) => !/[\"\\\\]/.test(prefix))\n\n  if (allowedMimeTypes.length > 0 && !prefixes.includes('')) {\n    checks.push(`(${prefixes.map((prefix) => `\"file.mime\" : \"${prefix}\"`).join(' OR ')})`)\n  }\n\n  if (!allowRestrictedFileTypes) {\n    checks.push(`\"file.mime\" NOT IN [${XML_FAMILY_MIME_TYPES.map((type) => `\"${type}\"`).join(', ')}]`)\n  }\n\n  return checks.join(' AND ')\n}\n\n// Continue Payload's numeric suffix convention when the conflict exists only in ImageKit.\nconst nextFilename = (filename: string): string => {\n  const { name, ext } = posix.parse(filename)\n  const suffix = /^(.*)-(\\d+)$/.exec(name)\n  return `${suffix ? `${suffix[1]}-${Number(suffix[2]) + 1}` : `${name}-1`}${ext}`\n}\n\nexport const createImageKitUploadAuthHandler = ({\n  access = defaultAccess,\n  collections,\n  privateKey,\n  publicKey,\n  verifyClientUpload,\n}: CreateImageKitUploadAuthHandlerArgs): PayloadHandler => {\n  return async (req) => {\n    if (!req.json) {\n      throw new APIError('Content-Type expected to be application/json', 400)\n    }\n\n    const body = (await req.json()) as {\n      action?: unknown\n      collectionSlug?: unknown\n      fileId?: unknown\n      filename?: unknown\n      filesize?: unknown\n      mimeType?: unknown\n      signedReceipt?: unknown\n    }\n    const { action, collectionSlug, fileId, signedReceipt } = body\n    let { filename, filesize, mimeType } = body\n\n    if (typeof collectionSlug !== 'string' || !Object.hasOwn(collections, collectionSlug)) {\n      throw new APIError('Invalid upload payload.', 400)\n    }\n\n    await assertClientUploadAccess({ collectionSlug, req })\n\n    const imageKitCollection = collections[collectionSlug]\n    if (!imageKitCollection) {\n      throw new APIError(`Collection ${collectionSlug} was not found in ImageKit options.`, 400)\n    }\n\n    if (!(await access({ collectionSlug, req }))) {\n      throw new Forbidden(req.t)\n    }\n\n    if (action === 'complete') {\n      if (typeof fileId !== 'string' || !fileId.trim() || typeof signedReceipt !== 'string') {\n        throw new APIError('Invalid ImageKit upload completion payload.', 400)\n      }\n      const receipt = verifyClientUploadReceipt({ collectionSlug, req, signedReceipt })\n      if (\n        !isImageKitReceiptContext(receipt.context) ||\n        receipt.filename !== receipt.context.filename ||\n        (receipt.context.fileId !== undefined && receipt.context.fileId !== fileId)\n      ) {\n        throw new APIError('Invalid ImageKit client upload context.', 400)\n      }\n\n      // The browser supplies a lookup ID, not proof. Check provider state against the\n      // original signed authorization before including that ID in a new signed receipt.\n      const context: ImageKitReceiptContext = { ...receipt.context, fileId }\n      await verifyClientUpload({ collectionSlug, context })\n      delete context.uploadTag\n      const response: ImageKitUploadCompletion = {\n        clientUploadContext: {\n          _objectKey: context._objectKey,\n          prefix: context.prefix,\n          signedReceipt: createClientUploadReceipt({\n            collectionSlug,\n            context,\n            filename: context.filename,\n            req,\n          }),\n        },\n      }\n      return Response.json(response, { headers: { 'Cache-Control': 'no-store' } })\n    }\n\n    if (action === 'retry') {\n      if (typeof signedReceipt !== 'string') {\n        throw new APIError('Invalid ImageKit upload retry payload.', 400)\n      }\n      const receipt = verifyClientUploadReceipt({ collectionSlug, req, signedReceipt })\n      if (\n        !isImageKitReceiptContext(receipt.context) ||\n        receipt.filename !== receipt.context.filename ||\n        receipt.context.fileId !== undefined\n      ) {\n        throw new APIError('Invalid ImageKit upload retry payload.', 400)\n      }\n      filename = nextFilename(receipt.context.filename)\n      filesize = receipt.context.expectedSize\n      mimeType = receipt.context.expectedMimeType\n    }\n\n    if (\n      (action !== undefined && action !== 'retry') ||\n      typeof filename !== 'string' ||\n      typeof mimeType !== 'string'\n    ) {\n      throw new APIError('Invalid upload payload.', 400)\n    }\n\n    assertClientUploadAllowed({\n      collection: req.payload.collections[collectionSlug]?.config,\n      filename,\n      mimeType,\n    })\n    assertClientUploadFileSize(filesize)\n\n    const requestedSize = filesize as number\n    const expectedMimeType = getMimeTypeEssence(mimeType)\n    if (!expectedMimeType) {\n      throw new APIError('A valid MIME type is required for ImageKit client uploads.', 400)\n    }\n\n    const collectionConfig = req.payload.collections[collectionSlug]?.config\n    const allowedMimeTypes =\n      collectionConfig &&\n      typeof collectionConfig.upload === 'object' &&\n      Array.isArray(collectionConfig.upload.mimeTypes)\n        ? collectionConfig.upload.mimeTypes\n        : []\n\n    if (allowedMimeTypes.length > 0 && !validateMimeType(expectedMimeType, allowedMimeTypes)) {\n      throw new APIError(`File type ${expectedMimeType} is not allowed.`, 400)\n    }\n\n    const filesizeLimit = req.payload.config.upload.limits?.fileSize\n\n    if (\n      typeof filesizeLimit === 'number' &&\n      Number.isFinite(filesizeLimit) &&\n      requestedSize > filesizeLimit\n    ) {\n      throw new APIError(\n        `Exceeded file size limit. Limit: ${bytesToMB(filesizeLimit)}MB, got: ${bytesToMB(requestedSize)}MB`,\n        400,\n      )\n    }\n\n    const sanitizedFilename = await getSafeFileName({\n      collectionSlug,\n      desiredFilename: getImageKitSafeFilename(filename),\n      req,\n    })\n    const resolved = buildUploadStoragePathData({\n      collectionPrefix: imageKitCollection.prefix,\n      docPrefix: imageKitCollection.prefix,\n      filename: sanitizedFilename,\n    })\n    const folder = `/${resolved.storageFilePath.slice(0, -(sanitizedFilename.length + 1))}`\n    const uploadTag = `payload-upload-${randomUUID()}`\n    const uploadPayload: ImageKitUploadPayload = {\n      checks: getUploadChecks({\n        allowedMimeTypes,\n        allowRestrictedFileTypes:\n          typeof collectionConfig?.upload === 'object' &&\n          Boolean(collectionConfig.upload.allowRestrictedFileTypes),\n        filesize: requestedSize,\n      }),\n      fileName: sanitizedFilename,\n      folder,\n      isPrivateFile: imageKitCollection.isPrivate ? 'true' : 'false',\n      overwriteFile: 'false',\n      tags: uploadTag,\n      useUniqueFileName: 'false',\n    }\n    const receiptContext: ImageKitReceiptContext = {\n      collectionSlug,\n      expectedMimeType,\n      expectedSize: requestedSize,\n      filename: sanitizedFilename,\n      isPrivate: imageKitCollection.isPrivate,\n      prefix: resolved.sanitizedDocPrefix,\n      uploadTag,\n    }\n    const response: ImageKitUploadAuthorization = {\n      clientUploadContext: {\n        prefix: resolved.sanitizedDocPrefix,\n        signedReceipt: createClientUploadReceipt({\n          collectionSlug,\n          context: receiptContext,\n          filename: sanitizedFilename,\n          req,\n        }),\n      },\n      filename: sanitizedFilename,\n      token: createImageKitUploadToken({ privateKey, publicKey, uploadPayload }),\n      uploadPayload,\n    }\n\n    return Response.json(response, {\n      headers: {\n        'Cache-Control': 'no-store',\n      },\n    })\n  }\n}\n"],"names":["buildUploadStoragePathData","randomUUID","posix","APIError","Forbidden","assertClientUploadAccess","assertClientUploadAllowed","assertClientUploadFileSize","createClientUploadReceipt","getSafeFileName","verifyClientUploadReceipt","getSanitizedUploadFilename","validateMimeType","isImageKitReceiptContext","createImageKitUploadToken","defaultAccess","req","Boolean","user","bytesToMB","bytes","toFixed","getMimeTypeEssence","mimeType","split","trim","toLowerCase","getImageKitSafeFilename","filename","replace","XML_FAMILY_MIME_TYPES","getUploadChecks","allowedMimeTypes","allowRestrictedFileTypes","filesize","checks","prefixes","map","filter","prefix","test","length","includes","push","join","type","nextFilename","name","ext","parse","suffix","exec","Number","createImageKitUploadAuthHandler","access","collections","privateKey","publicKey","verifyClientUpload","json","body","action","collectionSlug","fileId","signedReceipt","Object","hasOwn","imageKitCollection","t","receipt","context","undefined","uploadTag","response","clientUploadContext","_objectKey","Response","headers","expectedSize","expectedMimeType","collection","payload","config","requestedSize","collectionConfig","upload","Array","isArray","mimeTypes","filesizeLimit","limits","fileSize","isFinite","sanitizedFilename","desiredFilename","resolved","collectionPrefix","docPrefix","folder","storageFilePath","slice","uploadPayload","fileName","isPrivateFile","isPrivate","overwriteFile","tags","useUniqueFileName","receiptContext","sanitizedDocPrefix","token"],"mappings":"AAGA,SAASA,0BAA0B,QAAQ,6CAA4C;AACvF,SAASC,UAAU,QAAQ,cAAa;AACxC,SAASC,KAAK,QAAQ,YAAW;AACjC,SAASC,QAAQ,EAAEC,SAAS,QAAQ,UAAS;AAC7C,SACEC,wBAAwB,EACxBC,yBAAyB,EACzBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,eAAe,EACfC,yBAAyB,QACpB,mBAAkB;AACzB,SAASC,0BAA0B,EAAEC,gBAAgB,QAAQ,iBAAgB;AAU7E,SAASC,wBAAwB,QAAQ,sBAAqB;AAC9D,SAASC,yBAAyB,QAAQ,4BAA2B;AAerE,MAAMC,gBAAqC,CAAC,EAAEC,GAAG,EAAE,GAAKC,QAAQD,IAAIE,IAAI;AAExE,MAAMC,YAAY,CAACC,QAA0B,AAACA,CAAAA,QAAQ,OAAO,IAAG,EAAGC,OAAO,CAAC;AAE3E,MAAMC,qBAAqB,CAACC,WAC1B,AAACA,CAAAA,SAASC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAC,EAAGC,IAAI,GAAGC,WAAW;AAEtD,MAAMC,0BAA0B,CAACC,WAC/BjB,2BAA2BiB,UAAUC,OAAO,CAAC,YAAY;AAE3D,iGAAiG;AACjG,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB,CAAC,EAC9BC,gBAAgB,EAChBC,wBAAwB,EACxBC,QAAQ,EAKT;IACC,MAAMC,SAAS;QAAC,CAAC,cAAc,EAAED,UAAU;KAAC;IAC5C,sFAAsF;IACtF,mFAAmF;IACnF,MAAME,WAAWJ,iBACdK,GAAG,CAAC,CAACd,WAAaA,SAASM,OAAO,CAAC,KAAK,KACxCS,MAAM,CAAC,CAACC,SAAW,CAAC,QAAQC,IAAI,CAACD;IAEpC,IAAIP,iBAAiBS,MAAM,GAAG,KAAK,CAACL,SAASM,QAAQ,CAAC,KAAK;QACzDP,OAAOQ,IAAI,CAAC,CAAC,CAAC,EAAEP,SAASC,GAAG,CAAC,CAACE,SAAW,CAAC,eAAe,EAAEA,OAAO,CAAC,CAAC,EAAEK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvF;IAEA,IAAI,CAACX,0BAA0B;QAC7BE,OAAOQ,IAAI,CAAC,CAAC,oBAAoB,EAAEb,sBAAsBO,GAAG,CAAC,CAACQ,OAAS,CAAC,CAAC,EAAEA,KAAK,CAAC,CAAC,EAAED,IAAI,CAAC,MAAM,CAAC,CAAC;IACnG;IAEA,OAAOT,OAAOS,IAAI,CAAC;AACrB,EAAC;AAED,0FAA0F;AAC1F,MAAME,eAAe,CAAClB;IACpB,MAAM,EAAEmB,IAAI,EAAEC,GAAG,EAAE,GAAG9C,MAAM+C,KAAK,CAACrB;IAClC,MAAMsB,SAAS,eAAeC,IAAI,CAACJ;IACnC,OAAO,GAAGG,SAAS,GAAGA,MAAM,CAAC,EAAE,CAAC,CAAC,EAAEE,OAAOF,MAAM,CAAC,EAAE,IAAI,GAAG,GAAG,GAAGH,KAAK,EAAE,CAAC,GAAGC,KAAK;AAClF;AAEA,OAAO,MAAMK,kCAAkC,CAAC,EAC9CC,SAASvC,aAAa,EACtBwC,WAAW,EACXC,UAAU,EACVC,SAAS,EACTC,kBAAkB,EACkB;IACpC,OAAO,OAAO1C;QACZ,IAAI,CAACA,IAAI2C,IAAI,EAAE;YACb,MAAM,IAAIxD,SAAS,gDAAgD;QACrE;QAEA,MAAMyD,OAAQ,MAAM5C,IAAI2C,IAAI;QAS5B,MAAM,EAAEE,MAAM,EAAEC,cAAc,EAAEC,MAAM,EAAEC,aAAa,EAAE,GAAGJ;QAC1D,IAAI,EAAEhC,QAAQ,EAAEM,QAAQ,EAAEX,QAAQ,EAAE,GAAGqC;QAEvC,IAAI,OAAOE,mBAAmB,YAAY,CAACG,OAAOC,MAAM,CAACX,aAAaO,iBAAiB;YACrF,MAAM,IAAI3D,SAAS,2BAA2B;QAChD;QAEA,MAAME,yBAAyB;YAAEyD;YAAgB9C;QAAI;QAErD,MAAMmD,qBAAqBZ,WAAW,CAACO,eAAe;QACtD,IAAI,CAACK,oBAAoB;YACvB,MAAM,IAAIhE,SAAS,CAAC,WAAW,EAAE2D,eAAe,mCAAmC,CAAC,EAAE;QACxF;QAEA,IAAI,CAAE,MAAMR,OAAO;YAAEQ;YAAgB9C;QAAI,IAAK;YAC5C,MAAM,IAAIZ,UAAUY,IAAIoD,CAAC;QAC3B;QAEA,IAAIP,WAAW,YAAY;YACzB,IAAI,OAAOE,WAAW,YAAY,CAACA,OAAOtC,IAAI,MAAM,OAAOuC,kBAAkB,UAAU;gBACrF,MAAM,IAAI7D,SAAS,+CAA+C;YACpE;YACA,MAAMkE,UAAU3D,0BAA0B;gBAAEoD;gBAAgB9C;gBAAKgD;YAAc;YAC/E,IACE,CAACnD,yBAAyBwD,QAAQC,OAAO,KACzCD,QAAQzC,QAAQ,KAAKyC,QAAQC,OAAO,CAAC1C,QAAQ,IAC5CyC,QAAQC,OAAO,CAACP,MAAM,KAAKQ,aAAaF,QAAQC,OAAO,CAACP,MAAM,KAAKA,QACpE;gBACA,MAAM,IAAI5D,SAAS,2CAA2C;YAChE;YAEA,gFAAgF;YAChF,kFAAkF;YAClF,MAAMmE,UAAkC;gBAAE,GAAGD,QAAQC,OAAO;gBAAEP;YAAO;YACrE,MAAML,mBAAmB;gBAAEI;gBAAgBQ;YAAQ;YACnD,OAAOA,QAAQE,SAAS;YACxB,MAAMC,WAAqC;gBACzCC,qBAAqB;oBACnBC,YAAYL,QAAQK,UAAU;oBAC9BpC,QAAQ+B,QAAQ/B,MAAM;oBACtByB,eAAexD,0BAA0B;wBACvCsD;wBACAQ;wBACA1C,UAAU0C,QAAQ1C,QAAQ;wBAC1BZ;oBACF;gBACF;YACF;YACA,OAAO4D,SAASjB,IAAI,CAACc,UAAU;gBAAEI,SAAS;oBAAE,iBAAiB;gBAAW;YAAE;QAC5E;QAEA,IAAIhB,WAAW,SAAS;YACtB,IAAI,OAAOG,kBAAkB,UAAU;gBACrC,MAAM,IAAI7D,SAAS,0CAA0C;YAC/D;YACA,MAAMkE,UAAU3D,0BAA0B;gBAAEoD;gBAAgB9C;gBAAKgD;YAAc;YAC/E,IACE,CAACnD,yBAAyBwD,QAAQC,OAAO,KACzCD,QAAQzC,QAAQ,KAAKyC,QAAQC,OAAO,CAAC1C,QAAQ,IAC7CyC,QAAQC,OAAO,CAACP,MAAM,KAAKQ,WAC3B;gBACA,MAAM,IAAIpE,SAAS,0CAA0C;YAC/D;YACAyB,WAAWkB,aAAauB,QAAQC,OAAO,CAAC1C,QAAQ;YAChDM,WAAWmC,QAAQC,OAAO,CAACQ,YAAY;YACvCvD,WAAW8C,QAAQC,OAAO,CAACS,gBAAgB;QAC7C;QAEA,IACE,AAAClB,WAAWU,aAAaV,WAAW,WACpC,OAAOjC,aAAa,YACpB,OAAOL,aAAa,UACpB;YACA,MAAM,IAAIpB,SAAS,2BAA2B;QAChD;QAEAG,0BAA0B;YACxB0E,YAAYhE,IAAIiE,OAAO,CAAC1B,WAAW,CAACO,eAAe,EAAEoB;YACrDtD;YACAL;QACF;QACAhB,2BAA2B2B;QAE3B,MAAMiD,gBAAgBjD;QACtB,MAAM6C,mBAAmBzD,mBAAmBC;QAC5C,IAAI,CAACwD,kBAAkB;YACrB,MAAM,IAAI5E,SAAS,8DAA8D;QACnF;QAEA,MAAMiF,mBAAmBpE,IAAIiE,OAAO,CAAC1B,WAAW,CAACO,eAAe,EAAEoB;QAClE,MAAMlD,mBACJoD,oBACA,OAAOA,iBAAiBC,MAAM,KAAK,YACnCC,MAAMC,OAAO,CAACH,iBAAiBC,MAAM,CAACG,SAAS,IAC3CJ,iBAAiBC,MAAM,CAACG,SAAS,GACjC,EAAE;QAER,IAAIxD,iBAAiBS,MAAM,GAAG,KAAK,CAAC7B,iBAAiBmE,kBAAkB/C,mBAAmB;YACxF,MAAM,IAAI7B,SAAS,CAAC,UAAU,EAAE4E,iBAAiB,gBAAgB,CAAC,EAAE;QACtE;QAEA,MAAMU,gBAAgBzE,IAAIiE,OAAO,CAACC,MAAM,CAACG,MAAM,CAACK,MAAM,EAAEC;QAExD,IACE,OAAOF,kBAAkB,YACzBrC,OAAOwC,QAAQ,CAACH,kBAChBN,gBAAgBM,eAChB;YACA,MAAM,IAAItF,SACR,CAAC,iCAAiC,EAAEgB,UAAUsE,eAAe,SAAS,EAAEtE,UAAUgE,eAAe,EAAE,CAAC,EACpG;QAEJ;QAEA,MAAMU,oBAAoB,MAAMpF,gBAAgB;YAC9CqD;YACAgC,iBAAiBnE,wBAAwBC;YACzCZ;QACF;QACA,MAAM+E,WAAW/F,2BAA2B;YAC1CgG,kBAAkB7B,mBAAmB5B,MAAM;YAC3C0D,WAAW9B,mBAAmB5B,MAAM;YACpCX,UAAUiE;QACZ;QACA,MAAMK,SAAS,CAAC,CAAC,EAAEH,SAASI,eAAe,CAACC,KAAK,CAAC,GAAG,CAAEP,CAAAA,kBAAkBpD,MAAM,GAAG,CAAA,IAAK;QACvF,MAAM+B,YAAY,CAAC,eAAe,EAAEvE,cAAc;QAClD,MAAMoG,gBAAuC;YAC3ClE,QAAQJ,gBAAgB;gBACtBC;gBACAC,0BACE,OAAOmD,kBAAkBC,WAAW,YACpCpE,QAAQmE,iBAAiBC,MAAM,CAACpD,wBAAwB;gBAC1DC,UAAUiD;YACZ;YACAmB,UAAUT;YACVK;YACAK,eAAepC,mBAAmBqC,SAAS,GAAG,SAAS;YACvDC,eAAe;YACfC,MAAMlC;YACNmC,mBAAmB;QACrB;QACA,MAAMC,iBAAyC;YAC7C9C;YACAiB;YACAD,cAAcK;YACdvD,UAAUiE;YACVW,WAAWrC,mBAAmBqC,SAAS;YACvCjE,QAAQwD,SAASc,kBAAkB;YACnCrC;QACF;QACA,MAAMC,WAAwC;YAC5CC,qBAAqB;gBACnBnC,QAAQwD,SAASc,kBAAkB;gBACnC7C,eAAexD,0BAA0B;oBACvCsD;oBACAQ,SAASsC;oBACThF,UAAUiE;oBACV7E;gBACF;YACF;YACAY,UAAUiE;YACViB,OAAOhG,0BAA0B;gBAAE0C;gBAAYC;gBAAW4C;YAAc;YACxEA;QACF;QAEA,OAAOzB,SAASjB,IAAI,CAACc,UAAU;YAC7BI,SAAS;gBACP,iBAAiB;YACnB;QACF;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/endpoints/createImageKitUploadAuthHandler.ts"],"sourcesContent":["import type { ClientUploadsAccess } from '@payloadcms/plugin-cloud-storage/types'\nimport type { PayloadHandler, UploadCollectionSlug } from 'payload'\n\nimport { buildUploadStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { randomUUID } from 'node:crypto'\nimport { posix } from 'node:path'\nimport { APIError, Forbidden } from 'payload'\nimport {\n  assertClientUploadAccess,\n  assertClientUploadAllowed,\n  assertClientUploadFileSize,\n  createClientUploadReceipt,\n  getSafeFileName,\n  verifyClientUploadReceipt,\n} from 'payload/internal'\nimport { getSanitizedUploadFilename, validateMimeType } from 'payload/shared'\n\nimport type {\n  ImageKitReceiptContext,\n  ImageKitUploadAuthorization,\n  ImageKitUploadCompletion,\n  ImageKitUploadPayload,\n} from '../clientUploads.js'\nimport type { createImageKitClientUploadVerifier } from '../clientUploadVerification.js'\n\nimport { isImageKitReceiptContext } from '../clientUploads.js'\nimport { assertWithinFileSizeLimit } from '../fileSizeLimit.js'\nimport { createImageKitUploadToken } from '../imageKitUploadToken.js'\n\ntype ImageKitUploadCollection = {\n  fileSizeLimit?: number\n  isPrivate: boolean\n  prefix: string\n}\n\ntype CreateImageKitUploadAuthHandlerArgs = {\n  access?: ClientUploadsAccess\n  collections: Partial<Record<UploadCollectionSlug, ImageKitUploadCollection>>\n  privateKey: string\n  publicKey: string\n  verifyClientUpload: ReturnType<typeof createImageKitClientUploadVerifier>\n}\n\nconst defaultAccess: ClientUploadsAccess = ({ req }) => Boolean(req.user)\n\nconst getMimeTypeEssence = (mimeType: string): string =>\n  (mimeType.split(';', 1)[0] || '').trim().toLowerCase()\n\nconst getImageKitSafeFilename = (filename: string): string =>\n  getSanitizedUploadFilename(filename).replace(/[^\\w.-]/g, '_')\n\n// ImageKit can't match Payload's `+xml` suffix rule, so name the XML-family types it may detect.\nconst XML_FAMILY_MIME_TYPES = [\n  'application/atom+xml',\n  'application/mathml+xml',\n  'application/rdf+xml',\n  'application/rss+xml',\n  'application/xhtml+xml',\n  'application/xml',\n  'application/xslt+xml',\n  'image/svg+xml',\n  'text/xml',\n]\n\n/**\n * ImageKit evaluates `file.mime` against its own content detection, which can differ from\n * the browser's extension-based type (e.g. `.xltm` is detected as `.xlsx`). Constrain the\n * detected type with the rules completion verification applies, not the browser's claim.\n */\nexport const getUploadChecks = ({\n  allowedMimeTypes,\n  allowRestrictedFileTypes,\n  filesize,\n}: {\n  allowedMimeTypes: string[]\n  allowRestrictedFileTypes: boolean\n  filesize: number\n}): string => {\n  const checks = [`\"file.size\" = ${filesize}`]\n  // Mirror Payload's validateMimeType, which drops the first `*` and matches by prefix.\n  // Entries with quotes or backslashes can't prefix a valid MIME type, so omit them.\n  const prefixes = allowedMimeTypes\n    .map((mimeType) => mimeType.replace('*', ''))\n    .filter((prefix) => !/[\"\\\\]/.test(prefix))\n\n  if (allowedMimeTypes.length > 0 && !prefixes.includes('')) {\n    checks.push(`(${prefixes.map((prefix) => `\"file.mime\" : \"${prefix}\"`).join(' OR ')})`)\n  }\n\n  if (!allowRestrictedFileTypes) {\n    checks.push(`\"file.mime\" NOT IN [${XML_FAMILY_MIME_TYPES.map((type) => `\"${type}\"`).join(', ')}]`)\n  }\n\n  return checks.join(' AND ')\n}\n\n// Continue Payload's numeric suffix convention when the conflict exists only in ImageKit.\nconst nextFilename = (filename: string): string => {\n  const { name, ext } = posix.parse(filename)\n  const suffix = /^(.*)-(\\d+)$/.exec(name)\n  return `${suffix ? `${suffix[1]}-${Number(suffix[2]) + 1}` : `${name}-1`}${ext}`\n}\n\nexport const createImageKitUploadAuthHandler = ({\n  access = defaultAccess,\n  collections,\n  privateKey,\n  publicKey,\n  verifyClientUpload,\n}: CreateImageKitUploadAuthHandlerArgs): PayloadHandler => {\n  return async (req) => {\n    if (!req.json) {\n      throw new APIError('Content-Type expected to be application/json', 400)\n    }\n\n    const body = (await req.json()) as {\n      action?: unknown\n      collectionSlug?: unknown\n      fileId?: unknown\n      filename?: unknown\n      filesize?: unknown\n      mimeType?: unknown\n      signedReceipt?: unknown\n    }\n    const { action, collectionSlug, fileId, signedReceipt } = body\n    let { filename, filesize, mimeType } = body\n\n    if (typeof collectionSlug !== 'string' || !Object.hasOwn(collections, collectionSlug)) {\n      throw new APIError('Invalid upload payload.', 400)\n    }\n\n    await assertClientUploadAccess({ collectionSlug, req })\n\n    const imageKitCollection = collections[collectionSlug]\n    if (!imageKitCollection) {\n      throw new APIError(`Collection ${collectionSlug} was not found in ImageKit options.`, 400)\n    }\n\n    if (!(await access({ collectionSlug, req }))) {\n      throw new Forbidden(req.t)\n    }\n\n    if (action === 'complete') {\n      if (typeof fileId !== 'string' || !fileId.trim() || typeof signedReceipt !== 'string') {\n        throw new APIError('Invalid ImageKit upload completion payload.', 400)\n      }\n      const receipt = verifyClientUploadReceipt({ collectionSlug, req, signedReceipt })\n      if (\n        !isImageKitReceiptContext(receipt.context) ||\n        receipt.filename !== receipt.context.filename ||\n        (receipt.context.fileId !== undefined && receipt.context.fileId !== fileId)\n      ) {\n        throw new APIError('Invalid ImageKit client upload context.', 400)\n      }\n\n      // The browser supplies a lookup ID, not proof. Check provider state against the\n      // original signed authorization before including that ID in a new signed receipt.\n      const context: ImageKitReceiptContext = { ...receipt.context, fileId }\n      await verifyClientUpload({ collectionSlug, context })\n      delete context.uploadTag\n      const response: ImageKitUploadCompletion = {\n        clientUploadContext: {\n          _objectKey: context._objectKey,\n          prefix: context.prefix,\n          signedReceipt: createClientUploadReceipt({\n            collectionSlug,\n            context,\n            filename: context.filename,\n            req,\n          }),\n        },\n      }\n      return Response.json(response, { headers: { 'Cache-Control': 'no-store' } })\n    }\n\n    if (action === 'retry') {\n      if (typeof signedReceipt !== 'string') {\n        throw new APIError('Invalid ImageKit upload retry payload.', 400)\n      }\n      const receipt = verifyClientUploadReceipt({ collectionSlug, req, signedReceipt })\n      if (\n        !isImageKitReceiptContext(receipt.context) ||\n        receipt.filename !== receipt.context.filename ||\n        receipt.context.fileId !== undefined\n      ) {\n        throw new APIError('Invalid ImageKit upload retry payload.', 400)\n      }\n      filename = nextFilename(receipt.context.filename)\n      filesize = receipt.context.expectedSize\n      mimeType = receipt.context.expectedMimeType\n    }\n\n    if (\n      (action !== undefined && action !== 'retry') ||\n      typeof filename !== 'string' ||\n      typeof mimeType !== 'string'\n    ) {\n      throw new APIError('Invalid upload payload.', 400)\n    }\n\n    assertClientUploadAllowed({\n      collection: req.payload.collections[collectionSlug]?.config,\n      filename,\n      mimeType,\n    })\n    assertClientUploadFileSize(filesize)\n\n    const requestedSize = filesize as number\n    const expectedMimeType = getMimeTypeEssence(mimeType)\n    if (!expectedMimeType) {\n      throw new APIError('A valid MIME type is required for ImageKit client uploads.', 400)\n    }\n\n    const collectionConfig = req.payload.collections[collectionSlug]?.config\n    const allowedMimeTypes =\n      collectionConfig &&\n      typeof collectionConfig.upload === 'object' &&\n      Array.isArray(collectionConfig.upload.mimeTypes)\n        ? collectionConfig.upload.mimeTypes\n        : []\n\n    if (allowedMimeTypes.length > 0 && !validateMimeType(expectedMimeType, allowedMimeTypes)) {\n      throw new APIError(`File type ${expectedMimeType} is not allowed.`, 400)\n    }\n\n    assertWithinFileSizeLimit(requestedSize, req.payload.config.upload.limits?.fileSize)\n    assertWithinFileSizeLimit(requestedSize, imageKitCollection.fileSizeLimit)\n\n    const sanitizedFilename = await getSafeFileName({\n      collectionSlug,\n      desiredFilename: getImageKitSafeFilename(filename),\n      req,\n    })\n    const resolved = buildUploadStoragePathData({\n      collectionPrefix: imageKitCollection.prefix,\n      docPrefix: imageKitCollection.prefix,\n      filename: sanitizedFilename,\n    })\n    const folder = `/${resolved.storageFilePath.slice(0, -(sanitizedFilename.length + 1))}`\n    const uploadTag = `payload-upload-${randomUUID()}`\n    const uploadPayload: ImageKitUploadPayload = {\n      checks: getUploadChecks({\n        allowedMimeTypes,\n        allowRestrictedFileTypes:\n          typeof collectionConfig?.upload === 'object' &&\n          Boolean(collectionConfig.upload.allowRestrictedFileTypes),\n        filesize: requestedSize,\n      }),\n      fileName: sanitizedFilename,\n      folder,\n      isPrivateFile: imageKitCollection.isPrivate ? 'true' : 'false',\n      overwriteFile: 'false',\n      tags: uploadTag,\n      useUniqueFileName: 'false',\n    }\n    const receiptContext: ImageKitReceiptContext = {\n      collectionSlug,\n      expectedMimeType,\n      expectedSize: requestedSize,\n      filename: sanitizedFilename,\n      isPrivate: imageKitCollection.isPrivate,\n      prefix: resolved.sanitizedDocPrefix,\n      uploadTag,\n    }\n    const response: ImageKitUploadAuthorization = {\n      clientUploadContext: {\n        prefix: resolved.sanitizedDocPrefix,\n        signedReceipt: createClientUploadReceipt({\n          collectionSlug,\n          context: receiptContext,\n          filename: sanitizedFilename,\n          req,\n        }),\n      },\n      filename: sanitizedFilename,\n      token: createImageKitUploadToken({ privateKey, publicKey, uploadPayload }),\n      uploadPayload,\n    }\n\n    return Response.json(response, {\n      headers: {\n        'Cache-Control': 'no-store',\n      },\n    })\n  }\n}\n"],"names":["buildUploadStoragePathData","randomUUID","posix","APIError","Forbidden","assertClientUploadAccess","assertClientUploadAllowed","assertClientUploadFileSize","createClientUploadReceipt","getSafeFileName","verifyClientUploadReceipt","getSanitizedUploadFilename","validateMimeType","isImageKitReceiptContext","assertWithinFileSizeLimit","createImageKitUploadToken","defaultAccess","req","Boolean","user","getMimeTypeEssence","mimeType","split","trim","toLowerCase","getImageKitSafeFilename","filename","replace","XML_FAMILY_MIME_TYPES","getUploadChecks","allowedMimeTypes","allowRestrictedFileTypes","filesize","checks","prefixes","map","filter","prefix","test","length","includes","push","join","type","nextFilename","name","ext","parse","suffix","exec","Number","createImageKitUploadAuthHandler","access","collections","privateKey","publicKey","verifyClientUpload","json","body","action","collectionSlug","fileId","signedReceipt","Object","hasOwn","imageKitCollection","t","receipt","context","undefined","uploadTag","response","clientUploadContext","_objectKey","Response","headers","expectedSize","expectedMimeType","collection","payload","config","requestedSize","collectionConfig","upload","Array","isArray","mimeTypes","limits","fileSize","fileSizeLimit","sanitizedFilename","desiredFilename","resolved","collectionPrefix","docPrefix","folder","storageFilePath","slice","uploadPayload","fileName","isPrivateFile","isPrivate","overwriteFile","tags","useUniqueFileName","receiptContext","sanitizedDocPrefix","token"],"mappings":"AAGA,SAASA,0BAA0B,QAAQ,6CAA4C;AACvF,SAASC,UAAU,QAAQ,cAAa;AACxC,SAASC,KAAK,QAAQ,YAAW;AACjC,SAASC,QAAQ,EAAEC,SAAS,QAAQ,UAAS;AAC7C,SACEC,wBAAwB,EACxBC,yBAAyB,EACzBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,eAAe,EACfC,yBAAyB,QACpB,mBAAkB;AACzB,SAASC,0BAA0B,EAAEC,gBAAgB,QAAQ,iBAAgB;AAU7E,SAASC,wBAAwB,QAAQ,sBAAqB;AAC9D,SAASC,yBAAyB,QAAQ,sBAAqB;AAC/D,SAASC,yBAAyB,QAAQ,4BAA2B;AAgBrE,MAAMC,gBAAqC,CAAC,EAAEC,GAAG,EAAE,GAAKC,QAAQD,IAAIE,IAAI;AAExE,MAAMC,qBAAqB,CAACC,WAC1B,AAACA,CAAAA,SAASC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAC,EAAGC,IAAI,GAAGC,WAAW;AAEtD,MAAMC,0BAA0B,CAACC,WAC/Bf,2BAA2Be,UAAUC,OAAO,CAAC,YAAY;AAE3D,iGAAiG;AACjG,MAAMC,wBAAwB;IAC5B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED;;;;CAIC,GACD,OAAO,MAAMC,kBAAkB,CAAC,EAC9BC,gBAAgB,EAChBC,wBAAwB,EACxBC,QAAQ,EAKT;IACC,MAAMC,SAAS;QAAC,CAAC,cAAc,EAAED,UAAU;KAAC;IAC5C,sFAAsF;IACtF,mFAAmF;IACnF,MAAME,WAAWJ,iBACdK,GAAG,CAAC,CAACd,WAAaA,SAASM,OAAO,CAAC,KAAK,KACxCS,MAAM,CAAC,CAACC,SAAW,CAAC,QAAQC,IAAI,CAACD;IAEpC,IAAIP,iBAAiBS,MAAM,GAAG,KAAK,CAACL,SAASM,QAAQ,CAAC,KAAK;QACzDP,OAAOQ,IAAI,CAAC,CAAC,CAAC,EAAEP,SAASC,GAAG,CAAC,CAACE,SAAW,CAAC,eAAe,EAAEA,OAAO,CAAC,CAAC,EAAEK,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvF;IAEA,IAAI,CAACX,0BAA0B;QAC7BE,OAAOQ,IAAI,CAAC,CAAC,oBAAoB,EAAEb,sBAAsBO,GAAG,CAAC,CAACQ,OAAS,CAAC,CAAC,EAAEA,KAAK,CAAC,CAAC,EAAED,IAAI,CAAC,MAAM,CAAC,CAAC;IACnG;IAEA,OAAOT,OAAOS,IAAI,CAAC;AACrB,EAAC;AAED,0FAA0F;AAC1F,MAAME,eAAe,CAAClB;IACpB,MAAM,EAAEmB,IAAI,EAAEC,GAAG,EAAE,GAAG5C,MAAM6C,KAAK,CAACrB;IAClC,MAAMsB,SAAS,eAAeC,IAAI,CAACJ;IACnC,OAAO,GAAGG,SAAS,GAAGA,MAAM,CAAC,EAAE,CAAC,CAAC,EAAEE,OAAOF,MAAM,CAAC,EAAE,IAAI,GAAG,GAAG,GAAGH,KAAK,EAAE,CAAC,GAAGC,KAAK;AAClF;AAEA,OAAO,MAAMK,kCAAkC,CAAC,EAC9CC,SAASpC,aAAa,EACtBqC,WAAW,EACXC,UAAU,EACVC,SAAS,EACTC,kBAAkB,EACkB;IACpC,OAAO,OAAOvC;QACZ,IAAI,CAACA,IAAIwC,IAAI,EAAE;YACb,MAAM,IAAItD,SAAS,gDAAgD;QACrE;QAEA,MAAMuD,OAAQ,MAAMzC,IAAIwC,IAAI;QAS5B,MAAM,EAAEE,MAAM,EAAEC,cAAc,EAAEC,MAAM,EAAEC,aAAa,EAAE,GAAGJ;QAC1D,IAAI,EAAEhC,QAAQ,EAAEM,QAAQ,EAAEX,QAAQ,EAAE,GAAGqC;QAEvC,IAAI,OAAOE,mBAAmB,YAAY,CAACG,OAAOC,MAAM,CAACX,aAAaO,iBAAiB;YACrF,MAAM,IAAIzD,SAAS,2BAA2B;QAChD;QAEA,MAAME,yBAAyB;YAAEuD;YAAgB3C;QAAI;QAErD,MAAMgD,qBAAqBZ,WAAW,CAACO,eAAe;QACtD,IAAI,CAACK,oBAAoB;YACvB,MAAM,IAAI9D,SAAS,CAAC,WAAW,EAAEyD,eAAe,mCAAmC,CAAC,EAAE;QACxF;QAEA,IAAI,CAAE,MAAMR,OAAO;YAAEQ;YAAgB3C;QAAI,IAAK;YAC5C,MAAM,IAAIb,UAAUa,IAAIiD,CAAC;QAC3B;QAEA,IAAIP,WAAW,YAAY;YACzB,IAAI,OAAOE,WAAW,YAAY,CAACA,OAAOtC,IAAI,MAAM,OAAOuC,kBAAkB,UAAU;gBACrF,MAAM,IAAI3D,SAAS,+CAA+C;YACpE;YACA,MAAMgE,UAAUzD,0BAA0B;gBAAEkD;gBAAgB3C;gBAAK6C;YAAc;YAC/E,IACE,CAACjD,yBAAyBsD,QAAQC,OAAO,KACzCD,QAAQzC,QAAQ,KAAKyC,QAAQC,OAAO,CAAC1C,QAAQ,IAC5CyC,QAAQC,OAAO,CAACP,MAAM,KAAKQ,aAAaF,QAAQC,OAAO,CAACP,MAAM,KAAKA,QACpE;gBACA,MAAM,IAAI1D,SAAS,2CAA2C;YAChE;YAEA,gFAAgF;YAChF,kFAAkF;YAClF,MAAMiE,UAAkC;gBAAE,GAAGD,QAAQC,OAAO;gBAAEP;YAAO;YACrE,MAAML,mBAAmB;gBAAEI;gBAAgBQ;YAAQ;YACnD,OAAOA,QAAQE,SAAS;YACxB,MAAMC,WAAqC;gBACzCC,qBAAqB;oBACnBC,YAAYL,QAAQK,UAAU;oBAC9BpC,QAAQ+B,QAAQ/B,MAAM;oBACtByB,eAAetD,0BAA0B;wBACvCoD;wBACAQ;wBACA1C,UAAU0C,QAAQ1C,QAAQ;wBAC1BT;oBACF;gBACF;YACF;YACA,OAAOyD,SAASjB,IAAI,CAACc,UAAU;gBAAEI,SAAS;oBAAE,iBAAiB;gBAAW;YAAE;QAC5E;QAEA,IAAIhB,WAAW,SAAS;YACtB,IAAI,OAAOG,kBAAkB,UAAU;gBACrC,MAAM,IAAI3D,SAAS,0CAA0C;YAC/D;YACA,MAAMgE,UAAUzD,0BAA0B;gBAAEkD;gBAAgB3C;gBAAK6C;YAAc;YAC/E,IACE,CAACjD,yBAAyBsD,QAAQC,OAAO,KACzCD,QAAQzC,QAAQ,KAAKyC,QAAQC,OAAO,CAAC1C,QAAQ,IAC7CyC,QAAQC,OAAO,CAACP,MAAM,KAAKQ,WAC3B;gBACA,MAAM,IAAIlE,SAAS,0CAA0C;YAC/D;YACAuB,WAAWkB,aAAauB,QAAQC,OAAO,CAAC1C,QAAQ;YAChDM,WAAWmC,QAAQC,OAAO,CAACQ,YAAY;YACvCvD,WAAW8C,QAAQC,OAAO,CAACS,gBAAgB;QAC7C;QAEA,IACE,AAAClB,WAAWU,aAAaV,WAAW,WACpC,OAAOjC,aAAa,YACpB,OAAOL,aAAa,UACpB;YACA,MAAM,IAAIlB,SAAS,2BAA2B;QAChD;QAEAG,0BAA0B;YACxBwE,YAAY7D,IAAI8D,OAAO,CAAC1B,WAAW,CAACO,eAAe,EAAEoB;YACrDtD;YACAL;QACF;QACAd,2BAA2ByB;QAE3B,MAAMiD,gBAAgBjD;QACtB,MAAM6C,mBAAmBzD,mBAAmBC;QAC5C,IAAI,CAACwD,kBAAkB;YACrB,MAAM,IAAI1E,SAAS,8DAA8D;QACnF;QAEA,MAAM+E,mBAAmBjE,IAAI8D,OAAO,CAAC1B,WAAW,CAACO,eAAe,EAAEoB;QAClE,MAAMlD,mBACJoD,oBACA,OAAOA,iBAAiBC,MAAM,KAAK,YACnCC,MAAMC,OAAO,CAACH,iBAAiBC,MAAM,CAACG,SAAS,IAC3CJ,iBAAiBC,MAAM,CAACG,SAAS,GACjC,EAAE;QAER,IAAIxD,iBAAiBS,MAAM,GAAG,KAAK,CAAC3B,iBAAiBiE,kBAAkB/C,mBAAmB;YACxF,MAAM,IAAI3B,SAAS,CAAC,UAAU,EAAE0E,iBAAiB,gBAAgB,CAAC,EAAE;QACtE;QAEA/D,0BAA0BmE,eAAehE,IAAI8D,OAAO,CAACC,MAAM,CAACG,MAAM,CAACI,MAAM,EAAEC;QAC3E1E,0BAA0BmE,eAAehB,mBAAmBwB,aAAa;QAEzE,MAAMC,oBAAoB,MAAMjF,gBAAgB;YAC9CmD;YACA+B,iBAAiBlE,wBAAwBC;YACzCT;QACF;QACA,MAAM2E,WAAW5F,2BAA2B;YAC1C6F,kBAAkB5B,mBAAmB5B,MAAM;YAC3CyD,WAAW7B,mBAAmB5B,MAAM;YACpCX,UAAUgE;QACZ;QACA,MAAMK,SAAS,CAAC,CAAC,EAAEH,SAASI,eAAe,CAACC,KAAK,CAAC,GAAG,CAAEP,CAAAA,kBAAkBnD,MAAM,GAAG,CAAA,IAAK;QACvF,MAAM+B,YAAY,CAAC,eAAe,EAAErE,cAAc;QAClD,MAAMiG,gBAAuC;YAC3CjE,QAAQJ,gBAAgB;gBACtBC;gBACAC,0BACE,OAAOmD,kBAAkBC,WAAW,YACpCjE,QAAQgE,iBAAiBC,MAAM,CAACpD,wBAAwB;gBAC1DC,UAAUiD;YACZ;YACAkB,UAAUT;YACVK;YACAK,eAAenC,mBAAmBoC,SAAS,GAAG,SAAS;YACvDC,eAAe;YACfC,MAAMjC;YACNkC,mBAAmB;QACrB;QACA,MAAMC,iBAAyC;YAC7C7C;YACAiB;YACAD,cAAcK;YACdvD,UAAUgE;YACVW,WAAWpC,mBAAmBoC,SAAS;YACvChE,QAAQuD,SAASc,kBAAkB;YACnCpC;QACF;QACA,MAAMC,WAAwC;YAC5CC,qBAAqB;gBACnBnC,QAAQuD,SAASc,kBAAkB;gBACnC5C,eAAetD,0BAA0B;oBACvCoD;oBACAQ,SAASqC;oBACT/E,UAAUgE;oBACVzE;gBACF;YACF;YACAS,UAAUgE;YACViB,OAAO5F,0BAA0B;gBAAEuC;gBAAYC;gBAAW2C;YAAc;YACxEA;QACF;QAEA,OAAOxB,SAASjB,IAAI,CAACc,UAAU;YAC7BI,SAAS;gBACP,iBAAiB;YACnB;QACF;IACF;AACF,EAAC"}

package/dist/fileSizeLimit.d.ts

@@ -0,0 +1,6 @@
+export declare const isValidFileSizeLimit: (value: unknown) => value is number;
+/**
+ * Rejects a file larger than `limit` bytes. An undefined or non-finite limit (Payload's
+ * `upload.limits.fileSize` accepts `Infinity`) means no limit.
+ */
+export declare const assertWithinFileSizeLimit: (size: number, limit: number | undefined) => void;

package/dist/fileSizeLimit.js

@@ -0,0 +1,13 @@
+import { APIError } from 'payload';
+const bytesToMB = (bytes)=>(bytes / 1024 / 1024).toFixed(2);
+export const isValidFileSizeLimit = (value)=>typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
+/**
+ * Rejects a file larger than `limit` bytes. An undefined or non-finite limit (Payload's
+ * `upload.limits.fileSize` accepts `Infinity`) means no limit.
+ */ export const assertWithinFileSizeLimit = (size, limit)=>{
+    if (typeof limit === 'number' && Number.isFinite(limit) && size > limit) {
+        throw new APIError(`Exceeded file size limit. Limit: ${bytesToMB(limit)}MB, got: ${bytesToMB(size)}MB`, 400);
+    }
+};
+
+//# sourceMappingURL=fileSizeLimit.js.map

package/dist/fileSizeLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/fileSizeLimit.ts"],"sourcesContent":["import { APIError } from 'payload'\n\nconst bytesToMB = (bytes: number): string => (bytes / 1024 / 1024).toFixed(2)\n\nexport const isValidFileSizeLimit = (value: unknown): value is number =>\n  typeof value === 'number' && Number.isSafeInteger(value) && value > 0\n\n/**\n * Rejects a file larger than `limit` bytes. An undefined or non-finite limit (Payload's\n * `upload.limits.fileSize` accepts `Infinity`) means no limit.\n */\nexport const assertWithinFileSizeLimit = (size: number, limit: number | undefined): void => {\n  if (typeof limit === 'number' && Number.isFinite(limit) && size > limit) {\n    throw new APIError(\n      `Exceeded file size limit. Limit: ${bytesToMB(limit)}MB, got: ${bytesToMB(size)}MB`,\n      400,\n    )\n  }\n}\n"],"names":["APIError","bytesToMB","bytes","toFixed","isValidFileSizeLimit","value","Number","isSafeInteger","assertWithinFileSizeLimit","size","limit","isFinite"],"mappings":"AAAA,SAASA,QAAQ,QAAQ,UAAS;AAElC,MAAMC,YAAY,CAACC,QAA0B,AAACA,CAAAA,QAAQ,OAAO,IAAG,EAAGC,OAAO,CAAC;AAE3E,OAAO,MAAMC,uBAAuB,CAACC,QACnC,OAAOA,UAAU,YAAYC,OAAOC,aAAa,CAACF,UAAUA,QAAQ,EAAC;AAEvE;;;CAGC,GACD,OAAO,MAAMG,4BAA4B,CAACC,MAAcC;IACtD,IAAI,OAAOA,UAAU,YAAYJ,OAAOK,QAAQ,CAACD,UAAUD,OAAOC,OAAO;QACvE,MAAM,IAAIV,SACR,CAAC,iCAAiC,EAAEC,UAAUS,OAAO,SAAS,EAAET,UAAUQ,MAAM,EAAE,CAAC,EACnF;IAEJ;AACF,EAAC"}

package/dist/index.d.ts

@@ -1,6 +1,12 @@
 import type { ClientUploadsConfig } from '@payloadcms/plugin-cloud-storage/types';
 import type { Config, UploadCollectionSlug } from 'payload';
 export type ImageKitCollectionOptions = {
+    /**
+     * Maximum upload size in bytes for this collection. Applies on top of Payload's
+     * `upload.limits.fileSize`, so it can only tighten that limit. Client uploads are
+     * rejected before ImageKit authorization; server uploads before they reach ImageKit.
+     */
+    fileSizeLimit?: number;
     /**
      * Override Payload's native focal-point picker (`upload.focalPoint`) for this
      * collection.

package/dist/index.js

@@ -9,6 +9,7 @@ import { validateMimeType } from 'payload/shared';
 import { imageKitUploadAuthPath, isImageKitReceiptContext } from './clientUploads.js';
 import { createImageKitClientUploadVerifier, getClientUploadStorageFilePath } from './clientUploadVerification.js';
 import { createImageKitUploadAuthHandler } from './endpoints/createImageKitUploadAuthHandler.js';
+import { assertWithinFileSizeLimit, isValidFileSizeLimit } from './fileSizeLimit.js';
 import { getAdminThumbnailURL, getPrivateAdminThumbnailURL, isPdfMimeType, isVideoMimeType } from './getAdminThumbnailURL.js';
 import { getImageKitThumbnailSrc, getVideoPosterSrc } from './imageTransforms.js';
 const DEFAULT_SIGNED_URL_EXPIRES_IN = 900;
@@ -22,6 +23,7 @@ const DEFAULT_SIGNED_URL_EXPIRES_IN = 900;
  */ const ORIGINAL_FILE_TRANSFORMATION = 'orig-true';
 const PRIVATE_COLLECTION_DESCRIPTION = 'Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.';
 const isPrivateCollectionConfig = (value)=>value !== true && typeof value === 'object' && value?.private === true;
+const getCollectionFileSizeLimit = (value)=>value !== true && typeof value === 'object' ? value?.fileSizeLimit : undefined;
 const XML_FAMILY_MIME_TYPES = [
     'application/xml',
     'image/svg+xml',
@@ -468,6 +470,13 @@ export const imagekitStorage = (pluginOptions)=>(config)=>{
         if (!collections || Object.keys(collections).length === 0) {
             throw new Error('imagekitStorage: `collections` must include at least one upload collection.');
         }
+        const invalidFileSizeLimitSlugs = Object.entries(collections).filter(([, value])=>{
+            const fileSizeLimit = getCollectionFileSizeLimit(value);
+            return fileSizeLimit !== undefined && !isValidFileSizeLimit(fileSizeLimit);
+        }).map(([slug])=>slug);
+        if (invalidFileSizeLimitSlugs.length > 0) {
+            throw new Error(`imagekitStorage: \`fileSizeLimit\` must be a positive integer number of bytes (${invalidFileSizeLimitSlugs.join(', ')}).`);
+        }
         const privateSlugs = new Set(Object.entries(collections).filter(([, value])=>isPrivateCollectionConfig(value)).map(([slug])=>slug));
         const configuredSlugs = new Set(Object.keys(collections));
         if (disablePayloadAccessControl && privateSlugs.size > 0) {
@@ -516,6 +525,7 @@ export const imagekitStorage = (pluginOptions)=>(config)=>{
                 const isCollectionPrivate = privateSlugs.has(collection.slug);
                 const buildThumbnailURL = (doc)=>isDocumentPrivate(doc, isCollectionPrivate) ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute) : getAdminThumbnailURL(doc);
                 const collectionOptions = collections[collection.slug];
+                const collectionFileSizeLimit = getCollectionFileSizeLimit(collectionOptions);
                 const collectionFocalPoint = collectionOptions !== true && typeof collectionOptions === 'object' && typeof collectionOptions.focalPoint === 'boolean' ? collectionOptions.focalPoint : undefined;
                 // Surface a "this is a private collection" note in the list and edit views.
                 // Preserve an existing string description by appending; leave custom
@@ -574,6 +584,14 @@ export const imagekitStorage = (pluginOptions)=>(config)=>{
                         ],
                         beforeOperation: [
                             ...collection.hooks?.beforeOperation || [],
+                            ({ args, operation, req })=>{
+                                // Client uploads are checked when ImageKit authorization is requested, and
+                                // their verified size is bound to that authorization.
+                                if ((operation === 'create' || operation === 'update') && req.file && !req.file.clientUploadContext) {
+                                    assertWithinFileSizeLimit(req.file.size, collectionFileSizeLimit);
+                                }
+                                return args;
+                            },
                             ({ args, operation, req })=>{
                                 if (operation !== 'create' && operation !== 'update' || req.context?.skipCloudStorage || !req.file || req.file.clientUploadContext || !('data' in args) || !isRecord(args.data) || typeof args.data.prefix !== 'string') {
                                     return args;
@@ -611,6 +629,7 @@ export const imagekitStorage = (pluginOptions)=>(config)=>{
         const uploadCollections = Object.fromEntries(Object.keys(collections).map((collectionSlug)=>[
                 collectionSlug,
                 {
+                    fileSizeLimit: getCollectionFileSizeLimit(collections[collectionSlug]),
                     isPrivate: privateSlugs.has(collectionSlug),
                     prefix: getCollectionFolder(rootFolder, collectionSlug)
                 }

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  Adapter,\n  ClientUploadsConfig,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type {\n  CollectionConfig,\n  CollectionSlug,\n  Config,\n  Field,\n  PayloadRequest,\n  TypeWithID,\n  UploadCollectionSlug,\n  Where,\n} from 'payload'\n\nimport ImageKit, { toFile } from '@imagekit/nodejs'\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport {\n  buildStoragePathData,\n  buildUploadStoragePathData,\n  getStorageFilePath,\n  initClientUploads,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { openAsBlob } from 'node:fs'\nimport path from 'node:path'\nimport { APIError } from 'payload'\nimport {\n  getRangeRequestInfo,\n  isXmlMimeType,\n  UPLOAD_CONTENT_SECURITY_POLICY,\n} from 'payload/internal'\nimport { validateMimeType } from 'payload/shared'\n\nimport type { VerifiedImageKitUpload } from './clientUploadVerification.js'\n\nimport { imageKitUploadAuthPath, isImageKitReceiptContext } from './clientUploads.js'\nimport {\n  createImageKitClientUploadVerifier,\n  getClientUploadStorageFilePath,\n} from './clientUploadVerification.js'\nimport { createImageKitUploadAuthHandler } from './endpoints/createImageKitUploadAuthHandler.js'\nimport {\n  getAdminThumbnailURL,\n  getPrivateAdminThumbnailURL,\n  isPdfMimeType,\n  isVideoMimeType,\n} from './getAdminThumbnailURL.js'\nimport { getImageKitThumbnailSrc, getVideoPosterSrc } from './imageTransforms.js'\n\nexport type ImageKitCollectionOptions = {\n  /**\n   * Override Payload's native focal-point picker (`upload.focalPoint`) for this\n   * collection.\n   */\n  focalPoint?: boolean\n  /**\n   * Upload files in this collection as ImageKit private files (`isPrivateFile: true`)\n   * and deliver them only through short-lived signed URLs, behind Payload access control.\n   */\n  private?: boolean\n}\ntype ImageKitCollectionConfig = ImageKitCollectionOptions | true\ntype ImageKitCollectionMap = Partial<Record<UploadCollectionSlug, ImageKitCollectionConfig>>\n\nconst DEFAULT_SIGNED_URL_EXPIRES_IN = 900\n/**\n * ImageKit re-encodes some uploads and serves the smaller derivative from the plain\n * delivery URL — a 1.9 MB MP4 can come back as 868 KB. That is exactly what we want\n * for visitors, but not when reading the file back to verify a client upload: the\n * bytes and the byte count would both belong to a file ImageKit's API never reported.\n * `orig-true` asks for the untouched original and does not disable optimisation for\n * anyone else.\n */\nconst ORIGINAL_FILE_TRANSFORMATION = 'orig-true'\n\nconst PRIVATE_COLLECTION_DESCRIPTION =\n  'Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.'\n\nconst isPrivateCollectionConfig = (value: ImageKitCollectionConfig | undefined): boolean =>\n  value !== true && typeof value === 'object' && value?.private === true\n\nconst XML_FAMILY_MIME_TYPES = ['application/xml', 'image/svg+xml', 'text/xml']\n\nconst collectionCanStoreXml = (collection: CollectionConfig): boolean => {\n  const upload = collection.upload\n\n  if (!upload || upload === true) {\n    return Boolean(upload)\n  }\n\n  // Payload skips MIME and content restrictions when this escape hatch is enabled.\n  if (upload.allowRestrictedFileTypes) {\n    return true\n  }\n\n  const allowedMimeTypes = upload.mimeTypes\n\n  return (\n    !allowedMimeTypes?.length ||\n    allowedMimeTypes.some((mimeType) => mimeType.includes('*') || isXmlMimeType(mimeType)) ||\n    XML_FAMILY_MIME_TYPES.some((mimeType) => validateMimeType(mimeType, allowedMimeTypes))\n  )\n}\n\n/**\n * Whether a specific document is private. The flag stored on the document at upload time\n * (`imagekit.isPrivate`) is the source of truth — a file's privacy on ImageKit is fixed\n * when it is uploaded and does not change if the collection's `private` setting changes\n * later. Falls back to the collection setting for documents uploaded before this flag existed.\n */\nconst isDocumentPrivate = (doc: unknown, collectionIsPrivate: boolean): boolean => {\n  const stored = (doc as { imagekit?: { isPrivate?: boolean } } | undefined)?.imagekit?.isPrivate\n\n  return typeof stored === 'boolean' ? stored : collectionIsPrivate\n}\ntype ImageKitReference = {\n  imagekit?: {\n    fileId?: string\n    isPrivate?: boolean\n    thumbnailUrl?: string\n    url?: string\n  }\n}\n\ntype UploadDocumentData = {\n  thumbnailURL?: string\n} & ImageKitReference\n\nexport type PayloadStorageImageKitConfig = {\n  alwaysInsertFields?: boolean\n  clientUploads?: ClientUploadsConfig\n  collections: ImageKitCollectionMap\n  disablePayloadAccessControl?: true\n  enabled?: boolean\n  /**\n   * Broad default for Payload's native focal-point picker (`upload.focalPoint`)\n   * on every configured collection. Focal points are disabled by default for\n   * configured collections, so prefer collection-level `focalPoint: true` for\n   * image collections. A collection's own `upload.focalPoint` still takes\n   * precedence.\n   */\n  focalPoint?: boolean\n  folder: string\n  privateKey: string\n  publicKey: string\n  /**\n   * Expiry (in seconds) applied to signed URLs generated for private collections.\n   * Defaults to 900 (15 minutes). URLs are signed fresh on every request, so a short\n   * window is safe.\n   */\n  signedUrlExpiresIn?: number\n  urlEndpoint: string\n}\n\nconst normalizeFolder = (folder: string): string => {\n  const normalized = folder.trim().replace(/^\\/+|\\/+$/g, '')\n\n  if (!normalized) {\n    throw new Error('imagekitStorage: `folder` is required.')\n  }\n\n  return `/${normalized}`\n}\n\nconst getCollectionFolder = (rootFolder: string, collectionSlug: string): string =>\n  path.posix.join(rootFolder, collectionSlug)\n\nconst findImageKitFileId = async (\n  imagekit: ImageKit,\n  filePath: string,\n): Promise<string | undefined> => {\n  const parentPath = path.posix.dirname(filePath)\n  const name = path.posix.basename(filePath)\n\n  const limit = 100\n\n  for (let skip = 0; ; skip += limit) {\n    const assets = await imagekit.assets.list({\n      type: 'file',\n      limit,\n      path: parentPath === '/' ? '/' : `${parentPath}/`,\n      skip,\n    })\n\n    const found = assets.find(\n      (asset) => 'fileId' in asset && asset.filePath === filePath && asset.name === name,\n    )\n\n    if (found && 'fileId' in found) {\n      return found.fileId\n    }\n\n    if (assets.length < limit) {\n      break\n    }\n  }\n\n  return undefined\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object'\n\nconst getStoredImageKitURL = (doc: unknown): string | undefined => {\n  const storedURL = (doc as ImageKitReference | undefined)?.imagekit?.url\n\n  return typeof storedURL === 'string' && storedURL.trim().length > 0 ? storedURL : undefined\n}\n\nconst hasStoredImageKitURL = (doc: unknown): boolean => !!getStoredImageKitURL(doc)\n\nconst findUploadDocumentByFilename = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: string\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<null | TypeWithID> => {\n  const constraints: Where[] = [\n    {\n      filename: {\n        equals: filename,\n      },\n    },\n  ]\n\n  if (typeof prefix === 'string') {\n    constraints.push({\n      prefix: {\n        equals: prefix,\n      },\n    })\n  }\n\n  return req.payload.db.findOne({\n    collection,\n    req,\n    where: {\n      and: constraints,\n    },\n  })\n}\n\nconst applyVerifiedClientUploadToData = <T extends UploadDocumentData>(\n  data: T,\n  uploaded: VerifiedImageKitUpload,\n  buildThumbnailURL: (data: T) => string = getAdminThumbnailURL,\n  isPrivate: boolean,\n): T => {\n  data.imagekit = {\n    fileId: uploaded.fileId,\n    isPrivate,\n    thumbnailUrl: uploaded.thumbnailUrl,\n    url: uploaded.url,\n  }\n\n  // Preserve the admin preview when the original file was already uploaded client-side.\n  data.thumbnailURL = buildThumbnailURL(data)\n\n  return data\n}\n\nconst imagekitAdapter = ({\n  apiRoute,\n  client,\n  clientUploads,\n  privateSlugs,\n  rootFolder,\n  signedUrlExpiresIn,\n  urlEndpoint,\n  verifyClientUpload,\n}: {\n  apiRoute: string\n  client: ImageKit\n  clientUploads?: ClientUploadsConfig\n  privateSlugs: Set<string>\n  rootFolder: string\n  signedUrlExpiresIn: number\n  urlEndpoint: string\n  verifyClientUpload: ReturnType<typeof createImageKitClientUploadVerifier>\n}): Adapter => {\n  const fetchUploadedFile = async ({\n    fileSize,\n    fileURL,\n    mimeType,\n    range,\n  }: {\n    fileSize: number\n    fileURL: string\n    mimeType: string\n    range?: null | string\n  }): Promise<Response> => {\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader: range ?? null })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    const normalizedRange =\n      rangeResult.type === 'partial'\n        ? `bytes=${rangeResult.rangeStart}-${rangeResult.rangeEnd}`\n        : undefined\n    // Payload cancels image probes after reading a bounded prefix. Next.js memoizes\n    // GET responses by teeing their streams; cancelling one branch can then wait\n    // forever for its unread cached sibling. An explicit signal opts out of that\n    // memoization, while no-store also excludes these reads from the data cache.\n    const response = await fetch(fileURL, {\n      cache: 'no-store',\n      ...(normalizedRange ? { headers: { Range: normalizedRange } } : {}),\n      signal: new AbortController().signal,\n    })\n\n    if (!response.ok || response.status !== rangeResult.status) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error(\n        `imagekitStorage: ImageKit returned an unexpected file response (${response.status}).`,\n      )\n    }\n\n    const upstreamLength = response.headers.get('Content-Length')\n    const expectedLength = rangeResult.headers['Content-Length']\n    const upstreamRange = response.headers.get('Content-Range')\n    const expectedRange =\n      rangeResult.type === 'partial' ? rangeResult.headers['Content-Range'] : undefined\n\n    if (\n      (upstreamLength !== null && upstreamLength !== expectedLength) ||\n      (expectedRange && upstreamRange !== expectedRange)\n    ) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error('imagekitStorage: ImageKit returned mismatched file content metadata.')\n    }\n\n    const headers = new Headers(rangeResult.headers)\n    headers.set('Content-Type', mimeType)\n    if (isXmlMimeType(mimeType)) {\n      headers.set('Content-Security-Policy', UPLOAD_CONTENT_SECURITY_POLICY)\n    }\n\n    return new Response(response.body, {\n      headers,\n      status: response.status,\n    })\n  }\n\n  return ({ collection, prefix = getCollectionFolder(rootFolder, collection.slug) }) => {\n    const isPrivate = privateSlugs.has(collection.slug)\n\n    // Sign a relative ImageKit path against the configured urlEndpoint. We always sign\n    // a computed path (never a stored absolute URL) because ImageKit's signature is\n    // derived from the path after stripping urlEndpoint, so the host must match.\n    const buildSignedURL = (src: string, tr?: null | string): string =>\n      client.helper.buildSrc({\n        expiresIn: signedUrlExpiresIn,\n        signed: true,\n        src,\n        transformation: tr ? [{ raw: tr }] : undefined,\n        urlEndpoint,\n      })\n\n    const buildThumbnailURL = (doc: UploadDocumentData): string =>\n      isDocumentPrivate(doc, isPrivate)\n        ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n        : getAdminThumbnailURL(doc)\n\n    return {\n      name: 'imagekit',\n      clientUploads,\n      fields: [\n        {\n          // Presentational wrapper: tucks the ImageKit details into a closed panel without\n          // changing the `imagekit.*` data paths.\n          type: 'collapsible',\n          admin: {\n            condition: (data) => hasStoredImageKitURL(data),\n            initCollapsed: true,\n          },\n          fields: [\n            {\n              name: 'imagekit',\n              type: 'group',\n              admin: {\n                disableListColumn: true,\n                disableListFilter: true,\n              },\n              fields: [\n                {\n                  name: 'fileId',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n                {\n                  name: 'url',\n                  type: 'text',\n                  admin: {\n                    readOnly: true,\n                  },\n                  label: 'URL',\n                },\n                {\n                  name: 'isPrivate',\n                  type: 'checkbox',\n                  admin: {\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description:\n                      \"Indicates whether this file was uploaded to ImageKit as private. Private files are delivered through signed URLs. Changes to this collection's private option in payload.config only affect future uploads.\",\n                    readOnly: true,\n                  },\n                  label: 'Private file',\n                },\n                {\n                  name: 'signedUrl',\n                  type: 'text',\n                  admin: {\n                    // Only relevant for private files; the plain `url` works directly for public ones.\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description: `Temporary signed URL for reaching this private file directly on ImageKit. Expires ${signedUrlExpiresIn} seconds after load and is regenerated on every read. Note: anyone with this URL can access the file until it expires — it is not gated by Payload access control.`,\n                    readOnly: true,\n                  },\n                  hooks: {\n                    // Computed server-side on read so it is always freshly signed and never persisted.\n                    afterRead: [\n                      ({ data, siblingData }) => {\n                        if (!isDocumentPrivate({ imagekit: siblingData }, isPrivate)) {\n                          return undefined\n                        }\n\n                        const filename = (data as { filename?: string } | undefined)?.filename\n\n                        if (!filename) {\n                          return undefined\n                        }\n\n                        const source = (data || {}) as { _objectKey?: string; prefix?: string }\n                        const documentPrefix = path.posix.join(\n                          source.prefix || prefix,\n                          source._objectKey || '',\n                        )\n                        const storageFilePath = buildStoragePathData({\n                          collectionPrefix: prefix,\n                          docPrefix: documentPrefix,\n                          filename,\n                        }).storageFilePath\n\n                        return buildSignedURL(`/${storageFilePath}`)\n                      },\n                    ],\n                  },\n                  label: 'Signed URL',\n                  virtual: true,\n                },\n                {\n                  name: 'thumbnailUrl',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n              ],\n              interfaceName: 'imagekitFields',\n              label: false,\n            },\n          ],\n          label: 'Storage: ImageKit',\n        },\n      ],\n      generateURL: ({ filename, prefix: documentPrefix = '' }) =>\n        client.helper.buildSrc({\n          src: `/${buildStoragePathData({\n            collectionPrefix: prefix,\n            docPrefix: documentPrefix,\n            filename,\n          }).storageFilePath}`,\n          urlEndpoint,\n        }),\n      handleDelete: async ({ doc, storageFilePath }) => {\n        const storedFileId = (doc as ImageKitReference & typeof doc).imagekit?.fileId\n        const fileId =\n          storedFileId || (await findImageKitFileId(client, `/${storageFilePath.replace(/^\\/+/, '')}`))\n\n        if (!fileId) {\n          return\n        }\n\n        await client.files.delete(fileId)\n      },\n      handleUpload: async ({ clientUploadContext, data, file, storageFilePath }) => {\n        if (clientUploadContext) {\n          const uploaded = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n\n          return applyVerifiedClientUploadToData(data, uploaded, buildThumbnailURL, isPrivate)\n        }\n\n        // ImageKit's `toFile()` consumes async iterables before starting the request. A file-backed\n        // Blob keeps temporary-file uploads lazy so FormData can stream them from disk instead.\n        const uploadSource = file.tempFilePath\n          ? await openAsBlob(file.tempFilePath, { type: file.mimeType })\n          : file.buffer\n        const uploadFile = await toFile(uploadSource, file.filename, { type: file.mimeType })\n        const uploadFolder = path.posix.dirname(`/${storageFilePath.replace(/^\\/+/, '')}`)\n        const uploadFilename = path.posix.basename(storageFilePath)\n\n        const uploaded = await client.files.upload({\n          file: uploadFile,\n          fileName: uploadFilename,\n          folder: uploadFolder,\n          useUniqueFileName: false,\n          ...(isPrivate ? { isPrivateFile: true } : {}),\n        })\n\n        data.imagekit = {\n          fileId: uploaded.fileId,\n          isPrivate,\n          thumbnailUrl: uploaded.thumbnailUrl,\n          url: uploaded.url,\n        }\n\n        // Set the root-level thumbnailURL that Payload's admin interface expects.\n        // `buildThumbnailURL` needs the filename, which Payload may not have copied onto\n        // `data` yet at this point, so fall back to the uploaded file's name.\n        data.thumbnailURL = buildThumbnailURL({\n          ...data,\n          filename: (data as { filename?: string }).filename || uploadFilename,\n        })\n\n        return data\n      },\n      requiresClientUploadReceipt: true,\n      staticHandler: async (req, args) => {\n        const requestURL = new URL(req.url || 'http://localhost')\n        const tr = requestURL.searchParams.get('tr')\n        const hasClientUploadContext = 'clientUploadContext' in args.params\n\n        if (hasClientUploadContext) {\n          const clientUploadContext = args.params.clientUploadContext\n\n          if (!isImageKitReceiptContext(clientUploadContext)) {\n            throw new APIError('Invalid ImageKit client upload context.', 400)\n          }\n\n          const uploadedFile = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n          const expectedFilePath = getClientUploadStorageFilePath({\n            collectionPrefix: prefix,\n            context: clientUploadContext,\n          })\n          const verifiedFileURL = isPrivate\n            ? buildSignedURL(`/${expectedFilePath}`, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: `/${expectedFilePath}`,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: uploadedFile.size,\n            fileURL: verifiedFileURL,\n            mimeType: uploadedFile.mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        const doc =\n          args.doc ||\n          (await findUploadDocumentByFilename({\n            collection: args.params.collection,\n            filename: args.params.filename,\n            prefix: args.params.prefix,\n            req,\n          }))\n\n        const storageFilePath = await getStorageFilePath({\n          collection,\n          collectionPrefix: prefix,\n          doc: doc || undefined,\n          filename: args.params.filename,\n          prefixQueryParam: args.params.prefix,\n          req,\n        })\n        const imageKitPath = `/${storageFilePath.replace(/^\\/+/, '')}`\n        const mimeType = (doc as { mimeType?: string } | null)?.mimeType\n\n        // XML-family uploads (including SVG) must pass through Payload so its CSP is\n        // present even when ImageKit uses a custom, same-origin delivery domain.\n        if (typeof mimeType === 'string' && isXmlMimeType(mimeType)) {\n          const filesize = (doc as { filesize?: number } | null)?.filesize\n\n          if (typeof filesize !== 'number' || !Number.isSafeInteger(filesize) || filesize < 0) {\n            throw new APIError('Stored ImageKit file metadata is incomplete.', 500)\n          }\n\n          const fileURL = isDocumentPrivate(doc, isPrivate)\n            ? buildSignedURL(imageKitPath, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: imageKitPath,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: filesize,\n            fileURL,\n            mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        // Sign based on the document's stored status, not the collection's current\n        // setting, so files keep working if the collection's privacy is changed later.\n        if (isDocumentPrivate(doc, isPrivate)) {\n          let signSrc = imageKitPath\n\n          // A `tr` request for a video/PDF is a thumbnail request (the plain transform\n          // can't render a preview); serve ImageKit's generated thumbnail instead.\n          if (tr && isVideoMimeType(mimeType)) {\n            signSrc = getVideoPosterSrc(signSrc)\n          } else if (tr && isPdfMimeType(mimeType)) {\n            signSrc = getImageKitThumbnailSrc(signSrc)\n          }\n\n          return Response.redirect(buildSignedURL(signSrc, tr), 302)\n        }\n\n        const imageKitURL = client.helper.buildSrc({\n          src:\n            getStoredImageKitURL(doc) ||\n            imageKitPath,\n          transformation: tr ? [{ raw: tr }] : undefined,\n          urlEndpoint,\n        })\n\n        return Response.redirect(imageKitURL, 302)\n      },\n    }\n  }\n}\n\nconst toCloudStorageCollections = (\n  collections: ImageKitCollectionMap,\n  adapter: Adapter,\n  privateSlugs: Set<string>,\n  rootFolder: string,\n  disablePayloadAccessControl?: true,\n): Partial<Record<CollectionSlug, CollectionOptions>> => {\n  const mappedCollections: Partial<Record<CollectionSlug, CollectionOptions>> = {}\n\n  for (const collectionSlug of Object.keys(collections)) {\n    mappedCollections[collectionSlug] = {\n      adapter,\n      disableLocalStorage: true,\n      // Private files require Payload access control so URLs can be signed at serve time.\n      disablePayloadAccessControl: privateSlugs.has(collectionSlug)\n        ? undefined\n        : disablePayloadAccessControl,\n      prefix: getCollectionFolder(rootFolder, collectionSlug),\n    }\n  }\n\n  return mappedCollections\n}\n\nexport const imagekitStorage =\n  (pluginOptions: PayloadStorageImageKitConfig) =>\n  (config: Config): Config => {\n    const {\n      alwaysInsertFields,\n      clientUploads,\n      collections,\n      disablePayloadAccessControl,\n      enabled,\n      focalPoint,\n      folder,\n      privateKey,\n      publicKey,\n      signedUrlExpiresIn: signedUrlExpiresInOption,\n      urlEndpoint,\n    } = pluginOptions\n\n    if (!privateKey?.trim()) {\n      throw new Error('imagekitStorage: `privateKey` is required.')\n    }\n\n    if (!publicKey?.trim()) {\n      throw new Error('imagekitStorage: `publicKey` is required.')\n    }\n\n    if (!urlEndpoint?.trim()) {\n      throw new Error('imagekitStorage: `urlEndpoint` is required.')\n    }\n\n    if (!collections || Object.keys(collections).length === 0) {\n      throw new Error('imagekitStorage: `collections` must include at least one upload collection.')\n    }\n\n    const privateSlugs = new Set(\n      Object.entries(collections)\n        .filter(([, value]) => isPrivateCollectionConfig(value))\n        .map(([slug]) => slug),\n    )\n    const configuredSlugs = new Set(Object.keys(collections))\n\n    if (disablePayloadAccessControl && privateSlugs.size > 0) {\n      throw new Error(\n        'imagekitStorage: `disablePayloadAccessControl` cannot be used with private collections. Private files require Payload access control to remain enabled so URLs can be signed at serve time.',\n      )\n    }\n\n    if (disablePayloadAccessControl) {\n      const xmlCollectionSlugs = (config.collections || [])\n        .filter(\n          (collection) =>\n            configuredSlugs.has(collection.slug) && collectionCanStoreXml(collection),\n        )\n        .map((collection) => collection.slug)\n\n      if (xmlCollectionSlugs.length > 0) {\n        throw new Error(\n          `imagekitStorage: \\`disablePayloadAccessControl\\` cannot be used with collections that can store XML-family files (${xmlCollectionSlugs.join(', ')}). XML-family files require Payload's file route so its Content Security Policy is applied. Configure a MIME allow list that excludes SVG/XML, or keep Payload access control enabled.`,\n        )\n      }\n    }\n\n    const signedUrlExpiresIn =\n      typeof signedUrlExpiresInOption === 'number' && signedUrlExpiresInOption > 0\n        ? signedUrlExpiresInOption\n        : DEFAULT_SIGNED_URL_EXPIRES_IN\n    const apiRoute = config.routes?.api ?? '/api'\n\n    const rootFolder = normalizeFolder(folder)\n\n    const imageKitClient = new ImageKit({ privateKey })\n    const collectionSecurity = Object.fromEntries(\n      (config.collections || [])\n        .filter((collection) => configuredSlugs.has(collection.slug))\n        .map((collection) => [\n          collection.slug,\n          {\n            collection,\n            isPrivate: privateSlugs.has(collection.slug),\n            prefix: getCollectionFolder(rootFolder, collection.slug),\n          },\n        ]),\n    )\n    const verifyClientUpload = createImageKitClientUploadVerifier({\n      client: imageKitClient,\n      collections: collectionSecurity,\n    })\n    const adapter = imagekitAdapter({\n      apiRoute,\n      client: imageKitClient,\n      clientUploads,\n      privateSlugs,\n      rootFolder,\n      signedUrlExpiresIn,\n      urlEndpoint,\n      verifyClientUpload,\n    })\n\n    const configWithCropDisabled: Config = {\n      ...config,\n      collections: (config.collections || []).map((collection) => {\n        if (!configuredSlugs.has(collection.slug)) {\n          return collection\n        }\n\n        const isCollectionPrivate = privateSlugs.has(collection.slug)\n        const buildThumbnailURL = (doc: unknown): string =>\n          isDocumentPrivate(doc, isCollectionPrivate)\n            ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n            : getAdminThumbnailURL(doc)\n\n        const collectionOptions = collections[collection.slug]\n        const collectionFocalPoint =\n          collectionOptions !== true &&\n          typeof collectionOptions === 'object' &&\n          typeof collectionOptions.focalPoint === 'boolean'\n            ? collectionOptions.focalPoint\n            : undefined\n\n        // Surface a \"this is a private collection\" note in the list and edit views.\n        // Preserve an existing string description by appending; leave custom\n        // component descriptions untouched.\n        const existingDescription = collection.admin?.description\n        const baseAdmin = isCollectionPrivate\n          ? {\n              ...(collection.admin || {}),\n              description:\n                typeof existingDescription === 'string' && existingDescription.trim().length > 0\n                  ? `${existingDescription} ${PRIVATE_COLLECTION_DESCRIPTION}`\n                  : (existingDescription ?? PRIVATE_COLLECTION_DESCRIPTION),\n            }\n          : collection.admin\n\n        return {\n          ...collection,\n          admin: baseAdmin,\n          hooks: {\n            ...(collection.hooks || {}),\n            beforeChange: [\n              ...(collection.hooks?.beforeChange || []),\n              async ({ data, req }) => {\n                if (!isRecord(data) || !req.file?.clientUploadContext) {\n                  return data\n                }\n\n                const context = req.file.clientUploadContext\n                const requestMimeType = req.file.mimetype.split(';', 1)[0]?.trim().toLowerCase()\n                if (\n                  !isImageKitReceiptContext(context) ||\n                  context.filename !== data.filename ||\n                  context.filename !== req.file.name ||\n                  // Payload can clear req.file.size when preparing an in-memory image.\n                  // generateFileData preserves the original size on the document.\n                  context.expectedSize !== data.filesize\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n\n                const uploaded = await verifyClientUpload({\n                  collectionSlug: collection.slug,\n                  context,\n                })\n                // Payload keeps the browser's MIME unless it fetched the file content, in which\n                // case it uses the verified ImageKit-detected type the static handler served.\n                if (\n                  requestMimeType !== context.expectedMimeType &&\n                  requestMimeType !== uploaded.mimeType\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n                // A provider file can only be claimed once, including through legacy receipts.\n                // The unique file ID index also rejects concurrent claims.\n                const existing = await req.payload.db.findOne({\n                  collection: collection.slug,\n                  req,\n                  where: {\n                    'imagekit.fileId': {\n                      equals: uploaded.fileId,\n                    },\n                  },\n                })\n                if (existing) {\n                  throw new APIError('This ImageKit client upload receipt has already been used.', 400)\n                }\n\n                data.filename = uploaded.name\n                data.filesize = uploaded.size\n                data.mimeType = uploaded.mimeType\n\n                return applyVerifiedClientUploadToData(\n                  data,\n                  uploaded,\n                  buildThumbnailURL,\n                  isCollectionPrivate,\n                )\n              },\n            ],\n            beforeOperation: [\n              ...(collection.hooks?.beforeOperation || []),\n              ({ args, operation, req }) => {\n                if (\n                  (operation !== 'create' && operation !== 'update') ||\n                  req.context?.skipCloudStorage ||\n                  !req.file ||\n                  req.file.clientUploadContext ||\n                  !('data' in args) ||\n                  !isRecord(args.data) ||\n                  typeof args.data.prefix !== 'string'\n                ) {\n                  return args\n                }\n\n                // Payload checks filename uniqueness before cloud storage's beforeChange\n                // normalizes the prefix. Use the persisted form during that lookup too.\n                args.data.prefix = buildUploadStoragePathData({\n                  collectionPrefix: getCollectionFolder(rootFolder, collection.slug),\n                  docPrefix: args.data.prefix,\n                  filename: req.file.name,\n                }).sanitizedDocPrefix\n                return args\n              },\n            ],\n          },\n          upload: {\n            // Focal points are opt-in for configured collections. Plugin-level\n            // and collection-level options can override this default; a\n            // collection's own `upload.focalPoint` still wins because it is\n            // spread in afterwards.\n            focalPoint: false,\n            ...(typeof focalPoint === 'boolean' ? { focalPoint } : {}),\n            ...(typeof collectionFocalPoint === 'boolean'\n              ? { focalPoint: collectionFocalPoint }\n              : {}),\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            adminThumbnail: ({ doc }) => buildThumbnailURL(doc),\n            crop: false,\n          },\n        }\n      }),\n    }\n\n    const uploadCollections = Object.fromEntries(\n      Object.keys(collections).map((collectionSlug) => [\n        collectionSlug,\n        {\n          isPrivate: privateSlugs.has(collectionSlug),\n          prefix: getCollectionFolder(rootFolder, collectionSlug),\n        },\n      ]),\n    ) as Partial<\n      Record<UploadCollectionSlug, { isPrivate: boolean; prefix: string }>\n    >\n\n    initClientUploads({\n      clientHandler: '@humaan/payload-storage-imagekit/client#ImageKitUploadHandler',\n      collections: uploadCollections,\n      config: configWithCropDisabled,\n      enabled: enabled !== false && Boolean(clientUploads),\n      serverHandler: createImageKitUploadAuthHandler({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collections: uploadCollections,\n        privateKey,\n        publicKey,\n        verifyClientUpload,\n      }),\n      serverHandlerPath: imageKitUploadAuthPath,\n    })\n\n    const output = cloudStoragePlugin({\n      alwaysInsertFields,\n      collections: toCloudStorageCollections(\n        collections,\n        adapter,\n        privateSlugs,\n        rootFolder,\n        disablePayloadAccessControl,\n      ),\n      enabled,\n    })(configWithCropDisabled)\n\n    // Make the provider identity unique at persistence time to reject concurrent receipt replays.\n    // Keep the legacy object key index for existing uploads.\n    output.collections = (output.collections || []).map((collection) => {\n      if (!configuredSlugs.has(collection.slug)) {\n        return collection\n      }\n\n      const originalPrefixField = (config.collections || [])\n        .find((original) => original.slug === collection.slug)\n        ?.fields.find((field) => 'name' in field && field.name === 'prefix')\n\n      const withUniqueIdentity = (field: Field): Field => {\n        if (\n          field.type === 'text' &&\n          'name' in field &&\n          field.name === 'prefix' &&\n          (!originalPrefixField ||\n            !('defaultValue' in originalPrefixField) ||\n            originalPrefixField.defaultValue == null)\n        ) {\n          // Cloud storage's collection-prefix default is applied on reads of old\n          // documents that have no stored prefix. Its URL hook then appends that\n          // prefix, but Payload's file access check cannot find it in the DB.\n          // Upload hooks still persist the collection prefix for new files.\n          return {\n            ...field,\n            defaultValue: ({ req }) =>\n              req.file && typeof field.defaultValue === 'string' ? field.defaultValue : '',\n          }\n        }\n        if ('name' in field && field.name === '_objectKey') {\n          return { ...field, unique: true } as Field\n        }\n        if (field.type === 'group' && 'name' in field && field.name === 'imagekit') {\n          return {\n            ...field,\n            fields: field.fields.map((metadataField) =>\n              'name' in metadataField && metadataField.name === 'fileId'\n                ? { ...metadataField, unique: true }\n                : metadataField,\n            ),\n          }\n        }\n        // The imagekit group sits inside the adapter's presentational \"Storage: ImageKit\" panel.\n        if (field.type === 'collapsible') {\n          return { ...field, fields: field.fields.map(withUniqueIdentity) }\n        }\n        return field\n      }\n\n      return {\n        ...collection,\n        fields: collection.fields.map(withUniqueIdentity),\n      }\n    })\n\n    return output\n  }\n\nexport { migrateFolder } from './migrate.js'\nexport type { MigrateFolderOptions, MigrationJobResult, MigrationLocation } from './migrate.js'\n\n// Backward-compatible alias\nexport const payloadStorageImagekit = imagekitStorage\nexport const payloadStorageImageKit = imagekitStorage\n\nexport type PayloadStorageImagekitConfig = PayloadStorageImageKitConfig\n"],"names":["ImageKit","toFile","cloudStoragePlugin","buildStoragePathData","buildUploadStoragePathData","getStorageFilePath","initClientUploads","openAsBlob","path","APIError","getRangeRequestInfo","isXmlMimeType","UPLOAD_CONTENT_SECURITY_POLICY","validateMimeType","imageKitUploadAuthPath","isImageKitReceiptContext","createImageKitClientUploadVerifier","getClientUploadStorageFilePath","createImageKitUploadAuthHandler","getAdminThumbnailURL","getPrivateAdminThumbnailURL","isPdfMimeType","isVideoMimeType","getImageKitThumbnailSrc","getVideoPosterSrc","DEFAULT_SIGNED_URL_EXPIRES_IN","ORIGINAL_FILE_TRANSFORMATION","PRIVATE_COLLECTION_DESCRIPTION","isPrivateCollectionConfig","value","private","XML_FAMILY_MIME_TYPES","collectionCanStoreXml","collection","upload","Boolean","allowRestrictedFileTypes","allowedMimeTypes","mimeTypes","length","some","mimeType","includes","isDocumentPrivate","doc","collectionIsPrivate","stored","imagekit","isPrivate","normalizeFolder","folder","normalized","trim","replace","Error","getCollectionFolder","rootFolder","collectionSlug","posix","join","findImageKitFileId","filePath","parentPath","dirname","name","basename","limit","skip","assets","list","type","found","find","asset","fileId","undefined","isRecord","getStoredImageKitURL","storedURL","url","hasStoredImageKitURL","findUploadDocumentByFilename","filename","prefix","req","constraints","equals","push","payload","db","findOne","where","and","applyVerifiedClientUploadToData","data","uploaded","buildThumbnailURL","thumbnailUrl","thumbnailURL","imagekitAdapter","apiRoute","client","clientUploads","privateSlugs","signedUrlExpiresIn","urlEndpoint","verifyClientUpload","fetchUploadedFile","fileSize","fileURL","range","rangeResult","rangeHeader","Response","headers","Headers","status","normalizedRange","rangeStart","rangeEnd","response","fetch","cache","Range","signal","AbortController","ok","body","cancel","catch","upstreamLength","get","expectedLength","upstreamRange","expectedRange","set","slug","has","buildSignedURL","src","tr","helper","buildSrc","expiresIn","signed","transformation","raw","fields","admin","condition","initCollapsed","disableListColumn","disableListFilter","hidden","readOnly","label","_data","siblingData","description","hooks","afterRead","source","documentPrefix","_objectKey","storageFilePath","collectionPrefix","docPrefix","virtual","interfaceName","generateURL","handleDelete","storedFileId","files","delete","handleUpload","clientUploadContext","file","context","uploadSource","tempFilePath","buffer","uploadFile","uploadFolder","uploadFilename","fileName","useUniqueFileName","isPrivateFile","requiresClientUploadReceipt","staticHandler","args","requestURL","URL","searchParams","hasClientUploadContext","params","uploadedFile","expectedFilePath","verifiedFileURL","size","prefixQueryParam","imageKitPath","filesize","Number","isSafeInteger","signSrc","redirect","imageKitURL","toCloudStorageCollections","collections","adapter","disablePayloadAccessControl","mappedCollections","Object","keys","disableLocalStorage","imagekitStorage","pluginOptions","config","alwaysInsertFields","enabled","focalPoint","privateKey","publicKey","signedUrlExpiresInOption","Set","entries","filter","map","configuredSlugs","xmlCollectionSlugs","routes","api","imageKitClient","collectionSecurity","fromEntries","configWithCropDisabled","isCollectionPrivate","collectionOptions","collectionFocalPoint","existingDescription","baseAdmin","beforeChange","requestMimeType","mimetype","split","toLowerCase","expectedSize","expectedMimeType","existing","beforeOperation","operation","skipCloudStorage","sanitizedDocPrefix","adminThumbnail","crop","uploadCollections","clientHandler","serverHandler","access","serverHandlerPath","output","originalPrefixField","original","field","withUniqueIdentity","defaultValue","unique","metadataField","migrateFolder","payloadStorageImagekit","payloadStorageImageKit"],"mappings":"AAgBA,OAAOA,YAAYC,MAAM,QAAQ,mBAAkB;AACnD,SAASC,kBAAkB,QAAQ,mCAAkC;AACrE,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,EAClBC,iBAAiB,QACZ,6CAA4C;AACnD,SAASC,UAAU,QAAQ,UAAS;AACpC,OAAOC,UAAU,YAAW;AAC5B,SAASC,QAAQ,QAAQ,UAAS;AAClC,SACEC,mBAAmB,EACnBC,aAAa,EACbC,8BAA8B,QACzB,mBAAkB;AACzB,SAASC,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,sBAAsB,EAAEC,wBAAwB,QAAQ,qBAAoB;AACrF,SACEC,kCAAkC,EAClCC,8BAA8B,QACzB,gCAA+B;AACtC,SAASC,+BAA+B,QAAQ,iDAAgD;AAChG,SACEC,oBAAoB,EACpBC,2BAA2B,EAC3BC,aAAa,EACbC,eAAe,QACV,4BAA2B;AAClC,SAASC,uBAAuB,EAAEC,iBAAiB,QAAQ,uBAAsB;AAiBjF,MAAMC,gCAAgC;AACtC;;;;;;;CAOC,GACD,MAAMC,+BAA+B;AAErC,MAAMC,iCACJ;AAEF,MAAMC,4BAA4B,CAACC,QACjCA,UAAU,QAAQ,OAAOA,UAAU,YAAYA,OAAOC,YAAY;AAEpE,MAAMC,wBAAwB;IAAC;IAAmB;IAAiB;CAAW;AAE9E,MAAMC,wBAAwB,CAACC;IAC7B,MAAMC,SAASD,WAAWC,MAAM;IAEhC,IAAI,CAACA,UAAUA,WAAW,MAAM;QAC9B,OAAOC,QAAQD;IACjB;IAEA,iFAAiF;IACjF,IAAIA,OAAOE,wBAAwB,EAAE;QACnC,OAAO;IACT;IAEA,MAAMC,mBAAmBH,OAAOI,SAAS;IAEzC,OACE,CAACD,kBAAkBE,UACnBF,iBAAiBG,IAAI,CAAC,CAACC,WAAaA,SAASC,QAAQ,CAAC,QAAQ/B,cAAc8B,cAC5EV,sBAAsBS,IAAI,CAAC,CAACC,WAAa5B,iBAAiB4B,UAAUJ;AAExE;AAEA;;;;;CAKC,GACD,MAAMM,oBAAoB,CAACC,KAAcC;IACvC,MAAMC,SAAUF,KAA4DG,UAAUC;IAEtF,OAAO,OAAOF,WAAW,YAAYA,SAASD;AAChD;AAwCA,MAAMI,kBAAkB,CAACC;IACvB,MAAMC,aAAaD,OAAOE,IAAI,GAAGC,OAAO,CAAC,cAAc;IAEvD,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM;IAClB;IAEA,OAAO,CAAC,CAAC,EAAEH,YAAY;AACzB;AAEA,MAAMI,sBAAsB,CAACC,YAAoBC,iBAC/CjD,KAAKkD,KAAK,CAACC,IAAI,CAACH,YAAYC;AAE9B,MAAMG,qBAAqB,OACzBb,UACAc;IAEA,MAAMC,aAAatD,KAAKkD,KAAK,CAACK,OAAO,CAACF;IACtC,MAAMG,OAAOxD,KAAKkD,KAAK,CAACO,QAAQ,CAACJ;IAEjC,MAAMK,QAAQ;IAEd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMrB,SAASqB,MAAM,CAACC,IAAI,CAAC;YACxCC,MAAM;YACNJ;YACA1D,MAAMsD,eAAe,MAAM,MAAM,GAAGA,WAAW,CAAC,CAAC;YACjDK;QACF;QAEA,MAAMI,QAAQH,OAAOI,IAAI,CACvB,CAACC,QAAU,YAAYA,SAASA,MAAMZ,QAAQ,KAAKA,YAAYY,MAAMT,IAAI,KAAKA;QAGhF,IAAIO,SAAS,YAAYA,OAAO;YAC9B,OAAOA,MAAMG,MAAM;QACrB;QAEA,IAAIN,OAAO7B,MAAM,GAAG2B,OAAO;YACzB;QACF;IACF;IAEA,OAAOS;AACT;AAEA,MAAMC,WAAW,CAAC/C,QAChB,CAAC,CAACA,SAAS,OAAOA,UAAU;AAE9B,MAAMgD,uBAAuB,CAACjC;IAC5B,MAAMkC,YAAalC,KAAuCG,UAAUgC;IAEpE,OAAO,OAAOD,cAAc,YAAYA,UAAU1B,IAAI,GAAGb,MAAM,GAAG,IAAIuC,YAAYH;AACpF;AAEA,MAAMK,uBAAuB,CAACpC,MAA0B,CAAC,CAACiC,qBAAqBjC;AAE/E,MAAMqC,+BAA+B,OAAO,EAC1ChD,UAAU,EACViD,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,MAAMC,cAAuB;QAC3B;YACEH,UAAU;gBACRI,QAAQJ;YACV;QACF;KACD;IAED,IAAI,OAAOC,WAAW,UAAU;QAC9BE,YAAYE,IAAI,CAAC;YACfJ,QAAQ;gBACNG,QAAQH;YACV;QACF;IACF;IAEA,OAAOC,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QAC5BzD;QACAmD;QACAO,OAAO;YACLC,KAAKP;QACP;IACF;AACF;AAEA,MAAMQ,kCAAkC,CACtCC,MACAC,UACAC,oBAAyC7E,oBAAoB,EAC7D6B;IAEA8C,KAAK/C,QAAQ,GAAG;QACd2B,QAAQqB,SAASrB,MAAM;QACvB1B;QACAiD,cAAcF,SAASE,YAAY;QACnClB,KAAKgB,SAAShB,GAAG;IACnB;IAEA,sFAAsF;IACtFe,KAAKI,YAAY,GAAGF,kBAAkBF;IAEtC,OAAOA;AACT;AAEA,MAAMK,kBAAkB,CAAC,EACvBC,QAAQ,EACRC,MAAM,EACNC,aAAa,EACbC,YAAY,EACZ/C,UAAU,EACVgD,kBAAkB,EAClBC,WAAW,EACXC,kBAAkB,EAUnB;IACC,MAAMC,oBAAoB,OAAO,EAC/BC,QAAQ,EACRC,OAAO,EACPpE,QAAQ,EACRqE,KAAK,EAMN;QACC,MAAMC,cAAcrG,oBAAoB;YAAEkG;YAAUI,aAAaF,SAAS;QAAK;QAE/E,IAAIC,YAAYzC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAI2C,SAAS,MAAM;gBACxBC,SAAS,IAAIC,QAAQJ,YAAYG,OAAO;gBACxCE,QAAQL,YAAYK,MAAM;YAC5B;QACF;QAEA,MAAMC,kBACJN,YAAYzC,IAAI,KAAK,YACjB,CAAC,MAAM,EAAEyC,YAAYO,UAAU,CAAC,CAAC,EAAEP,YAAYQ,QAAQ,EAAE,GACzD5C;QACN,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM6C,WAAW,MAAMC,MAAMZ,SAAS;YACpCa,OAAO;YACP,GAAIL,kBAAkB;gBAAEH,SAAS;oBAAES,OAAON;gBAAgB;YAAE,IAAI,CAAC,CAAC;YAClEO,QAAQ,IAAIC,kBAAkBD,MAAM;QACtC;QAEA,IAAI,CAACJ,SAASM,EAAE,IAAIN,SAASJ,MAAM,KAAKL,YAAYK,MAAM,EAAE;YAC1D,KAAKI,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMtD;YACzC,MAAM,IAAIrB,MACR,CAAC,gEAAgE,EAAEkE,SAASJ,MAAM,CAAC,EAAE,CAAC;QAE1F;QAEA,MAAMc,iBAAiBV,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC5C,MAAMC,iBAAiBrB,YAAYG,OAAO,CAAC,iBAAiB;QAC5D,MAAMmB,gBAAgBb,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC3C,MAAMG,gBACJvB,YAAYzC,IAAI,KAAK,YAAYyC,YAAYG,OAAO,CAAC,gBAAgB,GAAGvC;QAE1E,IACE,AAACuD,mBAAmB,QAAQA,mBAAmBE,kBAC9CE,iBAAiBD,kBAAkBC,eACpC;YACA,KAAKd,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMtD;YACzC,MAAM,IAAIrB,MAAM;QAClB;QAEA,MAAM4D,UAAU,IAAIC,QAAQJ,YAAYG,OAAO;QAC/CA,QAAQqB,GAAG,CAAC,gBAAgB9F;QAC5B,IAAI9B,cAAc8B,WAAW;YAC3ByE,QAAQqB,GAAG,CAAC,2BAA2B3H;QACzC;QAEA,OAAO,IAAIqG,SAASO,SAASO,IAAI,EAAE;YACjCb;YACAE,QAAQI,SAASJ,MAAM;QACzB;IACF;IAEA,OAAO,CAAC,EAAEnF,UAAU,EAAEkD,SAAS5B,oBAAoBC,YAAYvB,WAAWuG,IAAI,CAAC,EAAE;QAC/E,MAAMxF,YAAYuD,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;QAElD,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,MAAME,iBAAiB,CAACC,KAAaC,KACnCvC,OAAOwC,MAAM,CAACC,QAAQ,CAAC;gBACrBC,WAAWvC;gBACXwC,QAAQ;gBACRL;gBACAM,gBAAgBL,KAAK;oBAAC;wBAAEM,KAAKN;oBAAG;iBAAE,GAAGjE;gBACrC8B;YACF;QAEF,MAAMT,oBAAoB,CAACpD,MACzBD,kBAAkBC,KAAKI,aACnB5B,4BAA4BwB,KAAKX,WAAWuG,IAAI,EAAEpC,YAClDjF,qBAAqByB;QAE3B,OAAO;YACLoB,MAAM;YACNsC;YACA6C,QAAQ;gBACN;oBACE,iFAAiF;oBACjF,wCAAwC;oBACxC7E,MAAM;oBACN8E,OAAO;wBACLC,WAAW,CAACvD,OAASd,qBAAqBc;wBAC1CwD,eAAe;oBACjB;oBACAH,QAAQ;wBACN;4BACEnF,MAAM;4BACNM,MAAM;4BACN8E,OAAO;gCACLG,mBAAmB;gCACnBC,mBAAmB;4BACrB;4BACAL,QAAQ;gCACN;oCACEnF,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLK,QAAQ;oCACV;gCACF;gCACA;oCACEzF,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLM,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE3F,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLC,WAAW,CAACO,OAAOC,cACjBlH,kBAAkB;gDAAEI,UAAU8G;4CAAY,GAAG7G;wCAC/C8G,aACE;wCACFJ,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE3F,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACL,mFAAmF;wCACnFC,WAAW,CAACO,OAAOC,cACjBlH,kBAAkB;gDAAEI,UAAU8G;4CAAY,GAAG7G;wCAC/C8G,aAAa,CAAC,kFAAkF,EAAEtD,mBAAmB,kKAAkK,CAAC;wCACxRkD,UAAU;oCACZ;oCACAK,OAAO;wCACL,mFAAmF;wCACnFC,WAAW;4CACT,CAAC,EAAElE,IAAI,EAAE+D,WAAW,EAAE;gDACpB,IAAI,CAAClH,kBAAkB;oDAAEI,UAAU8G;gDAAY,GAAG7G,YAAY;oDAC5D,OAAO2B;gDACT;gDAEA,MAAMO,WAAYY,MAA4CZ;gDAE9D,IAAI,CAACA,UAAU;oDACb,OAAOP;gDACT;gDAEA,MAAMsF,SAAUnE,QAAQ,CAAC;gDACzB,MAAMoE,iBAAiB1J,KAAKkD,KAAK,CAACC,IAAI,CACpCsG,OAAO9E,MAAM,IAAIA,QACjB8E,OAAOE,UAAU,IAAI;gDAEvB,MAAMC,kBAAkBjK,qBAAqB;oDAC3CkK,kBAAkBlF;oDAClBmF,WAAWJ;oDACXhF;gDACF,GAAGkF,eAAe;gDAElB,OAAO1B,eAAe,CAAC,CAAC,EAAE0B,iBAAiB;4CAC7C;yCACD;oCACH;oCACAT,OAAO;oCACPY,SAAS;gCACX;gCACA;oCACEvG,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLK,QAAQ;oCACV;gCACF;6BACD;4BACDe,eAAe;4BACfb,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD;YACDc,aAAa,CAAC,EAAEvF,QAAQ,EAAEC,QAAQ+E,iBAAiB,EAAE,EAAE,GACrD7D,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACrBH,KAAK,CAAC,CAAC,EAAExI,qBAAqB;wBAC5BkK,kBAAkBlF;wBAClBmF,WAAWJ;wBACXhF;oBACF,GAAGkF,eAAe,EAAE;oBACpB3D;gBACF;YACFiE,cAAc,OAAO,EAAE9H,GAAG,EAAEwH,eAAe,EAAE;gBAC3C,MAAMO,eAAe,AAAC/H,IAAuCG,QAAQ,EAAE2B;gBACvE,MAAMA,SACJiG,gBAAiB,MAAM/G,mBAAmByC,QAAQ,CAAC,CAAC,EAAE+D,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBAE7F,IAAI,CAACqB,QAAQ;oBACX;gBACF;gBAEA,MAAM2B,OAAOuE,KAAK,CAACC,MAAM,CAACnG;YAC5B;YACAoG,cAAc,OAAO,EAAEC,mBAAmB,EAAEjF,IAAI,EAAEkF,IAAI,EAAEZ,eAAe,EAAE;gBACvE,IAAIW,qBAAqB;oBACvB,MAAMhF,WAAW,MAAMW,mBAAmB;wBACxCjD,gBAAgBxB,WAAWuG,IAAI;wBAC/ByC,SAASF;oBACX;oBAEA,OAAOlF,gCAAgCC,MAAMC,UAAUC,mBAAmBhD;gBAC5E;gBAEA,4FAA4F;gBAC5F,wFAAwF;gBACxF,MAAMkI,eAAeF,KAAKG,YAAY,GAClC,MAAM5K,WAAWyK,KAAKG,YAAY,EAAE;oBAAE7G,MAAM0G,KAAKvI,QAAQ;gBAAC,KAC1DuI,KAAKI,MAAM;gBACf,MAAMC,aAAa,MAAMpL,OAAOiL,cAAcF,KAAK9F,QAAQ,EAAE;oBAAEZ,MAAM0G,KAAKvI,QAAQ;gBAAC;gBACnF,MAAM6I,eAAe9K,KAAKkD,KAAK,CAACK,OAAO,CAAC,CAAC,CAAC,EAAEqG,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBACjF,MAAMkI,iBAAiB/K,KAAKkD,KAAK,CAACO,QAAQ,CAACmG;gBAE3C,MAAMrE,WAAW,MAAMM,OAAOuE,KAAK,CAAC1I,MAAM,CAAC;oBACzC8I,MAAMK;oBACNG,UAAUD;oBACVrI,QAAQoI;oBACRG,mBAAmB;oBACnB,GAAIzI,YAAY;wBAAE0I,eAAe;oBAAK,IAAI,CAAC,CAAC;gBAC9C;gBAEA5F,KAAK/C,QAAQ,GAAG;oBACd2B,QAAQqB,SAASrB,MAAM;oBACvB1B;oBACAiD,cAAcF,SAASE,YAAY;oBACnClB,KAAKgB,SAAShB,GAAG;gBACnB;gBAEA,0EAA0E;gBAC1E,iFAAiF;gBACjF,sEAAsE;gBACtEe,KAAKI,YAAY,GAAGF,kBAAkB;oBACpC,GAAGF,IAAI;oBACPZ,UAAU,AAACY,KAA+BZ,QAAQ,IAAIqG;gBACxD;gBAEA,OAAOzF;YACT;YACA6F,6BAA6B;YAC7BC,eAAe,OAAOxG,KAAKyG;gBACzB,MAAMC,aAAa,IAAIC,IAAI3G,IAAIL,GAAG,IAAI;gBACtC,MAAM6D,KAAKkD,WAAWE,YAAY,CAAC7D,GAAG,CAAC;gBACvC,MAAM8D,yBAAyB,yBAAyBJ,KAAKK,MAAM;gBAEnE,IAAID,wBAAwB;oBAC1B,MAAMlB,sBAAsBc,KAAKK,MAAM,CAACnB,mBAAmB;oBAE3D,IAAI,CAAChK,yBAAyBgK,sBAAsB;wBAClD,MAAM,IAAItK,SAAS,2CAA2C;oBAChE;oBAEA,MAAM0L,eAAe,MAAMzF,mBAAmB;wBAC5CjD,gBAAgBxB,WAAWuG,IAAI;wBAC/ByC,SAASF;oBACX;oBACA,MAAMqB,mBAAmBnL,+BAA+B;wBACtDoJ,kBAAkBlF;wBAClB8F,SAASF;oBACX;oBACA,MAAMsB,kBAAkBrJ,YACpB0F,eAAe,CAAC,CAAC,EAAE0D,kBAAkB,EAAE1K,gCACvC2E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK,CAAC,CAAC,EAAEyD,kBAAkB;wBAC3BnD,gBAAgB;4BAAC;gCAAEC,KAAKxH;4BAA6B;yBAAE;wBACvD+E;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAUuF,aAAaG,IAAI;wBAC3BzF,SAASwF;wBACT5J,UAAU0J,aAAa1J,QAAQ;wBAC/BqE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,MAAMvF,MACJiJ,KAAKjJ,GAAG,IACP,MAAMqC,6BAA6B;oBAClChD,YAAY4J,KAAKK,MAAM,CAACjK,UAAU;oBAClCiD,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BC,QAAQ0G,KAAKK,MAAM,CAAC/G,MAAM;oBAC1BC;gBACF;gBAEF,MAAMgF,kBAAkB,MAAM/J,mBAAmB;oBAC/C4B;oBACAoI,kBAAkBlF;oBAClBvC,KAAKA,OAAO+B;oBACZO,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BqH,kBAAkBV,KAAKK,MAAM,CAAC/G,MAAM;oBACpCC;gBACF;gBACA,MAAMoH,eAAe,CAAC,CAAC,EAAEpC,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBAC9D,MAAMZ,WAAYG,KAAsCH;gBAExD,6EAA6E;gBAC7E,yEAAyE;gBACzE,IAAI,OAAOA,aAAa,YAAY9B,cAAc8B,WAAW;oBAC3D,MAAMgK,WAAY7J,KAAsC6J;oBAExD,IAAI,OAAOA,aAAa,YAAY,CAACC,OAAOC,aAAa,CAACF,aAAaA,WAAW,GAAG;wBACnF,MAAM,IAAIhM,SAAS,gDAAgD;oBACrE;oBAEA,MAAMoG,UAAUlE,kBAAkBC,KAAKI,aACnC0F,eAAe8D,cAAc9K,gCAC7B2E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK6D;wBACLvD,gBAAgB;4BAAC;gCAAEC,KAAKxH;4BAA6B;yBAAE;wBACvD+E;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAU6F;wBACV5F;wBACApE;wBACAqE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,2EAA2E;gBAC3E,+EAA+E;gBAC/E,IAAIxF,kBAAkBC,KAAKI,YAAY;oBACrC,IAAI4J,UAAUJ;oBAEd,6EAA6E;oBAC7E,yEAAyE;oBACzE,IAAI5D,MAAMtH,gBAAgBmB,WAAW;wBACnCmK,UAAUpL,kBAAkBoL;oBAC9B,OAAO,IAAIhE,MAAMvH,cAAcoB,WAAW;wBACxCmK,UAAUrL,wBAAwBqL;oBACpC;oBAEA,OAAO3F,SAAS4F,QAAQ,CAACnE,eAAekE,SAAShE,KAAK;gBACxD;gBAEA,MAAMkE,cAAczG,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACzCH,KACE9D,qBAAqBjC,QACrB4J;oBACFvD,gBAAgBL,KAAK;wBAAC;4BAAEM,KAAKN;wBAAG;qBAAE,GAAGjE;oBACrC8B;gBACF;gBAEA,OAAOQ,SAAS4F,QAAQ,CAACC,aAAa;YACxC;QACF;IACF;AACF;AAEA,MAAMC,4BAA4B,CAChCC,aACAC,SACA1G,cACA/C,YACA0J;IAEA,MAAMC,oBAAwE,CAAC;IAE/E,KAAK,MAAM1J,kBAAkB2J,OAAOC,IAAI,CAACL,aAAc;QACrDG,iBAAiB,CAAC1J,eAAe,GAAG;YAClCwJ;YACAK,qBAAqB;YACrB,oFAAoF;YACpFJ,6BAA6B3G,aAAakC,GAAG,CAAChF,kBAC1CkB,YACAuI;YACJ/H,QAAQ5B,oBAAoBC,YAAYC;QAC1C;IACF;IAEA,OAAO0J;AACT;AAEA,OAAO,MAAMI,kBACX,CAACC,gBACD,CAACC;QACC,MAAM,EACJC,kBAAkB,EAClBpH,aAAa,EACb0G,WAAW,EACXE,2BAA2B,EAC3BS,OAAO,EACPC,UAAU,EACV1K,MAAM,EACN2K,UAAU,EACVC,SAAS,EACTtH,oBAAoBuH,wBAAwB,EAC5CtH,WAAW,EACZ,GAAG+G;QAEJ,IAAI,CAACK,YAAYzK,QAAQ;YACvB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACwK,WAAW1K,QAAQ;YACtB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACmD,aAAarD,QAAQ;YACxB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAAC0J,eAAeI,OAAOC,IAAI,CAACL,aAAazK,MAAM,KAAK,GAAG;YACzD,MAAM,IAAIe,MAAM;QAClB;QAEA,MAAMiD,eAAe,IAAIyH,IACvBZ,OAAOa,OAAO,CAACjB,aACZkB,MAAM,CAAC,CAAC,GAAGrM,MAAM,GAAKD,0BAA0BC,QAChDsM,GAAG,CAAC,CAAC,CAAC3F,KAAK,GAAKA;QAErB,MAAM4F,kBAAkB,IAAIJ,IAAIZ,OAAOC,IAAI,CAACL;QAE5C,IAAIE,+BAA+B3G,aAAa+F,IAAI,GAAG,GAAG;YACxD,MAAM,IAAIhJ,MACR;QAEJ;QAEA,IAAI4J,6BAA6B;YAC/B,MAAMmB,qBAAqB,AAACZ,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAChDkB,MAAM,CACL,CAACjM,aACCmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,KAAKxG,sBAAsBC,aAEjEkM,GAAG,CAAC,CAAClM,aAAeA,WAAWuG,IAAI;YAEtC,IAAI6F,mBAAmB9L,MAAM,GAAG,GAAG;gBACjC,MAAM,IAAIe,MACR,CAAC,kHAAkH,EAAE+K,mBAAmB1K,IAAI,CAAC,MAAM,sLAAsL,CAAC;YAE9U;QACF;QAEA,MAAM6C,qBACJ,OAAOuH,6BAA6B,YAAYA,2BAA2B,IACvEA,2BACAtM;QACN,MAAM2E,WAAWqH,OAAOa,MAAM,EAAEC,OAAO;QAEvC,MAAM/K,aAAaP,gBAAgBC;QAEnC,MAAMsL,iBAAiB,IAAIxO,SAAS;YAAE6N;QAAW;QACjD,MAAMY,qBAAqBrB,OAAOsB,WAAW,CAC3C,AAACjB,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACrBkB,MAAM,CAAC,CAACjM,aAAemM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAC1D2F,GAAG,CAAC,CAAClM,aAAe;gBACnBA,WAAWuG,IAAI;gBACf;oBACEvG;oBACAe,WAAWuD,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;oBAC3CrD,QAAQ5B,oBAAoBC,YAAYvB,WAAWuG,IAAI;gBACzD;aACD;QAEL,MAAM9B,qBAAqB1F,mCAAmC;YAC5DqF,QAAQmI;YACRxB,aAAayB;QACf;QACA,MAAMxB,UAAU9G,gBAAgB;YAC9BC;YACAC,QAAQmI;YACRlI;YACAC;YACA/C;YACAgD;YACAC;YACAC;QACF;QAEA,MAAMiI,yBAAiC;YACrC,GAAGlB,MAAM;YACTT,aAAa,AAACS,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAAClM;gBAC3C,IAAI,CAACmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAAG;oBACzC,OAAOvG;gBACT;gBAEA,MAAM2M,sBAAsBrI,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;gBAC5D,MAAMxC,oBAAoB,CAACpD,MACzBD,kBAAkBC,KAAKgM,uBACnBxN,4BAA4BwB,KAAKX,WAAWuG,IAAI,EAAEpC,YAClDjF,qBAAqByB;gBAE3B,MAAMiM,oBAAoB7B,WAAW,CAAC/K,WAAWuG,IAAI,CAAC;gBACtD,MAAMsG,uBACJD,sBAAsB,QACtB,OAAOA,sBAAsB,YAC7B,OAAOA,kBAAkBjB,UAAU,KAAK,YACpCiB,kBAAkBjB,UAAU,GAC5BjJ;gBAEN,4EAA4E;gBAC5E,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMoK,sBAAsB9M,WAAWmH,KAAK,EAAEU;gBAC9C,MAAMkF,YAAYJ,sBACd;oBACE,GAAI3M,WAAWmH,KAAK,IAAI,CAAC,CAAC;oBAC1BU,aACE,OAAOiF,wBAAwB,YAAYA,oBAAoB3L,IAAI,GAAGb,MAAM,GAAG,IAC3E,GAAGwM,oBAAoB,CAAC,EAAEpN,gCAAgC,GACzDoN,uBAAuBpN;gBAChC,IACAM,WAAWmH,KAAK;gBAEpB,OAAO;oBACL,GAAGnH,UAAU;oBACbmH,OAAO4F;oBACPjF,OAAO;wBACL,GAAI9H,WAAW8H,KAAK,IAAI,CAAC,CAAC;wBAC1BkF,cAAc;+BACRhN,WAAW8H,KAAK,EAAEkF,gBAAgB,EAAE;4BACxC,OAAO,EAAEnJ,IAAI,EAAEV,GAAG,EAAE;gCAClB,IAAI,CAACR,SAASkB,SAAS,CAACV,IAAI4F,IAAI,EAAED,qBAAqB;oCACrD,OAAOjF;gCACT;gCAEA,MAAMmF,UAAU7F,IAAI4F,IAAI,CAACD,mBAAmB;gCAC5C,MAAMmE,kBAAkB9J,IAAI4F,IAAI,CAACmE,QAAQ,CAACC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAEhM,OAAOiM;gCACnE,IACE,CAACtO,yBAAyBkK,YAC1BA,QAAQ/F,QAAQ,KAAKY,KAAKZ,QAAQ,IAClC+F,QAAQ/F,QAAQ,KAAKE,IAAI4F,IAAI,CAAChH,IAAI,IAClC,qEAAqE;gCACrE,gEAAgE;gCAChEiH,QAAQqE,YAAY,KAAKxJ,KAAK2G,QAAQ,EACtC;oCACA,MAAM,IAAIhM,SAAS,iEAAiE;gCACtF;gCAEA,MAAMsF,WAAW,MAAMW,mBAAmB;oCACxCjD,gBAAgBxB,WAAWuG,IAAI;oCAC/ByC;gCACF;gCACA,gFAAgF;gCAChF,8EAA8E;gCAC9E,IACEiE,oBAAoBjE,QAAQsE,gBAAgB,IAC5CL,oBAAoBnJ,SAAStD,QAAQ,EACrC;oCACA,MAAM,IAAIhC,SAAS,iEAAiE;gCACtF;gCACA,+EAA+E;gCAC/E,2DAA2D;gCAC3D,MAAM+O,WAAW,MAAMpK,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;oCAC5CzD,YAAYA,WAAWuG,IAAI;oCAC3BpD;oCACAO,OAAO;wCACL,mBAAmB;4CACjBL,QAAQS,SAASrB,MAAM;wCACzB;oCACF;gCACF;gCACA,IAAI8K,UAAU;oCACZ,MAAM,IAAI/O,SAAS,8DAA8D;gCACnF;gCAEAqF,KAAKZ,QAAQ,GAAGa,SAAS/B,IAAI;gCAC7B8B,KAAK2G,QAAQ,GAAG1G,SAASuG,IAAI;gCAC7BxG,KAAKrD,QAAQ,GAAGsD,SAAStD,QAAQ;gCAEjC,OAAOoD,gCACLC,MACAC,UACAC,mBACA4I;4BAEJ;yBACD;wBACDa,iBAAiB;+BACXxN,WAAW8H,KAAK,EAAE0F,mBAAmB,EAAE;4BAC3C,CAAC,EAAE5D,IAAI,EAAE6D,SAAS,EAAEtK,GAAG,EAAE;gCACvB,IACE,AAACsK,cAAc,YAAYA,cAAc,YACzCtK,IAAI6F,OAAO,EAAE0E,oBACb,CAACvK,IAAI4F,IAAI,IACT5F,IAAI4F,IAAI,CAACD,mBAAmB,IAC5B,CAAE,CAAA,UAAUc,IAAG,KACf,CAACjH,SAASiH,KAAK/F,IAAI,KACnB,OAAO+F,KAAK/F,IAAI,CAACX,MAAM,KAAK,UAC5B;oCACA,OAAO0G;gCACT;gCAEA,yEAAyE;gCACzE,wEAAwE;gCACxEA,KAAK/F,IAAI,CAACX,MAAM,GAAG/E,2BAA2B;oCAC5CiK,kBAAkB9G,oBAAoBC,YAAYvB,WAAWuG,IAAI;oCACjE8B,WAAWuB,KAAK/F,IAAI,CAACX,MAAM;oCAC3BD,UAAUE,IAAI4F,IAAI,CAAChH,IAAI;gCACzB,GAAG4L,kBAAkB;gCACrB,OAAO/D;4BACT;yBACD;oBACH;oBACA3J,QAAQ;wBACN,mEAAmE;wBACnE,4DAA4D;wBAC5D,gEAAgE;wBAChE,wBAAwB;wBACxB0L,YAAY;wBACZ,GAAI,OAAOA,eAAe,YAAY;4BAAEA;wBAAW,IAAI,CAAC,CAAC;wBACzD,GAAI,OAAOkB,yBAAyB,YAChC;4BAAElB,YAAYkB;wBAAqB,IACnC,CAAC,CAAC;wBACN,GAAI,OAAO7M,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;wBAClE2N,gBAAgB,CAAC,EAAEjN,GAAG,EAAE,GAAKoD,kBAAkBpD;wBAC/CkN,MAAM;oBACR;gBACF;YACF;QACF;QAEA,MAAMC,oBAAoB3C,OAAOsB,WAAW,CAC1CtB,OAAOC,IAAI,CAACL,aAAamB,GAAG,CAAC,CAAC1K,iBAAmB;gBAC/CA;gBACA;oBACET,WAAWuD,aAAakC,GAAG,CAAChF;oBAC5B0B,QAAQ5B,oBAAoBC,YAAYC;gBAC1C;aACD;QAKHnD,kBAAkB;YAChB0P,eAAe;YACfhD,aAAa+C;YACbtC,QAAQkB;YACRhB,SAASA,YAAY,SAASxL,QAAQmE;YACtC2J,eAAe/O,gCAAgC;gBAC7CgP,QAAQ,OAAO5J,kBAAkB,WAAWA,cAAc4J,MAAM,GAAGvL;gBACnEqI,aAAa+C;gBACblC;gBACAC;gBACApH;YACF;YACAyJ,mBAAmBrP;QACrB;QAEA,MAAMsP,SAASlQ,mBAAmB;YAChCwN;YACAV,aAAaD,0BACXC,aACAC,SACA1G,cACA/C,YACA0J;YAEFS;QACF,GAAGgB;QAEH,8FAA8F;QAC9F,yDAAyD;QACzDyB,OAAOpD,WAAW,GAAG,AAACoD,CAAAA,OAAOpD,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAAClM;YACnD,IAAI,CAACmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAAG;gBACzC,OAAOvG;YACT;YAEA,MAAMoO,sBAAsB,AAAC5C,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACjDxI,IAAI,CAAC,CAAC8L,WAAaA,SAAS9H,IAAI,KAAKvG,WAAWuG,IAAI,GACnDW,OAAO3E,KAAK,CAAC+L,QAAU,UAAUA,SAASA,MAAMvM,IAAI,KAAK;YAE7D,MAAMwM,qBAAqB,CAACD;gBAC1B,IACEA,MAAMjM,IAAI,KAAK,UACf,UAAUiM,SACVA,MAAMvM,IAAI,KAAK,YACd,CAAA,CAACqM,uBACA,CAAE,CAAA,kBAAkBA,mBAAkB,KACtCA,oBAAoBI,YAAY,IAAI,IAAG,GACzC;oBACA,uEAAuE;oBACvE,uEAAuE;oBACvE,oEAAoE;oBACpE,kEAAkE;oBAClE,OAAO;wBACL,GAAGF,KAAK;wBACRE,cAAc,CAAC,EAAErL,GAAG,EAAE,GACpBA,IAAI4F,IAAI,IAAI,OAAOuF,MAAME,YAAY,KAAK,WAAWF,MAAME,YAAY,GAAG;oBAC9E;gBACF;gBACA,IAAI,UAAUF,SAASA,MAAMvM,IAAI,KAAK,cAAc;oBAClD,OAAO;wBAAE,GAAGuM,KAAK;wBAAEG,QAAQ;oBAAK;gBAClC;gBACA,IAAIH,MAAMjM,IAAI,KAAK,WAAW,UAAUiM,SAASA,MAAMvM,IAAI,KAAK,YAAY;oBAC1E,OAAO;wBACL,GAAGuM,KAAK;wBACRpH,QAAQoH,MAAMpH,MAAM,CAACgF,GAAG,CAAC,CAACwC,gBACxB,UAAUA,iBAAiBA,cAAc3M,IAAI,KAAK,WAC9C;gCAAE,GAAG2M,aAAa;gCAAED,QAAQ;4BAAK,IACjCC;oBAER;gBACF;gBACA,yFAAyF;gBACzF,IAAIJ,MAAMjM,IAAI,KAAK,eAAe;oBAChC,OAAO;wBAAE,GAAGiM,KAAK;wBAAEpH,QAAQoH,MAAMpH,MAAM,CAACgF,GAAG,CAACqC;oBAAoB;gBAClE;gBACA,OAAOD;YACT;YAEA,OAAO;gBACL,GAAGtO,UAAU;gBACbkH,QAAQlH,WAAWkH,MAAM,CAACgF,GAAG,CAACqC;YAChC;QACF;QAEA,OAAOJ;IACT,EAAC;AAEH,SAASQ,aAAa,QAAQ,eAAc;AAG5C,4BAA4B;AAC5B,OAAO,MAAMC,yBAAyBtD,gBAAe;AACrD,OAAO,MAAMuD,yBAAyBvD,gBAAe"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  Adapter,\n  ClientUploadsConfig,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type {\n  CollectionConfig,\n  CollectionSlug,\n  Config,\n  Field,\n  PayloadRequest,\n  TypeWithID,\n  UploadCollectionSlug,\n  Where,\n} from 'payload'\n\nimport ImageKit, { toFile } from '@imagekit/nodejs'\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport {\n  buildStoragePathData,\n  buildUploadStoragePathData,\n  getStorageFilePath,\n  initClientUploads,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { openAsBlob } from 'node:fs'\nimport path from 'node:path'\nimport { APIError } from 'payload'\nimport {\n  getRangeRequestInfo,\n  isXmlMimeType,\n  UPLOAD_CONTENT_SECURITY_POLICY,\n} from 'payload/internal'\nimport { validateMimeType } from 'payload/shared'\n\nimport type { VerifiedImageKitUpload } from './clientUploadVerification.js'\n\nimport { imageKitUploadAuthPath, isImageKitReceiptContext } from './clientUploads.js'\nimport {\n  createImageKitClientUploadVerifier,\n  getClientUploadStorageFilePath,\n} from './clientUploadVerification.js'\nimport { createImageKitUploadAuthHandler } from './endpoints/createImageKitUploadAuthHandler.js'\nimport { assertWithinFileSizeLimit, isValidFileSizeLimit } from './fileSizeLimit.js'\nimport {\n  getAdminThumbnailURL,\n  getPrivateAdminThumbnailURL,\n  isPdfMimeType,\n  isVideoMimeType,\n} from './getAdminThumbnailURL.js'\nimport { getImageKitThumbnailSrc, getVideoPosterSrc } from './imageTransforms.js'\n\nexport type ImageKitCollectionOptions = {\n  /**\n   * Maximum upload size in bytes for this collection. Applies on top of Payload's\n   * `upload.limits.fileSize`, so it can only tighten that limit. Client uploads are\n   * rejected before ImageKit authorization; server uploads before they reach ImageKit.\n   */\n  fileSizeLimit?: number\n  /**\n   * Override Payload's native focal-point picker (`upload.focalPoint`) for this\n   * collection.\n   */\n  focalPoint?: boolean\n  /**\n   * Upload files in this collection as ImageKit private files (`isPrivateFile: true`)\n   * and deliver them only through short-lived signed URLs, behind Payload access control.\n   */\n  private?: boolean\n}\ntype ImageKitCollectionConfig = ImageKitCollectionOptions | true\ntype ImageKitCollectionMap = Partial<Record<UploadCollectionSlug, ImageKitCollectionConfig>>\n\nconst DEFAULT_SIGNED_URL_EXPIRES_IN = 900\n/**\n * ImageKit re-encodes some uploads and serves the smaller derivative from the plain\n * delivery URL — a 1.9 MB MP4 can come back as 868 KB. That is exactly what we want\n * for visitors, but not when reading the file back to verify a client upload: the\n * bytes and the byte count would both belong to a file ImageKit's API never reported.\n * `orig-true` asks for the untouched original and does not disable optimisation for\n * anyone else.\n */\nconst ORIGINAL_FILE_TRANSFORMATION = 'orig-true'\n\nconst PRIVATE_COLLECTION_DESCRIPTION =\n  'Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.'\n\nconst isPrivateCollectionConfig = (value: ImageKitCollectionConfig | undefined): boolean =>\n  value !== true && typeof value === 'object' && value?.private === true\n\nconst getCollectionFileSizeLimit = (\n  value: ImageKitCollectionConfig | undefined,\n): number | undefined =>\n  value !== true && typeof value === 'object' ? value?.fileSizeLimit : undefined\n\nconst XML_FAMILY_MIME_TYPES = ['application/xml', 'image/svg+xml', 'text/xml']\n\nconst collectionCanStoreXml = (collection: CollectionConfig): boolean => {\n  const upload = collection.upload\n\n  if (!upload || upload === true) {\n    return Boolean(upload)\n  }\n\n  // Payload skips MIME and content restrictions when this escape hatch is enabled.\n  if (upload.allowRestrictedFileTypes) {\n    return true\n  }\n\n  const allowedMimeTypes = upload.mimeTypes\n\n  return (\n    !allowedMimeTypes?.length ||\n    allowedMimeTypes.some((mimeType) => mimeType.includes('*') || isXmlMimeType(mimeType)) ||\n    XML_FAMILY_MIME_TYPES.some((mimeType) => validateMimeType(mimeType, allowedMimeTypes))\n  )\n}\n\n/**\n * Whether a specific document is private. The flag stored on the document at upload time\n * (`imagekit.isPrivate`) is the source of truth — a file's privacy on ImageKit is fixed\n * when it is uploaded and does not change if the collection's `private` setting changes\n * later. Falls back to the collection setting for documents uploaded before this flag existed.\n */\nconst isDocumentPrivate = (doc: unknown, collectionIsPrivate: boolean): boolean => {\n  const stored = (doc as { imagekit?: { isPrivate?: boolean } } | undefined)?.imagekit?.isPrivate\n\n  return typeof stored === 'boolean' ? stored : collectionIsPrivate\n}\ntype ImageKitReference = {\n  imagekit?: {\n    fileId?: string\n    isPrivate?: boolean\n    thumbnailUrl?: string\n    url?: string\n  }\n}\n\ntype UploadDocumentData = {\n  thumbnailURL?: string\n} & ImageKitReference\n\nexport type PayloadStorageImageKitConfig = {\n  alwaysInsertFields?: boolean\n  clientUploads?: ClientUploadsConfig\n  collections: ImageKitCollectionMap\n  disablePayloadAccessControl?: true\n  enabled?: boolean\n  /**\n   * Broad default for Payload's native focal-point picker (`upload.focalPoint`)\n   * on every configured collection. Focal points are disabled by default for\n   * configured collections, so prefer collection-level `focalPoint: true` for\n   * image collections. A collection's own `upload.focalPoint` still takes\n   * precedence.\n   */\n  focalPoint?: boolean\n  folder: string\n  privateKey: string\n  publicKey: string\n  /**\n   * Expiry (in seconds) applied to signed URLs generated for private collections.\n   * Defaults to 900 (15 minutes). URLs are signed fresh on every request, so a short\n   * window is safe.\n   */\n  signedUrlExpiresIn?: number\n  urlEndpoint: string\n}\n\nconst normalizeFolder = (folder: string): string => {\n  const normalized = folder.trim().replace(/^\\/+|\\/+$/g, '')\n\n  if (!normalized) {\n    throw new Error('imagekitStorage: `folder` is required.')\n  }\n\n  return `/${normalized}`\n}\n\nconst getCollectionFolder = (rootFolder: string, collectionSlug: string): string =>\n  path.posix.join(rootFolder, collectionSlug)\n\nconst findImageKitFileId = async (\n  imagekit: ImageKit,\n  filePath: string,\n): Promise<string | undefined> => {\n  const parentPath = path.posix.dirname(filePath)\n  const name = path.posix.basename(filePath)\n\n  const limit = 100\n\n  for (let skip = 0; ; skip += limit) {\n    const assets = await imagekit.assets.list({\n      type: 'file',\n      limit,\n      path: parentPath === '/' ? '/' : `${parentPath}/`,\n      skip,\n    })\n\n    const found = assets.find(\n      (asset) => 'fileId' in asset && asset.filePath === filePath && asset.name === name,\n    )\n\n    if (found && 'fileId' in found) {\n      return found.fileId\n    }\n\n    if (assets.length < limit) {\n      break\n    }\n  }\n\n  return undefined\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object'\n\nconst getStoredImageKitURL = (doc: unknown): string | undefined => {\n  const storedURL = (doc as ImageKitReference | undefined)?.imagekit?.url\n\n  return typeof storedURL === 'string' && storedURL.trim().length > 0 ? storedURL : undefined\n}\n\nconst hasStoredImageKitURL = (doc: unknown): boolean => !!getStoredImageKitURL(doc)\n\nconst findUploadDocumentByFilename = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: string\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<null | TypeWithID> => {\n  const constraints: Where[] = [\n    {\n      filename: {\n        equals: filename,\n      },\n    },\n  ]\n\n  if (typeof prefix === 'string') {\n    constraints.push({\n      prefix: {\n        equals: prefix,\n      },\n    })\n  }\n\n  return req.payload.db.findOne({\n    collection,\n    req,\n    where: {\n      and: constraints,\n    },\n  })\n}\n\nconst applyVerifiedClientUploadToData = <T extends UploadDocumentData>(\n  data: T,\n  uploaded: VerifiedImageKitUpload,\n  buildThumbnailURL: (data: T) => string = getAdminThumbnailURL,\n  isPrivate: boolean,\n): T => {\n  data.imagekit = {\n    fileId: uploaded.fileId,\n    isPrivate,\n    thumbnailUrl: uploaded.thumbnailUrl,\n    url: uploaded.url,\n  }\n\n  // Preserve the admin preview when the original file was already uploaded client-side.\n  data.thumbnailURL = buildThumbnailURL(data)\n\n  return data\n}\n\nconst imagekitAdapter = ({\n  apiRoute,\n  client,\n  clientUploads,\n  privateSlugs,\n  rootFolder,\n  signedUrlExpiresIn,\n  urlEndpoint,\n  verifyClientUpload,\n}: {\n  apiRoute: string\n  client: ImageKit\n  clientUploads?: ClientUploadsConfig\n  privateSlugs: Set<string>\n  rootFolder: string\n  signedUrlExpiresIn: number\n  urlEndpoint: string\n  verifyClientUpload: ReturnType<typeof createImageKitClientUploadVerifier>\n}): Adapter => {\n  const fetchUploadedFile = async ({\n    fileSize,\n    fileURL,\n    mimeType,\n    range,\n  }: {\n    fileSize: number\n    fileURL: string\n    mimeType: string\n    range?: null | string\n  }): Promise<Response> => {\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader: range ?? null })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    const normalizedRange =\n      rangeResult.type === 'partial'\n        ? `bytes=${rangeResult.rangeStart}-${rangeResult.rangeEnd}`\n        : undefined\n    // Payload cancels image probes after reading a bounded prefix. Next.js memoizes\n    // GET responses by teeing their streams; cancelling one branch can then wait\n    // forever for its unread cached sibling. An explicit signal opts out of that\n    // memoization, while no-store also excludes these reads from the data cache.\n    const response = await fetch(fileURL, {\n      cache: 'no-store',\n      ...(normalizedRange ? { headers: { Range: normalizedRange } } : {}),\n      signal: new AbortController().signal,\n    })\n\n    if (!response.ok || response.status !== rangeResult.status) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error(\n        `imagekitStorage: ImageKit returned an unexpected file response (${response.status}).`,\n      )\n    }\n\n    const upstreamLength = response.headers.get('Content-Length')\n    const expectedLength = rangeResult.headers['Content-Length']\n    const upstreamRange = response.headers.get('Content-Range')\n    const expectedRange =\n      rangeResult.type === 'partial' ? rangeResult.headers['Content-Range'] : undefined\n\n    if (\n      (upstreamLength !== null && upstreamLength !== expectedLength) ||\n      (expectedRange && upstreamRange !== expectedRange)\n    ) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error('imagekitStorage: ImageKit returned mismatched file content metadata.')\n    }\n\n    const headers = new Headers(rangeResult.headers)\n    headers.set('Content-Type', mimeType)\n    if (isXmlMimeType(mimeType)) {\n      headers.set('Content-Security-Policy', UPLOAD_CONTENT_SECURITY_POLICY)\n    }\n\n    return new Response(response.body, {\n      headers,\n      status: response.status,\n    })\n  }\n\n  return ({ collection, prefix = getCollectionFolder(rootFolder, collection.slug) }) => {\n    const isPrivate = privateSlugs.has(collection.slug)\n\n    // Sign a relative ImageKit path against the configured urlEndpoint. We always sign\n    // a computed path (never a stored absolute URL) because ImageKit's signature is\n    // derived from the path after stripping urlEndpoint, so the host must match.\n    const buildSignedURL = (src: string, tr?: null | string): string =>\n      client.helper.buildSrc({\n        expiresIn: signedUrlExpiresIn,\n        signed: true,\n        src,\n        transformation: tr ? [{ raw: tr }] : undefined,\n        urlEndpoint,\n      })\n\n    const buildThumbnailURL = (doc: UploadDocumentData): string =>\n      isDocumentPrivate(doc, isPrivate)\n        ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n        : getAdminThumbnailURL(doc)\n\n    return {\n      name: 'imagekit',\n      clientUploads,\n      fields: [\n        {\n          // Presentational wrapper: tucks the ImageKit details into a closed panel without\n          // changing the `imagekit.*` data paths.\n          type: 'collapsible',\n          admin: {\n            condition: (data) => hasStoredImageKitURL(data),\n            initCollapsed: true,\n          },\n          fields: [\n            {\n              name: 'imagekit',\n              type: 'group',\n              admin: {\n                disableListColumn: true,\n                disableListFilter: true,\n              },\n              fields: [\n                {\n                  name: 'fileId',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n                {\n                  name: 'url',\n                  type: 'text',\n                  admin: {\n                    readOnly: true,\n                  },\n                  label: 'URL',\n                },\n                {\n                  name: 'isPrivate',\n                  type: 'checkbox',\n                  admin: {\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description:\n                      \"Indicates whether this file was uploaded to ImageKit as private. Private files are delivered through signed URLs. Changes to this collection's private option in payload.config only affect future uploads.\",\n                    readOnly: true,\n                  },\n                  label: 'Private file',\n                },\n                {\n                  name: 'signedUrl',\n                  type: 'text',\n                  admin: {\n                    // Only relevant for private files; the plain `url` works directly for public ones.\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description: `Temporary signed URL for reaching this private file directly on ImageKit. Expires ${signedUrlExpiresIn} seconds after load and is regenerated on every read. Note: anyone with this URL can access the file until it expires — it is not gated by Payload access control.`,\n                    readOnly: true,\n                  },\n                  hooks: {\n                    // Computed server-side on read so it is always freshly signed and never persisted.\n                    afterRead: [\n                      ({ data, siblingData }) => {\n                        if (!isDocumentPrivate({ imagekit: siblingData }, isPrivate)) {\n                          return undefined\n                        }\n\n                        const filename = (data as { filename?: string } | undefined)?.filename\n\n                        if (!filename) {\n                          return undefined\n                        }\n\n                        const source = (data || {}) as { _objectKey?: string; prefix?: string }\n                        const documentPrefix = path.posix.join(\n                          source.prefix || prefix,\n                          source._objectKey || '',\n                        )\n                        const storageFilePath = buildStoragePathData({\n                          collectionPrefix: prefix,\n                          docPrefix: documentPrefix,\n                          filename,\n                        }).storageFilePath\n\n                        return buildSignedURL(`/${storageFilePath}`)\n                      },\n                    ],\n                  },\n                  label: 'Signed URL',\n                  virtual: true,\n                },\n                {\n                  name: 'thumbnailUrl',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n              ],\n              interfaceName: 'imagekitFields',\n              label: false,\n            },\n          ],\n          label: 'Storage: ImageKit',\n        },\n      ],\n      generateURL: ({ filename, prefix: documentPrefix = '' }) =>\n        client.helper.buildSrc({\n          src: `/${buildStoragePathData({\n            collectionPrefix: prefix,\n            docPrefix: documentPrefix,\n            filename,\n          }).storageFilePath}`,\n          urlEndpoint,\n        }),\n      handleDelete: async ({ doc, storageFilePath }) => {\n        const storedFileId = (doc as ImageKitReference & typeof doc).imagekit?.fileId\n        const fileId =\n          storedFileId || (await findImageKitFileId(client, `/${storageFilePath.replace(/^\\/+/, '')}`))\n\n        if (!fileId) {\n          return\n        }\n\n        await client.files.delete(fileId)\n      },\n      handleUpload: async ({ clientUploadContext, data, file, storageFilePath }) => {\n        if (clientUploadContext) {\n          const uploaded = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n\n          return applyVerifiedClientUploadToData(data, uploaded, buildThumbnailURL, isPrivate)\n        }\n\n        // ImageKit's `toFile()` consumes async iterables before starting the request. A file-backed\n        // Blob keeps temporary-file uploads lazy so FormData can stream them from disk instead.\n        const uploadSource = file.tempFilePath\n          ? await openAsBlob(file.tempFilePath, { type: file.mimeType })\n          : file.buffer\n        const uploadFile = await toFile(uploadSource, file.filename, { type: file.mimeType })\n        const uploadFolder = path.posix.dirname(`/${storageFilePath.replace(/^\\/+/, '')}`)\n        const uploadFilename = path.posix.basename(storageFilePath)\n\n        const uploaded = await client.files.upload({\n          file: uploadFile,\n          fileName: uploadFilename,\n          folder: uploadFolder,\n          useUniqueFileName: false,\n          ...(isPrivate ? { isPrivateFile: true } : {}),\n        })\n\n        data.imagekit = {\n          fileId: uploaded.fileId,\n          isPrivate,\n          thumbnailUrl: uploaded.thumbnailUrl,\n          url: uploaded.url,\n        }\n\n        // Set the root-level thumbnailURL that Payload's admin interface expects.\n        // `buildThumbnailURL` needs the filename, which Payload may not have copied onto\n        // `data` yet at this point, so fall back to the uploaded file's name.\n        data.thumbnailURL = buildThumbnailURL({\n          ...data,\n          filename: (data as { filename?: string }).filename || uploadFilename,\n        })\n\n        return data\n      },\n      requiresClientUploadReceipt: true,\n      staticHandler: async (req, args) => {\n        const requestURL = new URL(req.url || 'http://localhost')\n        const tr = requestURL.searchParams.get('tr')\n        const hasClientUploadContext = 'clientUploadContext' in args.params\n\n        if (hasClientUploadContext) {\n          const clientUploadContext = args.params.clientUploadContext\n\n          if (!isImageKitReceiptContext(clientUploadContext)) {\n            throw new APIError('Invalid ImageKit client upload context.', 400)\n          }\n\n          const uploadedFile = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n          const expectedFilePath = getClientUploadStorageFilePath({\n            collectionPrefix: prefix,\n            context: clientUploadContext,\n          })\n          const verifiedFileURL = isPrivate\n            ? buildSignedURL(`/${expectedFilePath}`, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: `/${expectedFilePath}`,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: uploadedFile.size,\n            fileURL: verifiedFileURL,\n            mimeType: uploadedFile.mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        const doc =\n          args.doc ||\n          (await findUploadDocumentByFilename({\n            collection: args.params.collection,\n            filename: args.params.filename,\n            prefix: args.params.prefix,\n            req,\n          }))\n\n        const storageFilePath = await getStorageFilePath({\n          collection,\n          collectionPrefix: prefix,\n          doc: doc || undefined,\n          filename: args.params.filename,\n          prefixQueryParam: args.params.prefix,\n          req,\n        })\n        const imageKitPath = `/${storageFilePath.replace(/^\\/+/, '')}`\n        const mimeType = (doc as { mimeType?: string } | null)?.mimeType\n\n        // XML-family uploads (including SVG) must pass through Payload so its CSP is\n        // present even when ImageKit uses a custom, same-origin delivery domain.\n        if (typeof mimeType === 'string' && isXmlMimeType(mimeType)) {\n          const filesize = (doc as { filesize?: number } | null)?.filesize\n\n          if (typeof filesize !== 'number' || !Number.isSafeInteger(filesize) || filesize < 0) {\n            throw new APIError('Stored ImageKit file metadata is incomplete.', 500)\n          }\n\n          const fileURL = isDocumentPrivate(doc, isPrivate)\n            ? buildSignedURL(imageKitPath, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: imageKitPath,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: filesize,\n            fileURL,\n            mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        // Sign based on the document's stored status, not the collection's current\n        // setting, so files keep working if the collection's privacy is changed later.\n        if (isDocumentPrivate(doc, isPrivate)) {\n          let signSrc = imageKitPath\n\n          // A `tr` request for a video/PDF is a thumbnail request (the plain transform\n          // can't render a preview); serve ImageKit's generated thumbnail instead.\n          if (tr && isVideoMimeType(mimeType)) {\n            signSrc = getVideoPosterSrc(signSrc)\n          } else if (tr && isPdfMimeType(mimeType)) {\n            signSrc = getImageKitThumbnailSrc(signSrc)\n          }\n\n          return Response.redirect(buildSignedURL(signSrc, tr), 302)\n        }\n\n        const imageKitURL = client.helper.buildSrc({\n          src:\n            getStoredImageKitURL(doc) ||\n            imageKitPath,\n          transformation: tr ? [{ raw: tr }] : undefined,\n          urlEndpoint,\n        })\n\n        return Response.redirect(imageKitURL, 302)\n      },\n    }\n  }\n}\n\nconst toCloudStorageCollections = (\n  collections: ImageKitCollectionMap,\n  adapter: Adapter,\n  privateSlugs: Set<string>,\n  rootFolder: string,\n  disablePayloadAccessControl?: true,\n): Partial<Record<CollectionSlug, CollectionOptions>> => {\n  const mappedCollections: Partial<Record<CollectionSlug, CollectionOptions>> = {}\n\n  for (const collectionSlug of Object.keys(collections)) {\n    mappedCollections[collectionSlug] = {\n      adapter,\n      disableLocalStorage: true,\n      // Private files require Payload access control so URLs can be signed at serve time.\n      disablePayloadAccessControl: privateSlugs.has(collectionSlug)\n        ? undefined\n        : disablePayloadAccessControl,\n      prefix: getCollectionFolder(rootFolder, collectionSlug),\n    }\n  }\n\n  return mappedCollections\n}\n\nexport const imagekitStorage =\n  (pluginOptions: PayloadStorageImageKitConfig) =>\n  (config: Config): Config => {\n    const {\n      alwaysInsertFields,\n      clientUploads,\n      collections,\n      disablePayloadAccessControl,\n      enabled,\n      focalPoint,\n      folder,\n      privateKey,\n      publicKey,\n      signedUrlExpiresIn: signedUrlExpiresInOption,\n      urlEndpoint,\n    } = pluginOptions\n\n    if (!privateKey?.trim()) {\n      throw new Error('imagekitStorage: `privateKey` is required.')\n    }\n\n    if (!publicKey?.trim()) {\n      throw new Error('imagekitStorage: `publicKey` is required.')\n    }\n\n    if (!urlEndpoint?.trim()) {\n      throw new Error('imagekitStorage: `urlEndpoint` is required.')\n    }\n\n    if (!collections || Object.keys(collections).length === 0) {\n      throw new Error('imagekitStorage: `collections` must include at least one upload collection.')\n    }\n\n    const invalidFileSizeLimitSlugs = Object.entries(collections)\n      .filter(([, value]) => {\n        const fileSizeLimit = getCollectionFileSizeLimit(value)\n        return fileSizeLimit !== undefined && !isValidFileSizeLimit(fileSizeLimit)\n      })\n      .map(([slug]) => slug)\n\n    if (invalidFileSizeLimitSlugs.length > 0) {\n      throw new Error(\n        `imagekitStorage: \\`fileSizeLimit\\` must be a positive integer number of bytes (${invalidFileSizeLimitSlugs.join(', ')}).`,\n      )\n    }\n\n    const privateSlugs = new Set(\n      Object.entries(collections)\n        .filter(([, value]) => isPrivateCollectionConfig(value))\n        .map(([slug]) => slug),\n    )\n    const configuredSlugs = new Set(Object.keys(collections))\n\n    if (disablePayloadAccessControl && privateSlugs.size > 0) {\n      throw new Error(\n        'imagekitStorage: `disablePayloadAccessControl` cannot be used with private collections. Private files require Payload access control to remain enabled so URLs can be signed at serve time.',\n      )\n    }\n\n    if (disablePayloadAccessControl) {\n      const xmlCollectionSlugs = (config.collections || [])\n        .filter(\n          (collection) =>\n            configuredSlugs.has(collection.slug) && collectionCanStoreXml(collection),\n        )\n        .map((collection) => collection.slug)\n\n      if (xmlCollectionSlugs.length > 0) {\n        throw new Error(\n          `imagekitStorage: \\`disablePayloadAccessControl\\` cannot be used with collections that can store XML-family files (${xmlCollectionSlugs.join(', ')}). XML-family files require Payload's file route so its Content Security Policy is applied. Configure a MIME allow list that excludes SVG/XML, or keep Payload access control enabled.`,\n        )\n      }\n    }\n\n    const signedUrlExpiresIn =\n      typeof signedUrlExpiresInOption === 'number' && signedUrlExpiresInOption > 0\n        ? signedUrlExpiresInOption\n        : DEFAULT_SIGNED_URL_EXPIRES_IN\n    const apiRoute = config.routes?.api ?? '/api'\n\n    const rootFolder = normalizeFolder(folder)\n\n    const imageKitClient = new ImageKit({ privateKey })\n    const collectionSecurity = Object.fromEntries(\n      (config.collections || [])\n        .filter((collection) => configuredSlugs.has(collection.slug))\n        .map((collection) => [\n          collection.slug,\n          {\n            collection,\n            isPrivate: privateSlugs.has(collection.slug),\n            prefix: getCollectionFolder(rootFolder, collection.slug),\n          },\n        ]),\n    )\n    const verifyClientUpload = createImageKitClientUploadVerifier({\n      client: imageKitClient,\n      collections: collectionSecurity,\n    })\n    const adapter = imagekitAdapter({\n      apiRoute,\n      client: imageKitClient,\n      clientUploads,\n      privateSlugs,\n      rootFolder,\n      signedUrlExpiresIn,\n      urlEndpoint,\n      verifyClientUpload,\n    })\n\n    const configWithCropDisabled: Config = {\n      ...config,\n      collections: (config.collections || []).map((collection) => {\n        if (!configuredSlugs.has(collection.slug)) {\n          return collection\n        }\n\n        const isCollectionPrivate = privateSlugs.has(collection.slug)\n        const buildThumbnailURL = (doc: unknown): string =>\n          isDocumentPrivate(doc, isCollectionPrivate)\n            ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n            : getAdminThumbnailURL(doc)\n\n        const collectionOptions = collections[collection.slug]\n        const collectionFileSizeLimit = getCollectionFileSizeLimit(collectionOptions)\n        const collectionFocalPoint =\n          collectionOptions !== true &&\n          typeof collectionOptions === 'object' &&\n          typeof collectionOptions.focalPoint === 'boolean'\n            ? collectionOptions.focalPoint\n            : undefined\n\n        // Surface a \"this is a private collection\" note in the list and edit views.\n        // Preserve an existing string description by appending; leave custom\n        // component descriptions untouched.\n        const existingDescription = collection.admin?.description\n        const baseAdmin = isCollectionPrivate\n          ? {\n              ...(collection.admin || {}),\n              description:\n                typeof existingDescription === 'string' && existingDescription.trim().length > 0\n                  ? `${existingDescription} ${PRIVATE_COLLECTION_DESCRIPTION}`\n                  : (existingDescription ?? PRIVATE_COLLECTION_DESCRIPTION),\n            }\n          : collection.admin\n\n        return {\n          ...collection,\n          admin: baseAdmin,\n          hooks: {\n            ...(collection.hooks || {}),\n            beforeChange: [\n              ...(collection.hooks?.beforeChange || []),\n              async ({ data, req }) => {\n                if (!isRecord(data) || !req.file?.clientUploadContext) {\n                  return data\n                }\n\n                const context = req.file.clientUploadContext\n                const requestMimeType = req.file.mimetype.split(';', 1)[0]?.trim().toLowerCase()\n                if (\n                  !isImageKitReceiptContext(context) ||\n                  context.filename !== data.filename ||\n                  context.filename !== req.file.name ||\n                  // Payload can clear req.file.size when preparing an in-memory image.\n                  // generateFileData preserves the original size on the document.\n                  context.expectedSize !== data.filesize\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n\n                const uploaded = await verifyClientUpload({\n                  collectionSlug: collection.slug,\n                  context,\n                })\n                // Payload keeps the browser's MIME unless it fetched the file content, in which\n                // case it uses the verified ImageKit-detected type the static handler served.\n                if (\n                  requestMimeType !== context.expectedMimeType &&\n                  requestMimeType !== uploaded.mimeType\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n                // A provider file can only be claimed once, including through legacy receipts.\n                // The unique file ID index also rejects concurrent claims.\n                const existing = await req.payload.db.findOne({\n                  collection: collection.slug,\n                  req,\n                  where: {\n                    'imagekit.fileId': {\n                      equals: uploaded.fileId,\n                    },\n                  },\n                })\n                if (existing) {\n                  throw new APIError('This ImageKit client upload receipt has already been used.', 400)\n                }\n\n                data.filename = uploaded.name\n                data.filesize = uploaded.size\n                data.mimeType = uploaded.mimeType\n\n                return applyVerifiedClientUploadToData(\n                  data,\n                  uploaded,\n                  buildThumbnailURL,\n                  isCollectionPrivate,\n                )\n              },\n            ],\n            beforeOperation: [\n              ...(collection.hooks?.beforeOperation || []),\n              ({ args, operation, req }) => {\n                // Client uploads are checked when ImageKit authorization is requested, and\n                // their verified size is bound to that authorization.\n                if (\n                  (operation === 'create' || operation === 'update') &&\n                  req.file &&\n                  !req.file.clientUploadContext\n                ) {\n                  assertWithinFileSizeLimit(req.file.size, collectionFileSizeLimit)\n                }\n                return args\n              },\n              ({ args, operation, req }) => {\n                if (\n                  (operation !== 'create' && operation !== 'update') ||\n                  req.context?.skipCloudStorage ||\n                  !req.file ||\n                  req.file.clientUploadContext ||\n                  !('data' in args) ||\n                  !isRecord(args.data) ||\n                  typeof args.data.prefix !== 'string'\n                ) {\n                  return args\n                }\n\n                // Payload checks filename uniqueness before cloud storage's beforeChange\n                // normalizes the prefix. Use the persisted form during that lookup too.\n                args.data.prefix = buildUploadStoragePathData({\n                  collectionPrefix: getCollectionFolder(rootFolder, collection.slug),\n                  docPrefix: args.data.prefix,\n                  filename: req.file.name,\n                }).sanitizedDocPrefix\n                return args\n              },\n            ],\n          },\n          upload: {\n            // Focal points are opt-in for configured collections. Plugin-level\n            // and collection-level options can override this default; a\n            // collection's own `upload.focalPoint` still wins because it is\n            // spread in afterwards.\n            focalPoint: false,\n            ...(typeof focalPoint === 'boolean' ? { focalPoint } : {}),\n            ...(typeof collectionFocalPoint === 'boolean'\n              ? { focalPoint: collectionFocalPoint }\n              : {}),\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            adminThumbnail: ({ doc }) => buildThumbnailURL(doc),\n            crop: false,\n          },\n        }\n      }),\n    }\n\n    const uploadCollections = Object.fromEntries(\n      Object.keys(collections).map((collectionSlug) => [\n        collectionSlug,\n        {\n          fileSizeLimit: getCollectionFileSizeLimit(collections[collectionSlug]),\n          isPrivate: privateSlugs.has(collectionSlug),\n          prefix: getCollectionFolder(rootFolder, collectionSlug),\n        },\n      ]),\n    ) as Partial<\n      Record<UploadCollectionSlug, { fileSizeLimit?: number; isPrivate: boolean; prefix: string }>\n    >\n\n    initClientUploads({\n      clientHandler: '@humaan/payload-storage-imagekit/client#ImageKitUploadHandler',\n      collections: uploadCollections,\n      config: configWithCropDisabled,\n      enabled: enabled !== false && Boolean(clientUploads),\n      serverHandler: createImageKitUploadAuthHandler({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collections: uploadCollections,\n        privateKey,\n        publicKey,\n        verifyClientUpload,\n      }),\n      serverHandlerPath: imageKitUploadAuthPath,\n    })\n\n    const output = cloudStoragePlugin({\n      alwaysInsertFields,\n      collections: toCloudStorageCollections(\n        collections,\n        adapter,\n        privateSlugs,\n        rootFolder,\n        disablePayloadAccessControl,\n      ),\n      enabled,\n    })(configWithCropDisabled)\n\n    // Make the provider identity unique at persistence time to reject concurrent receipt replays.\n    // Keep the legacy object key index for existing uploads.\n    output.collections = (output.collections || []).map((collection) => {\n      if (!configuredSlugs.has(collection.slug)) {\n        return collection\n      }\n\n      const originalPrefixField = (config.collections || [])\n        .find((original) => original.slug === collection.slug)\n        ?.fields.find((field) => 'name' in field && field.name === 'prefix')\n\n      const withUniqueIdentity = (field: Field): Field => {\n        if (\n          field.type === 'text' &&\n          'name' in field &&\n          field.name === 'prefix' &&\n          (!originalPrefixField ||\n            !('defaultValue' in originalPrefixField) ||\n            originalPrefixField.defaultValue == null)\n        ) {\n          // Cloud storage's collection-prefix default is applied on reads of old\n          // documents that have no stored prefix. Its URL hook then appends that\n          // prefix, but Payload's file access check cannot find it in the DB.\n          // Upload hooks still persist the collection prefix for new files.\n          return {\n            ...field,\n            defaultValue: ({ req }) =>\n              req.file && typeof field.defaultValue === 'string' ? field.defaultValue : '',\n          }\n        }\n        if ('name' in field && field.name === '_objectKey') {\n          return { ...field, unique: true } as Field\n        }\n        if (field.type === 'group' && 'name' in field && field.name === 'imagekit') {\n          return {\n            ...field,\n            fields: field.fields.map((metadataField) =>\n              'name' in metadataField && metadataField.name === 'fileId'\n                ? { ...metadataField, unique: true }\n                : metadataField,\n            ),\n          }\n        }\n        // The imagekit group sits inside the adapter's presentational \"Storage: ImageKit\" panel.\n        if (field.type === 'collapsible') {\n          return { ...field, fields: field.fields.map(withUniqueIdentity) }\n        }\n        return field\n      }\n\n      return {\n        ...collection,\n        fields: collection.fields.map(withUniqueIdentity),\n      }\n    })\n\n    return output\n  }\n\nexport { migrateFolder } from './migrate.js'\nexport type { MigrateFolderOptions, MigrationJobResult, MigrationLocation } from './migrate.js'\n\n// Backward-compatible alias\nexport const payloadStorageImagekit = imagekitStorage\nexport const payloadStorageImageKit = imagekitStorage\n\nexport type PayloadStorageImagekitConfig = PayloadStorageImageKitConfig\n"],"names":["ImageKit","toFile","cloudStoragePlugin","buildStoragePathData","buildUploadStoragePathData","getStorageFilePath","initClientUploads","openAsBlob","path","APIError","getRangeRequestInfo","isXmlMimeType","UPLOAD_CONTENT_SECURITY_POLICY","validateMimeType","imageKitUploadAuthPath","isImageKitReceiptContext","createImageKitClientUploadVerifier","getClientUploadStorageFilePath","createImageKitUploadAuthHandler","assertWithinFileSizeLimit","isValidFileSizeLimit","getAdminThumbnailURL","getPrivateAdminThumbnailURL","isPdfMimeType","isVideoMimeType","getImageKitThumbnailSrc","getVideoPosterSrc","DEFAULT_SIGNED_URL_EXPIRES_IN","ORIGINAL_FILE_TRANSFORMATION","PRIVATE_COLLECTION_DESCRIPTION","isPrivateCollectionConfig","value","private","getCollectionFileSizeLimit","fileSizeLimit","undefined","XML_FAMILY_MIME_TYPES","collectionCanStoreXml","collection","upload","Boolean","allowRestrictedFileTypes","allowedMimeTypes","mimeTypes","length","some","mimeType","includes","isDocumentPrivate","doc","collectionIsPrivate","stored","imagekit","isPrivate","normalizeFolder","folder","normalized","trim","replace","Error","getCollectionFolder","rootFolder","collectionSlug","posix","join","findImageKitFileId","filePath","parentPath","dirname","name","basename","limit","skip","assets","list","type","found","find","asset","fileId","isRecord","getStoredImageKitURL","storedURL","url","hasStoredImageKitURL","findUploadDocumentByFilename","filename","prefix","req","constraints","equals","push","payload","db","findOne","where","and","applyVerifiedClientUploadToData","data","uploaded","buildThumbnailURL","thumbnailUrl","thumbnailURL","imagekitAdapter","apiRoute","client","clientUploads","privateSlugs","signedUrlExpiresIn","urlEndpoint","verifyClientUpload","fetchUploadedFile","fileSize","fileURL","range","rangeResult","rangeHeader","Response","headers","Headers","status","normalizedRange","rangeStart","rangeEnd","response","fetch","cache","Range","signal","AbortController","ok","body","cancel","catch","upstreamLength","get","expectedLength","upstreamRange","expectedRange","set","slug","has","buildSignedURL","src","tr","helper","buildSrc","expiresIn","signed","transformation","raw","fields","admin","condition","initCollapsed","disableListColumn","disableListFilter","hidden","readOnly","label","_data","siblingData","description","hooks","afterRead","source","documentPrefix","_objectKey","storageFilePath","collectionPrefix","docPrefix","virtual","interfaceName","generateURL","handleDelete","storedFileId","files","delete","handleUpload","clientUploadContext","file","context","uploadSource","tempFilePath","buffer","uploadFile","uploadFolder","uploadFilename","fileName","useUniqueFileName","isPrivateFile","requiresClientUploadReceipt","staticHandler","args","requestURL","URL","searchParams","hasClientUploadContext","params","uploadedFile","expectedFilePath","verifiedFileURL","size","prefixQueryParam","imageKitPath","filesize","Number","isSafeInteger","signSrc","redirect","imageKitURL","toCloudStorageCollections","collections","adapter","disablePayloadAccessControl","mappedCollections","Object","keys","disableLocalStorage","imagekitStorage","pluginOptions","config","alwaysInsertFields","enabled","focalPoint","privateKey","publicKey","signedUrlExpiresInOption","invalidFileSizeLimitSlugs","entries","filter","map","Set","configuredSlugs","xmlCollectionSlugs","routes","api","imageKitClient","collectionSecurity","fromEntries","configWithCropDisabled","isCollectionPrivate","collectionOptions","collectionFileSizeLimit","collectionFocalPoint","existingDescription","baseAdmin","beforeChange","requestMimeType","mimetype","split","toLowerCase","expectedSize","expectedMimeType","existing","beforeOperation","operation","skipCloudStorage","sanitizedDocPrefix","adminThumbnail","crop","uploadCollections","clientHandler","serverHandler","access","serverHandlerPath","output","originalPrefixField","original","field","withUniqueIdentity","defaultValue","unique","metadataField","migrateFolder","payloadStorageImagekit","payloadStorageImageKit"],"mappings":"AAgBA,OAAOA,YAAYC,MAAM,QAAQ,mBAAkB;AACnD,SAASC,kBAAkB,QAAQ,mCAAkC;AACrE,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,EAClBC,iBAAiB,QACZ,6CAA4C;AACnD,SAASC,UAAU,QAAQ,UAAS;AACpC,OAAOC,UAAU,YAAW;AAC5B,SAASC,QAAQ,QAAQ,UAAS;AAClC,SACEC,mBAAmB,EACnBC,aAAa,EACbC,8BAA8B,QACzB,mBAAkB;AACzB,SAASC,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,sBAAsB,EAAEC,wBAAwB,QAAQ,qBAAoB;AACrF,SACEC,kCAAkC,EAClCC,8BAA8B,QACzB,gCAA+B;AACtC,SAASC,+BAA+B,QAAQ,iDAAgD;AAChG,SAASC,yBAAyB,EAAEC,oBAAoB,QAAQ,qBAAoB;AACpF,SACEC,oBAAoB,EACpBC,2BAA2B,EAC3BC,aAAa,EACbC,eAAe,QACV,4BAA2B;AAClC,SAASC,uBAAuB,EAAEC,iBAAiB,QAAQ,uBAAsB;AAuBjF,MAAMC,gCAAgC;AACtC;;;;;;;CAOC,GACD,MAAMC,+BAA+B;AAErC,MAAMC,iCACJ;AAEF,MAAMC,4BAA4B,CAACC,QACjCA,UAAU,QAAQ,OAAOA,UAAU,YAAYA,OAAOC,YAAY;AAEpE,MAAMC,6BAA6B,CACjCF,QAEAA,UAAU,QAAQ,OAAOA,UAAU,WAAWA,OAAOG,gBAAgBC;AAEvE,MAAMC,wBAAwB;IAAC;IAAmB;IAAiB;CAAW;AAE9E,MAAMC,wBAAwB,CAACC;IAC7B,MAAMC,SAASD,WAAWC,MAAM;IAEhC,IAAI,CAACA,UAAUA,WAAW,MAAM;QAC9B,OAAOC,QAAQD;IACjB;IAEA,iFAAiF;IACjF,IAAIA,OAAOE,wBAAwB,EAAE;QACnC,OAAO;IACT;IAEA,MAAMC,mBAAmBH,OAAOI,SAAS;IAEzC,OACE,CAACD,kBAAkBE,UACnBF,iBAAiBG,IAAI,CAAC,CAACC,WAAaA,SAASC,QAAQ,CAAC,QAAQpC,cAAcmC,cAC5EV,sBAAsBS,IAAI,CAAC,CAACC,WAAajC,iBAAiBiC,UAAUJ;AAExE;AAEA;;;;;CAKC,GACD,MAAMM,oBAAoB,CAACC,KAAcC;IACvC,MAAMC,SAAUF,KAA4DG,UAAUC;IAEtF,OAAO,OAAOF,WAAW,YAAYA,SAASD;AAChD;AAwCA,MAAMI,kBAAkB,CAACC;IACvB,MAAMC,aAAaD,OAAOE,IAAI,GAAGC,OAAO,CAAC,cAAc;IAEvD,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM;IAClB;IAEA,OAAO,CAAC,CAAC,EAAEH,YAAY;AACzB;AAEA,MAAMI,sBAAsB,CAACC,YAAoBC,iBAC/CtD,KAAKuD,KAAK,CAACC,IAAI,CAACH,YAAYC;AAE9B,MAAMG,qBAAqB,OACzBb,UACAc;IAEA,MAAMC,aAAa3D,KAAKuD,KAAK,CAACK,OAAO,CAACF;IACtC,MAAMG,OAAO7D,KAAKuD,KAAK,CAACO,QAAQ,CAACJ;IAEjC,MAAMK,QAAQ;IAEd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMrB,SAASqB,MAAM,CAACC,IAAI,CAAC;YACxCC,MAAM;YACNJ;YACA/D,MAAM2D,eAAe,MAAM,MAAM,GAAGA,WAAW,CAAC,CAAC;YACjDK;QACF;QAEA,MAAMI,QAAQH,OAAOI,IAAI,CACvB,CAACC,QAAU,YAAYA,SAASA,MAAMZ,QAAQ,KAAKA,YAAYY,MAAMT,IAAI,KAAKA;QAGhF,IAAIO,SAAS,YAAYA,OAAO;YAC9B,OAAOA,MAAMG,MAAM;QACrB;QAEA,IAAIN,OAAO7B,MAAM,GAAG2B,OAAO;YACzB;QACF;IACF;IAEA,OAAOpC;AACT;AAEA,MAAM6C,WAAW,CAACjD,QAChB,CAAC,CAACA,SAAS,OAAOA,UAAU;AAE9B,MAAMkD,uBAAuB,CAAChC;IAC5B,MAAMiC,YAAajC,KAAuCG,UAAU+B;IAEpE,OAAO,OAAOD,cAAc,YAAYA,UAAUzB,IAAI,GAAGb,MAAM,GAAG,IAAIsC,YAAY/C;AACpF;AAEA,MAAMiD,uBAAuB,CAACnC,MAA0B,CAAC,CAACgC,qBAAqBhC;AAE/E,MAAMoC,+BAA+B,OAAO,EAC1C/C,UAAU,EACVgD,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,MAAMC,cAAuB;QAC3B;YACEH,UAAU;gBACRI,QAAQJ;YACV;QACF;KACD;IAED,IAAI,OAAOC,WAAW,UAAU;QAC9BE,YAAYE,IAAI,CAAC;YACfJ,QAAQ;gBACNG,QAAQH;YACV;QACF;IACF;IAEA,OAAOC,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QAC5BxD;QACAkD;QACAO,OAAO;YACLC,KAAKP;QACP;IACF;AACF;AAEA,MAAMQ,kCAAkC,CACtCC,MACAC,UACAC,oBAAyC/E,oBAAoB,EAC7DgC;IAEA6C,KAAK9C,QAAQ,GAAG;QACd2B,QAAQoB,SAASpB,MAAM;QACvB1B;QACAgD,cAAcF,SAASE,YAAY;QACnClB,KAAKgB,SAAShB,GAAG;IACnB;IAEA,sFAAsF;IACtFe,KAAKI,YAAY,GAAGF,kBAAkBF;IAEtC,OAAOA;AACT;AAEA,MAAMK,kBAAkB,CAAC,EACvBC,QAAQ,EACRC,MAAM,EACNC,aAAa,EACbC,YAAY,EACZ9C,UAAU,EACV+C,kBAAkB,EAClBC,WAAW,EACXC,kBAAkB,EAUnB;IACC,MAAMC,oBAAoB,OAAO,EAC/BC,QAAQ,EACRC,OAAO,EACPnE,QAAQ,EACRoE,KAAK,EAMN;QACC,MAAMC,cAAczG,oBAAoB;YAAEsG;YAAUI,aAAaF,SAAS;QAAK;QAE/E,IAAIC,YAAYxC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAI0C,SAAS,MAAM;gBACxBC,SAAS,IAAIC,QAAQJ,YAAYG,OAAO;gBACxCE,QAAQL,YAAYK,MAAM;YAC5B;QACF;QAEA,MAAMC,kBACJN,YAAYxC,IAAI,KAAK,YACjB,CAAC,MAAM,EAAEwC,YAAYO,UAAU,CAAC,CAAC,EAAEP,YAAYQ,QAAQ,EAAE,GACzDxF;QACN,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAMyF,WAAW,MAAMC,MAAMZ,SAAS;YACpCa,OAAO;YACP,GAAIL,kBAAkB;gBAAEH,SAAS;oBAAES,OAAON;gBAAgB;YAAE,IAAI,CAAC,CAAC;YAClEO,QAAQ,IAAIC,kBAAkBD,MAAM;QACtC;QAEA,IAAI,CAACJ,SAASM,EAAE,IAAIN,SAASJ,MAAM,KAAKL,YAAYK,MAAM,EAAE;YAC1D,KAAKI,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMlG;YACzC,MAAM,IAAIwB,MACR,CAAC,gEAAgE,EAAEiE,SAASJ,MAAM,CAAC,EAAE,CAAC;QAE1F;QAEA,MAAMc,iBAAiBV,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC5C,MAAMC,iBAAiBrB,YAAYG,OAAO,CAAC,iBAAiB;QAC5D,MAAMmB,gBAAgBb,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC3C,MAAMG,gBACJvB,YAAYxC,IAAI,KAAK,YAAYwC,YAAYG,OAAO,CAAC,gBAAgB,GAAGnF;QAE1E,IACE,AAACmG,mBAAmB,QAAQA,mBAAmBE,kBAC9CE,iBAAiBD,kBAAkBC,eACpC;YACA,KAAKd,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMlG;YACzC,MAAM,IAAIwB,MAAM;QAClB;QAEA,MAAM2D,UAAU,IAAIC,QAAQJ,YAAYG,OAAO;QAC/CA,QAAQqB,GAAG,CAAC,gBAAgB7F;QAC5B,IAAInC,cAAcmC,WAAW;YAC3BwE,QAAQqB,GAAG,CAAC,2BAA2B/H;QACzC;QAEA,OAAO,IAAIyG,SAASO,SAASO,IAAI,EAAE;YACjCb;YACAE,QAAQI,SAASJ,MAAM;QACzB;IACF;IAEA,OAAO,CAAC,EAAElF,UAAU,EAAEiD,SAAS3B,oBAAoBC,YAAYvB,WAAWsG,IAAI,CAAC,EAAE;QAC/E,MAAMvF,YAAYsD,aAAakC,GAAG,CAACvG,WAAWsG,IAAI;QAElD,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,MAAME,iBAAiB,CAACC,KAAaC,KACnCvC,OAAOwC,MAAM,CAACC,QAAQ,CAAC;gBACrBC,WAAWvC;gBACXwC,QAAQ;gBACRL;gBACAM,gBAAgBL,KAAK;oBAAC;wBAAEM,KAAKN;oBAAG;iBAAE,GAAG7G;gBACrC0E;YACF;QAEF,MAAMT,oBAAoB,CAACnD,MACzBD,kBAAkBC,KAAKI,aACnB/B,4BAA4B2B,KAAKX,WAAWsG,IAAI,EAAEpC,YAClDnF,qBAAqB4B;QAE3B,OAAO;YACLoB,MAAM;YACNqC;YACA6C,QAAQ;gBACN;oBACE,iFAAiF;oBACjF,wCAAwC;oBACxC5E,MAAM;oBACN6E,OAAO;wBACLC,WAAW,CAACvD,OAASd,qBAAqBc;wBAC1CwD,eAAe;oBACjB;oBACAH,QAAQ;wBACN;4BACElF,MAAM;4BACNM,MAAM;4BACN6E,OAAO;gCACLG,mBAAmB;gCACnBC,mBAAmB;4BACrB;4BACAL,QAAQ;gCACN;oCACElF,MAAM;oCACNM,MAAM;oCACN6E,OAAO;wCACLK,QAAQ;oCACV;gCACF;gCACA;oCACExF,MAAM;oCACNM,MAAM;oCACN6E,OAAO;wCACLM,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE1F,MAAM;oCACNM,MAAM;oCACN6E,OAAO;wCACLC,WAAW,CAACO,OAAOC,cACjBjH,kBAAkB;gDAAEI,UAAU6G;4CAAY,GAAG5G;wCAC/C6G,aACE;wCACFJ,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE1F,MAAM;oCACNM,MAAM;oCACN6E,OAAO;wCACL,mFAAmF;wCACnFC,WAAW,CAACO,OAAOC,cACjBjH,kBAAkB;gDAAEI,UAAU6G;4CAAY,GAAG5G;wCAC/C6G,aAAa,CAAC,kFAAkF,EAAEtD,mBAAmB,kKAAkK,CAAC;wCACxRkD,UAAU;oCACZ;oCACAK,OAAO;wCACL,mFAAmF;wCACnFC,WAAW;4CACT,CAAC,EAAElE,IAAI,EAAE+D,WAAW,EAAE;gDACpB,IAAI,CAACjH,kBAAkB;oDAAEI,UAAU6G;gDAAY,GAAG5G,YAAY;oDAC5D,OAAOlB;gDACT;gDAEA,MAAMmD,WAAYY,MAA4CZ;gDAE9D,IAAI,CAACA,UAAU;oDACb,OAAOnD;gDACT;gDAEA,MAAMkI,SAAUnE,QAAQ,CAAC;gDACzB,MAAMoE,iBAAiB9J,KAAKuD,KAAK,CAACC,IAAI,CACpCqG,OAAO9E,MAAM,IAAIA,QACjB8E,OAAOE,UAAU,IAAI;gDAEvB,MAAMC,kBAAkBrK,qBAAqB;oDAC3CsK,kBAAkBlF;oDAClBmF,WAAWJ;oDACXhF;gDACF,GAAGkF,eAAe;gDAElB,OAAO1B,eAAe,CAAC,CAAC,EAAE0B,iBAAiB;4CAC7C;yCACD;oCACH;oCACAT,OAAO;oCACPY,SAAS;gCACX;gCACA;oCACEtG,MAAM;oCACNM,MAAM;oCACN6E,OAAO;wCACLK,QAAQ;oCACV;gCACF;6BACD;4BACDe,eAAe;4BACfb,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD;YACDc,aAAa,CAAC,EAAEvF,QAAQ,EAAEC,QAAQ+E,iBAAiB,EAAE,EAAE,GACrD7D,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACrBH,KAAK,CAAC,CAAC,EAAE5I,qBAAqB;wBAC5BsK,kBAAkBlF;wBAClBmF,WAAWJ;wBACXhF;oBACF,GAAGkF,eAAe,EAAE;oBACpB3D;gBACF;YACFiE,cAAc,OAAO,EAAE7H,GAAG,EAAEuH,eAAe,EAAE;gBAC3C,MAAMO,eAAe,AAAC9H,IAAuCG,QAAQ,EAAE2B;gBACvE,MAAMA,SACJgG,gBAAiB,MAAM9G,mBAAmBwC,QAAQ,CAAC,CAAC,EAAE+D,gBAAgB9G,OAAO,CAAC,QAAQ,KAAK;gBAE7F,IAAI,CAACqB,QAAQ;oBACX;gBACF;gBAEA,MAAM0B,OAAOuE,KAAK,CAACC,MAAM,CAAClG;YAC5B;YACAmG,cAAc,OAAO,EAAEC,mBAAmB,EAAEjF,IAAI,EAAEkF,IAAI,EAAEZ,eAAe,EAAE;gBACvE,IAAIW,qBAAqB;oBACvB,MAAMhF,WAAW,MAAMW,mBAAmB;wBACxChD,gBAAgBxB,WAAWsG,IAAI;wBAC/ByC,SAASF;oBACX;oBAEA,OAAOlF,gCAAgCC,MAAMC,UAAUC,mBAAmB/C;gBAC5E;gBAEA,4FAA4F;gBAC5F,wFAAwF;gBACxF,MAAMiI,eAAeF,KAAKG,YAAY,GAClC,MAAMhL,WAAW6K,KAAKG,YAAY,EAAE;oBAAE5G,MAAMyG,KAAKtI,QAAQ;gBAAC,KAC1DsI,KAAKI,MAAM;gBACf,MAAMC,aAAa,MAAMxL,OAAOqL,cAAcF,KAAK9F,QAAQ,EAAE;oBAAEX,MAAMyG,KAAKtI,QAAQ;gBAAC;gBACnF,MAAM4I,eAAelL,KAAKuD,KAAK,CAACK,OAAO,CAAC,CAAC,CAAC,EAAEoG,gBAAgB9G,OAAO,CAAC,QAAQ,KAAK;gBACjF,MAAMiI,iBAAiBnL,KAAKuD,KAAK,CAACO,QAAQ,CAACkG;gBAE3C,MAAMrE,WAAW,MAAMM,OAAOuE,KAAK,CAACzI,MAAM,CAAC;oBACzC6I,MAAMK;oBACNG,UAAUD;oBACVpI,QAAQmI;oBACRG,mBAAmB;oBACnB,GAAIxI,YAAY;wBAAEyI,eAAe;oBAAK,IAAI,CAAC,CAAC;gBAC9C;gBAEA5F,KAAK9C,QAAQ,GAAG;oBACd2B,QAAQoB,SAASpB,MAAM;oBACvB1B;oBACAgD,cAAcF,SAASE,YAAY;oBACnClB,KAAKgB,SAAShB,GAAG;gBACnB;gBAEA,0EAA0E;gBAC1E,iFAAiF;gBACjF,sEAAsE;gBACtEe,KAAKI,YAAY,GAAGF,kBAAkB;oBACpC,GAAGF,IAAI;oBACPZ,UAAU,AAACY,KAA+BZ,QAAQ,IAAIqG;gBACxD;gBAEA,OAAOzF;YACT;YACA6F,6BAA6B;YAC7BC,eAAe,OAAOxG,KAAKyG;gBACzB,MAAMC,aAAa,IAAIC,IAAI3G,IAAIL,GAAG,IAAI;gBACtC,MAAM6D,KAAKkD,WAAWE,YAAY,CAAC7D,GAAG,CAAC;gBACvC,MAAM8D,yBAAyB,yBAAyBJ,KAAKK,MAAM;gBAEnE,IAAID,wBAAwB;oBAC1B,MAAMlB,sBAAsBc,KAAKK,MAAM,CAACnB,mBAAmB;oBAE3D,IAAI,CAACpK,yBAAyBoK,sBAAsB;wBAClD,MAAM,IAAI1K,SAAS,2CAA2C;oBAChE;oBAEA,MAAM8L,eAAe,MAAMzF,mBAAmB;wBAC5ChD,gBAAgBxB,WAAWsG,IAAI;wBAC/ByC,SAASF;oBACX;oBACA,MAAMqB,mBAAmBvL,+BAA+B;wBACtDwJ,kBAAkBlF;wBAClB8F,SAASF;oBACX;oBACA,MAAMsB,kBAAkBpJ,YACpByF,eAAe,CAAC,CAAC,EAAE0D,kBAAkB,EAAE5K,gCACvC6E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK,CAAC,CAAC,EAAEyD,kBAAkB;wBAC3BnD,gBAAgB;4BAAC;gCAAEC,KAAK1H;4BAA6B;yBAAE;wBACvDiF;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAUuF,aAAaG,IAAI;wBAC3BzF,SAASwF;wBACT3J,UAAUyJ,aAAazJ,QAAQ;wBAC/BoE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,MAAMtF,MACJgJ,KAAKhJ,GAAG,IACP,MAAMoC,6BAA6B;oBAClC/C,YAAY2J,KAAKK,MAAM,CAAChK,UAAU;oBAClCgD,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BC,QAAQ0G,KAAKK,MAAM,CAAC/G,MAAM;oBAC1BC;gBACF;gBAEF,MAAMgF,kBAAkB,MAAMnK,mBAAmB;oBAC/CiC;oBACAmI,kBAAkBlF;oBAClBtC,KAAKA,OAAOd;oBACZmD,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BqH,kBAAkBV,KAAKK,MAAM,CAAC/G,MAAM;oBACpCC;gBACF;gBACA,MAAMoH,eAAe,CAAC,CAAC,EAAEpC,gBAAgB9G,OAAO,CAAC,QAAQ,KAAK;gBAC9D,MAAMZ,WAAYG,KAAsCH;gBAExD,6EAA6E;gBAC7E,yEAAyE;gBACzE,IAAI,OAAOA,aAAa,YAAYnC,cAAcmC,WAAW;oBAC3D,MAAM+J,WAAY5J,KAAsC4J;oBAExD,IAAI,OAAOA,aAAa,YAAY,CAACC,OAAOC,aAAa,CAACF,aAAaA,WAAW,GAAG;wBACnF,MAAM,IAAIpM,SAAS,gDAAgD;oBACrE;oBAEA,MAAMwG,UAAUjE,kBAAkBC,KAAKI,aACnCyF,eAAe8D,cAAchL,gCAC7B6E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK6D;wBACLvD,gBAAgB;4BAAC;gCAAEC,KAAK1H;4BAA6B;yBAAE;wBACvDiF;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAU6F;wBACV5F;wBACAnE;wBACAoE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,2EAA2E;gBAC3E,+EAA+E;gBAC/E,IAAIvF,kBAAkBC,KAAKI,YAAY;oBACrC,IAAI2J,UAAUJ;oBAEd,6EAA6E;oBAC7E,yEAAyE;oBACzE,IAAI5D,MAAMxH,gBAAgBsB,WAAW;wBACnCkK,UAAUtL,kBAAkBsL;oBAC9B,OAAO,IAAIhE,MAAMzH,cAAcuB,WAAW;wBACxCkK,UAAUvL,wBAAwBuL;oBACpC;oBAEA,OAAO3F,SAAS4F,QAAQ,CAACnE,eAAekE,SAAShE,KAAK;gBACxD;gBAEA,MAAMkE,cAAczG,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACzCH,KACE9D,qBAAqBhC,QACrB2J;oBACFvD,gBAAgBL,KAAK;wBAAC;4BAAEM,KAAKN;wBAAG;qBAAE,GAAG7G;oBACrC0E;gBACF;gBAEA,OAAOQ,SAAS4F,QAAQ,CAACC,aAAa;YACxC;QACF;IACF;AACF;AAEA,MAAMC,4BAA4B,CAChCC,aACAC,SACA1G,cACA9C,YACAyJ;IAEA,MAAMC,oBAAwE,CAAC;IAE/E,KAAK,MAAMzJ,kBAAkB0J,OAAOC,IAAI,CAACL,aAAc;QACrDG,iBAAiB,CAACzJ,eAAe,GAAG;YAClCuJ;YACAK,qBAAqB;YACrB,oFAAoF;YACpFJ,6BAA6B3G,aAAakC,GAAG,CAAC/E,kBAC1C3B,YACAmL;YACJ/H,QAAQ3B,oBAAoBC,YAAYC;QAC1C;IACF;IAEA,OAAOyJ;AACT;AAEA,OAAO,MAAMI,kBACX,CAACC,gBACD,CAACC;QACC,MAAM,EACJC,kBAAkB,EAClBpH,aAAa,EACb0G,WAAW,EACXE,2BAA2B,EAC3BS,OAAO,EACPC,UAAU,EACVzK,MAAM,EACN0K,UAAU,EACVC,SAAS,EACTtH,oBAAoBuH,wBAAwB,EAC5CtH,WAAW,EACZ,GAAG+G;QAEJ,IAAI,CAACK,YAAYxK,QAAQ;YACvB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACuK,WAAWzK,QAAQ;YACtB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACkD,aAAapD,QAAQ;YACxB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACyJ,eAAeI,OAAOC,IAAI,CAACL,aAAaxK,MAAM,KAAK,GAAG;YACzD,MAAM,IAAIe,MAAM;QAClB;QAEA,MAAMyK,4BAA4BZ,OAAOa,OAAO,CAACjB,aAC9CkB,MAAM,CAAC,CAAC,GAAGvM,MAAM;YAChB,MAAMG,gBAAgBD,2BAA2BF;YACjD,OAAOG,kBAAkBC,aAAa,CAACf,qBAAqBc;QAC9D,GACCqM,GAAG,CAAC,CAAC,CAAC3F,KAAK,GAAKA;QAEnB,IAAIwF,0BAA0BxL,MAAM,GAAG,GAAG;YACxC,MAAM,IAAIe,MACR,CAAC,+EAA+E,EAAEyK,0BAA0BpK,IAAI,CAAC,MAAM,EAAE,CAAC;QAE9H;QAEA,MAAM2C,eAAe,IAAI6H,IACvBhB,OAAOa,OAAO,CAACjB,aACZkB,MAAM,CAAC,CAAC,GAAGvM,MAAM,GAAKD,0BAA0BC,QAChDwM,GAAG,CAAC,CAAC,CAAC3F,KAAK,GAAKA;QAErB,MAAM6F,kBAAkB,IAAID,IAAIhB,OAAOC,IAAI,CAACL;QAE5C,IAAIE,+BAA+B3G,aAAa+F,IAAI,GAAG,GAAG;YACxD,MAAM,IAAI/I,MACR;QAEJ;QAEA,IAAI2J,6BAA6B;YAC/B,MAAMoB,qBAAqB,AAACb,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAChDkB,MAAM,CACL,CAAChM,aACCmM,gBAAgB5F,GAAG,CAACvG,WAAWsG,IAAI,KAAKvG,sBAAsBC,aAEjEiM,GAAG,CAAC,CAACjM,aAAeA,WAAWsG,IAAI;YAEtC,IAAI8F,mBAAmB9L,MAAM,GAAG,GAAG;gBACjC,MAAM,IAAIe,MACR,CAAC,kHAAkH,EAAE+K,mBAAmB1K,IAAI,CAAC,MAAM,sLAAsL,CAAC;YAE9U;QACF;QAEA,MAAM4C,qBACJ,OAAOuH,6BAA6B,YAAYA,2BAA2B,IACvEA,2BACAxM;QACN,MAAM6E,WAAWqH,OAAOc,MAAM,EAAEC,OAAO;QAEvC,MAAM/K,aAAaP,gBAAgBC;QAEnC,MAAMsL,iBAAiB,IAAI7O,SAAS;YAAEiO;QAAW;QACjD,MAAMa,qBAAqBtB,OAAOuB,WAAW,CAC3C,AAAClB,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACrBkB,MAAM,CAAC,CAAChM,aAAemM,gBAAgB5F,GAAG,CAACvG,WAAWsG,IAAI,GAC1D2F,GAAG,CAAC,CAACjM,aAAe;gBACnBA,WAAWsG,IAAI;gBACf;oBACEtG;oBACAe,WAAWsD,aAAakC,GAAG,CAACvG,WAAWsG,IAAI;oBAC3CrD,QAAQ3B,oBAAoBC,YAAYvB,WAAWsG,IAAI;gBACzD;aACD;QAEL,MAAM9B,qBAAqB9F,mCAAmC;YAC5DyF,QAAQoI;YACRzB,aAAa0B;QACf;QACA,MAAMzB,UAAU9G,gBAAgB;YAC9BC;YACAC,QAAQoI;YACRnI;YACAC;YACA9C;YACA+C;YACAC;YACAC;QACF;QAEA,MAAMkI,yBAAiC;YACrC,GAAGnB,MAAM;YACTT,aAAa,AAACS,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAACjM;gBAC3C,IAAI,CAACmM,gBAAgB5F,GAAG,CAACvG,WAAWsG,IAAI,GAAG;oBACzC,OAAOtG;gBACT;gBAEA,MAAM2M,sBAAsBtI,aAAakC,GAAG,CAACvG,WAAWsG,IAAI;gBAC5D,MAAMxC,oBAAoB,CAACnD,MACzBD,kBAAkBC,KAAKgM,uBACnB3N,4BAA4B2B,KAAKX,WAAWsG,IAAI,EAAEpC,YAClDnF,qBAAqB4B;gBAE3B,MAAMiM,oBAAoB9B,WAAW,CAAC9K,WAAWsG,IAAI,CAAC;gBACtD,MAAMuG,0BAA0BlN,2BAA2BiN;gBAC3D,MAAME,uBACJF,sBAAsB,QACtB,OAAOA,sBAAsB,YAC7B,OAAOA,kBAAkBlB,UAAU,KAAK,YACpCkB,kBAAkBlB,UAAU,GAC5B7L;gBAEN,4EAA4E;gBAC5E,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMkN,sBAAsB/M,WAAWkH,KAAK,EAAEU;gBAC9C,MAAMoF,YAAYL,sBACd;oBACE,GAAI3M,WAAWkH,KAAK,IAAI,CAAC,CAAC;oBAC1BU,aACE,OAAOmF,wBAAwB,YAAYA,oBAAoB5L,IAAI,GAAGb,MAAM,GAAG,IAC3E,GAAGyM,oBAAoB,CAAC,EAAExN,gCAAgC,GACzDwN,uBAAuBxN;gBAChC,IACAS,WAAWkH,KAAK;gBAEpB,OAAO;oBACL,GAAGlH,UAAU;oBACbkH,OAAO8F;oBACPnF,OAAO;wBACL,GAAI7H,WAAW6H,KAAK,IAAI,CAAC,CAAC;wBAC1BoF,cAAc;+BACRjN,WAAW6H,KAAK,EAAEoF,gBAAgB,EAAE;4BACxC,OAAO,EAAErJ,IAAI,EAAEV,GAAG,EAAE;gCAClB,IAAI,CAACR,SAASkB,SAAS,CAACV,IAAI4F,IAAI,EAAED,qBAAqB;oCACrD,OAAOjF;gCACT;gCAEA,MAAMmF,UAAU7F,IAAI4F,IAAI,CAACD,mBAAmB;gCAC5C,MAAMqE,kBAAkBhK,IAAI4F,IAAI,CAACqE,QAAQ,CAACC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAEjM,OAAOkM;gCACnE,IACE,CAAC5O,yBAAyBsK,YAC1BA,QAAQ/F,QAAQ,KAAKY,KAAKZ,QAAQ,IAClC+F,QAAQ/F,QAAQ,KAAKE,IAAI4F,IAAI,CAAC/G,IAAI,IAClC,qEAAqE;gCACrE,gEAAgE;gCAChEgH,QAAQuE,YAAY,KAAK1J,KAAK2G,QAAQ,EACtC;oCACA,MAAM,IAAIpM,SAAS,iEAAiE;gCACtF;gCAEA,MAAM0F,WAAW,MAAMW,mBAAmB;oCACxChD,gBAAgBxB,WAAWsG,IAAI;oCAC/ByC;gCACF;gCACA,gFAAgF;gCAChF,8EAA8E;gCAC9E,IACEmE,oBAAoBnE,QAAQwE,gBAAgB,IAC5CL,oBAAoBrJ,SAASrD,QAAQ,EACrC;oCACA,MAAM,IAAIrC,SAAS,iEAAiE;gCACtF;gCACA,+EAA+E;gCAC/E,2DAA2D;gCAC3D,MAAMqP,WAAW,MAAMtK,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;oCAC5CxD,YAAYA,WAAWsG,IAAI;oCAC3BpD;oCACAO,OAAO;wCACL,mBAAmB;4CACjBL,QAAQS,SAASpB,MAAM;wCACzB;oCACF;gCACF;gCACA,IAAI+K,UAAU;oCACZ,MAAM,IAAIrP,SAAS,8DAA8D;gCACnF;gCAEAyF,KAAKZ,QAAQ,GAAGa,SAAS9B,IAAI;gCAC7B6B,KAAK2G,QAAQ,GAAG1G,SAASuG,IAAI;gCAC7BxG,KAAKpD,QAAQ,GAAGqD,SAASrD,QAAQ;gCAEjC,OAAOmD,gCACLC,MACAC,UACAC,mBACA6I;4BAEJ;yBACD;wBACDc,iBAAiB;+BACXzN,WAAW6H,KAAK,EAAE4F,mBAAmB,EAAE;4BAC3C,CAAC,EAAE9D,IAAI,EAAE+D,SAAS,EAAExK,GAAG,EAAE;gCACvB,2EAA2E;gCAC3E,sDAAsD;gCACtD,IACE,AAACwK,CAAAA,cAAc,YAAYA,cAAc,QAAO,KAChDxK,IAAI4F,IAAI,IACR,CAAC5F,IAAI4F,IAAI,CAACD,mBAAmB,EAC7B;oCACAhK,0BAA0BqE,IAAI4F,IAAI,CAACsB,IAAI,EAAEyC;gCAC3C;gCACA,OAAOlD;4BACT;4BACA,CAAC,EAAEA,IAAI,EAAE+D,SAAS,EAAExK,GAAG,EAAE;gCACvB,IACE,AAACwK,cAAc,YAAYA,cAAc,YACzCxK,IAAI6F,OAAO,EAAE4E,oBACb,CAACzK,IAAI4F,IAAI,IACT5F,IAAI4F,IAAI,CAACD,mBAAmB,IAC5B,CAAE,CAAA,UAAUc,IAAG,KACf,CAACjH,SAASiH,KAAK/F,IAAI,KACnB,OAAO+F,KAAK/F,IAAI,CAACX,MAAM,KAAK,UAC5B;oCACA,OAAO0G;gCACT;gCAEA,yEAAyE;gCACzE,wEAAwE;gCACxEA,KAAK/F,IAAI,CAACX,MAAM,GAAGnF,2BAA2B;oCAC5CqK,kBAAkB7G,oBAAoBC,YAAYvB,WAAWsG,IAAI;oCACjE8B,WAAWuB,KAAK/F,IAAI,CAACX,MAAM;oCAC3BD,UAAUE,IAAI4F,IAAI,CAAC/G,IAAI;gCACzB,GAAG6L,kBAAkB;gCACrB,OAAOjE;4BACT;yBACD;oBACH;oBACA1J,QAAQ;wBACN,mEAAmE;wBACnE,4DAA4D;wBAC5D,gEAAgE;wBAChE,wBAAwB;wBACxByL,YAAY;wBACZ,GAAI,OAAOA,eAAe,YAAY;4BAAEA;wBAAW,IAAI,CAAC,CAAC;wBACzD,GAAI,OAAOoB,yBAAyB,YAChC;4BAAEpB,YAAYoB;wBAAqB,IACnC,CAAC,CAAC;wBACN,GAAI,OAAO9M,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;wBAClE4N,gBAAgB,CAAC,EAAElN,GAAG,EAAE,GAAKmD,kBAAkBnD;wBAC/CmN,MAAM;oBACR;gBACF;YACF;QACF;QAEA,MAAMC,oBAAoB7C,OAAOuB,WAAW,CAC1CvB,OAAOC,IAAI,CAACL,aAAamB,GAAG,CAAC,CAACzK,iBAAmB;gBAC/CA;gBACA;oBACE5B,eAAeD,2BAA2BmL,WAAW,CAACtJ,eAAe;oBACrET,WAAWsD,aAAakC,GAAG,CAAC/E;oBAC5ByB,QAAQ3B,oBAAoBC,YAAYC;gBAC1C;aACD;QAKHxD,kBAAkB;YAChBgQ,eAAe;YACflD,aAAaiD;YACbxC,QAAQmB;YACRjB,SAASA,YAAY,SAASvL,QAAQkE;YACtC6J,eAAerP,gCAAgC;gBAC7CsP,QAAQ,OAAO9J,kBAAkB,WAAWA,cAAc8J,MAAM,GAAGrO;gBACnEiL,aAAaiD;gBACbpC;gBACAC;gBACApH;YACF;YACA2J,mBAAmB3P;QACrB;QAEA,MAAM4P,SAASxQ,mBAAmB;YAChC4N;YACAV,aAAaD,0BACXC,aACAC,SACA1G,cACA9C,YACAyJ;YAEFS;QACF,GAAGiB;QAEH,8FAA8F;QAC9F,yDAAyD;QACzD0B,OAAOtD,WAAW,GAAG,AAACsD,CAAAA,OAAOtD,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAACjM;YACnD,IAAI,CAACmM,gBAAgB5F,GAAG,CAACvG,WAAWsG,IAAI,GAAG;gBACzC,OAAOtG;YACT;YAEA,MAAMqO,sBAAsB,AAAC9C,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACjDvI,IAAI,CAAC,CAAC+L,WAAaA,SAAShI,IAAI,KAAKtG,WAAWsG,IAAI,GACnDW,OAAO1E,KAAK,CAACgM,QAAU,UAAUA,SAASA,MAAMxM,IAAI,KAAK;YAE7D,MAAMyM,qBAAqB,CAACD;gBAC1B,IACEA,MAAMlM,IAAI,KAAK,UACf,UAAUkM,SACVA,MAAMxM,IAAI,KAAK,YACd,CAAA,CAACsM,uBACA,CAAE,CAAA,kBAAkBA,mBAAkB,KACtCA,oBAAoBI,YAAY,IAAI,IAAG,GACzC;oBACA,uEAAuE;oBACvE,uEAAuE;oBACvE,oEAAoE;oBACpE,kEAAkE;oBAClE,OAAO;wBACL,GAAGF,KAAK;wBACRE,cAAc,CAAC,EAAEvL,GAAG,EAAE,GACpBA,IAAI4F,IAAI,IAAI,OAAOyF,MAAME,YAAY,KAAK,WAAWF,MAAME,YAAY,GAAG;oBAC9E;gBACF;gBACA,IAAI,UAAUF,SAASA,MAAMxM,IAAI,KAAK,cAAc;oBAClD,OAAO;wBAAE,GAAGwM,KAAK;wBAAEG,QAAQ;oBAAK;gBAClC;gBACA,IAAIH,MAAMlM,IAAI,KAAK,WAAW,UAAUkM,SAASA,MAAMxM,IAAI,KAAK,YAAY;oBAC1E,OAAO;wBACL,GAAGwM,KAAK;wBACRtH,QAAQsH,MAAMtH,MAAM,CAACgF,GAAG,CAAC,CAAC0C,gBACxB,UAAUA,iBAAiBA,cAAc5M,IAAI,KAAK,WAC9C;gCAAE,GAAG4M,aAAa;gCAAED,QAAQ;4BAAK,IACjCC;oBAER;gBACF;gBACA,yFAAyF;gBACzF,IAAIJ,MAAMlM,IAAI,KAAK,eAAe;oBAChC,OAAO;wBAAE,GAAGkM,KAAK;wBAAEtH,QAAQsH,MAAMtH,MAAM,CAACgF,GAAG,CAACuC;oBAAoB;gBAClE;gBACA,OAAOD;YACT;YAEA,OAAO;gBACL,GAAGvO,UAAU;gBACbiH,QAAQjH,WAAWiH,MAAM,CAACgF,GAAG,CAACuC;YAChC;QACF;QAEA,OAAOJ;IACT,EAAC;AAEH,SAASQ,aAAa,QAAQ,eAAc;AAG5C,4BAA4B;AAC5B,OAAO,MAAMC,yBAAyBxD,gBAAe;AACrD,OAAO,MAAMyD,yBAAyBzD,gBAAe"}

package/dist/migrate.js

@@ -227,20 +227,40 @@ const transferTag = (source, filePath, documentID, isPrivate)=>{
                         filename: destination.name,
                         imagekit
                     };
-                    await payload.update({
-                        id: doc.id,
-                        collection: slug,
-                        context: {
-                            skipCloudStorage: true
-                        },
-                        data: {
-                            _objectKey: null,
-                            filename: destination.name,
-                            imagekit,
-                            prefix: destinationFolder.replace(/^\//, ''),
-                            thumbnailURL: isPrivate ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api) : getAdminThumbnailURL(updated)
-                        }
-                    });
+                    const data = {
+                        filename: destination.name,
+                        imagekit,
+                        prefix: destinationFolder.replace(/^\//, ''),
+                        thumbnailURL: isPrivate ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api) : getAdminThumbnailURL(updated)
+                    };
+                    if (payload.db.name === 'mongoose') {
+                        // A sparse unique MongoDB index permits missing keys, but only one null.
+                        // Use the adapter directly: Local API merges the old key back into the
+                        // update, which conflicts with $unset. Remove it and save the reference
+                        // in one database write, so failed updates leave the source intact.
+                        await payload.db.updateOne({
+                            id: doc.id,
+                            collection: slug,
+                            data: {
+                                ...data,
+                                $unset: {
+                                    _objectKey: 1
+                                }
+                            }
+                        });
+                    } else {
+                        await payload.update({
+                            id: doc.id,
+                            collection: slug,
+                            context: {
+                                skipCloudStorage: true
+                            },
+                            data: {
+                                ...data,
+                                _objectKey: null
+                            }
+                        });
+                    }
                     result.migrated += 1;
                     console.log(`[migrateFolder] Migrated ${slug}/${doc.id} to ${destinationPath}.`);
                 } catch (error) {

package/dist/migrate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["/* eslint-disable no-console -- Migration progress is intentionally reported to the invoking process. */\n\nimport type { Payload, UploadCollectionSlug } from 'payload'\n\nimport ImageKit from '@imagekit/nodejs'\nimport { createHash } from 'node:crypto'\nimport path from 'node:path'\n\nimport { getAdminThumbnailURL, getPrivateAdminThumbnailURL } from './getAdminThumbnailURL.js'\n\nexport type MigrationLocation = {\n  /** Root folder, with collection subfolders beneath it. */\n  folder: string\n  privateKey: string\n  urlEndpoint: string\n}\n\nexport type MigrateFolderOptions = {\n  /** `true` preserves source privacy; an explicit `private` value sets destination privacy. */\n  collections: Partial<Record<UploadCollectionSlug, { private?: boolean } | true>>\n  /** Reads and reports the same plan without uploading or updating documents. Defaults to true. */\n  dryRun?: boolean\n  from: MigrationLocation\n  /** The database containing the records to update, including any already at the destination. */\n  payload: Payload\n  signedUrlExpiresIn?: number\n  to: MigrationLocation\n}\n\nexport type MigrationJobResult = {\n  collectionSlug: string\n  errors: { documentID: number | string; message: string }[]\n  failed: number\n  migrated: number\n  planned: number\n  /** Existing tagged transfers recovered after an interrupted run. Included in migrated when live. */\n  reused: number\n  skipped: number\n}\n\ntype Asset = {\n  fileId: string\n  filePath: string\n  isPrivateFile?: boolean\n  name: string\n  tags?: null | string[]\n  thumbnail?: string\n  updatedAt?: string\n  url: string\n  versionInfo?: { id?: string }\n}\n\nconst normalizeLocation = (location: MigrationLocation, label: string): MigrationLocation => {\n  if (!location?.privateKey?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.privateKey\\` is required.`)\n  }\n  if (!location.urlEndpoint?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.urlEndpoint\\` is required.`)\n  }\n  const endpoint = new URL(location.urlEndpoint)\n  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.search || endpoint.hash) {\n    throw new Error(\n      `migrateFolder: \\`${label}.urlEndpoint\\` must be an HTTP(S) URL without a query or fragment.`,\n    )\n  }\n  const folder = location.folder?.trim().replace(/^\\/+|\\/+$/g, '')\n  if (\n    !folder ||\n    folder.split('/').some((segment) => !segment || segment === '.' || segment === '..')\n  ) {\n    throw new Error(\n      `migrateFolder: \\`${label}.folder\\` must be a non-empty folder without dot segments.`,\n    )\n  }\n  return { ...location, folder: `/${folder}`, urlEndpoint: endpoint.href.replace(/\\/$/, '') }\n}\n\nconst isInFolder = (filePath: string, folder: string): boolean => filePath.startsWith(`${folder}/`)\n\nconst getAsset = async (client: ImageKit, fileId: string): Promise<Asset | undefined> => {\n  try {\n    const file = await client.files.get(fileId)\n    if (!file.fileId || !file.filePath || !file.url) {\n      throw new Error(`ImageKit returned incomplete file details for \"${fileId}\".`)\n    }\n    return {\n      ...file,\n      name: file.name || path.posix.basename(file.filePath),\n      fileId: file.fileId,\n      filePath: file.filePath,\n      url: file.url,\n    }\n  } catch (error) {\n    // Authentication errors, rate limits and outages are not evidence of a missing file.\n    if (error instanceof ImageKit.NotFoundError) {\n      return undefined\n    }\n    throw error\n  }\n}\n\nconst findDestination = async (client: ImageKit, filePath: string): Promise<Asset | undefined> => {\n  const limit = 100\n  for (let skip = 0; ; skip += limit) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit,\n      path: `${path.posix.dirname(filePath)}/`,\n      skip,\n    })\n    const match = assets.find((asset) => 'fileId' in asset && asset.filePath === filePath)\n    if (match && 'fileId' in match && match.fileId) {\n      return getAsset(client, match.fileId)\n    }\n    if (assets.length < limit) {\n      return undefined\n    }\n  }\n}\n\nconst transferTag = (\n  source: Asset,\n  filePath: string,\n  documentID: number | string,\n  isPrivate: boolean,\n): string => {\n  const identity = JSON.stringify([\n    source.fileId,\n    source.versionInfo?.id || source.updatedAt,\n    source.url,\n    filePath,\n    documentID,\n    isPrivate,\n  ])\n  return `payload-migration-${createHash('sha256').update(identity).digest('hex')}`\n}\n\n/**\n * Copy referenced originals between ImageKit folders/accounts and update Payload in place.\n * Transfers are tagged at upload time and never overwrite an existing destination file.\n * Reruns recover the upload/database-update gap without relying on filename equality.\n */\nexport const migrateFolder = async (\n  options: MigrateFolderOptions,\n): Promise<MigrationJobResult[]> => {\n  const { collections, dryRun = true, payload, signedUrlExpiresIn = 900 } = options\n  const from = normalizeLocation(options.from, 'from')\n  const to = normalizeLocation(options.to, 'to')\n  if (!payload) {\n    throw new Error('migrateFolder: `payload` is required.')\n  }\n  const slugs = Object.keys(collections || {})\n  if (!slugs.length) {\n    throw new Error('migrateFolder: `collections` must include at least one upload collection.')\n  }\n  for (const slug of slugs) {\n    if (!payload.collections[slug]?.config.upload) {\n      throw new Error(`migrateFolder: \"${slug}\" is not an upload collection.`)\n    }\n  }\n  if (!Number.isFinite(signedUrlExpiresIn) || signedUrlExpiresIn <= 0) {\n    throw new Error('migrateFolder: `signedUrlExpiresIn` must be positive.')\n  }\n\n  // A single transfer path for both cases gives uploads atomic provenance tags, including\n  // when an upload succeeds remotely but its response is lost. Native copy cannot add a tag.\n  const sourceClient = new ImageKit({ maxRetries: 0, privateKey: from.privateKey })\n  const destinationClient = new ImageKit({ maxRetries: 0, privateKey: to.privateKey })\n  const results: MigrationJobResult[] = []\n\n  for (const slug of slugs) {\n    const result: MigrationJobResult = {\n      collectionSlug: slug,\n      errors: [],\n      failed: 0,\n      migrated: 0,\n      planned: 0,\n      reused: 0,\n      skipped: 0,\n    }\n    const sourceFolder = path.posix.join(from.folder, slug)\n    const destinationFolder = path.posix.join(to.folder, slug)\n    const collectionOptions = collections[slug]\n    const plannedPaths = new Map<string, string>()\n    let page = 1\n    let hasNextPage: boolean\n\n    do {\n      const found = await payload.find({ collection: slug, depth: 0, limit: 100, page, sort: 'id' })\n      hasNextPage = found.hasNextPage\n      page += 1\n      for (const doc of found.docs) {\n        const reference = (doc as { imagekit?: { fileId?: string } }).imagekit\n        if (!reference?.fileId) {\n          result.skipped += 1\n          console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: no ImageKit file ID.`)\n          continue\n        }\n        try {\n          const atDestination = await getAsset(destinationClient, reference.fileId)\n          if (atDestination && isInFolder(atDestination.filePath, destinationFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: already at destination.`)\n            continue\n          }\n          const source = await getAsset(sourceClient, reference.fileId)\n          if (!source) {\n            throw new Error(`File \"${reference.fileId}\" was not found in the source account.`)\n          }\n          if (!isInFolder(source.filePath, sourceFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: outside ${sourceFolder}.`)\n            continue\n          }\n\n          const isPrivate =\n            collectionOptions !== true && typeof collectionOptions?.private === 'boolean'\n              ? collectionOptions.private\n              : source.isPrivateFile === true\n          const destinationPath = path.posix.join(destinationFolder, source.name)\n          const tag = transferTag(source, destinationPath, doc.id, isPrivate)\n          const previousTransfer = plannedPaths.get(destinationPath)\n          if (previousTransfer && previousTransfer !== tag) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": multiple source records target this path.`,\n            )\n          }\n          plannedPaths.set(destinationPath, tag)\n          let destination = await findDestination(destinationClient, destinationPath)\n          if (\n            destination &&\n            (!destination.tags?.includes(tag) || (destination.isPrivateFile === true) !== isPrivate)\n          ) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": existing asset is not this transfer.`,\n            )\n          }\n          if (destination) {\n            result.reused += 1\n          }\n          if (dryRun) {\n            result.planned += 1\n            console.log(\n              `[migrateFolder] [dry-run] Would ${destination ? 'reuse' : 'upload'} ${slug}/${doc.id}: ${source.filePath} -> ${destinationPath}`,\n            )\n            continue\n          }\n\n          if (!destination) {\n            const sourceURL = sourceClient.helper.buildSrc({\n              ...(source.isPrivateFile ? { expiresIn: signedUrlExpiresIn, signed: true } : {}),\n              src: source.filePath,\n              transformation: [{ raw: 'orig-true' }],\n              urlEndpoint: from.urlEndpoint,\n            })\n            const uploaded = await destinationClient.files.upload({\n              file: sourceURL,\n              fileName: source.name,\n              folder: destinationFolder,\n              isPrivateFile: isPrivate,\n              overwriteFile: false,\n              tags: [tag],\n              useUniqueFileName: false,\n            })\n            if (!uploaded.fileId) {\n              throw new Error(`Upload of \"${source.fileId}\" did not return a file ID.`)\n            }\n            destination = await getAsset(destinationClient, uploaded.fileId)\n            if (\n              !destination ||\n              destination.filePath !== destinationPath ||\n              !destination.tags?.includes(tag) ||\n              (destination.isPrivateFile === true) !== isPrivate\n            ) {\n              throw new Error(\n                `Upload of \"${source.fileId}\" returned unexpected destination details.`,\n              )\n            }\n          }\n\n          const imagekit = {\n            fileId: destination.fileId,\n            isPrivate,\n            thumbnailUrl: destination.thumbnail || null,\n            url: destinationClient.helper.buildSrc({\n              src: destination.filePath,\n              urlEndpoint: to.urlEndpoint,\n            }),\n          }\n          const updated = { ...doc, filename: destination.name, imagekit }\n          await payload.update({\n            id: doc.id,\n            collection: slug,\n            context: { skipCloudStorage: true },\n            data: {\n              _objectKey: null,\n              filename: destination.name,\n              imagekit,\n              prefix: destinationFolder.replace(/^\\//, ''),\n              thumbnailURL: isPrivate\n                ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api)\n                : getAdminThumbnailURL(updated),\n            },\n          })\n          result.migrated += 1\n          console.log(`[migrateFolder] Migrated ${slug}/${doc.id} to ${destinationPath}.`)\n        } catch (error) {\n          const message = error instanceof Error ? error.message : 'Unknown migration error'\n          result.failed += 1\n          result.errors.push({ documentID: doc.id, message })\n          console.error(`[migrateFolder] Failed ${slug}/${doc.id}: ${message}`)\n        }\n      }\n    } while (hasNextPage)\n\n    results.push(result)\n    console.log(\n      `[migrateFolder] ${slug}: planned=${result.planned}, migrated=${result.migrated}, reused=${result.reused}, skipped=${result.skipped}, failed=${result.failed}.`,\n    )\n  }\n  return results\n}\n"],"names":["ImageKit","createHash","path","getAdminThumbnailURL","getPrivateAdminThumbnailURL","normalizeLocation","location","label","privateKey","trim","Error","urlEndpoint","endpoint","URL","includes","protocol","search","hash","folder","replace","split","some","segment","href","isInFolder","filePath","startsWith","getAsset","client","fileId","file","files","get","url","name","posix","basename","error","NotFoundError","undefined","findDestination","limit","skip","assets","list","type","dirname","match","find","asset","length","transferTag","source","documentID","isPrivate","identity","JSON","stringify","versionInfo","id","updatedAt","update","digest","migrateFolder","options","collections","dryRun","payload","signedUrlExpiresIn","from","to","slugs","Object","keys","slug","config","upload","Number","isFinite","sourceClient","maxRetries","destinationClient","results","result","collectionSlug","errors","failed","migrated","planned","reused","skipped","sourceFolder","join","destinationFolder","collectionOptions","plannedPaths","Map","page","hasNextPage","found","collection","depth","sort","doc","docs","reference","imagekit","console","log","atDestination","private","isPrivateFile","destinationPath","tag","previousTransfer","set","destination","tags","sourceURL","helper","buildSrc","expiresIn","signed","src","transformation","raw","uploaded","fileName","overwriteFile","useUniqueFileName","thumbnailUrl","thumbnail","updated","filename","context","skipCloudStorage","data","_objectKey","prefix","thumbnailURL","routes","api","message","push"],"mappings":"AAAA,sGAAsG,GAItG,OAAOA,cAAc,mBAAkB;AACvC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,UAAU,YAAW;AAE5B,SAASC,oBAAoB,EAAEC,2BAA2B,QAAQ,4BAA2B;AA4C7F,MAAMC,oBAAoB,CAACC,UAA6BC;IACtD,IAAI,CAACD,UAAUE,YAAYC,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,0BAA0B,CAAC;IACvE;IACA,IAAI,CAACD,SAASK,WAAW,EAAEF,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,2BAA2B,CAAC;IACxE;IACA,MAAMK,WAAW,IAAIC,IAAIP,SAASK,WAAW;IAC7C,IAAI,CAAC;QAAC;QAAS;KAAS,CAACG,QAAQ,CAACF,SAASG,QAAQ,KAAKH,SAASI,MAAM,IAAIJ,SAASK,IAAI,EAAE;QACxF,MAAM,IAAIP,MACR,CAAC,iBAAiB,EAAEH,MAAM,kEAAkE,CAAC;IAEjG;IACA,MAAMW,SAASZ,SAASY,MAAM,EAAET,OAAOU,QAAQ,cAAc;IAC7D,IACE,CAACD,UACDA,OAAOE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAOA,YAAY,OAC/E;QACA,MAAM,IAAIZ,MACR,CAAC,iBAAiB,EAAEH,MAAM,0DAA0D,CAAC;IAEzF;IACA,OAAO;QAAE,GAAGD,QAAQ;QAAEY,QAAQ,CAAC,CAAC,EAAEA,QAAQ;QAAEP,aAAaC,SAASW,IAAI,CAACJ,OAAO,CAAC,OAAO;IAAI;AAC5F;AAEA,MAAMK,aAAa,CAACC,UAAkBP,SAA4BO,SAASC,UAAU,CAAC,GAAGR,OAAO,CAAC,CAAC;AAElG,MAAMS,WAAW,OAAOC,QAAkBC;IACxC,IAAI;QACF,MAAMC,OAAO,MAAMF,OAAOG,KAAK,CAACC,GAAG,CAACH;QACpC,IAAI,CAACC,KAAKD,MAAM,IAAI,CAACC,KAAKL,QAAQ,IAAI,CAACK,KAAKG,GAAG,EAAE;YAC/C,MAAM,IAAIvB,MAAM,CAAC,+CAA+C,EAAEmB,OAAO,EAAE,CAAC;QAC9E;QACA,OAAO;YACL,GAAGC,IAAI;YACPI,MAAMJ,KAAKI,IAAI,IAAIhC,KAAKiC,KAAK,CAACC,QAAQ,CAACN,KAAKL,QAAQ;YACpDI,QAAQC,KAAKD,MAAM;YACnBJ,UAAUK,KAAKL,QAAQ;YACvBQ,KAAKH,KAAKG,GAAG;QACf;IACF,EAAE,OAAOI,OAAO;QACd,qFAAqF;QACrF,IAAIA,iBAAiBrC,SAASsC,aAAa,EAAE;YAC3C,OAAOC;QACT;QACA,MAAMF;IACR;AACF;AAEA,MAAMG,kBAAkB,OAAOZ,QAAkBH;IAC/C,MAAMgB,QAAQ;IACd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMf,OAAOe,MAAM,CAACC,IAAI,CAAC;YACtCC,MAAM;YACNJ;YACAvC,MAAM,GAAGA,KAAKiC,KAAK,CAACW,OAAO,CAACrB,UAAU,CAAC,CAAC;YACxCiB;QACF;QACA,MAAMK,QAAQJ,OAAOK,IAAI,CAAC,CAACC,QAAU,YAAYA,SAASA,MAAMxB,QAAQ,KAAKA;QAC7E,IAAIsB,SAAS,YAAYA,SAASA,MAAMlB,MAAM,EAAE;YAC9C,OAAOF,SAASC,QAAQmB,MAAMlB,MAAM;QACtC;QACA,IAAIc,OAAOO,MAAM,GAAGT,OAAO;YACzB,OAAOF;QACT;IACF;AACF;AAEA,MAAMY,cAAc,CAClBC,QACA3B,UACA4B,YACAC;IAEA,MAAMC,WAAWC,KAAKC,SAAS,CAAC;QAC9BL,OAAOvB,MAAM;QACbuB,OAAOM,WAAW,EAAEC,MAAMP,OAAOQ,SAAS;QAC1CR,OAAOnB,GAAG;QACVR;QACA4B;QACAC;KACD;IACD,OAAO,CAAC,kBAAkB,EAAErD,WAAW,UAAU4D,MAAM,CAACN,UAAUO,MAAM,CAAC,QAAQ;AACnF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC;IAEA,MAAM,EAAEC,WAAW,EAAEC,SAAS,IAAI,EAAEC,OAAO,EAAEC,qBAAqB,GAAG,EAAE,GAAGJ;IAC1E,MAAMK,OAAOhE,kBAAkB2D,QAAQK,IAAI,EAAE;IAC7C,MAAMC,KAAKjE,kBAAkB2D,QAAQM,EAAE,EAAE;IACzC,IAAI,CAACH,SAAS;QACZ,MAAM,IAAIzD,MAAM;IAClB;IACA,MAAM6D,QAAQC,OAAOC,IAAI,CAACR,eAAe,CAAC;IAC1C,IAAI,CAACM,MAAMrB,MAAM,EAAE;QACjB,MAAM,IAAIxC,MAAM;IAClB;IACA,KAAK,MAAMgE,QAAQH,MAAO;QACxB,IAAI,CAACJ,QAAQF,WAAW,CAACS,KAAK,EAAEC,OAAOC,QAAQ;YAC7C,MAAM,IAAIlE,MAAM,CAAC,gBAAgB,EAAEgE,KAAK,8BAA8B,CAAC;QACzE;IACF;IACA,IAAI,CAACG,OAAOC,QAAQ,CAACV,uBAAuBA,sBAAsB,GAAG;QACnE,MAAM,IAAI1D,MAAM;IAClB;IAEA,wFAAwF;IACxF,2FAA2F;IAC3F,MAAMqE,eAAe,IAAI/E,SAAS;QAAEgF,YAAY;QAAGxE,YAAY6D,KAAK7D,UAAU;IAAC;IAC/E,MAAMyE,oBAAoB,IAAIjF,SAAS;QAAEgF,YAAY;QAAGxE,YAAY8D,GAAG9D,UAAU;IAAC;IAClF,MAAM0E,UAAgC,EAAE;IAExC,KAAK,MAAMR,QAAQH,MAAO;QACxB,MAAMY,SAA6B;YACjCC,gBAAgBV;YAChBW,QAAQ,EAAE;YACVC,QAAQ;YACRC,UAAU;YACVC,SAAS;YACTC,QAAQ;YACRC,SAAS;QACX;QACA,MAAMC,eAAezF,KAAKiC,KAAK,CAACyD,IAAI,CAACvB,KAAKnD,MAAM,EAAEwD;QAClD,MAAMmB,oBAAoB3F,KAAKiC,KAAK,CAACyD,IAAI,CAACtB,GAAGpD,MAAM,EAAEwD;QACrD,MAAMoB,oBAAoB7B,WAAW,CAACS,KAAK;QAC3C,MAAMqB,eAAe,IAAIC;QACzB,IAAIC,OAAO;QACX,IAAIC;QAEJ,GAAG;YACD,MAAMC,QAAQ,MAAMhC,QAAQnB,IAAI,CAAC;gBAAEoD,YAAY1B;gBAAM2B,OAAO;gBAAG5D,OAAO;gBAAKwD;gBAAMK,MAAM;YAAK;YAC5FJ,cAAcC,MAAMD,WAAW;YAC/BD,QAAQ;YACR,KAAK,MAAMM,OAAOJ,MAAMK,IAAI,CAAE;gBAC5B,MAAMC,YAAY,AAACF,IAA2CG,QAAQ;gBACtE,IAAI,CAACD,WAAW5E,QAAQ;oBACtBsD,OAAOO,OAAO,IAAI;oBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,sBAAsB,CAAC;oBAC9E;gBACF;gBACA,IAAI;oBACF,MAAMkD,gBAAgB,MAAMlF,SAASsD,mBAAmBwB,UAAU5E,MAAM;oBACxE,IAAIgF,iBAAiBrF,WAAWqF,cAAcpF,QAAQ,EAAEoE,oBAAoB;wBAC1EV,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,yBAAyB,CAAC;wBACjF;oBACF;oBACA,MAAMP,SAAS,MAAMzB,SAASoD,cAAc0B,UAAU5E,MAAM;oBAC5D,IAAI,CAACuB,QAAQ;wBACX,MAAM,IAAI1C,MAAM,CAAC,MAAM,EAAE+F,UAAU5E,MAAM,CAAC,sCAAsC,CAAC;oBACnF;oBACA,IAAI,CAACL,WAAW4B,OAAO3B,QAAQ,EAAEkE,eAAe;wBAC9CR,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,UAAU,EAAEgC,aAAa,CAAC,CAAC;wBAClF;oBACF;oBAEA,MAAMrC,YACJwC,sBAAsB,QAAQ,OAAOA,mBAAmBgB,YAAY,YAChEhB,kBAAkBgB,OAAO,GACzB1D,OAAO2D,aAAa,KAAK;oBAC/B,MAAMC,kBAAkB9G,KAAKiC,KAAK,CAACyD,IAAI,CAACC,mBAAmBzC,OAAOlB,IAAI;oBACtE,MAAM+E,MAAM9D,YAAYC,QAAQ4D,iBAAiBT,IAAI5C,EAAE,EAAEL;oBACzD,MAAM4D,mBAAmBnB,aAAa/D,GAAG,CAACgF;oBAC1C,IAAIE,oBAAoBA,qBAAqBD,KAAK;wBAChD,MAAM,IAAIvG,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,4CAA4C,CAAC;oBAE7F;oBACAjB,aAAaoB,GAAG,CAACH,iBAAiBC;oBAClC,IAAIG,cAAc,MAAM5E,gBAAgByC,mBAAmB+B;oBAC3D,IACEI,eACC,CAAA,CAACA,YAAYC,IAAI,EAAEvG,SAASmG,QAAQ,AAACG,YAAYL,aAAa,KAAK,SAAUzD,SAAQ,GACtF;wBACA,MAAM,IAAI5C,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,uCAAuC,CAAC;oBAExF;oBACA,IAAII,aAAa;wBACfjC,OAAOM,MAAM,IAAI;oBACnB;oBACA,IAAIvB,QAAQ;wBACViB,OAAOK,OAAO,IAAI;wBAClBmB,QAAQC,GAAG,CACT,CAAC,gCAAgC,EAAEQ,cAAc,UAAU,SAAS,CAAC,EAAE1C,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEP,OAAO3B,QAAQ,CAAC,IAAI,EAAEuF,iBAAiB;wBAEnI;oBACF;oBAEA,IAAI,CAACI,aAAa;wBAChB,MAAME,YAAYvC,aAAawC,MAAM,CAACC,QAAQ,CAAC;4BAC7C,GAAIpE,OAAO2D,aAAa,GAAG;gCAAEU,WAAWrD;gCAAoBsD,QAAQ;4BAAK,IAAI,CAAC,CAAC;4BAC/EC,KAAKvE,OAAO3B,QAAQ;4BACpBmG,gBAAgB;gCAAC;oCAAEC,KAAK;gCAAY;6BAAE;4BACtClH,aAAa0D,KAAK1D,WAAW;wBAC/B;wBACA,MAAMmH,WAAW,MAAM7C,kBAAkBlD,KAAK,CAAC6C,MAAM,CAAC;4BACpD9C,MAAMwF;4BACNS,UAAU3E,OAAOlB,IAAI;4BACrBhB,QAAQ2E;4BACRkB,eAAezD;4BACf0E,eAAe;4BACfX,MAAM;gCAACJ;6BAAI;4BACXgB,mBAAmB;wBACrB;wBACA,IAAI,CAACH,SAASjG,MAAM,EAAE;4BACpB,MAAM,IAAInB,MAAM,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,2BAA2B,CAAC;wBAC1E;wBACAuF,cAAc,MAAMzF,SAASsD,mBAAmB6C,SAASjG,MAAM;wBAC/D,IACE,CAACuF,eACDA,YAAY3F,QAAQ,KAAKuF,mBACzB,CAACI,YAAYC,IAAI,EAAEvG,SAASmG,QAC5B,AAACG,YAAYL,aAAa,KAAK,SAAUzD,WACzC;4BACA,MAAM,IAAI5C,MACR,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,0CAA0C,CAAC;wBAE3E;oBACF;oBAEA,MAAM6E,WAAW;wBACf7E,QAAQuF,YAAYvF,MAAM;wBAC1ByB;wBACA4E,cAAcd,YAAYe,SAAS,IAAI;wBACvClG,KAAKgD,kBAAkBsC,MAAM,CAACC,QAAQ,CAAC;4BACrCG,KAAKP,YAAY3F,QAAQ;4BACzBd,aAAa2D,GAAG3D,WAAW;wBAC7B;oBACF;oBACA,MAAMyH,UAAU;wBAAE,GAAG7B,GAAG;wBAAE8B,UAAUjB,YAAYlF,IAAI;wBAAEwE;oBAAS;oBAC/D,MAAMvC,QAAQN,MAAM,CAAC;wBACnBF,IAAI4C,IAAI5C,EAAE;wBACVyC,YAAY1B;wBACZ4D,SAAS;4BAAEC,kBAAkB;wBAAK;wBAClCC,MAAM;4BACJC,YAAY;4BACZJ,UAAUjB,YAAYlF,IAAI;4BAC1BwE;4BACAgC,QAAQ7C,kBAAkB1E,OAAO,CAAC,OAAO;4BACzCwH,cAAcrF,YACVlD,4BAA4BgI,SAAS1D,MAAMP,QAAQQ,MAAM,CAACiE,MAAM,CAACC,GAAG,IACpE1I,qBAAqBiI;wBAC3B;oBACF;oBACAjD,OAAOI,QAAQ,IAAI;oBACnBoB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,IAAI,EAAEqD,gBAAgB,CAAC,CAAC;gBACjF,EAAE,OAAO3E,OAAO;oBACd,MAAMyG,UAAUzG,iBAAiB3B,QAAQ2B,MAAMyG,OAAO,GAAG;oBACzD3D,OAAOG,MAAM,IAAI;oBACjBH,OAAOE,MAAM,CAAC0D,IAAI,CAAC;wBAAE1F,YAAYkD,IAAI5C,EAAE;wBAAEmF;oBAAQ;oBACjDnC,QAAQtE,KAAK,CAAC,CAAC,uBAAuB,EAAEqC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEmF,SAAS;gBACtE;YACF;QACF,QAAS5C,YAAY;QAErBhB,QAAQ6D,IAAI,CAAC5D;QACbwB,QAAQC,GAAG,CACT,CAAC,gBAAgB,EAAElC,KAAK,UAAU,EAAES,OAAOK,OAAO,CAAC,WAAW,EAAEL,OAAOI,QAAQ,CAAC,SAAS,EAAEJ,OAAOM,MAAM,CAAC,UAAU,EAAEN,OAAOO,OAAO,CAAC,SAAS,EAAEP,OAAOG,MAAM,CAAC,CAAC,CAAC;IAEnK;IACA,OAAOJ;AACT,EAAC"}
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["/* eslint-disable no-console -- Migration progress is intentionally reported to the invoking process. */\n\nimport type { Payload, UploadCollectionSlug } from 'payload'\n\nimport ImageKit from '@imagekit/nodejs'\nimport { createHash } from 'node:crypto'\nimport path from 'node:path'\n\nimport { getAdminThumbnailURL, getPrivateAdminThumbnailURL } from './getAdminThumbnailURL.js'\n\nexport type MigrationLocation = {\n  /** Root folder, with collection subfolders beneath it. */\n  folder: string\n  privateKey: string\n  urlEndpoint: string\n}\n\nexport type MigrateFolderOptions = {\n  /** `true` preserves source privacy; an explicit `private` value sets destination privacy. */\n  collections: Partial<Record<UploadCollectionSlug, { private?: boolean } | true>>\n  /** Reads and reports the same plan without uploading or updating documents. Defaults to true. */\n  dryRun?: boolean\n  from: MigrationLocation\n  /** The database containing the records to update, including any already at the destination. */\n  payload: Payload\n  signedUrlExpiresIn?: number\n  to: MigrationLocation\n}\n\nexport type MigrationJobResult = {\n  collectionSlug: string\n  errors: { documentID: number | string; message: string }[]\n  failed: number\n  migrated: number\n  planned: number\n  /** Existing tagged transfers recovered after an interrupted run. Included in migrated when live. */\n  reused: number\n  skipped: number\n}\n\ntype Asset = {\n  fileId: string\n  filePath: string\n  isPrivateFile?: boolean\n  name: string\n  tags?: null | string[]\n  thumbnail?: string\n  updatedAt?: string\n  url: string\n  versionInfo?: { id?: string }\n}\n\nconst normalizeLocation = (location: MigrationLocation, label: string): MigrationLocation => {\n  if (!location?.privateKey?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.privateKey\\` is required.`)\n  }\n  if (!location.urlEndpoint?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.urlEndpoint\\` is required.`)\n  }\n  const endpoint = new URL(location.urlEndpoint)\n  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.search || endpoint.hash) {\n    throw new Error(\n      `migrateFolder: \\`${label}.urlEndpoint\\` must be an HTTP(S) URL without a query or fragment.`,\n    )\n  }\n  const folder = location.folder?.trim().replace(/^\\/+|\\/+$/g, '')\n  if (\n    !folder ||\n    folder.split('/').some((segment) => !segment || segment === '.' || segment === '..')\n  ) {\n    throw new Error(\n      `migrateFolder: \\`${label}.folder\\` must be a non-empty folder without dot segments.`,\n    )\n  }\n  return { ...location, folder: `/${folder}`, urlEndpoint: endpoint.href.replace(/\\/$/, '') }\n}\n\nconst isInFolder = (filePath: string, folder: string): boolean => filePath.startsWith(`${folder}/`)\n\nconst getAsset = async (client: ImageKit, fileId: string): Promise<Asset | undefined> => {\n  try {\n    const file = await client.files.get(fileId)\n    if (!file.fileId || !file.filePath || !file.url) {\n      throw new Error(`ImageKit returned incomplete file details for \"${fileId}\".`)\n    }\n    return {\n      ...file,\n      name: file.name || path.posix.basename(file.filePath),\n      fileId: file.fileId,\n      filePath: file.filePath,\n      url: file.url,\n    }\n  } catch (error) {\n    // Authentication errors, rate limits and outages are not evidence of a missing file.\n    if (error instanceof ImageKit.NotFoundError) {\n      return undefined\n    }\n    throw error\n  }\n}\n\nconst findDestination = async (client: ImageKit, filePath: string): Promise<Asset | undefined> => {\n  const limit = 100\n  for (let skip = 0; ; skip += limit) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit,\n      path: `${path.posix.dirname(filePath)}/`,\n      skip,\n    })\n    const match = assets.find((asset) => 'fileId' in asset && asset.filePath === filePath)\n    if (match && 'fileId' in match && match.fileId) {\n      return getAsset(client, match.fileId)\n    }\n    if (assets.length < limit) {\n      return undefined\n    }\n  }\n}\n\nconst transferTag = (\n  source: Asset,\n  filePath: string,\n  documentID: number | string,\n  isPrivate: boolean,\n): string => {\n  const identity = JSON.stringify([\n    source.fileId,\n    source.versionInfo?.id || source.updatedAt,\n    source.url,\n    filePath,\n    documentID,\n    isPrivate,\n  ])\n  return `payload-migration-${createHash('sha256').update(identity).digest('hex')}`\n}\n\n/**\n * Copy referenced originals between ImageKit folders/accounts and update Payload in place.\n * Transfers are tagged at upload time and never overwrite an existing destination file.\n * Reruns recover the upload/database-update gap without relying on filename equality.\n */\nexport const migrateFolder = async (\n  options: MigrateFolderOptions,\n): Promise<MigrationJobResult[]> => {\n  const { collections, dryRun = true, payload, signedUrlExpiresIn = 900 } = options\n  const from = normalizeLocation(options.from, 'from')\n  const to = normalizeLocation(options.to, 'to')\n  if (!payload) {\n    throw new Error('migrateFolder: `payload` is required.')\n  }\n  const slugs = Object.keys(collections || {})\n  if (!slugs.length) {\n    throw new Error('migrateFolder: `collections` must include at least one upload collection.')\n  }\n  for (const slug of slugs) {\n    if (!payload.collections[slug]?.config.upload) {\n      throw new Error(`migrateFolder: \"${slug}\" is not an upload collection.`)\n    }\n  }\n  if (!Number.isFinite(signedUrlExpiresIn) || signedUrlExpiresIn <= 0) {\n    throw new Error('migrateFolder: `signedUrlExpiresIn` must be positive.')\n  }\n\n  // A single transfer path for both cases gives uploads atomic provenance tags, including\n  // when an upload succeeds remotely but its response is lost. Native copy cannot add a tag.\n  const sourceClient = new ImageKit({ maxRetries: 0, privateKey: from.privateKey })\n  const destinationClient = new ImageKit({ maxRetries: 0, privateKey: to.privateKey })\n  const results: MigrationJobResult[] = []\n\n  for (const slug of slugs) {\n    const result: MigrationJobResult = {\n      collectionSlug: slug,\n      errors: [],\n      failed: 0,\n      migrated: 0,\n      planned: 0,\n      reused: 0,\n      skipped: 0,\n    }\n    const sourceFolder = path.posix.join(from.folder, slug)\n    const destinationFolder = path.posix.join(to.folder, slug)\n    const collectionOptions = collections[slug]\n    const plannedPaths = new Map<string, string>()\n    let page = 1\n    let hasNextPage: boolean\n\n    do {\n      const found = await payload.find({ collection: slug, depth: 0, limit: 100, page, sort: 'id' })\n      hasNextPage = found.hasNextPage\n      page += 1\n      for (const doc of found.docs) {\n        const reference = (doc as { imagekit?: { fileId?: string } }).imagekit\n        if (!reference?.fileId) {\n          result.skipped += 1\n          console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: no ImageKit file ID.`)\n          continue\n        }\n        try {\n          const atDestination = await getAsset(destinationClient, reference.fileId)\n          if (atDestination && isInFolder(atDestination.filePath, destinationFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: already at destination.`)\n            continue\n          }\n          const source = await getAsset(sourceClient, reference.fileId)\n          if (!source) {\n            throw new Error(`File \"${reference.fileId}\" was not found in the source account.`)\n          }\n          if (!isInFolder(source.filePath, sourceFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: outside ${sourceFolder}.`)\n            continue\n          }\n\n          const isPrivate =\n            collectionOptions !== true && typeof collectionOptions?.private === 'boolean'\n              ? collectionOptions.private\n              : source.isPrivateFile === true\n          const destinationPath = path.posix.join(destinationFolder, source.name)\n          const tag = transferTag(source, destinationPath, doc.id, isPrivate)\n          const previousTransfer = plannedPaths.get(destinationPath)\n          if (previousTransfer && previousTransfer !== tag) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": multiple source records target this path.`,\n            )\n          }\n          plannedPaths.set(destinationPath, tag)\n          let destination = await findDestination(destinationClient, destinationPath)\n          if (\n            destination &&\n            (!destination.tags?.includes(tag) || (destination.isPrivateFile === true) !== isPrivate)\n          ) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": existing asset is not this transfer.`,\n            )\n          }\n          if (destination) {\n            result.reused += 1\n          }\n          if (dryRun) {\n            result.planned += 1\n            console.log(\n              `[migrateFolder] [dry-run] Would ${destination ? 'reuse' : 'upload'} ${slug}/${doc.id}: ${source.filePath} -> ${destinationPath}`,\n            )\n            continue\n          }\n\n          if (!destination) {\n            const sourceURL = sourceClient.helper.buildSrc({\n              ...(source.isPrivateFile ? { expiresIn: signedUrlExpiresIn, signed: true } : {}),\n              src: source.filePath,\n              transformation: [{ raw: 'orig-true' }],\n              urlEndpoint: from.urlEndpoint,\n            })\n            const uploaded = await destinationClient.files.upload({\n              file: sourceURL,\n              fileName: source.name,\n              folder: destinationFolder,\n              isPrivateFile: isPrivate,\n              overwriteFile: false,\n              tags: [tag],\n              useUniqueFileName: false,\n            })\n            if (!uploaded.fileId) {\n              throw new Error(`Upload of \"${source.fileId}\" did not return a file ID.`)\n            }\n            destination = await getAsset(destinationClient, uploaded.fileId)\n            if (\n              !destination ||\n              destination.filePath !== destinationPath ||\n              !destination.tags?.includes(tag) ||\n              (destination.isPrivateFile === true) !== isPrivate\n            ) {\n              throw new Error(\n                `Upload of \"${source.fileId}\" returned unexpected destination details.`,\n              )\n            }\n          }\n\n          const imagekit = {\n            fileId: destination.fileId,\n            isPrivate,\n            thumbnailUrl: destination.thumbnail || null,\n            url: destinationClient.helper.buildSrc({\n              src: destination.filePath,\n              urlEndpoint: to.urlEndpoint,\n            }),\n          }\n          const updated = { ...doc, filename: destination.name, imagekit }\n          const data = {\n            filename: destination.name,\n            imagekit,\n            prefix: destinationFolder.replace(/^\\//, ''),\n            thumbnailURL: isPrivate\n              ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api)\n              : getAdminThumbnailURL(updated),\n          }\n          if (payload.db.name === 'mongoose') {\n            // A sparse unique MongoDB index permits missing keys, but only one null.\n            // Use the adapter directly: Local API merges the old key back into the\n            // update, which conflicts with $unset. Remove it and save the reference\n            // in one database write, so failed updates leave the source intact.\n            await payload.db.updateOne({\n              id: doc.id,\n              collection: slug,\n              data: { ...data, $unset: { _objectKey: 1 } },\n            })\n          } else {\n            await payload.update({\n              id: doc.id,\n              collection: slug,\n              context: { skipCloudStorage: true },\n              data: { ...data, _objectKey: null },\n            })\n          }\n          result.migrated += 1\n          console.log(`[migrateFolder] Migrated ${slug}/${doc.id} to ${destinationPath}.`)\n        } catch (error) {\n          const message = error instanceof Error ? error.message : 'Unknown migration error'\n          result.failed += 1\n          result.errors.push({ documentID: doc.id, message })\n          console.error(`[migrateFolder] Failed ${slug}/${doc.id}: ${message}`)\n        }\n      }\n    } while (hasNextPage)\n\n    results.push(result)\n    console.log(\n      `[migrateFolder] ${slug}: planned=${result.planned}, migrated=${result.migrated}, reused=${result.reused}, skipped=${result.skipped}, failed=${result.failed}.`,\n    )\n  }\n  return results\n}\n"],"names":["ImageKit","createHash","path","getAdminThumbnailURL","getPrivateAdminThumbnailURL","normalizeLocation","location","label","privateKey","trim","Error","urlEndpoint","endpoint","URL","includes","protocol","search","hash","folder","replace","split","some","segment","href","isInFolder","filePath","startsWith","getAsset","client","fileId","file","files","get","url","name","posix","basename","error","NotFoundError","undefined","findDestination","limit","skip","assets","list","type","dirname","match","find","asset","length","transferTag","source","documentID","isPrivate","identity","JSON","stringify","versionInfo","id","updatedAt","update","digest","migrateFolder","options","collections","dryRun","payload","signedUrlExpiresIn","from","to","slugs","Object","keys","slug","config","upload","Number","isFinite","sourceClient","maxRetries","destinationClient","results","result","collectionSlug","errors","failed","migrated","planned","reused","skipped","sourceFolder","join","destinationFolder","collectionOptions","plannedPaths","Map","page","hasNextPage","found","collection","depth","sort","doc","docs","reference","imagekit","console","log","atDestination","private","isPrivateFile","destinationPath","tag","previousTransfer","set","destination","tags","sourceURL","helper","buildSrc","expiresIn","signed","src","transformation","raw","uploaded","fileName","overwriteFile","useUniqueFileName","thumbnailUrl","thumbnail","updated","filename","data","prefix","thumbnailURL","routes","api","db","updateOne","$unset","_objectKey","context","skipCloudStorage","message","push"],"mappings":"AAAA,sGAAsG,GAItG,OAAOA,cAAc,mBAAkB;AACvC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,UAAU,YAAW;AAE5B,SAASC,oBAAoB,EAAEC,2BAA2B,QAAQ,4BAA2B;AA4C7F,MAAMC,oBAAoB,CAACC,UAA6BC;IACtD,IAAI,CAACD,UAAUE,YAAYC,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,0BAA0B,CAAC;IACvE;IACA,IAAI,CAACD,SAASK,WAAW,EAAEF,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,2BAA2B,CAAC;IACxE;IACA,MAAMK,WAAW,IAAIC,IAAIP,SAASK,WAAW;IAC7C,IAAI,CAAC;QAAC;QAAS;KAAS,CAACG,QAAQ,CAACF,SAASG,QAAQ,KAAKH,SAASI,MAAM,IAAIJ,SAASK,IAAI,EAAE;QACxF,MAAM,IAAIP,MACR,CAAC,iBAAiB,EAAEH,MAAM,kEAAkE,CAAC;IAEjG;IACA,MAAMW,SAASZ,SAASY,MAAM,EAAET,OAAOU,QAAQ,cAAc;IAC7D,IACE,CAACD,UACDA,OAAOE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAOA,YAAY,OAC/E;QACA,MAAM,IAAIZ,MACR,CAAC,iBAAiB,EAAEH,MAAM,0DAA0D,CAAC;IAEzF;IACA,OAAO;QAAE,GAAGD,QAAQ;QAAEY,QAAQ,CAAC,CAAC,EAAEA,QAAQ;QAAEP,aAAaC,SAASW,IAAI,CAACJ,OAAO,CAAC,OAAO;IAAI;AAC5F;AAEA,MAAMK,aAAa,CAACC,UAAkBP,SAA4BO,SAASC,UAAU,CAAC,GAAGR,OAAO,CAAC,CAAC;AAElG,MAAMS,WAAW,OAAOC,QAAkBC;IACxC,IAAI;QACF,MAAMC,OAAO,MAAMF,OAAOG,KAAK,CAACC,GAAG,CAACH;QACpC,IAAI,CAACC,KAAKD,MAAM,IAAI,CAACC,KAAKL,QAAQ,IAAI,CAACK,KAAKG,GAAG,EAAE;YAC/C,MAAM,IAAIvB,MAAM,CAAC,+CAA+C,EAAEmB,OAAO,EAAE,CAAC;QAC9E;QACA,OAAO;YACL,GAAGC,IAAI;YACPI,MAAMJ,KAAKI,IAAI,IAAIhC,KAAKiC,KAAK,CAACC,QAAQ,CAACN,KAAKL,QAAQ;YACpDI,QAAQC,KAAKD,MAAM;YACnBJ,UAAUK,KAAKL,QAAQ;YACvBQ,KAAKH,KAAKG,GAAG;QACf;IACF,EAAE,OAAOI,OAAO;QACd,qFAAqF;QACrF,IAAIA,iBAAiBrC,SAASsC,aAAa,EAAE;YAC3C,OAAOC;QACT;QACA,MAAMF;IACR;AACF;AAEA,MAAMG,kBAAkB,OAAOZ,QAAkBH;IAC/C,MAAMgB,QAAQ;IACd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMf,OAAOe,MAAM,CAACC,IAAI,CAAC;YACtCC,MAAM;YACNJ;YACAvC,MAAM,GAAGA,KAAKiC,KAAK,CAACW,OAAO,CAACrB,UAAU,CAAC,CAAC;YACxCiB;QACF;QACA,MAAMK,QAAQJ,OAAOK,IAAI,CAAC,CAACC,QAAU,YAAYA,SAASA,MAAMxB,QAAQ,KAAKA;QAC7E,IAAIsB,SAAS,YAAYA,SAASA,MAAMlB,MAAM,EAAE;YAC9C,OAAOF,SAASC,QAAQmB,MAAMlB,MAAM;QACtC;QACA,IAAIc,OAAOO,MAAM,GAAGT,OAAO;YACzB,OAAOF;QACT;IACF;AACF;AAEA,MAAMY,cAAc,CAClBC,QACA3B,UACA4B,YACAC;IAEA,MAAMC,WAAWC,KAAKC,SAAS,CAAC;QAC9BL,OAAOvB,MAAM;QACbuB,OAAOM,WAAW,EAAEC,MAAMP,OAAOQ,SAAS;QAC1CR,OAAOnB,GAAG;QACVR;QACA4B;QACAC;KACD;IACD,OAAO,CAAC,kBAAkB,EAAErD,WAAW,UAAU4D,MAAM,CAACN,UAAUO,MAAM,CAAC,QAAQ;AACnF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC;IAEA,MAAM,EAAEC,WAAW,EAAEC,SAAS,IAAI,EAAEC,OAAO,EAAEC,qBAAqB,GAAG,EAAE,GAAGJ;IAC1E,MAAMK,OAAOhE,kBAAkB2D,QAAQK,IAAI,EAAE;IAC7C,MAAMC,KAAKjE,kBAAkB2D,QAAQM,EAAE,EAAE;IACzC,IAAI,CAACH,SAAS;QACZ,MAAM,IAAIzD,MAAM;IAClB;IACA,MAAM6D,QAAQC,OAAOC,IAAI,CAACR,eAAe,CAAC;IAC1C,IAAI,CAACM,MAAMrB,MAAM,EAAE;QACjB,MAAM,IAAIxC,MAAM;IAClB;IACA,KAAK,MAAMgE,QAAQH,MAAO;QACxB,IAAI,CAACJ,QAAQF,WAAW,CAACS,KAAK,EAAEC,OAAOC,QAAQ;YAC7C,MAAM,IAAIlE,MAAM,CAAC,gBAAgB,EAAEgE,KAAK,8BAA8B,CAAC;QACzE;IACF;IACA,IAAI,CAACG,OAAOC,QAAQ,CAACV,uBAAuBA,sBAAsB,GAAG;QACnE,MAAM,IAAI1D,MAAM;IAClB;IAEA,wFAAwF;IACxF,2FAA2F;IAC3F,MAAMqE,eAAe,IAAI/E,SAAS;QAAEgF,YAAY;QAAGxE,YAAY6D,KAAK7D,UAAU;IAAC;IAC/E,MAAMyE,oBAAoB,IAAIjF,SAAS;QAAEgF,YAAY;QAAGxE,YAAY8D,GAAG9D,UAAU;IAAC;IAClF,MAAM0E,UAAgC,EAAE;IAExC,KAAK,MAAMR,QAAQH,MAAO;QACxB,MAAMY,SAA6B;YACjCC,gBAAgBV;YAChBW,QAAQ,EAAE;YACVC,QAAQ;YACRC,UAAU;YACVC,SAAS;YACTC,QAAQ;YACRC,SAAS;QACX;QACA,MAAMC,eAAezF,KAAKiC,KAAK,CAACyD,IAAI,CAACvB,KAAKnD,MAAM,EAAEwD;QAClD,MAAMmB,oBAAoB3F,KAAKiC,KAAK,CAACyD,IAAI,CAACtB,GAAGpD,MAAM,EAAEwD;QACrD,MAAMoB,oBAAoB7B,WAAW,CAACS,KAAK;QAC3C,MAAMqB,eAAe,IAAIC;QACzB,IAAIC,OAAO;QACX,IAAIC;QAEJ,GAAG;YACD,MAAMC,QAAQ,MAAMhC,QAAQnB,IAAI,CAAC;gBAAEoD,YAAY1B;gBAAM2B,OAAO;gBAAG5D,OAAO;gBAAKwD;gBAAMK,MAAM;YAAK;YAC5FJ,cAAcC,MAAMD,WAAW;YAC/BD,QAAQ;YACR,KAAK,MAAMM,OAAOJ,MAAMK,IAAI,CAAE;gBAC5B,MAAMC,YAAY,AAACF,IAA2CG,QAAQ;gBACtE,IAAI,CAACD,WAAW5E,QAAQ;oBACtBsD,OAAOO,OAAO,IAAI;oBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,sBAAsB,CAAC;oBAC9E;gBACF;gBACA,IAAI;oBACF,MAAMkD,gBAAgB,MAAMlF,SAASsD,mBAAmBwB,UAAU5E,MAAM;oBACxE,IAAIgF,iBAAiBrF,WAAWqF,cAAcpF,QAAQ,EAAEoE,oBAAoB;wBAC1EV,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,yBAAyB,CAAC;wBACjF;oBACF;oBACA,MAAMP,SAAS,MAAMzB,SAASoD,cAAc0B,UAAU5E,MAAM;oBAC5D,IAAI,CAACuB,QAAQ;wBACX,MAAM,IAAI1C,MAAM,CAAC,MAAM,EAAE+F,UAAU5E,MAAM,CAAC,sCAAsC,CAAC;oBACnF;oBACA,IAAI,CAACL,WAAW4B,OAAO3B,QAAQ,EAAEkE,eAAe;wBAC9CR,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,UAAU,EAAEgC,aAAa,CAAC,CAAC;wBAClF;oBACF;oBAEA,MAAMrC,YACJwC,sBAAsB,QAAQ,OAAOA,mBAAmBgB,YAAY,YAChEhB,kBAAkBgB,OAAO,GACzB1D,OAAO2D,aAAa,KAAK;oBAC/B,MAAMC,kBAAkB9G,KAAKiC,KAAK,CAACyD,IAAI,CAACC,mBAAmBzC,OAAOlB,IAAI;oBACtE,MAAM+E,MAAM9D,YAAYC,QAAQ4D,iBAAiBT,IAAI5C,EAAE,EAAEL;oBACzD,MAAM4D,mBAAmBnB,aAAa/D,GAAG,CAACgF;oBAC1C,IAAIE,oBAAoBA,qBAAqBD,KAAK;wBAChD,MAAM,IAAIvG,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,4CAA4C,CAAC;oBAE7F;oBACAjB,aAAaoB,GAAG,CAACH,iBAAiBC;oBAClC,IAAIG,cAAc,MAAM5E,gBAAgByC,mBAAmB+B;oBAC3D,IACEI,eACC,CAAA,CAACA,YAAYC,IAAI,EAAEvG,SAASmG,QAAQ,AAACG,YAAYL,aAAa,KAAK,SAAUzD,SAAQ,GACtF;wBACA,MAAM,IAAI5C,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,uCAAuC,CAAC;oBAExF;oBACA,IAAII,aAAa;wBACfjC,OAAOM,MAAM,IAAI;oBACnB;oBACA,IAAIvB,QAAQ;wBACViB,OAAOK,OAAO,IAAI;wBAClBmB,QAAQC,GAAG,CACT,CAAC,gCAAgC,EAAEQ,cAAc,UAAU,SAAS,CAAC,EAAE1C,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEP,OAAO3B,QAAQ,CAAC,IAAI,EAAEuF,iBAAiB;wBAEnI;oBACF;oBAEA,IAAI,CAACI,aAAa;wBAChB,MAAME,YAAYvC,aAAawC,MAAM,CAACC,QAAQ,CAAC;4BAC7C,GAAIpE,OAAO2D,aAAa,GAAG;gCAAEU,WAAWrD;gCAAoBsD,QAAQ;4BAAK,IAAI,CAAC,CAAC;4BAC/EC,KAAKvE,OAAO3B,QAAQ;4BACpBmG,gBAAgB;gCAAC;oCAAEC,KAAK;gCAAY;6BAAE;4BACtClH,aAAa0D,KAAK1D,WAAW;wBAC/B;wBACA,MAAMmH,WAAW,MAAM7C,kBAAkBlD,KAAK,CAAC6C,MAAM,CAAC;4BACpD9C,MAAMwF;4BACNS,UAAU3E,OAAOlB,IAAI;4BACrBhB,QAAQ2E;4BACRkB,eAAezD;4BACf0E,eAAe;4BACfX,MAAM;gCAACJ;6BAAI;4BACXgB,mBAAmB;wBACrB;wBACA,IAAI,CAACH,SAASjG,MAAM,EAAE;4BACpB,MAAM,IAAInB,MAAM,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,2BAA2B,CAAC;wBAC1E;wBACAuF,cAAc,MAAMzF,SAASsD,mBAAmB6C,SAASjG,MAAM;wBAC/D,IACE,CAACuF,eACDA,YAAY3F,QAAQ,KAAKuF,mBACzB,CAACI,YAAYC,IAAI,EAAEvG,SAASmG,QAC5B,AAACG,YAAYL,aAAa,KAAK,SAAUzD,WACzC;4BACA,MAAM,IAAI5C,MACR,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,0CAA0C,CAAC;wBAE3E;oBACF;oBAEA,MAAM6E,WAAW;wBACf7E,QAAQuF,YAAYvF,MAAM;wBAC1ByB;wBACA4E,cAAcd,YAAYe,SAAS,IAAI;wBACvClG,KAAKgD,kBAAkBsC,MAAM,CAACC,QAAQ,CAAC;4BACrCG,KAAKP,YAAY3F,QAAQ;4BACzBd,aAAa2D,GAAG3D,WAAW;wBAC7B;oBACF;oBACA,MAAMyH,UAAU;wBAAE,GAAG7B,GAAG;wBAAE8B,UAAUjB,YAAYlF,IAAI;wBAAEwE;oBAAS;oBAC/D,MAAM4B,OAAO;wBACXD,UAAUjB,YAAYlF,IAAI;wBAC1BwE;wBACA6B,QAAQ1C,kBAAkB1E,OAAO,CAAC,OAAO;wBACzCqH,cAAclF,YACVlD,4BAA4BgI,SAAS1D,MAAMP,QAAQQ,MAAM,CAAC8D,MAAM,CAACC,GAAG,IACpEvI,qBAAqBiI;oBAC3B;oBACA,IAAIjE,QAAQwE,EAAE,CAACzG,IAAI,KAAK,YAAY;wBAClC,yEAAyE;wBACzE,uEAAuE;wBACvE,wEAAwE;wBACxE,oEAAoE;wBACpE,MAAMiC,QAAQwE,EAAE,CAACC,SAAS,CAAC;4BACzBjF,IAAI4C,IAAI5C,EAAE;4BACVyC,YAAY1B;4BACZ4D,MAAM;gCAAE,GAAGA,IAAI;gCAAEO,QAAQ;oCAAEC,YAAY;gCAAE;4BAAE;wBAC7C;oBACF,OAAO;wBACL,MAAM3E,QAAQN,MAAM,CAAC;4BACnBF,IAAI4C,IAAI5C,EAAE;4BACVyC,YAAY1B;4BACZqE,SAAS;gCAAEC,kBAAkB;4BAAK;4BAClCV,MAAM;gCAAE,GAAGA,IAAI;gCAAEQ,YAAY;4BAAK;wBACpC;oBACF;oBACA3D,OAAOI,QAAQ,IAAI;oBACnBoB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,IAAI,EAAEqD,gBAAgB,CAAC,CAAC;gBACjF,EAAE,OAAO3E,OAAO;oBACd,MAAM4G,UAAU5G,iBAAiB3B,QAAQ2B,MAAM4G,OAAO,GAAG;oBACzD9D,OAAOG,MAAM,IAAI;oBACjBH,OAAOE,MAAM,CAAC6D,IAAI,CAAC;wBAAE7F,YAAYkD,IAAI5C,EAAE;wBAAEsF;oBAAQ;oBACjDtC,QAAQtE,KAAK,CAAC,CAAC,uBAAuB,EAAEqC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEsF,SAAS;gBACtE;YACF;QACF,QAAS/C,YAAY;QAErBhB,QAAQgE,IAAI,CAAC/D;QACbwB,QAAQC,GAAG,CACT,CAAC,gBAAgB,EAAElC,KAAK,UAAU,EAAES,OAAOK,OAAO,CAAC,WAAW,EAAEL,OAAOI,QAAQ,CAAC,SAAS,EAAEJ,OAAOM,MAAM,CAAC,UAAU,EAAEN,OAAOO,OAAO,CAAC,SAAS,EAAEP,OAAOG,MAAM,CAAC,CAAC,CAAC;IAEnK;IACA,OAAOJ;AACT,EAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humaan/payload-storage-imagekit",
-  "version": "2.9.0",
+  "version": "2.9.2",
   "description": "ImageKit storage adapter plugin for Payload CMS uploads",
   "license": "MIT",
   "type": "module",
@@ -47,21 +47,21 @@
     "@payloadcms/ui": "3.90.2",
     "@swc-node/register": "1.12.1",
     "@swc/cli": "0.8.1",
-    "@types/node": "26.6.3",
+    "@types/node": "26.6.5",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "conventional-changelog": "8.1.3",
-    "conventional-changelog-conventionalcommits": "10.4.0",
+    "conventional-changelog-conventionalcommits": "10.4.1",
     "copyfiles": "2.4.1",
     "cross-env": "10.1.0",
     "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.8",
+    "eslint-config-next": "16.4.1",
     "graphql": "^16.14.2",
     "mongodb-memory-server": "11.3.0",
-    "next": "16.3.8",
+    "next": "16.4.1",
     "open": "^11.0.4",
     "payload": "3.90.2",
-    "prettier": "^3.9.9",
+    "prettier": "^3.9.10",
     "qs-esm": "8.0.2",
     "react": "19.3.0",
     "react-dom": "19.3.0",
@@ -69,7 +69,7 @@
     "sharp": "0.35.5",
     "sort-package-json": "^4.0.0",
     "typescript": "6.0.3",
-    "vite": "8.3.1",
+    "vite": "8.3.4",
     "vite-tsconfig-paths": "6.1.1",
     "vitest": "4.1.11"
   },
@@ -78,7 +78,7 @@
     "payload": ">=3.90.1 <4.0.0"
   },
   "engines": {
-    "node": ">=24.15.0 <25"
+    "node": ">=24.22.0 <25"
   },
   "publishConfig": {
     "access": "public",