@humaan/payload-storage-imagekit 2.9.1 → 3.0.0-canary.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type {\n  Adapter,\n  ClientUploadsConfig,\n  CollectionOptions,\n} from '@payloadcms/plugin-cloud-storage/types'\nimport type {\n  CollectionConfig,\n  CollectionSlug,\n  Config,\n  Field,\n  PayloadRequest,\n  TypeWithID,\n  UploadCollectionSlug,\n  Where,\n} from 'payload'\n\nimport ImageKit, { toFile } from '@imagekit/nodejs'\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport {\n  buildStoragePathData,\n  buildUploadStoragePathData,\n  getStorageFilePath,\n  initClientUploads,\n} from '@payloadcms/plugin-cloud-storage/utilities'\nimport { openAsBlob } from 'node:fs'\nimport path from 'node:path'\nimport { APIError } from 'payload'\nimport {\n  getRangeRequestInfo,\n  isXmlMimeType,\n  UPLOAD_CONTENT_SECURITY_POLICY,\n} from 'payload/internal'\nimport { validateMimeType } from 'payload/shared'\n\nimport type { VerifiedImageKitUpload } from './clientUploadVerification.js'\n\nimport { imageKitUploadAuthPath, isImageKitReceiptContext } from './clientUploads.js'\nimport {\n  createImageKitClientUploadVerifier,\n  getClientUploadStorageFilePath,\n} from './clientUploadVerification.js'\nimport { createImageKitUploadAuthHandler } from './endpoints/createImageKitUploadAuthHandler.js'\nimport {\n  getAdminThumbnailURL,\n  getPrivateAdminThumbnailURL,\n  isPdfMimeType,\n  isVideoMimeType,\n} from './getAdminThumbnailURL.js'\nimport { getImageKitThumbnailSrc, getVideoPosterSrc } from './imageTransforms.js'\n\nexport type ImageKitCollectionOptions = {\n  /**\n   * Override Payload's native focal-point picker (`upload.focalPoint`) for this\n   * collection.\n   */\n  focalPoint?: boolean\n  /**\n   * Upload files in this collection as ImageKit private files (`isPrivateFile: true`)\n   * and deliver them only through short-lived signed URLs, behind Payload access control.\n   */\n  private?: boolean\n}\ntype ImageKitCollectionConfig = ImageKitCollectionOptions | true\ntype ImageKitCollectionMap = Partial<Record<UploadCollectionSlug, ImageKitCollectionConfig>>\n\nconst DEFAULT_SIGNED_URL_EXPIRES_IN = 900\n/**\n * ImageKit re-encodes some uploads and serves the smaller derivative from the plain\n * delivery URL — a 1.9 MB MP4 can come back as 868 KB. That is exactly what we want\n * for visitors, but not when reading the file back to verify a client upload: the\n * bytes and the byte count would both belong to a file ImageKit's API never reported.\n * `orig-true` asks for the untouched original and does not disable optimisation for\n * anyone else.\n */\nconst ORIGINAL_FILE_TRANSFORMATION = 'orig-true'\n\nconst PRIVATE_COLLECTION_DESCRIPTION =\n  'Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.'\n\nconst isPrivateCollectionConfig = (value: ImageKitCollectionConfig | undefined): boolean =>\n  value !== true && typeof value === 'object' && value?.private === true\n\nconst XML_FAMILY_MIME_TYPES = ['application/xml', 'image/svg+xml', 'text/xml']\n\nconst collectionCanStoreXml = (collection: CollectionConfig): boolean => {\n  const upload = collection.upload\n\n  if (!upload || upload === true) {\n    return Boolean(upload)\n  }\n\n  // Payload skips MIME and content restrictions when this escape hatch is enabled.\n  if (upload.allowRestrictedFileTypes) {\n    return true\n  }\n\n  const allowedMimeTypes = upload.mimeTypes\n\n  return (\n    !allowedMimeTypes?.length ||\n    allowedMimeTypes.some((mimeType) => mimeType.includes('*') || isXmlMimeType(mimeType)) ||\n    XML_FAMILY_MIME_TYPES.some((mimeType) => validateMimeType(mimeType, allowedMimeTypes))\n  )\n}\n\n/**\n * Whether a specific document is private. The flag stored on the document at upload time\n * (`imagekit.isPrivate`) is the source of truth — a file's privacy on ImageKit is fixed\n * when it is uploaded and does not change if the collection's `private` setting changes\n * later. Falls back to the collection setting for documents uploaded before this flag existed.\n */\nconst isDocumentPrivate = (doc: unknown, collectionIsPrivate: boolean): boolean => {\n  const stored = (doc as { imagekit?: { isPrivate?: boolean } } | undefined)?.imagekit?.isPrivate\n\n  return typeof stored === 'boolean' ? stored : collectionIsPrivate\n}\ntype ImageKitReference = {\n  imagekit?: {\n    fileId?: string\n    isPrivate?: boolean\n    thumbnailUrl?: string\n    url?: string\n  }\n}\n\ntype UploadDocumentData = {\n  thumbnailURL?: string\n} & ImageKitReference\n\nexport type PayloadStorageImageKitConfig = {\n  alwaysInsertFields?: boolean\n  clientUploads?: ClientUploadsConfig\n  collections: ImageKitCollectionMap\n  disablePayloadAccessControl?: true\n  enabled?: boolean\n  /**\n   * Broad default for Payload's native focal-point picker (`upload.focalPoint`)\n   * on every configured collection. Focal points are disabled by default for\n   * configured collections, so prefer collection-level `focalPoint: true` for\n   * image collections. A collection's own `upload.focalPoint` still takes\n   * precedence.\n   */\n  focalPoint?: boolean\n  folder: string\n  privateKey: string\n  publicKey: string\n  /**\n   * Expiry (in seconds) applied to signed URLs generated for private collections.\n   * Defaults to 900 (15 minutes). URLs are signed fresh on every request, so a short\n   * window is safe.\n   */\n  signedUrlExpiresIn?: number\n  urlEndpoint: string\n}\n\nconst normalizeFolder = (folder: string): string => {\n  const normalized = folder.trim().replace(/^\\/+|\\/+$/g, '')\n\n  if (!normalized) {\n    throw new Error('imagekitStorage: `folder` is required.')\n  }\n\n  return `/${normalized}`\n}\n\nconst getCollectionFolder = (rootFolder: string, collectionSlug: string): string =>\n  path.posix.join(rootFolder, collectionSlug)\n\nconst findImageKitFileId = async (\n  imagekit: ImageKit,\n  filePath: string,\n): Promise<string | undefined> => {\n  const parentPath = path.posix.dirname(filePath)\n  const name = path.posix.basename(filePath)\n\n  const limit = 100\n\n  for (let skip = 0; ; skip += limit) {\n    const assets = await imagekit.assets.list({\n      type: 'file',\n      limit,\n      path: parentPath === '/' ? '/' : `${parentPath}/`,\n      skip,\n    })\n\n    const found = assets.find(\n      (asset) => 'fileId' in asset && asset.filePath === filePath && asset.name === name,\n    )\n\n    if (found && 'fileId' in found) {\n      return found.fileId\n    }\n\n    if (assets.length < limit) {\n      break\n    }\n  }\n\n  return undefined\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> =>\n  !!value && typeof value === 'object'\n\nconst getStoredImageKitURL = (doc: unknown): string | undefined => {\n  const storedURL = (doc as ImageKitReference | undefined)?.imagekit?.url\n\n  return typeof storedURL === 'string' && storedURL.trim().length > 0 ? storedURL : undefined\n}\n\nconst hasStoredImageKitURL = (doc: unknown): boolean => !!getStoredImageKitURL(doc)\n\nconst findUploadDocumentByFilename = async ({\n  collection,\n  filename,\n  prefix,\n  req,\n}: {\n  collection: string\n  filename: string\n  prefix?: string\n  req: PayloadRequest\n}): Promise<null | TypeWithID> => {\n  const constraints: Where[] = [\n    {\n      filename: {\n        equals: filename,\n      },\n    },\n  ]\n\n  if (typeof prefix === 'string') {\n    constraints.push({\n      prefix: {\n        equals: prefix,\n      },\n    })\n  }\n\n  return req.payload.db.findOne({\n    collection,\n    req,\n    where: {\n      and: constraints,\n    },\n  })\n}\n\nconst applyVerifiedClientUploadToData = <T extends UploadDocumentData>(\n  data: T,\n  uploaded: VerifiedImageKitUpload,\n  buildThumbnailURL: (data: T) => string = getAdminThumbnailURL,\n  isPrivate: boolean,\n): T => {\n  data.imagekit = {\n    fileId: uploaded.fileId,\n    isPrivate,\n    thumbnailUrl: uploaded.thumbnailUrl,\n    url: uploaded.url,\n  }\n\n  // Preserve the admin preview when the original file was already uploaded client-side.\n  data.thumbnailURL = buildThumbnailURL(data)\n\n  return data\n}\n\nconst imagekitAdapter = ({\n  apiRoute,\n  client,\n  clientUploads,\n  privateSlugs,\n  rootFolder,\n  signedUrlExpiresIn,\n  urlEndpoint,\n  verifyClientUpload,\n}: {\n  apiRoute: string\n  client: ImageKit\n  clientUploads?: ClientUploadsConfig\n  privateSlugs: Set<string>\n  rootFolder: string\n  signedUrlExpiresIn: number\n  urlEndpoint: string\n  verifyClientUpload: ReturnType<typeof createImageKitClientUploadVerifier>\n}): Adapter => {\n  const fetchUploadedFile = async ({\n    fileSize,\n    fileURL,\n    mimeType,\n    range,\n  }: {\n    fileSize: number\n    fileURL: string\n    mimeType: string\n    range?: null | string\n  }): Promise<Response> => {\n    const rangeResult = getRangeRequestInfo({ fileSize, rangeHeader: range ?? null })\n\n    if (rangeResult.type === 'invalid') {\n      return new Response(null, {\n        headers: new Headers(rangeResult.headers),\n        status: rangeResult.status,\n      })\n    }\n\n    const normalizedRange =\n      rangeResult.type === 'partial'\n        ? `bytes=${rangeResult.rangeStart}-${rangeResult.rangeEnd}`\n        : undefined\n    // Payload cancels image probes after reading a bounded prefix. Next.js memoizes\n    // GET responses by teeing their streams; cancelling one branch can then wait\n    // forever for its unread cached sibling. An explicit signal opts out of that\n    // memoization, while no-store also excludes these reads from the data cache.\n    const response = await fetch(fileURL, {\n      cache: 'no-store',\n      ...(normalizedRange ? { headers: { Range: normalizedRange } } : {}),\n      signal: new AbortController().signal,\n    })\n\n    if (!response.ok || response.status !== rangeResult.status) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error(\n        `imagekitStorage: ImageKit returned an unexpected file response (${response.status}).`,\n      )\n    }\n\n    const upstreamLength = response.headers.get('Content-Length')\n    const expectedLength = rangeResult.headers['Content-Length']\n    const upstreamRange = response.headers.get('Content-Range')\n    const expectedRange =\n      rangeResult.type === 'partial' ? rangeResult.headers['Content-Range'] : undefined\n\n    if (\n      (upstreamLength !== null && upstreamLength !== expectedLength) ||\n      (expectedRange && upstreamRange !== expectedRange)\n    ) {\n      void response.body?.cancel().catch(() => undefined)\n      throw new Error('imagekitStorage: ImageKit returned mismatched file content metadata.')\n    }\n\n    const headers = new Headers(rangeResult.headers)\n    headers.set('Content-Type', mimeType)\n    if (isXmlMimeType(mimeType)) {\n      headers.set('Content-Security-Policy', UPLOAD_CONTENT_SECURITY_POLICY)\n    }\n\n    return new Response(response.body, {\n      headers,\n      status: response.status,\n    })\n  }\n\n  return ({ collection, prefix = getCollectionFolder(rootFolder, collection.slug) }) => {\n    const isPrivate = privateSlugs.has(collection.slug)\n\n    // Sign a relative ImageKit path against the configured urlEndpoint. We always sign\n    // a computed path (never a stored absolute URL) because ImageKit's signature is\n    // derived from the path after stripping urlEndpoint, so the host must match.\n    const buildSignedURL = (src: string, tr?: null | string): string =>\n      client.helper.buildSrc({\n        expiresIn: signedUrlExpiresIn,\n        signed: true,\n        src,\n        transformation: tr ? [{ raw: tr }] : undefined,\n        urlEndpoint,\n      })\n\n    const buildThumbnailURL = (doc: UploadDocumentData): string =>\n      isDocumentPrivate(doc, isPrivate)\n        ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n        : getAdminThumbnailURL(doc)\n\n    return {\n      name: 'imagekit',\n      clientUploads,\n      fields: [\n        {\n          // Presentational wrapper: tucks the ImageKit details into a closed panel without\n          // changing the `imagekit.*` data paths.\n          type: 'collapsible',\n          admin: {\n            condition: (data) => hasStoredImageKitURL(data),\n            initCollapsed: true,\n          },\n          fields: [\n            {\n              name: 'imagekit',\n              type: 'group',\n              admin: {\n                disableListColumn: true,\n                disableListFilter: true,\n              },\n              fields: [\n                {\n                  name: 'fileId',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n                {\n                  name: 'url',\n                  type: 'text',\n                  admin: {\n                    readOnly: true,\n                  },\n                  label: 'URL',\n                },\n                {\n                  name: 'isPrivate',\n                  type: 'checkbox',\n                  admin: {\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description:\n                      \"Indicates whether this file was uploaded to ImageKit as private. Private files are delivered through signed URLs. Changes to this collection's private option in payload.config only affect future uploads.\",\n                    readOnly: true,\n                  },\n                  label: 'Private file',\n                },\n                {\n                  name: 'signedUrl',\n                  type: 'text',\n                  admin: {\n                    // Only relevant for private files; the plain `url` works directly for public ones.\n                    condition: (_data, siblingData) =>\n                      isDocumentPrivate({ imagekit: siblingData }, isPrivate),\n                    description: `Temporary signed URL for reaching this private file directly on ImageKit. Expires ${signedUrlExpiresIn} seconds after load and is regenerated on every read. Note: anyone with this URL can access the file until it expires — it is not gated by Payload access control.`,\n                    readOnly: true,\n                  },\n                  hooks: {\n                    // Computed server-side on read so it is always freshly signed and never persisted.\n                    afterRead: [\n                      ({ data, siblingData }) => {\n                        if (!isDocumentPrivate({ imagekit: siblingData }, isPrivate)) {\n                          return undefined\n                        }\n\n                        const filename = (data as { filename?: string } | undefined)?.filename\n\n                        if (!filename) {\n                          return undefined\n                        }\n\n                        const source = (data || {}) as { _objectKey?: string; prefix?: string }\n                        const documentPrefix = path.posix.join(\n                          source.prefix || prefix,\n                          source._objectKey || '',\n                        )\n                        const storageFilePath = buildStoragePathData({\n                          collectionPrefix: prefix,\n                          docPrefix: documentPrefix,\n                          filename,\n                        }).storageFilePath\n\n                        return buildSignedURL(`/${storageFilePath}`)\n                      },\n                    ],\n                  },\n                  label: 'Signed URL',\n                  virtual: true,\n                },\n                {\n                  name: 'thumbnailUrl',\n                  type: 'text',\n                  admin: {\n                    hidden: true,\n                  },\n                },\n              ],\n              interfaceName: 'imagekitFields',\n              label: false,\n            },\n          ],\n          label: 'Storage: ImageKit',\n        },\n      ],\n      generateURL: ({ filename, prefix: documentPrefix = '' }) =>\n        client.helper.buildSrc({\n          src: `/${buildStoragePathData({\n            collectionPrefix: prefix,\n            docPrefix: documentPrefix,\n            filename,\n          }).storageFilePath}`,\n          urlEndpoint,\n        }),\n      handleDelete: async ({ doc, storageFilePath }) => {\n        const storedFileId = (doc as ImageKitReference & typeof doc).imagekit?.fileId\n        const fileId =\n          storedFileId || (await findImageKitFileId(client, `/${storageFilePath.replace(/^\\/+/, '')}`))\n\n        if (!fileId) {\n          return\n        }\n\n        await client.files.delete(fileId)\n      },\n      handleUpload: async ({ clientUploadContext, data, file, storageFilePath }) => {\n        if (clientUploadContext) {\n          const uploaded = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n\n          return applyVerifiedClientUploadToData(data, uploaded, buildThumbnailURL, isPrivate)\n        }\n\n        // ImageKit's `toFile()` consumes async iterables before starting the request. A file-backed\n        // Blob keeps temporary-file uploads lazy so FormData can stream them from disk instead.\n        const uploadSource = file.tempFilePath\n          ? await openAsBlob(file.tempFilePath, { type: file.mimeType })\n          : file.buffer\n        const uploadFile = await toFile(uploadSource, file.filename, { type: file.mimeType })\n        const uploadFolder = path.posix.dirname(`/${storageFilePath.replace(/^\\/+/, '')}`)\n        const uploadFilename = path.posix.basename(storageFilePath)\n\n        const uploaded = await client.files.upload({\n          file: uploadFile,\n          fileName: uploadFilename,\n          folder: uploadFolder,\n          useUniqueFileName: false,\n          ...(isPrivate ? { isPrivateFile: true } : {}),\n        })\n\n        data.imagekit = {\n          fileId: uploaded.fileId,\n          isPrivate,\n          thumbnailUrl: uploaded.thumbnailUrl,\n          url: uploaded.url,\n        }\n\n        // Set the root-level thumbnailURL that Payload's admin interface expects.\n        // `buildThumbnailURL` needs the filename, which Payload may not have copied onto\n        // `data` yet at this point, so fall back to the uploaded file's name.\n        data.thumbnailURL = buildThumbnailURL({\n          ...data,\n          filename: (data as { filename?: string }).filename || uploadFilename,\n        })\n\n        return data\n      },\n      requiresClientUploadReceipt: true,\n      staticHandler: async (req, args) => {\n        const requestURL = new URL(req.url || 'http://localhost')\n        const tr = requestURL.searchParams.get('tr')\n        const hasClientUploadContext = 'clientUploadContext' in args.params\n\n        if (hasClientUploadContext) {\n          const clientUploadContext = args.params.clientUploadContext\n\n          if (!isImageKitReceiptContext(clientUploadContext)) {\n            throw new APIError('Invalid ImageKit client upload context.', 400)\n          }\n\n          const uploadedFile = await verifyClientUpload({\n            collectionSlug: collection.slug,\n            context: clientUploadContext,\n          })\n          const expectedFilePath = getClientUploadStorageFilePath({\n            collectionPrefix: prefix,\n            context: clientUploadContext,\n          })\n          const verifiedFileURL = isPrivate\n            ? buildSignedURL(`/${expectedFilePath}`, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: `/${expectedFilePath}`,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: uploadedFile.size,\n            fileURL: verifiedFileURL,\n            mimeType: uploadedFile.mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        const doc =\n          args.doc ||\n          (await findUploadDocumentByFilename({\n            collection: args.params.collection,\n            filename: args.params.filename,\n            prefix: args.params.prefix,\n            req,\n          }))\n\n        const storageFilePath = await getStorageFilePath({\n          collection,\n          collectionPrefix: prefix,\n          doc: doc || undefined,\n          filename: args.params.filename,\n          prefixQueryParam: args.params.prefix,\n          req,\n        })\n        const imageKitPath = `/${storageFilePath.replace(/^\\/+/, '')}`\n        const mimeType = (doc as { mimeType?: string } | null)?.mimeType\n\n        // XML-family uploads (including SVG) must pass through Payload so its CSP is\n        // present even when ImageKit uses a custom, same-origin delivery domain.\n        if (typeof mimeType === 'string' && isXmlMimeType(mimeType)) {\n          const filesize = (doc as { filesize?: number } | null)?.filesize\n\n          if (typeof filesize !== 'number' || !Number.isSafeInteger(filesize) || filesize < 0) {\n            throw new APIError('Stored ImageKit file metadata is incomplete.', 500)\n          }\n\n          const fileURL = isDocumentPrivate(doc, isPrivate)\n            ? buildSignedURL(imageKitPath, ORIGINAL_FILE_TRANSFORMATION)\n            : client.helper.buildSrc({\n                src: imageKitPath,\n                transformation: [{ raw: ORIGINAL_FILE_TRANSFORMATION }],\n                urlEndpoint,\n              })\n\n          return fetchUploadedFile({\n            fileSize: filesize,\n            fileURL,\n            mimeType,\n            range: req.headers.get('Range'),\n          })\n        }\n\n        // Sign based on the document's stored status, not the collection's current\n        // setting, so files keep working if the collection's privacy is changed later.\n        if (isDocumentPrivate(doc, isPrivate)) {\n          let signSrc = imageKitPath\n\n          // A `tr` request for a video/PDF is a thumbnail request (the plain transform\n          // can't render a preview); serve ImageKit's generated thumbnail instead.\n          if (tr && isVideoMimeType(mimeType)) {\n            signSrc = getVideoPosterSrc(signSrc)\n          } else if (tr && isPdfMimeType(mimeType)) {\n            signSrc = getImageKitThumbnailSrc(signSrc)\n          }\n\n          return Response.redirect(buildSignedURL(signSrc, tr), 302)\n        }\n\n        const imageKitURL = client.helper.buildSrc({\n          src:\n            getStoredImageKitURL(doc) ||\n            imageKitPath,\n          transformation: tr ? [{ raw: tr }] : undefined,\n          urlEndpoint,\n        })\n\n        return Response.redirect(imageKitURL, 302)\n      },\n    }\n  }\n}\n\nconst toCloudStorageCollections = (\n  collections: ImageKitCollectionMap,\n  adapter: Adapter,\n  privateSlugs: Set<string>,\n  rootFolder: string,\n  disablePayloadAccessControl?: true,\n): Partial<Record<CollectionSlug, CollectionOptions>> => {\n  const mappedCollections: Partial<Record<CollectionSlug, CollectionOptions>> = {}\n\n  for (const collectionSlug of Object.keys(collections)) {\n    mappedCollections[collectionSlug] = {\n      adapter,\n      disableLocalStorage: true,\n      // Private files require Payload access control so URLs can be signed at serve time.\n      disablePayloadAccessControl: privateSlugs.has(collectionSlug)\n        ? undefined\n        : disablePayloadAccessControl,\n      prefix: getCollectionFolder(rootFolder, collectionSlug),\n    }\n  }\n\n  return mappedCollections\n}\n\nexport const imagekitStorage =\n  (pluginOptions: PayloadStorageImageKitConfig) =>\n  (config: Config): Config => {\n    const {\n      alwaysInsertFields,\n      clientUploads,\n      collections,\n      disablePayloadAccessControl,\n      enabled,\n      focalPoint,\n      folder,\n      privateKey,\n      publicKey,\n      signedUrlExpiresIn: signedUrlExpiresInOption,\n      urlEndpoint,\n    } = pluginOptions\n\n    if (!privateKey?.trim()) {\n      throw new Error('imagekitStorage: `privateKey` is required.')\n    }\n\n    if (!publicKey?.trim()) {\n      throw new Error('imagekitStorage: `publicKey` is required.')\n    }\n\n    if (!urlEndpoint?.trim()) {\n      throw new Error('imagekitStorage: `urlEndpoint` is required.')\n    }\n\n    if (!collections || Object.keys(collections).length === 0) {\n      throw new Error('imagekitStorage: `collections` must include at least one upload collection.')\n    }\n\n    const privateSlugs = new Set(\n      Object.entries(collections)\n        .filter(([, value]) => isPrivateCollectionConfig(value))\n        .map(([slug]) => slug),\n    )\n    const configuredSlugs = new Set(Object.keys(collections))\n\n    if (disablePayloadAccessControl && privateSlugs.size > 0) {\n      throw new Error(\n        'imagekitStorage: `disablePayloadAccessControl` cannot be used with private collections. Private files require Payload access control to remain enabled so URLs can be signed at serve time.',\n      )\n    }\n\n    if (disablePayloadAccessControl) {\n      const xmlCollectionSlugs = (config.collections || [])\n        .filter(\n          (collection) =>\n            configuredSlugs.has(collection.slug) && collectionCanStoreXml(collection),\n        )\n        .map((collection) => collection.slug)\n\n      if (xmlCollectionSlugs.length > 0) {\n        throw new Error(\n          `imagekitStorage: \\`disablePayloadAccessControl\\` cannot be used with collections that can store XML-family files (${xmlCollectionSlugs.join(', ')}). XML-family files require Payload's file route so its Content Security Policy is applied. Configure a MIME allow list that excludes SVG/XML, or keep Payload access control enabled.`,\n        )\n      }\n    }\n\n    const signedUrlExpiresIn =\n      typeof signedUrlExpiresInOption === 'number' && signedUrlExpiresInOption > 0\n        ? signedUrlExpiresInOption\n        : DEFAULT_SIGNED_URL_EXPIRES_IN\n    const apiRoute = config.routes?.api ?? '/api'\n\n    const rootFolder = normalizeFolder(folder)\n\n    const imageKitClient = new ImageKit({ privateKey })\n    const collectionSecurity = Object.fromEntries(\n      (config.collections || [])\n        .filter((collection) => configuredSlugs.has(collection.slug))\n        .map((collection) => [\n          collection.slug,\n          {\n            collection,\n            isPrivate: privateSlugs.has(collection.slug),\n            prefix: getCollectionFolder(rootFolder, collection.slug),\n          },\n        ]),\n    )\n    const verifyClientUpload = createImageKitClientUploadVerifier({\n      client: imageKitClient,\n      collections: collectionSecurity,\n    })\n    const adapter = imagekitAdapter({\n      apiRoute,\n      client: imageKitClient,\n      clientUploads,\n      privateSlugs,\n      rootFolder,\n      signedUrlExpiresIn,\n      urlEndpoint,\n      verifyClientUpload,\n    })\n\n    const configWithCropDisabled: Config = {\n      ...config,\n      collections: (config.collections || []).map((collection) => {\n        if (!configuredSlugs.has(collection.slug)) {\n          return collection\n        }\n\n        const isCollectionPrivate = privateSlugs.has(collection.slug)\n        const buildThumbnailURL = (doc: unknown): string =>\n          isDocumentPrivate(doc, isCollectionPrivate)\n            ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n            : getAdminThumbnailURL(doc)\n\n        const collectionOptions = collections[collection.slug]\n        const collectionFocalPoint =\n          collectionOptions !== true &&\n          typeof collectionOptions === 'object' &&\n          typeof collectionOptions.focalPoint === 'boolean'\n            ? collectionOptions.focalPoint\n            : undefined\n\n        // Surface a \"this is a private collection\" note in the list and edit views.\n        // Preserve an existing string description by appending; leave custom\n        // component descriptions untouched.\n        const existingDescription = collection.admin?.description\n        const baseAdmin = isCollectionPrivate\n          ? {\n              ...(collection.admin || {}),\n              description:\n                typeof existingDescription === 'string' && existingDescription.trim().length > 0\n                  ? `${existingDescription} ${PRIVATE_COLLECTION_DESCRIPTION}`\n                  : (existingDescription ?? PRIVATE_COLLECTION_DESCRIPTION),\n            }\n          : collection.admin\n\n        return {\n          ...collection,\n          admin: baseAdmin,\n          hooks: {\n            ...(collection.hooks || {}),\n            beforeChange: [\n              ...(collection.hooks?.beforeChange || []),\n              async ({ data, req }) => {\n                if (!isRecord(data) || !req.file?.clientUploadContext) {\n                  return data\n                }\n\n                const context = req.file.clientUploadContext\n                const requestMimeType = req.file.mimetype.split(';', 1)[0]?.trim().toLowerCase()\n                if (\n                  !isImageKitReceiptContext(context) ||\n                  context.filename !== data.filename ||\n                  context.filename !== req.file.name ||\n                  // Payload can clear req.file.size when preparing an in-memory image.\n                  // generateFileData preserves the original size on the document.\n                  context.expectedSize !== data.filesize\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n\n                const uploaded = await verifyClientUpload({\n                  collectionSlug: collection.slug,\n                  context,\n                })\n                // Payload keeps the browser's MIME unless it fetched the file content, in which\n                // case it uses the verified ImageKit-detected type the static handler served.\n                if (\n                  requestMimeType !== context.expectedMimeType &&\n                  requestMimeType !== uploaded.mimeType\n                ) {\n                  throw new APIError('ImageKit client upload reference does not match this request.', 400)\n                }\n                // A provider file can only be claimed once, including through legacy receipts.\n                // The unique file ID index also rejects concurrent claims.\n                const existing = await req.payload.db.findOne({\n                  collection: collection.slug,\n                  req,\n                  where: {\n                    'imagekit.fileId': {\n                      equals: uploaded.fileId,\n                    },\n                  },\n                })\n                if (existing) {\n                  throw new APIError('This ImageKit client upload receipt has already been used.', 400)\n                }\n\n                data.filename = uploaded.name\n                data.filesize = uploaded.size\n                data.mimeType = uploaded.mimeType\n\n                return applyVerifiedClientUploadToData(\n                  data,\n                  uploaded,\n                  buildThumbnailURL,\n                  isCollectionPrivate,\n                )\n              },\n            ],\n            beforeOperation: [\n              ...(collection.hooks?.beforeOperation || []),\n              ({ args, operation, req }) => {\n                if (\n                  (operation !== 'create' && operation !== 'update') ||\n                  req.context?.skipCloudStorage ||\n                  !req.file ||\n                  req.file.clientUploadContext ||\n                  !('data' in args) ||\n                  !isRecord(args.data) ||\n                  typeof args.data.prefix !== 'string'\n                ) {\n                  return args\n                }\n\n                // Payload checks filename uniqueness before cloud storage's beforeChange\n                // normalizes the prefix. Use the persisted form during that lookup too.\n                args.data.prefix = buildUploadStoragePathData({\n                  collectionPrefix: getCollectionFolder(rootFolder, collection.slug),\n                  docPrefix: args.data.prefix,\n                  filename: req.file.name,\n                }).sanitizedDocPrefix\n                return args\n              },\n            ],\n          },\n          upload: {\n            // Focal points are opt-in for configured collections. Plugin-level\n            // and collection-level options can override this default; a\n            // collection's own `upload.focalPoint` still wins because it is\n            // spread in afterwards.\n            focalPoint: false,\n            ...(typeof focalPoint === 'boolean' ? { focalPoint } : {}),\n            ...(typeof collectionFocalPoint === 'boolean'\n              ? { focalPoint: collectionFocalPoint }\n              : {}),\n            ...(typeof collection.upload === 'object' ? collection.upload : {}),\n            adminThumbnail: ({ doc }) => buildThumbnailURL(doc),\n            crop: false,\n          },\n        }\n      }),\n    }\n\n    const uploadCollections = Object.fromEntries(\n      Object.keys(collections).map((collectionSlug) => [\n        collectionSlug,\n        {\n          isPrivate: privateSlugs.has(collectionSlug),\n          prefix: getCollectionFolder(rootFolder, collectionSlug),\n        },\n      ]),\n    ) as Partial<\n      Record<UploadCollectionSlug, { isPrivate: boolean; prefix: string }>\n    >\n\n    initClientUploads({\n      clientHandler: '@humaan/payload-storage-imagekit/client#ImageKitUploadHandler',\n      collections: uploadCollections,\n      config: configWithCropDisabled,\n      enabled: enabled !== false && Boolean(clientUploads),\n      serverHandler: createImageKitUploadAuthHandler({\n        access: typeof clientUploads === 'object' ? clientUploads.access : undefined,\n        collections: uploadCollections,\n        privateKey,\n        publicKey,\n        verifyClientUpload,\n      }),\n      serverHandlerPath: imageKitUploadAuthPath,\n    })\n\n    const output = cloudStoragePlugin({\n      alwaysInsertFields,\n      collections: toCloudStorageCollections(\n        collections,\n        adapter,\n        privateSlugs,\n        rootFolder,\n        disablePayloadAccessControl,\n      ),\n      enabled,\n    })(configWithCropDisabled)\n\n    // Make the provider identity unique at persistence time to reject concurrent receipt replays.\n    // Keep the legacy object key index for existing uploads.\n    output.collections = (output.collections || []).map((collection) => {\n      if (!configuredSlugs.has(collection.slug)) {\n        return collection\n      }\n\n      const originalPrefixField = (config.collections || [])\n        .find((original) => original.slug === collection.slug)\n        ?.fields.find((field) => 'name' in field && field.name === 'prefix')\n\n      const withUniqueIdentity = (field: Field): Field => {\n        if (\n          field.type === 'text' &&\n          'name' in field &&\n          field.name === 'prefix' &&\n          (!originalPrefixField ||\n            !('defaultValue' in originalPrefixField) ||\n            originalPrefixField.defaultValue == null)\n        ) {\n          // Cloud storage's collection-prefix default is applied on reads of old\n          // documents that have no stored prefix. Its URL hook then appends that\n          // prefix, but Payload's file access check cannot find it in the DB.\n          // Upload hooks still persist the collection prefix for new files.\n          return {\n            ...field,\n            defaultValue: ({ req }) =>\n              req.file && typeof field.defaultValue === 'string' ? field.defaultValue : '',\n          }\n        }\n        if ('name' in field && field.name === '_objectKey') {\n          return { ...field, unique: true } as Field\n        }\n        if (field.type === 'group' && 'name' in field && field.name === 'imagekit') {\n          return {\n            ...field,\n            fields: field.fields.map((metadataField) =>\n              'name' in metadataField && metadataField.name === 'fileId'\n                ? { ...metadataField, unique: true }\n                : metadataField,\n            ),\n          }\n        }\n        // The imagekit group sits inside the adapter's presentational \"Storage: ImageKit\" panel.\n        if (field.type === 'collapsible') {\n          return { ...field, fields: field.fields.map(withUniqueIdentity) }\n        }\n        return field\n      }\n\n      return {\n        ...collection,\n        fields: collection.fields.map(withUniqueIdentity),\n      }\n    })\n\n    return output\n  }\n\nexport { migrateFolder } from './migrate.js'\nexport type { MigrateFolderOptions, MigrationJobResult, MigrationLocation } from './migrate.js'\n\n// Backward-compatible alias\nexport const payloadStorageImagekit = imagekitStorage\nexport const payloadStorageImageKit = imagekitStorage\n\nexport type PayloadStorageImagekitConfig = PayloadStorageImageKitConfig\n"],"names":["ImageKit","toFile","cloudStoragePlugin","buildStoragePathData","buildUploadStoragePathData","getStorageFilePath","initClientUploads","openAsBlob","path","APIError","getRangeRequestInfo","isXmlMimeType","UPLOAD_CONTENT_SECURITY_POLICY","validateMimeType","imageKitUploadAuthPath","isImageKitReceiptContext","createImageKitClientUploadVerifier","getClientUploadStorageFilePath","createImageKitUploadAuthHandler","getAdminThumbnailURL","getPrivateAdminThumbnailURL","isPdfMimeType","isVideoMimeType","getImageKitThumbnailSrc","getVideoPosterSrc","DEFAULT_SIGNED_URL_EXPIRES_IN","ORIGINAL_FILE_TRANSFORMATION","PRIVATE_COLLECTION_DESCRIPTION","isPrivateCollectionConfig","value","private","XML_FAMILY_MIME_TYPES","collectionCanStoreXml","collection","upload","Boolean","allowRestrictedFileTypes","allowedMimeTypes","mimeTypes","length","some","mimeType","includes","isDocumentPrivate","doc","collectionIsPrivate","stored","imagekit","isPrivate","normalizeFolder","folder","normalized","trim","replace","Error","getCollectionFolder","rootFolder","collectionSlug","posix","join","findImageKitFileId","filePath","parentPath","dirname","name","basename","limit","skip","assets","list","type","found","find","asset","fileId","undefined","isRecord","getStoredImageKitURL","storedURL","url","hasStoredImageKitURL","findUploadDocumentByFilename","filename","prefix","req","constraints","equals","push","payload","db","findOne","where","and","applyVerifiedClientUploadToData","data","uploaded","buildThumbnailURL","thumbnailUrl","thumbnailURL","imagekitAdapter","apiRoute","client","clientUploads","privateSlugs","signedUrlExpiresIn","urlEndpoint","verifyClientUpload","fetchUploadedFile","fileSize","fileURL","range","rangeResult","rangeHeader","Response","headers","Headers","status","normalizedRange","rangeStart","rangeEnd","response","fetch","cache","Range","signal","AbortController","ok","body","cancel","catch","upstreamLength","get","expectedLength","upstreamRange","expectedRange","set","slug","has","buildSignedURL","src","tr","helper","buildSrc","expiresIn","signed","transformation","raw","fields","admin","condition","initCollapsed","disableListColumn","disableListFilter","hidden","readOnly","label","_data","siblingData","description","hooks","afterRead","source","documentPrefix","_objectKey","storageFilePath","collectionPrefix","docPrefix","virtual","interfaceName","generateURL","handleDelete","storedFileId","files","delete","handleUpload","clientUploadContext","file","context","uploadSource","tempFilePath","buffer","uploadFile","uploadFolder","uploadFilename","fileName","useUniqueFileName","isPrivateFile","requiresClientUploadReceipt","staticHandler","args","requestURL","URL","searchParams","hasClientUploadContext","params","uploadedFile","expectedFilePath","verifiedFileURL","size","prefixQueryParam","imageKitPath","filesize","Number","isSafeInteger","signSrc","redirect","imageKitURL","toCloudStorageCollections","collections","adapter","disablePayloadAccessControl","mappedCollections","Object","keys","disableLocalStorage","imagekitStorage","pluginOptions","config","alwaysInsertFields","enabled","focalPoint","privateKey","publicKey","signedUrlExpiresInOption","Set","entries","filter","map","configuredSlugs","xmlCollectionSlugs","routes","api","imageKitClient","collectionSecurity","fromEntries","configWithCropDisabled","isCollectionPrivate","collectionOptions","collectionFocalPoint","existingDescription","baseAdmin","beforeChange","requestMimeType","mimetype","split","toLowerCase","expectedSize","expectedMimeType","existing","beforeOperation","operation","skipCloudStorage","sanitizedDocPrefix","adminThumbnail","crop","uploadCollections","clientHandler","serverHandler","access","serverHandlerPath","output","originalPrefixField","original","field","withUniqueIdentity","defaultValue","unique","metadataField","migrateFolder","payloadStorageImagekit","payloadStorageImageKit"],"mappings":"AAgBA,OAAOA,YAAYC,MAAM,QAAQ,mBAAkB;AACnD,SAASC,kBAAkB,QAAQ,mCAAkC;AACrE,SACEC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,EAClBC,iBAAiB,QACZ,6CAA4C;AACnD,SAASC,UAAU,QAAQ,UAAS;AACpC,OAAOC,UAAU,YAAW;AAC5B,SAASC,QAAQ,QAAQ,UAAS;AAClC,SACEC,mBAAmB,EACnBC,aAAa,EACbC,8BAA8B,QACzB,mBAAkB;AACzB,SAASC,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,sBAAsB,EAAEC,wBAAwB,QAAQ,qBAAoB;AACrF,SACEC,kCAAkC,EAClCC,8BAA8B,QACzB,gCAA+B;AACtC,SAASC,+BAA+B,QAAQ,iDAAgD;AAChG,SACEC,oBAAoB,EACpBC,2BAA2B,EAC3BC,aAAa,EACbC,eAAe,QACV,4BAA2B;AAClC,SAASC,uBAAuB,EAAEC,iBAAiB,QAAQ,uBAAsB;AAiBjF,MAAMC,gCAAgC;AACtC;;;;;;;CAOC,GACD,MAAMC,+BAA+B;AAErC,MAAMC,iCACJ;AAEF,MAAMC,4BAA4B,CAACC,QACjCA,UAAU,QAAQ,OAAOA,UAAU,YAAYA,OAAOC,YAAY;AAEpE,MAAMC,wBAAwB;IAAC;IAAmB;IAAiB;CAAW;AAE9E,MAAMC,wBAAwB,CAACC;IAC7B,MAAMC,SAASD,WAAWC,MAAM;IAEhC,IAAI,CAACA,UAAUA,WAAW,MAAM;QAC9B,OAAOC,QAAQD;IACjB;IAEA,iFAAiF;IACjF,IAAIA,OAAOE,wBAAwB,EAAE;QACnC,OAAO;IACT;IAEA,MAAMC,mBAAmBH,OAAOI,SAAS;IAEzC,OACE,CAACD,kBAAkBE,UACnBF,iBAAiBG,IAAI,CAAC,CAACC,WAAaA,SAASC,QAAQ,CAAC,QAAQ/B,cAAc8B,cAC5EV,sBAAsBS,IAAI,CAAC,CAACC,WAAa5B,iBAAiB4B,UAAUJ;AAExE;AAEA;;;;;CAKC,GACD,MAAMM,oBAAoB,CAACC,KAAcC;IACvC,MAAMC,SAAUF,KAA4DG,UAAUC;IAEtF,OAAO,OAAOF,WAAW,YAAYA,SAASD;AAChD;AAwCA,MAAMI,kBAAkB,CAACC;IACvB,MAAMC,aAAaD,OAAOE,IAAI,GAAGC,OAAO,CAAC,cAAc;IAEvD,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM;IAClB;IAEA,OAAO,CAAC,CAAC,EAAEH,YAAY;AACzB;AAEA,MAAMI,sBAAsB,CAACC,YAAoBC,iBAC/CjD,KAAKkD,KAAK,CAACC,IAAI,CAACH,YAAYC;AAE9B,MAAMG,qBAAqB,OACzBb,UACAc;IAEA,MAAMC,aAAatD,KAAKkD,KAAK,CAACK,OAAO,CAACF;IACtC,MAAMG,OAAOxD,KAAKkD,KAAK,CAACO,QAAQ,CAACJ;IAEjC,MAAMK,QAAQ;IAEd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMrB,SAASqB,MAAM,CAACC,IAAI,CAAC;YACxCC,MAAM;YACNJ;YACA1D,MAAMsD,eAAe,MAAM,MAAM,GAAGA,WAAW,CAAC,CAAC;YACjDK;QACF;QAEA,MAAMI,QAAQH,OAAOI,IAAI,CACvB,CAACC,QAAU,YAAYA,SAASA,MAAMZ,QAAQ,KAAKA,YAAYY,MAAMT,IAAI,KAAKA;QAGhF,IAAIO,SAAS,YAAYA,OAAO;YAC9B,OAAOA,MAAMG,MAAM;QACrB;QAEA,IAAIN,OAAO7B,MAAM,GAAG2B,OAAO;YACzB;QACF;IACF;IAEA,OAAOS;AACT;AAEA,MAAMC,WAAW,CAAC/C,QAChB,CAAC,CAACA,SAAS,OAAOA,UAAU;AAE9B,MAAMgD,uBAAuB,CAACjC;IAC5B,MAAMkC,YAAalC,KAAuCG,UAAUgC;IAEpE,OAAO,OAAOD,cAAc,YAAYA,UAAU1B,IAAI,GAAGb,MAAM,GAAG,IAAIuC,YAAYH;AACpF;AAEA,MAAMK,uBAAuB,CAACpC,MAA0B,CAAC,CAACiC,qBAAqBjC;AAE/E,MAAMqC,+BAA+B,OAAO,EAC1ChD,UAAU,EACViD,QAAQ,EACRC,MAAM,EACNC,GAAG,EAMJ;IACC,MAAMC,cAAuB;QAC3B;YACEH,UAAU;gBACRI,QAAQJ;YACV;QACF;KACD;IAED,IAAI,OAAOC,WAAW,UAAU;QAC9BE,YAAYE,IAAI,CAAC;YACfJ,QAAQ;gBACNG,QAAQH;YACV;QACF;IACF;IAEA,OAAOC,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;QAC5BzD;QACAmD;QACAO,OAAO;YACLC,KAAKP;QACP;IACF;AACF;AAEA,MAAMQ,kCAAkC,CACtCC,MACAC,UACAC,oBAAyC7E,oBAAoB,EAC7D6B;IAEA8C,KAAK/C,QAAQ,GAAG;QACd2B,QAAQqB,SAASrB,MAAM;QACvB1B;QACAiD,cAAcF,SAASE,YAAY;QACnClB,KAAKgB,SAAShB,GAAG;IACnB;IAEA,sFAAsF;IACtFe,KAAKI,YAAY,GAAGF,kBAAkBF;IAEtC,OAAOA;AACT;AAEA,MAAMK,kBAAkB,CAAC,EACvBC,QAAQ,EACRC,MAAM,EACNC,aAAa,EACbC,YAAY,EACZ/C,UAAU,EACVgD,kBAAkB,EAClBC,WAAW,EACXC,kBAAkB,EAUnB;IACC,MAAMC,oBAAoB,OAAO,EAC/BC,QAAQ,EACRC,OAAO,EACPpE,QAAQ,EACRqE,KAAK,EAMN;QACC,MAAMC,cAAcrG,oBAAoB;YAAEkG;YAAUI,aAAaF,SAAS;QAAK;QAE/E,IAAIC,YAAYzC,IAAI,KAAK,WAAW;YAClC,OAAO,IAAI2C,SAAS,MAAM;gBACxBC,SAAS,IAAIC,QAAQJ,YAAYG,OAAO;gBACxCE,QAAQL,YAAYK,MAAM;YAC5B;QACF;QAEA,MAAMC,kBACJN,YAAYzC,IAAI,KAAK,YACjB,CAAC,MAAM,EAAEyC,YAAYO,UAAU,CAAC,CAAC,EAAEP,YAAYQ,QAAQ,EAAE,GACzD5C;QACN,gFAAgF;QAChF,6EAA6E;QAC7E,6EAA6E;QAC7E,6EAA6E;QAC7E,MAAM6C,WAAW,MAAMC,MAAMZ,SAAS;YACpCa,OAAO;YACP,GAAIL,kBAAkB;gBAAEH,SAAS;oBAAES,OAAON;gBAAgB;YAAE,IAAI,CAAC,CAAC;YAClEO,QAAQ,IAAIC,kBAAkBD,MAAM;QACtC;QAEA,IAAI,CAACJ,SAASM,EAAE,IAAIN,SAASJ,MAAM,KAAKL,YAAYK,MAAM,EAAE;YAC1D,KAAKI,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMtD;YACzC,MAAM,IAAIrB,MACR,CAAC,gEAAgE,EAAEkE,SAASJ,MAAM,CAAC,EAAE,CAAC;QAE1F;QAEA,MAAMc,iBAAiBV,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC5C,MAAMC,iBAAiBrB,YAAYG,OAAO,CAAC,iBAAiB;QAC5D,MAAMmB,gBAAgBb,SAASN,OAAO,CAACiB,GAAG,CAAC;QAC3C,MAAMG,gBACJvB,YAAYzC,IAAI,KAAK,YAAYyC,YAAYG,OAAO,CAAC,gBAAgB,GAAGvC;QAE1E,IACE,AAACuD,mBAAmB,QAAQA,mBAAmBE,kBAC9CE,iBAAiBD,kBAAkBC,eACpC;YACA,KAAKd,SAASO,IAAI,EAAEC,SAASC,MAAM,IAAMtD;YACzC,MAAM,IAAIrB,MAAM;QAClB;QAEA,MAAM4D,UAAU,IAAIC,QAAQJ,YAAYG,OAAO;QAC/CA,QAAQqB,GAAG,CAAC,gBAAgB9F;QAC5B,IAAI9B,cAAc8B,WAAW;YAC3ByE,QAAQqB,GAAG,CAAC,2BAA2B3H;QACzC;QAEA,OAAO,IAAIqG,SAASO,SAASO,IAAI,EAAE;YACjCb;YACAE,QAAQI,SAASJ,MAAM;QACzB;IACF;IAEA,OAAO,CAAC,EAAEnF,UAAU,EAAEkD,SAAS5B,oBAAoBC,YAAYvB,WAAWuG,IAAI,CAAC,EAAE;QAC/E,MAAMxF,YAAYuD,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;QAElD,mFAAmF;QACnF,gFAAgF;QAChF,6EAA6E;QAC7E,MAAME,iBAAiB,CAACC,KAAaC,KACnCvC,OAAOwC,MAAM,CAACC,QAAQ,CAAC;gBACrBC,WAAWvC;gBACXwC,QAAQ;gBACRL;gBACAM,gBAAgBL,KAAK;oBAAC;wBAAEM,KAAKN;oBAAG;iBAAE,GAAGjE;gBACrC8B;YACF;QAEF,MAAMT,oBAAoB,CAACpD,MACzBD,kBAAkBC,KAAKI,aACnB5B,4BAA4BwB,KAAKX,WAAWuG,IAAI,EAAEpC,YAClDjF,qBAAqByB;QAE3B,OAAO;YACLoB,MAAM;YACNsC;YACA6C,QAAQ;gBACN;oBACE,iFAAiF;oBACjF,wCAAwC;oBACxC7E,MAAM;oBACN8E,OAAO;wBACLC,WAAW,CAACvD,OAASd,qBAAqBc;wBAC1CwD,eAAe;oBACjB;oBACAH,QAAQ;wBACN;4BACEnF,MAAM;4BACNM,MAAM;4BACN8E,OAAO;gCACLG,mBAAmB;gCACnBC,mBAAmB;4BACrB;4BACAL,QAAQ;gCACN;oCACEnF,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLK,QAAQ;oCACV;gCACF;gCACA;oCACEzF,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLM,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE3F,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLC,WAAW,CAACO,OAAOC,cACjBlH,kBAAkB;gDAAEI,UAAU8G;4CAAY,GAAG7G;wCAC/C8G,aACE;wCACFJ,UAAU;oCACZ;oCACAC,OAAO;gCACT;gCACA;oCACE3F,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACL,mFAAmF;wCACnFC,WAAW,CAACO,OAAOC,cACjBlH,kBAAkB;gDAAEI,UAAU8G;4CAAY,GAAG7G;wCAC/C8G,aAAa,CAAC,kFAAkF,EAAEtD,mBAAmB,kKAAkK,CAAC;wCACxRkD,UAAU;oCACZ;oCACAK,OAAO;wCACL,mFAAmF;wCACnFC,WAAW;4CACT,CAAC,EAAElE,IAAI,EAAE+D,WAAW,EAAE;gDACpB,IAAI,CAAClH,kBAAkB;oDAAEI,UAAU8G;gDAAY,GAAG7G,YAAY;oDAC5D,OAAO2B;gDACT;gDAEA,MAAMO,WAAYY,MAA4CZ;gDAE9D,IAAI,CAACA,UAAU;oDACb,OAAOP;gDACT;gDAEA,MAAMsF,SAAUnE,QAAQ,CAAC;gDACzB,MAAMoE,iBAAiB1J,KAAKkD,KAAK,CAACC,IAAI,CACpCsG,OAAO9E,MAAM,IAAIA,QACjB8E,OAAOE,UAAU,IAAI;gDAEvB,MAAMC,kBAAkBjK,qBAAqB;oDAC3CkK,kBAAkBlF;oDAClBmF,WAAWJ;oDACXhF;gDACF,GAAGkF,eAAe;gDAElB,OAAO1B,eAAe,CAAC,CAAC,EAAE0B,iBAAiB;4CAC7C;yCACD;oCACH;oCACAT,OAAO;oCACPY,SAAS;gCACX;gCACA;oCACEvG,MAAM;oCACNM,MAAM;oCACN8E,OAAO;wCACLK,QAAQ;oCACV;gCACF;6BACD;4BACDe,eAAe;4BACfb,OAAO;wBACT;qBACD;oBACDA,OAAO;gBACT;aACD;YACDc,aAAa,CAAC,EAAEvF,QAAQ,EAAEC,QAAQ+E,iBAAiB,EAAE,EAAE,GACrD7D,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACrBH,KAAK,CAAC,CAAC,EAAExI,qBAAqB;wBAC5BkK,kBAAkBlF;wBAClBmF,WAAWJ;wBACXhF;oBACF,GAAGkF,eAAe,EAAE;oBACpB3D;gBACF;YACFiE,cAAc,OAAO,EAAE9H,GAAG,EAAEwH,eAAe,EAAE;gBAC3C,MAAMO,eAAe,AAAC/H,IAAuCG,QAAQ,EAAE2B;gBACvE,MAAMA,SACJiG,gBAAiB,MAAM/G,mBAAmByC,QAAQ,CAAC,CAAC,EAAE+D,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBAE7F,IAAI,CAACqB,QAAQ;oBACX;gBACF;gBAEA,MAAM2B,OAAOuE,KAAK,CAACC,MAAM,CAACnG;YAC5B;YACAoG,cAAc,OAAO,EAAEC,mBAAmB,EAAEjF,IAAI,EAAEkF,IAAI,EAAEZ,eAAe,EAAE;gBACvE,IAAIW,qBAAqB;oBACvB,MAAMhF,WAAW,MAAMW,mBAAmB;wBACxCjD,gBAAgBxB,WAAWuG,IAAI;wBAC/ByC,SAASF;oBACX;oBAEA,OAAOlF,gCAAgCC,MAAMC,UAAUC,mBAAmBhD;gBAC5E;gBAEA,4FAA4F;gBAC5F,wFAAwF;gBACxF,MAAMkI,eAAeF,KAAKG,YAAY,GAClC,MAAM5K,WAAWyK,KAAKG,YAAY,EAAE;oBAAE7G,MAAM0G,KAAKvI,QAAQ;gBAAC,KAC1DuI,KAAKI,MAAM;gBACf,MAAMC,aAAa,MAAMpL,OAAOiL,cAAcF,KAAK9F,QAAQ,EAAE;oBAAEZ,MAAM0G,KAAKvI,QAAQ;gBAAC;gBACnF,MAAM6I,eAAe9K,KAAKkD,KAAK,CAACK,OAAO,CAAC,CAAC,CAAC,EAAEqG,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBACjF,MAAMkI,iBAAiB/K,KAAKkD,KAAK,CAACO,QAAQ,CAACmG;gBAE3C,MAAMrE,WAAW,MAAMM,OAAOuE,KAAK,CAAC1I,MAAM,CAAC;oBACzC8I,MAAMK;oBACNG,UAAUD;oBACVrI,QAAQoI;oBACRG,mBAAmB;oBACnB,GAAIzI,YAAY;wBAAE0I,eAAe;oBAAK,IAAI,CAAC,CAAC;gBAC9C;gBAEA5F,KAAK/C,QAAQ,GAAG;oBACd2B,QAAQqB,SAASrB,MAAM;oBACvB1B;oBACAiD,cAAcF,SAASE,YAAY;oBACnClB,KAAKgB,SAAShB,GAAG;gBACnB;gBAEA,0EAA0E;gBAC1E,iFAAiF;gBACjF,sEAAsE;gBACtEe,KAAKI,YAAY,GAAGF,kBAAkB;oBACpC,GAAGF,IAAI;oBACPZ,UAAU,AAACY,KAA+BZ,QAAQ,IAAIqG;gBACxD;gBAEA,OAAOzF;YACT;YACA6F,6BAA6B;YAC7BC,eAAe,OAAOxG,KAAKyG;gBACzB,MAAMC,aAAa,IAAIC,IAAI3G,IAAIL,GAAG,IAAI;gBACtC,MAAM6D,KAAKkD,WAAWE,YAAY,CAAC7D,GAAG,CAAC;gBACvC,MAAM8D,yBAAyB,yBAAyBJ,KAAKK,MAAM;gBAEnE,IAAID,wBAAwB;oBAC1B,MAAMlB,sBAAsBc,KAAKK,MAAM,CAACnB,mBAAmB;oBAE3D,IAAI,CAAChK,yBAAyBgK,sBAAsB;wBAClD,MAAM,IAAItK,SAAS,2CAA2C;oBAChE;oBAEA,MAAM0L,eAAe,MAAMzF,mBAAmB;wBAC5CjD,gBAAgBxB,WAAWuG,IAAI;wBAC/ByC,SAASF;oBACX;oBACA,MAAMqB,mBAAmBnL,+BAA+B;wBACtDoJ,kBAAkBlF;wBAClB8F,SAASF;oBACX;oBACA,MAAMsB,kBAAkBrJ,YACpB0F,eAAe,CAAC,CAAC,EAAE0D,kBAAkB,EAAE1K,gCACvC2E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK,CAAC,CAAC,EAAEyD,kBAAkB;wBAC3BnD,gBAAgB;4BAAC;gCAAEC,KAAKxH;4BAA6B;yBAAE;wBACvD+E;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAUuF,aAAaG,IAAI;wBAC3BzF,SAASwF;wBACT5J,UAAU0J,aAAa1J,QAAQ;wBAC/BqE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,MAAMvF,MACJiJ,KAAKjJ,GAAG,IACP,MAAMqC,6BAA6B;oBAClChD,YAAY4J,KAAKK,MAAM,CAACjK,UAAU;oBAClCiD,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BC,QAAQ0G,KAAKK,MAAM,CAAC/G,MAAM;oBAC1BC;gBACF;gBAEF,MAAMgF,kBAAkB,MAAM/J,mBAAmB;oBAC/C4B;oBACAoI,kBAAkBlF;oBAClBvC,KAAKA,OAAO+B;oBACZO,UAAU2G,KAAKK,MAAM,CAAChH,QAAQ;oBAC9BqH,kBAAkBV,KAAKK,MAAM,CAAC/G,MAAM;oBACpCC;gBACF;gBACA,MAAMoH,eAAe,CAAC,CAAC,EAAEpC,gBAAgB/G,OAAO,CAAC,QAAQ,KAAK;gBAC9D,MAAMZ,WAAYG,KAAsCH;gBAExD,6EAA6E;gBAC7E,yEAAyE;gBACzE,IAAI,OAAOA,aAAa,YAAY9B,cAAc8B,WAAW;oBAC3D,MAAMgK,WAAY7J,KAAsC6J;oBAExD,IAAI,OAAOA,aAAa,YAAY,CAACC,OAAOC,aAAa,CAACF,aAAaA,WAAW,GAAG;wBACnF,MAAM,IAAIhM,SAAS,gDAAgD;oBACrE;oBAEA,MAAMoG,UAAUlE,kBAAkBC,KAAKI,aACnC0F,eAAe8D,cAAc9K,gCAC7B2E,OAAOwC,MAAM,CAACC,QAAQ,CAAC;wBACrBH,KAAK6D;wBACLvD,gBAAgB;4BAAC;gCAAEC,KAAKxH;4BAA6B;yBAAE;wBACvD+E;oBACF;oBAEJ,OAAOE,kBAAkB;wBACvBC,UAAU6F;wBACV5F;wBACApE;wBACAqE,OAAO1B,IAAI8B,OAAO,CAACiB,GAAG,CAAC;oBACzB;gBACF;gBAEA,2EAA2E;gBAC3E,+EAA+E;gBAC/E,IAAIxF,kBAAkBC,KAAKI,YAAY;oBACrC,IAAI4J,UAAUJ;oBAEd,6EAA6E;oBAC7E,yEAAyE;oBACzE,IAAI5D,MAAMtH,gBAAgBmB,WAAW;wBACnCmK,UAAUpL,kBAAkBoL;oBAC9B,OAAO,IAAIhE,MAAMvH,cAAcoB,WAAW;wBACxCmK,UAAUrL,wBAAwBqL;oBACpC;oBAEA,OAAO3F,SAAS4F,QAAQ,CAACnE,eAAekE,SAAShE,KAAK;gBACxD;gBAEA,MAAMkE,cAAczG,OAAOwC,MAAM,CAACC,QAAQ,CAAC;oBACzCH,KACE9D,qBAAqBjC,QACrB4J;oBACFvD,gBAAgBL,KAAK;wBAAC;4BAAEM,KAAKN;wBAAG;qBAAE,GAAGjE;oBACrC8B;gBACF;gBAEA,OAAOQ,SAAS4F,QAAQ,CAACC,aAAa;YACxC;QACF;IACF;AACF;AAEA,MAAMC,4BAA4B,CAChCC,aACAC,SACA1G,cACA/C,YACA0J;IAEA,MAAMC,oBAAwE,CAAC;IAE/E,KAAK,MAAM1J,kBAAkB2J,OAAOC,IAAI,CAACL,aAAc;QACrDG,iBAAiB,CAAC1J,eAAe,GAAG;YAClCwJ;YACAK,qBAAqB;YACrB,oFAAoF;YACpFJ,6BAA6B3G,aAAakC,GAAG,CAAChF,kBAC1CkB,YACAuI;YACJ/H,QAAQ5B,oBAAoBC,YAAYC;QAC1C;IACF;IAEA,OAAO0J;AACT;AAEA,OAAO,MAAMI,kBACX,CAACC,gBACD,CAACC;QACC,MAAM,EACJC,kBAAkB,EAClBpH,aAAa,EACb0G,WAAW,EACXE,2BAA2B,EAC3BS,OAAO,EACPC,UAAU,EACV1K,MAAM,EACN2K,UAAU,EACVC,SAAS,EACTtH,oBAAoBuH,wBAAwB,EAC5CtH,WAAW,EACZ,GAAG+G;QAEJ,IAAI,CAACK,YAAYzK,QAAQ;YACvB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACwK,WAAW1K,QAAQ;YACtB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAACmD,aAAarD,QAAQ;YACxB,MAAM,IAAIE,MAAM;QAClB;QAEA,IAAI,CAAC0J,eAAeI,OAAOC,IAAI,CAACL,aAAazK,MAAM,KAAK,GAAG;YACzD,MAAM,IAAIe,MAAM;QAClB;QAEA,MAAMiD,eAAe,IAAIyH,IACvBZ,OAAOa,OAAO,CAACjB,aACZkB,MAAM,CAAC,CAAC,GAAGrM,MAAM,GAAKD,0BAA0BC,QAChDsM,GAAG,CAAC,CAAC,CAAC3F,KAAK,GAAKA;QAErB,MAAM4F,kBAAkB,IAAIJ,IAAIZ,OAAOC,IAAI,CAACL;QAE5C,IAAIE,+BAA+B3G,aAAa+F,IAAI,GAAG,GAAG;YACxD,MAAM,IAAIhJ,MACR;QAEJ;QAEA,IAAI4J,6BAA6B;YAC/B,MAAMmB,qBAAqB,AAACZ,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAChDkB,MAAM,CACL,CAACjM,aACCmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,KAAKxG,sBAAsBC,aAEjEkM,GAAG,CAAC,CAAClM,aAAeA,WAAWuG,IAAI;YAEtC,IAAI6F,mBAAmB9L,MAAM,GAAG,GAAG;gBACjC,MAAM,IAAIe,MACR,CAAC,kHAAkH,EAAE+K,mBAAmB1K,IAAI,CAAC,MAAM,sLAAsL,CAAC;YAE9U;QACF;QAEA,MAAM6C,qBACJ,OAAOuH,6BAA6B,YAAYA,2BAA2B,IACvEA,2BACAtM;QACN,MAAM2E,WAAWqH,OAAOa,MAAM,EAAEC,OAAO;QAEvC,MAAM/K,aAAaP,gBAAgBC;QAEnC,MAAMsL,iBAAiB,IAAIxO,SAAS;YAAE6N;QAAW;QACjD,MAAMY,qBAAqBrB,OAAOsB,WAAW,CAC3C,AAACjB,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACrBkB,MAAM,CAAC,CAACjM,aAAemM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAC1D2F,GAAG,CAAC,CAAClM,aAAe;gBACnBA,WAAWuG,IAAI;gBACf;oBACEvG;oBACAe,WAAWuD,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;oBAC3CrD,QAAQ5B,oBAAoBC,YAAYvB,WAAWuG,IAAI;gBACzD;aACD;QAEL,MAAM9B,qBAAqB1F,mCAAmC;YAC5DqF,QAAQmI;YACRxB,aAAayB;QACf;QACA,MAAMxB,UAAU9G,gBAAgB;YAC9BC;YACAC,QAAQmI;YACRlI;YACAC;YACA/C;YACAgD;YACAC;YACAC;QACF;QAEA,MAAMiI,yBAAiC;YACrC,GAAGlB,MAAM;YACTT,aAAa,AAACS,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAAClM;gBAC3C,IAAI,CAACmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAAG;oBACzC,OAAOvG;gBACT;gBAEA,MAAM2M,sBAAsBrI,aAAakC,GAAG,CAACxG,WAAWuG,IAAI;gBAC5D,MAAMxC,oBAAoB,CAACpD,MACzBD,kBAAkBC,KAAKgM,uBACnBxN,4BAA4BwB,KAAKX,WAAWuG,IAAI,EAAEpC,YAClDjF,qBAAqByB;gBAE3B,MAAMiM,oBAAoB7B,WAAW,CAAC/K,WAAWuG,IAAI,CAAC;gBACtD,MAAMsG,uBACJD,sBAAsB,QACtB,OAAOA,sBAAsB,YAC7B,OAAOA,kBAAkBjB,UAAU,KAAK,YACpCiB,kBAAkBjB,UAAU,GAC5BjJ;gBAEN,4EAA4E;gBAC5E,qEAAqE;gBACrE,oCAAoC;gBACpC,MAAMoK,sBAAsB9M,WAAWmH,KAAK,EAAEU;gBAC9C,MAAMkF,YAAYJ,sBACd;oBACE,GAAI3M,WAAWmH,KAAK,IAAI,CAAC,CAAC;oBAC1BU,aACE,OAAOiF,wBAAwB,YAAYA,oBAAoB3L,IAAI,GAAGb,MAAM,GAAG,IAC3E,GAAGwM,oBAAoB,CAAC,EAAEpN,gCAAgC,GACzDoN,uBAAuBpN;gBAChC,IACAM,WAAWmH,KAAK;gBAEpB,OAAO;oBACL,GAAGnH,UAAU;oBACbmH,OAAO4F;oBACPjF,OAAO;wBACL,GAAI9H,WAAW8H,KAAK,IAAI,CAAC,CAAC;wBAC1BkF,cAAc;+BACRhN,WAAW8H,KAAK,EAAEkF,gBAAgB,EAAE;4BACxC,OAAO,EAAEnJ,IAAI,EAAEV,GAAG,EAAE;gCAClB,IAAI,CAACR,SAASkB,SAAS,CAACV,IAAI4F,IAAI,EAAED,qBAAqB;oCACrD,OAAOjF;gCACT;gCAEA,MAAMmF,UAAU7F,IAAI4F,IAAI,CAACD,mBAAmB;gCAC5C,MAAMmE,kBAAkB9J,IAAI4F,IAAI,CAACmE,QAAQ,CAACC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,EAAEhM,OAAOiM;gCACnE,IACE,CAACtO,yBAAyBkK,YAC1BA,QAAQ/F,QAAQ,KAAKY,KAAKZ,QAAQ,IAClC+F,QAAQ/F,QAAQ,KAAKE,IAAI4F,IAAI,CAAChH,IAAI,IAClC,qEAAqE;gCACrE,gEAAgE;gCAChEiH,QAAQqE,YAAY,KAAKxJ,KAAK2G,QAAQ,EACtC;oCACA,MAAM,IAAIhM,SAAS,iEAAiE;gCACtF;gCAEA,MAAMsF,WAAW,MAAMW,mBAAmB;oCACxCjD,gBAAgBxB,WAAWuG,IAAI;oCAC/ByC;gCACF;gCACA,gFAAgF;gCAChF,8EAA8E;gCAC9E,IACEiE,oBAAoBjE,QAAQsE,gBAAgB,IAC5CL,oBAAoBnJ,SAAStD,QAAQ,EACrC;oCACA,MAAM,IAAIhC,SAAS,iEAAiE;gCACtF;gCACA,+EAA+E;gCAC/E,2DAA2D;gCAC3D,MAAM+O,WAAW,MAAMpK,IAAII,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;oCAC5CzD,YAAYA,WAAWuG,IAAI;oCAC3BpD;oCACAO,OAAO;wCACL,mBAAmB;4CACjBL,QAAQS,SAASrB,MAAM;wCACzB;oCACF;gCACF;gCACA,IAAI8K,UAAU;oCACZ,MAAM,IAAI/O,SAAS,8DAA8D;gCACnF;gCAEAqF,KAAKZ,QAAQ,GAAGa,SAAS/B,IAAI;gCAC7B8B,KAAK2G,QAAQ,GAAG1G,SAASuG,IAAI;gCAC7BxG,KAAKrD,QAAQ,GAAGsD,SAAStD,QAAQ;gCAEjC,OAAOoD,gCACLC,MACAC,UACAC,mBACA4I;4BAEJ;yBACD;wBACDa,iBAAiB;+BACXxN,WAAW8H,KAAK,EAAE0F,mBAAmB,EAAE;4BAC3C,CAAC,EAAE5D,IAAI,EAAE6D,SAAS,EAAEtK,GAAG,EAAE;gCACvB,IACE,AAACsK,cAAc,YAAYA,cAAc,YACzCtK,IAAI6F,OAAO,EAAE0E,oBACb,CAACvK,IAAI4F,IAAI,IACT5F,IAAI4F,IAAI,CAACD,mBAAmB,IAC5B,CAAE,CAAA,UAAUc,IAAG,KACf,CAACjH,SAASiH,KAAK/F,IAAI,KACnB,OAAO+F,KAAK/F,IAAI,CAACX,MAAM,KAAK,UAC5B;oCACA,OAAO0G;gCACT;gCAEA,yEAAyE;gCACzE,wEAAwE;gCACxEA,KAAK/F,IAAI,CAACX,MAAM,GAAG/E,2BAA2B;oCAC5CiK,kBAAkB9G,oBAAoBC,YAAYvB,WAAWuG,IAAI;oCACjE8B,WAAWuB,KAAK/F,IAAI,CAACX,MAAM;oCAC3BD,UAAUE,IAAI4F,IAAI,CAAChH,IAAI;gCACzB,GAAG4L,kBAAkB;gCACrB,OAAO/D;4BACT;yBACD;oBACH;oBACA3J,QAAQ;wBACN,mEAAmE;wBACnE,4DAA4D;wBAC5D,gEAAgE;wBAChE,wBAAwB;wBACxB0L,YAAY;wBACZ,GAAI,OAAOA,eAAe,YAAY;4BAAEA;wBAAW,IAAI,CAAC,CAAC;wBACzD,GAAI,OAAOkB,yBAAyB,YAChC;4BAAElB,YAAYkB;wBAAqB,IACnC,CAAC,CAAC;wBACN,GAAI,OAAO7M,WAAWC,MAAM,KAAK,WAAWD,WAAWC,MAAM,GAAG,CAAC,CAAC;wBAClE2N,gBAAgB,CAAC,EAAEjN,GAAG,EAAE,GAAKoD,kBAAkBpD;wBAC/CkN,MAAM;oBACR;gBACF;YACF;QACF;QAEA,MAAMC,oBAAoB3C,OAAOsB,WAAW,CAC1CtB,OAAOC,IAAI,CAACL,aAAamB,GAAG,CAAC,CAAC1K,iBAAmB;gBAC/CA;gBACA;oBACET,WAAWuD,aAAakC,GAAG,CAAChF;oBAC5B0B,QAAQ5B,oBAAoBC,YAAYC;gBAC1C;aACD;QAKHnD,kBAAkB;YAChB0P,eAAe;YACfhD,aAAa+C;YACbtC,QAAQkB;YACRhB,SAASA,YAAY,SAASxL,QAAQmE;YACtC2J,eAAe/O,gCAAgC;gBAC7CgP,QAAQ,OAAO5J,kBAAkB,WAAWA,cAAc4J,MAAM,GAAGvL;gBACnEqI,aAAa+C;gBACblC;gBACAC;gBACApH;YACF;YACAyJ,mBAAmBrP;QACrB;QAEA,MAAMsP,SAASlQ,mBAAmB;YAChCwN;YACAV,aAAaD,0BACXC,aACAC,SACA1G,cACA/C,YACA0J;YAEFS;QACF,GAAGgB;QAEH,8FAA8F;QAC9F,yDAAyD;QACzDyB,OAAOpD,WAAW,GAAG,AAACoD,CAAAA,OAAOpD,WAAW,IAAI,EAAE,AAAD,EAAGmB,GAAG,CAAC,CAAClM;YACnD,IAAI,CAACmM,gBAAgB3F,GAAG,CAACxG,WAAWuG,IAAI,GAAG;gBACzC,OAAOvG;YACT;YAEA,MAAMoO,sBAAsB,AAAC5C,CAAAA,OAAOT,WAAW,IAAI,EAAE,AAAD,EACjDxI,IAAI,CAAC,CAAC8L,WAAaA,SAAS9H,IAAI,KAAKvG,WAAWuG,IAAI,GACnDW,OAAO3E,KAAK,CAAC+L,QAAU,UAAUA,SAASA,MAAMvM,IAAI,KAAK;YAE7D,MAAMwM,qBAAqB,CAACD;gBAC1B,IACEA,MAAMjM,IAAI,KAAK,UACf,UAAUiM,SACVA,MAAMvM,IAAI,KAAK,YACd,CAAA,CAACqM,uBACA,CAAE,CAAA,kBAAkBA,mBAAkB,KACtCA,oBAAoBI,YAAY,IAAI,IAAG,GACzC;oBACA,uEAAuE;oBACvE,uEAAuE;oBACvE,oEAAoE;oBACpE,kEAAkE;oBAClE,OAAO;wBACL,GAAGF,KAAK;wBACRE,cAAc,CAAC,EAAErL,GAAG,EAAE,GACpBA,IAAI4F,IAAI,IAAI,OAAOuF,MAAME,YAAY,KAAK,WAAWF,MAAME,YAAY,GAAG;oBAC9E;gBACF;gBACA,IAAI,UAAUF,SAASA,MAAMvM,IAAI,KAAK,cAAc;oBAClD,OAAO;wBAAE,GAAGuM,KAAK;wBAAEG,QAAQ;oBAAK;gBAClC;gBACA,IAAIH,MAAMjM,IAAI,KAAK,WAAW,UAAUiM,SAASA,MAAMvM,IAAI,KAAK,YAAY;oBAC1E,OAAO;wBACL,GAAGuM,KAAK;wBACRpH,QAAQoH,MAAMpH,MAAM,CAACgF,GAAG,CAAC,CAACwC,gBACxB,UAAUA,iBAAiBA,cAAc3M,IAAI,KAAK,WAC9C;gCAAE,GAAG2M,aAAa;gCAAED,QAAQ;4BAAK,IACjCC;oBAER;gBACF;gBACA,yFAAyF;gBACzF,IAAIJ,MAAMjM,IAAI,KAAK,eAAe;oBAChC,OAAO;wBAAE,GAAGiM,KAAK;wBAAEpH,QAAQoH,MAAMpH,MAAM,CAACgF,GAAG,CAACqC;oBAAoB;gBAClE;gBACA,OAAOD;YACT;YAEA,OAAO;gBACL,GAAGtO,UAAU;gBACbkH,QAAQlH,WAAWkH,MAAM,CAACgF,GAAG,CAACqC;YAChC;QACF;QAEA,OAAOJ;IACT,EAAC;AAEH,SAASQ,aAAa,QAAQ,eAAc;AAG5C,4BAA4B;AAC5B,OAAO,MAAMC,yBAAyBtD,gBAAe;AACrD,OAAO,MAAMuD,yBAAyBvD,gBAAe"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { Adapter, ClientUploadsConfig } from '@payloadcms/plugin-cloud-storage/types'\nimport type {\n  CollectionConfig,\n  CollectionSlug,\n  Config,\n  Field,\n  PayloadRequest,\n  StorageAdapter,\n  UploadCollectionSlug,\n} from 'payload'\n\nimport ImageKit, { toFile } from '@imagekit/nodejs'\nimport { cloudStoragePlugin } from '@payloadcms/plugin-cloud-storage'\nimport { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { openAsBlob } from 'node:fs'\nimport path from 'node:path'\nimport { APIError } from 'payload'\nimport {\n  assertClientUploadAllowed,\n  getRangeRequestInfo,\n  isXmlMimeType,\n  uploadContentSecurityPolicy,\n  verifyClientUploadReceipt,\n} from 'payload/internal'\n\nimport { createImageKitUploadInstructions } from './endpoints/createImageKitUploadInstructions.js'\nimport {\n  getAdminThumbnailURL,\n  getPrivateAdminThumbnailURL,\n  isPdfMimeType,\n  isVideoMimeType,\n} from './getAdminThumbnailURL.js'\nimport { getImageKitThumbnailSrc, getVideoPosterSrc } from './imageTransforms.js'\n\nexport type ImageKitCollectionOptions = { focalPoint?: boolean; private?: boolean }\nexport type PayloadStorageImageKitConfig = {\n  clientUploads?: ClientUploadsConfig\n  collections: Partial<Record<UploadCollectionSlug, ImageKitCollectionOptions | true>>\n  disablePayloadAccessControl?: true\n  enabled?: boolean\n  focalPoint?: boolean\n  folder: string\n  privateKey: string\n  publicKey: string\n  signedUrlExpiresIn?: number\n  urlEndpoint: string\n}\n\n/** Payload 4 storage capability. Register under config.storage, not config.plugins. */\nexport const imagekitStorage = (options: PayloadStorageImageKitConfig): StorageAdapter => ({\n  name: 'imagekit',\n  collections: Object.keys(options.collections),\n  init: (config) => initializeStorage(config, options),\n})\n\nexport { migrateFolder } from './migrate.js'\nexport type { MigrateFolderOptions, MigrationJobResult, MigrationLocation } from './migrate.js'\nexport const payloadStorageImagekit = imagekitStorage\nexport const payloadStorageImageKit = imagekitStorage\nexport type PayloadStorageImagekitConfig = PayloadStorageImageKitConfig\n\ninterface ProviderFile {\n  fileId: string\n  isPrivateFile?: boolean\n  mime?: string\n  name: string\n  size: number\n  thumbnail?: string\n  url: string\n}\n\ninterface FileLocation {\n  _objectKey?: string\n  filename?: string\n  filesize?: number\n  mimeType?: string\n  prefix?: string\n}\n\nfunction initializeStorage(config: Config, options: PayloadStorageImageKitConfig): Config {\n  for (const key of ['privateKey', 'publicKey', 'urlEndpoint', 'folder'] as const) {\n    if (!options[key]?.trim()) {\n      throw new Error(`imagekitStorage: \\`${key}\\` is required.`)\n    }\n  }\n  const folder = options.folder.trim().replace(/^\\/+|\\/+$/g, '')\n  if (folder.split('/').some((segment) => !segment || segment === '.' || segment === '..')) {\n    throw new Error('imagekitStorage: `folder` must not contain empty or dot segments.')\n  }\n  const client = new ImageKit({ privateKey: options.privateKey })\n  const collections: Partial<Record<string, ImageKitCollectionOptions | true>> = options.collections\n  if (!Object.keys(collections).length) {\n    throw new Error('imagekitStorage: `collections` must not be empty.')\n  }\n  const configured = new Set(Object.keys(collections))\n  const apiRoute = config.routes?.api ?? '/api'\n  const expiresIn = options.signedUrlExpiresIn ?? 900\n  const prefixFor = (slug: string) => path.posix.join(folder, slug)\n  const collectionIsPrivate = (slug: string) => {\n    const value = collections[slug]\n    return value !== true && value?.private === true\n  }\n  const sourceConfig: Config = {\n    ...config,\n    collections: (config.collections ?? []).map((collection) => {\n      if (!configured.has(collection.slug)) {\n        return collection\n      }\n      const isPrivate = collectionIsPrivate(collection.slug)\n      if (options.disablePayloadAccessControl && (isPrivate || canStoreXml(collection))) {\n        throw new Error(\n          'imagekitStorage: private and XML-capable collections require Payload access control.',\n        )\n      }\n      const setting = collections[collection.slug]\n      const focalPoint = setting !== true ? setting?.focalPoint : undefined\n      const description = collection.admin?.description\n      return {\n        ...collection,\n        admin: isPrivate\n          ? {\n              ...collection.admin,\n              description:\n                typeof description === 'string'\n                  ? `${description} Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.`\n                  : (description ??\n                    'Files in this collection are uploaded to ImageKit as private files and delivered through short-lived signed URLs.'),\n            }\n          : collection.admin,\n        hooks: {\n          ...collection.hooks,\n          beforeChange: [\n            ...(collection.hooks?.beforeChange ?? []),\n            async ({ data, operation, originalDoc, req }) => {\n              if (operation === 'validate') {\n                return data\n              }\n              const verified = req.context.imagekitVerifiedUpload as ProviderFile | undefined\n              if (!verified) {\n                return data\n              }\n              const existing = await req.payload.db.findOne({\n                // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- Generated consumer configs narrow CollectionSlug, unlike the standalone package build.\n                collection: collection.slug as CollectionSlug,\n                req,\n                where: { 'imagekit.fileId': { equals: verified.fileId } },\n              })\n              if (existing && existing.id !== originalDoc?.id) {\n                throw new APIError('This ImageKit upload reference has already been used.', 400)\n              }\n              return applyMetadata(data, verified, isPrivate, collection.slug, apiRoute)\n            },\n          ],\n        },\n        upload: {\n          focalPoint: focalPoint ?? options.focalPoint ?? false,\n          ...(typeof collection.upload === 'object' ? collection.upload : {}),\n          adminThumbnail: ({ doc }) =>\n            isPrivateDocument(doc, isPrivate)\n              ? getPrivateAdminThumbnailURL(doc, collection.slug, apiRoute)\n              : getAdminThumbnailURL(doc),\n          crop: false,\n        },\n      }\n    }),\n  }\n  const adapter: Adapter = ({ collection, prefix = prefixFor(collection.slug) }) => {\n    const isPrivate = collectionIsPrivate(collection.slug)\n    const buildURL = (key: string, signed: boolean, transformation?: null | string) =>\n      client.helper.buildSrc({\n        expiresIn: signed ? expiresIn : undefined,\n        signed,\n        src: `/${key.replace(/^\\/+/, '')}`,\n        transformation: transformation ? [{ raw: transformation }] : undefined,\n        urlEndpoint: options.urlEndpoint,\n      })\n    const deleteFile = async ({ storageFilePath }: { storageFilePath: string }) => {\n      const file = await findFile(client, storageFilePath)\n      if (file) {\n        await client.files.delete(file.fileId)\n      }\n    }\n    return {\n      name: 'imagekit',\n      copyFile: async ({ from, to }) => {\n        if (await findFile(client, to)) {\n          throw new Error(`ImageKit destination already exists: ${to}`)\n        }\n        const source = await findFile(client, from)\n        if (!source) {\n          throw new Error(`ImageKit source not found: ${from}`)\n        }\n        // Upload by URL copies the exact original without buffering it in the app process.\n        // overwriteFile:false protects a destination created concurrently with the lookup.\n        await client.files.upload({\n          customMetadata: source.customMetadata ?? undefined,\n          file: buildURL(from, Boolean(source.isPrivateFile), 'orig-true'),\n          fileName: path.posix.basename(to),\n          folder: `/${path.posix.dirname(to)}`,\n          isPrivateFile: source.isPrivateFile ?? false,\n          overwriteFile: false,\n          tags: source.tags ?? undefined,\n          useUniqueFileName: false,\n        })\n      },\n      deleteFile,\n      fields: storageFields({ buildURL, expiresIn, isPrivate, prefix }),\n      generateURL: ({ filename, prefix: docPrefix }) =>\n        buildURL(\n          buildStoragePathData({\n            collectionPrefix: prefix,\n            docPrefix,\n            filename,\n          }).storageFilePath,\n          false,\n        ),\n      handleDelete: deleteFile,\n      handleUpload: async ({ data, file, storageFilePath }) => {\n        const uploadSource = file.tempFilePath\n          ? await openAsBlob(file.tempFilePath, { type: file.mimeType })\n          : file.buffer\n        const uploaded = await client.files.upload({\n          file: await toFile(uploadSource, file.filename, { type: file.mimeType }),\n          fileName: path.posix.basename(storageFilePath),\n          folder: `/${path.posix.dirname(storageFilePath)}`,\n          isPrivateFile: isPrivate,\n          overwriteFile: false,\n          useUniqueFileName: false,\n        })\n        if (!uploaded.fileId || !uploaded.url) {\n          throw new Error('ImageKit returned incomplete upload metadata.')\n        }\n        return applyMetadata(\n          data,\n          {\n            name: path.posix.basename(storageFilePath),\n            fileId: uploaded.fileId,\n            isPrivateFile: isPrivate,\n            mime: file.mimeType,\n            size: file.filesize,\n            thumbnail: uploaded.thumbnailUrl,\n            url: uploaded.url,\n          },\n          isPrivate,\n          collection.slug,\n          apiRoute,\n        )\n      },\n      staticHandler: async (req, { doc, params }) => {\n        if (params.uploadReference) {\n          try {\n            const reference = params.uploadReference as { signedReceipt?: unknown }\n            const receipt = verifyClientUploadReceipt({\n              collectionSlug: collection.slug,\n              req,\n              signedReceipt: reference.signedReceipt,\n            })\n            const expectedPath = buildStoragePathData({\n              collectionPrefix: prefix,\n              docPrefix: path.posix.join(receipt.filePrefix, receipt._objectKey ?? ''),\n              filename: params.filename,\n            }).storageFilePath\n            if (\n              !receipt._objectKey ||\n              expectedPath !== receipt.storageFilePath ||\n              !expectedPath.startsWith(`${prefix.replace(/^\\/+/, '')}/`)\n            ) {\n              throw new APIError('Invalid ImageKit upload reference.', 400)\n            }\n            const uploaded = await findUploadedFile(client, expectedPath)\n            if (!uploaded || !uploaded.mime || Boolean(uploaded.isPrivateFile) !== isPrivate) {\n              throw new APIError('ImageKit upload did not match its authorization.', 400)\n            }\n            assertClientUploadAllowed({\n              collection,\n              filename: uploaded.name,\n              mimeType: uploaded.mime,\n            })\n            req.context.imagekitVerifiedUpload = uploaded\n            return await fetchOriginal({\n              file: uploaded,\n              req,\n              url: buildURL(expectedPath, isPrivate, 'orig-true'),\n            })\n          } catch (error) {\n            if (error instanceof APIError) {\n              return Response.json({ message: error.message }, { status: error.status })\n            }\n            throw error\n          }\n        }\n        const document =\n          doc ??\n          (await req.payload.db.findOne({\n            // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- Generated consumer configs narrow CollectionSlug, unlike the standalone package build.\n            collection: collection.slug as CollectionSlug,\n            req,\n            where: { filename: { equals: params.filename } },\n          }))\n        const source = getFileLocation(document, params.filename)\n        const key = buildStoragePathData({\n          collectionPrefix: prefix,\n          docPrefix: path.posix.join(\n            params.prefix ?? source.prefix ?? prefix,\n            source._objectKey ?? '',\n          ),\n          filename: params.filename,\n        }).storageFilePath\n        const privateFile = isPrivateDocument(document, isPrivate)\n        if (params.operation === 'transform' || isXmlMimeType(source.mimeType ?? '')) {\n          const file = await findFile(client, key)\n          if (!file?.mime) {\n            throw new APIError('ImageKit source not found.', 404)\n          }\n          return fetchOriginal({ file, req, url: buildURL(key, privateFile, 'orig-true') })\n        }\n        const tr = new URL(req.url ?? 'http://localhost').searchParams.get('tr')\n        let src = key\n        if (tr && isVideoMimeType(source.mimeType)) {\n          src = getVideoPosterSrc(src)\n        } else if (tr && isPdfMimeType(source.mimeType)) {\n          src = getImageKitThumbnailSrc(src)\n        }\n        // Existing v3 files may live under an earlier folder or delivery endpoint.\n        const storedURL = (document as { imagekit?: { url?: string }; original?: unknown } | null)\n          ?.imagekit?.url\n        if (\n          !privateFile &&\n          !tr &&\n          !(document && 'original' in document && document.original) &&\n          storedURL\n        ) {\n          return Response.redirect(storedURL, 302)\n        }\n        return Response.redirect(buildURL(src, privateFile, tr), 302)\n      },\n      supportsTempFiles: true,\n      uploadInstructions: {\n        adminHandler: { path: '@humaan/payload-storage-imagekit/client#ImageKitUploadHandler' },\n        enabled: options.enabled !== false && Boolean(options.clientUploads),\n        generate: createImageKitUploadInstructions({\n          access:\n            typeof options.clientUploads === 'object' ? options.clientUploads.access : undefined,\n          isPrivate,\n          prefix,\n          privateKey: options.privateKey,\n          publicKey: options.publicKey,\n        }),\n        requiresUploadReceipt: true,\n        useInAdmin: true,\n      },\n    }\n  }\n  const output = cloudStoragePlugin({\n    collections: Object.fromEntries(\n      Object.keys(collections).map((slug) => [\n        slug,\n        {\n          adapter,\n          disableLocalStorage: true,\n          disablePayloadAccessControl: options.disablePayloadAccessControl,\n          prefix: prefixFor(slug),\n        },\n      ]),\n    ),\n    enabled: options.enabled,\n  })(sourceConfig)\n  // Do not invent a prefix on reads of legacy documents. A stored prefix is retained;\n  // new uploads get their normalized destination from the file-operation pipeline.\n  output.collections = output.collections?.map((collection) =>\n    !configured.has(collection.slug)\n      ? collection\n      : {\n          ...collection,\n          fields: collection.fields.map((field) =>\n            field.type === 'text' && field.name === 'prefix'\n              ? {\n                  ...field,\n                  defaultValue: ({ req }) =>\n                    req.file && typeof field.defaultValue === 'string' ? field.defaultValue : '',\n                }\n              : field,\n          ),\n        },\n  )\n  return output\n}\n\nasync function findFile(client: ImageKit, storageFilePath: string) {\n  const filePath = `/${storageFilePath.replace(/^\\/+/, '')}`\n  const name = path.posix.basename(filePath)\n  for (let skip = 0; ; skip += 100) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit: 100,\n      path: `${path.posix.dirname(filePath)}/`,\n      skip,\n    })\n    const found = assets.find(\n      (asset) => 'fileId' in asset && asset.filePath === filePath && asset.name === name,\n    )\n    if (found && 'fileId' in found && found.fileId) {\n      const file = await client.files.get(found.fileId)\n      if (\n        file.fileId !== found.fileId ||\n        file.name !== name ||\n        file.filePath !== filePath ||\n        typeof file.size !== 'number' ||\n        !Number.isSafeInteger(file.size) ||\n        file.size < 0 ||\n        !file.url\n      ) {\n        throw new Error('ImageKit returned incomplete file metadata.')\n      }\n      return { ...file, name: file.name, fileId: file.fileId, size: file.size, url: file.url }\n    }\n    if (assets.length < 100) {\n      return undefined\n    }\n  }\n}\n\nasync function findUploadedFile(client: ImageKit, key: string) {\n  // ImageKit asset listings can lag a successful upload. Only admission retries;\n  // ordinary missing reads/deletes and collision lookups must stay immediate.\n  let file = await findFile(client, key)\n  for (const delay of [250, 500, 1000, 2000]) {\n    if (file) {\n      break\n    }\n    await new Promise((resolve) => setTimeout(resolve, delay))\n    file = await findFile(client, key)\n  }\n  return file\n}\n\nfunction isPrivateDocument(doc: unknown, fallback: boolean): boolean {\n  const value = (doc as { imagekit?: { isPrivate?: boolean } } | null)?.imagekit?.isPrivate\n  return typeof value === 'boolean' ? value : fallback\n}\n\nfunction getFileLocation(doc: unknown, filename: string): FileLocation {\n  const value = (doc ?? {}) as {\n    original?: FileLocation\n    variants?: Record<string, FileLocation>\n  } & FileLocation\n  return (\n    [value, value.original, ...Object.values(value.variants ?? {})].find(\n      (file) => file?.filename === filename,\n    ) ?? value\n  )\n}\n\nfunction applyMetadata(\n  data: Record<string, unknown>,\n  file: ProviderFile,\n  isPrivate: boolean,\n  slug: string,\n  apiRoute: string,\n) {\n  data.imagekit = {\n    fileId: file.fileId,\n    isPrivate,\n    thumbnailUrl: file.thumbnail,\n    url: file.url,\n  }\n  data.thumbnailURL = isPrivate\n    ? getPrivateAdminThumbnailURL(data, slug, apiRoute)\n    : getAdminThumbnailURL(data)\n  return data\n}\n\nasync function fetchOriginal({\n  file,\n  req,\n  url,\n}: {\n  file: ProviderFile\n  req: PayloadRequest\n  url: string\n}): Promise<Response> {\n  const range = getRangeRequestInfo({ fileSize: file.size, rangeHeader: req.headers.get('Range') })\n  if (range.type === 'invalid') {\n    return new Response(null, { headers: range.headers, status: range.status })\n  }\n  const response = await fetch(url, {\n    cache: 'no-store',\n    headers:\n      range.type === 'partial'\n        ? { Range: `bytes=${range.rangeStart}-${range.rangeEnd}` }\n        : undefined,\n    signal: new AbortController().signal,\n  })\n  if (\n    response.status !== range.status ||\n    response.headers.get('Content-Length') !== range.headers['Content-Length'] ||\n    (range.type === 'partial' &&\n      response.headers.get('Content-Range') !== range.headers['Content-Range'])\n  ) {\n    void response.body?.cancel().catch(() => undefined)\n    throw new APIError('ImageKit returned mismatched file content metadata.', 502)\n  }\n  const headers = new Headers(range.headers)\n  headers.set('Content-Type', file.mime ?? 'application/octet-stream')\n  if (isXmlMimeType(file.mime ?? '')) {\n    headers.set('Content-Security-Policy', uploadContentSecurityPolicy)\n  }\n  return new Response(response.body, { headers, status: range.status })\n}\n\nfunction canStoreXml(collection: CollectionConfig): boolean {\n  const upload = typeof collection.upload === 'object' ? collection.upload : undefined\n  return (\n    Boolean(upload?.allowRestrictedFileTypes) ||\n    !upload?.mimeTypes?.length ||\n    upload.mimeTypes.some((mime) => mime.includes('*') || isXmlMimeType(mime))\n  )\n}\n\nfunction storageFields({\n  buildURL,\n  expiresIn,\n  isPrivate,\n  prefix,\n}: {\n  buildURL: (key: string, signed: boolean, transformation?: null | string) => string\n  expiresIn: number\n  isPrivate: boolean\n  prefix: string\n}): Field[] {\n  return [\n    {\n      type: 'collapsible',\n      admin: {\n        condition: (data) => Boolean(data?.imagekit?.url),\n        initCollapsed: true,\n      },\n      fields: [\n        {\n          name: 'imagekit',\n          type: 'group',\n          admin: { disabled: { column: true, filter: true } },\n          fields: [\n            { name: 'fileId', type: 'text', admin: { hidden: true }, unique: true },\n            { name: 'url', type: 'text', admin: { readOnly: true }, label: 'URL' },\n            {\n              name: 'isPrivate',\n              type: 'checkbox',\n              admin: { readOnly: true },\n              label: 'Private file',\n            },\n            {\n              name: 'signedUrl',\n              type: 'text',\n              admin: {\n                condition: (_data, siblingData) =>\n                  isPrivateDocument({ imagekit: siblingData }, isPrivate),\n                description: `Temporary signed URL. Expires ${expiresIn} seconds after load. Anyone with this URL can access the file until it expires.`,\n                readOnly: true,\n              },\n              hooks: {\n                afterRead: [\n                  ({ data, siblingData }) => {\n                    if (\n                      !data?.filename ||\n                      !isPrivateDocument({ imagekit: siblingData }, isPrivate)\n                    ) {\n                      return undefined\n                    }\n                    const key = buildStoragePathData({\n                      collectionPrefix: prefix,\n                      docPrefix: path.posix.join(data.prefix || prefix, data._objectKey || ''),\n                      filename: data.filename,\n                    }).storageFilePath\n                    return buildURL(key, true)\n                  },\n                ],\n              },\n              label: 'Signed URL',\n              virtual: true,\n            },\n            { name: 'thumbnailUrl', type: 'text', admin: { hidden: true } },\n          ],\n          interfaceName: 'imagekitFields',\n          label: false,\n        },\n      ],\n      label: 'Storage: ImageKit',\n    },\n  ]\n}\n"],"names":["ImageKit","toFile","cloudStoragePlugin","buildStoragePathData","openAsBlob","path","APIError","assertClientUploadAllowed","getRangeRequestInfo","isXmlMimeType","uploadContentSecurityPolicy","verifyClientUploadReceipt","createImageKitUploadInstructions","getAdminThumbnailURL","getPrivateAdminThumbnailURL","isPdfMimeType","isVideoMimeType","getImageKitThumbnailSrc","getVideoPosterSrc","imagekitStorage","options","name","collections","Object","keys","init","config","initializeStorage","migrateFolder","payloadStorageImagekit","payloadStorageImageKit","key","trim","Error","folder","replace","split","some","segment","client","privateKey","length","configured","Set","apiRoute","routes","api","expiresIn","signedUrlExpiresIn","prefixFor","slug","posix","join","collectionIsPrivate","value","private","sourceConfig","map","collection","has","isPrivate","disablePayloadAccessControl","canStoreXml","setting","focalPoint","undefined","description","admin","hooks","beforeChange","data","operation","originalDoc","req","verified","context","imagekitVerifiedUpload","existing","payload","db","findOne","where","equals","fileId","id","applyMetadata","upload","adminThumbnail","doc","isPrivateDocument","crop","adapter","prefix","buildURL","signed","transformation","helper","buildSrc","src","raw","urlEndpoint","deleteFile","storageFilePath","file","findFile","files","delete","copyFile","from","to","source","customMetadata","Boolean","isPrivateFile","fileName","basename","dirname","overwriteFile","tags","useUniqueFileName","fields","storageFields","generateURL","filename","docPrefix","collectionPrefix","handleDelete","handleUpload","uploadSource","tempFilePath","type","mimeType","buffer","uploaded","url","mime","size","filesize","thumbnail","thumbnailUrl","staticHandler","params","uploadReference","reference","receipt","collectionSlug","signedReceipt","expectedPath","filePrefix","_objectKey","startsWith","findUploadedFile","fetchOriginal","error","Response","json","message","status","document","getFileLocation","privateFile","tr","URL","searchParams","get","storedURL","imagekit","original","redirect","supportsTempFiles","uploadInstructions","adminHandler","enabled","clientUploads","generate","access","publicKey","requiresUploadReceipt","useInAdmin","output","fromEntries","disableLocalStorage","field","defaultValue","filePath","skip","assets","list","limit","found","find","asset","Number","isSafeInteger","delay","Promise","resolve","setTimeout","fallback","values","variants","thumbnailURL","range","fileSize","rangeHeader","headers","response","fetch","cache","Range","rangeStart","rangeEnd","signal","AbortController","body","cancel","catch","Headers","set","allowRestrictedFileTypes","mimeTypes","includes","condition","initCollapsed","disabled","column","filter","hidden","unique","readOnly","label","_data","siblingData","afterRead","virtual","interfaceName"],"mappings":"AAWA,OAAOA,YAAYC,MAAM,QAAQ,mBAAkB;AACnD,SAASC,kBAAkB,QAAQ,mCAAkC;AACrE,SAASC,oBAAoB,QAAQ,6CAA4C;AACjF,SAASC,UAAU,QAAQ,UAAS;AACpC,OAAOC,UAAU,YAAW;AAC5B,SAASC,QAAQ,QAAQ,UAAS;AAClC,SACEC,yBAAyB,EACzBC,mBAAmB,EACnBC,aAAa,EACbC,2BAA2B,EAC3BC,yBAAyB,QACpB,mBAAkB;AAEzB,SAASC,gCAAgC,QAAQ,kDAAiD;AAClG,SACEC,oBAAoB,EACpBC,2BAA2B,EAC3BC,aAAa,EACbC,eAAe,QACV,4BAA2B;AAClC,SAASC,uBAAuB,EAAEC,iBAAiB,QAAQ,uBAAsB;AAgBjF,qFAAqF,GACrF,OAAO,MAAMC,kBAAkB,CAACC,UAA2D,CAAA;QACzFC,MAAM;QACNC,aAAaC,OAAOC,IAAI,CAACJ,QAAQE,WAAW;QAC5CG,MAAM,CAACC,SAAWC,kBAAkBD,QAAQN;IAC9C,CAAA,EAAE;AAEF,SAASQ,aAAa,QAAQ,eAAc;AAE5C,OAAO,MAAMC,yBAAyBV,gBAAe;AACrD,OAAO,MAAMW,yBAAyBX,gBAAe;AAqBrD,SAASQ,kBAAkBD,MAAc,EAAEN,OAAqC;IAC9E,KAAK,MAAMW,OAAO;QAAC;QAAc;QAAa;QAAe;KAAS,CAAW;QAC/E,IAAI,CAACX,OAAO,CAACW,IAAI,EAAEC,QAAQ;YACzB,MAAM,IAAIC,MAAM,CAAC,mBAAmB,EAAEF,IAAI,eAAe,CAAC;QAC5D;IACF;IACA,MAAMG,SAASd,QAAQc,MAAM,CAACF,IAAI,GAAGG,OAAO,CAAC,cAAc;IAC3D,IAAID,OAAOE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAOA,YAAY,OAAO;QACxF,MAAM,IAAIL,MAAM;IAClB;IACA,MAAMM,SAAS,IAAIvC,SAAS;QAAEwC,YAAYpB,QAAQoB,UAAU;IAAC;IAC7D,MAAMlB,cAAyEF,QAAQE,WAAW;IAClG,IAAI,CAACC,OAAOC,IAAI,CAACF,aAAamB,MAAM,EAAE;QACpC,MAAM,IAAIR,MAAM;IAClB;IACA,MAAMS,aAAa,IAAIC,IAAIpB,OAAOC,IAAI,CAACF;IACvC,MAAMsB,WAAWlB,OAAOmB,MAAM,EAAEC,OAAO;IACvC,MAAMC,YAAY3B,QAAQ4B,kBAAkB,IAAI;IAChD,MAAMC,YAAY,CAACC,OAAiB7C,KAAK8C,KAAK,CAACC,IAAI,CAAClB,QAAQgB;IAC5D,MAAMG,sBAAsB,CAACH;QAC3B,MAAMI,QAAQhC,WAAW,CAAC4B,KAAK;QAC/B,OAAOI,UAAU,QAAQA,OAAOC,YAAY;IAC9C;IACA,MAAMC,eAAuB;QAC3B,GAAG9B,MAAM;QACTJ,aAAa,AAACI,CAAAA,OAAOJ,WAAW,IAAI,EAAE,AAAD,EAAGmC,GAAG,CAAC,CAACC;YAC3C,IAAI,CAAChB,WAAWiB,GAAG,CAACD,WAAWR,IAAI,GAAG;gBACpC,OAAOQ;YACT;YACA,MAAME,YAAYP,oBAAoBK,WAAWR,IAAI;YACrD,IAAI9B,QAAQyC,2BAA2B,IAAKD,CAAAA,aAAaE,YAAYJ,WAAU,GAAI;gBACjF,MAAM,IAAIzB,MACR;YAEJ;YACA,MAAM8B,UAAUzC,WAAW,CAACoC,WAAWR,IAAI,CAAC;YAC5C,MAAMc,aAAaD,YAAY,OAAOA,SAASC,aAAaC;YAC5D,MAAMC,cAAcR,WAAWS,KAAK,EAAED;YACtC,OAAO;gBACL,GAAGR,UAAU;gBACbS,OAAOP,YACH;oBACE,GAAGF,WAAWS,KAAK;oBACnBD,aACE,OAAOA,gBAAgB,WACnB,GAAGA,YAAY,kHAAkH,CAAC,GACjIA,eACD;gBACR,IACAR,WAAWS,KAAK;gBACpBC,OAAO;oBACL,GAAGV,WAAWU,KAAK;oBACnBC,cAAc;2BACRX,WAAWU,KAAK,EAAEC,gBAAgB,EAAE;wBACxC,OAAO,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,GAAG,EAAE;4BAC1C,IAAIF,cAAc,YAAY;gCAC5B,OAAOD;4BACT;4BACA,MAAMI,WAAWD,IAAIE,OAAO,CAACC,sBAAsB;4BACnD,IAAI,CAACF,UAAU;gCACb,OAAOJ;4BACT;4BACA,MAAMO,WAAW,MAAMJ,IAAIK,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;gCAC5C,sKAAsK;gCACtKtB,YAAYA,WAAWR,IAAI;gCAC3BuB;gCACAQ,OAAO;oCAAE,mBAAmB;wCAAEC,QAAQR,SAASS,MAAM;oCAAC;gCAAE;4BAC1D;4BACA,IAAIN,YAAYA,SAASO,EAAE,KAAKZ,aAAaY,IAAI;gCAC/C,MAAM,IAAI9E,SAAS,yDAAyD;4BAC9E;4BACA,OAAO+E,cAAcf,MAAMI,UAAUd,WAAWF,WAAWR,IAAI,EAAEN;wBACnE;qBACD;gBACH;gBACA0C,QAAQ;oBACNtB,YAAYA,cAAc5C,QAAQ4C,UAAU,IAAI;oBAChD,GAAI,OAAON,WAAW4B,MAAM,KAAK,WAAW5B,WAAW4B,MAAM,GAAG,CAAC,CAAC;oBAClEC,gBAAgB,CAAC,EAAEC,GAAG,EAAE,GACtBC,kBAAkBD,KAAK5B,aACnB9C,4BAA4B0E,KAAK9B,WAAWR,IAAI,EAAEN,YAClD/B,qBAAqB2E;oBAC3BE,MAAM;gBACR;YACF;QACF;IACF;IACA,MAAMC,UAAmB,CAAC,EAAEjC,UAAU,EAAEkC,SAAS3C,UAAUS,WAAWR,IAAI,CAAC,EAAE;QAC3E,MAAMU,YAAYP,oBAAoBK,WAAWR,IAAI;QACrD,MAAM2C,WAAW,CAAC9D,KAAa+D,QAAiBC,iBAC9CxD,OAAOyD,MAAM,CAACC,QAAQ,CAAC;gBACrBlD,WAAW+C,SAAS/C,YAAYkB;gBAChC6B;gBACAI,KAAK,CAAC,CAAC,EAAEnE,IAAII,OAAO,CAAC,QAAQ,KAAK;gBAClC4D,gBAAgBA,iBAAiB;oBAAC;wBAAEI,KAAKJ;oBAAe;iBAAE,GAAG9B;gBAC7DmC,aAAahF,QAAQgF,WAAW;YAClC;QACF,MAAMC,aAAa,OAAO,EAAEC,eAAe,EAA+B;YACxE,MAAMC,OAAO,MAAMC,SAASjE,QAAQ+D;YACpC,IAAIC,MAAM;gBACR,MAAMhE,OAAOkE,KAAK,CAACC,MAAM,CAACH,KAAKpB,MAAM;YACvC;QACF;QACA,OAAO;YACL9D,MAAM;YACNsF,UAAU,OAAO,EAAEC,IAAI,EAAEC,EAAE,EAAE;gBAC3B,IAAI,MAAML,SAASjE,QAAQsE,KAAK;oBAC9B,MAAM,IAAI5E,MAAM,CAAC,qCAAqC,EAAE4E,IAAI;gBAC9D;gBACA,MAAMC,SAAS,MAAMN,SAASjE,QAAQqE;gBACtC,IAAI,CAACE,QAAQ;oBACX,MAAM,IAAI7E,MAAM,CAAC,2BAA2B,EAAE2E,MAAM;gBACtD;gBACA,mFAAmF;gBACnF,mFAAmF;gBACnF,MAAMrE,OAAOkE,KAAK,CAACnB,MAAM,CAAC;oBACxByB,gBAAgBD,OAAOC,cAAc,IAAI9C;oBACzCsC,MAAMV,SAASe,MAAMI,QAAQF,OAAOG,aAAa,GAAG;oBACpDC,UAAU7G,KAAK8C,KAAK,CAACgE,QAAQ,CAACN;oBAC9B3E,QAAQ,CAAC,CAAC,EAAE7B,KAAK8C,KAAK,CAACiE,OAAO,CAACP,KAAK;oBACpCI,eAAeH,OAAOG,aAAa,IAAI;oBACvCI,eAAe;oBACfC,MAAMR,OAAOQ,IAAI,IAAIrD;oBACrBsD,mBAAmB;gBACrB;YACF;YACAlB;YACAmB,QAAQC,cAAc;gBAAE5B;gBAAU9C;gBAAWa;gBAAWgC;YAAO;YAC/D8B,aAAa,CAAC,EAAEC,QAAQ,EAAE/B,QAAQgC,SAAS,EAAE,GAC3C/B,SACE1F,qBAAqB;oBACnB0H,kBAAkBjC;oBAClBgC;oBACAD;gBACF,GAAGrB,eAAe,EAClB;YAEJwB,cAAczB;YACd0B,cAAc,OAAO,EAAEzD,IAAI,EAAEiC,IAAI,EAAED,eAAe,EAAE;gBAClD,MAAM0B,eAAezB,KAAK0B,YAAY,GAClC,MAAM7H,WAAWmG,KAAK0B,YAAY,EAAE;oBAAEC,MAAM3B,KAAK4B,QAAQ;gBAAC,KAC1D5B,KAAK6B,MAAM;gBACf,MAAMC,WAAW,MAAM9F,OAAOkE,KAAK,CAACnB,MAAM,CAAC;oBACzCiB,MAAM,MAAMtG,OAAO+H,cAAczB,KAAKoB,QAAQ,EAAE;wBAAEO,MAAM3B,KAAK4B,QAAQ;oBAAC;oBACtEjB,UAAU7G,KAAK8C,KAAK,CAACgE,QAAQ,CAACb;oBAC9BpE,QAAQ,CAAC,CAAC,EAAE7B,KAAK8C,KAAK,CAACiE,OAAO,CAACd,kBAAkB;oBACjDW,eAAerD;oBACfyD,eAAe;oBACfE,mBAAmB;gBACrB;gBACA,IAAI,CAACc,SAASlD,MAAM,IAAI,CAACkD,SAASC,GAAG,EAAE;oBACrC,MAAM,IAAIrG,MAAM;gBAClB;gBACA,OAAOoD,cACLf,MACA;oBACEjD,MAAMhB,KAAK8C,KAAK,CAACgE,QAAQ,CAACb;oBAC1BnB,QAAQkD,SAASlD,MAAM;oBACvB8B,eAAerD;oBACf2E,MAAMhC,KAAK4B,QAAQ;oBACnBK,MAAMjC,KAAKkC,QAAQ;oBACnBC,WAAWL,SAASM,YAAY;oBAChCL,KAAKD,SAASC,GAAG;gBACnB,GACA1E,WACAF,WAAWR,IAAI,EACfN;YAEJ;YACAgG,eAAe,OAAOnE,KAAK,EAAEe,GAAG,EAAEqD,MAAM,EAAE;gBACxC,IAAIA,OAAOC,eAAe,EAAE;oBAC1B,IAAI;wBACF,MAAMC,YAAYF,OAAOC,eAAe;wBACxC,MAAME,UAAUrI,0BAA0B;4BACxCsI,gBAAgBvF,WAAWR,IAAI;4BAC/BuB;4BACAyE,eAAeH,UAAUG,aAAa;wBACxC;wBACA,MAAMC,eAAehJ,qBAAqB;4BACxC0H,kBAAkBjC;4BAClBgC,WAAWvH,KAAK8C,KAAK,CAACC,IAAI,CAAC4F,QAAQI,UAAU,EAAEJ,QAAQK,UAAU,IAAI;4BACrE1B,UAAUkB,OAAOlB,QAAQ;wBAC3B,GAAGrB,eAAe;wBAClB,IACE,CAAC0C,QAAQK,UAAU,IACnBF,iBAAiBH,QAAQ1C,eAAe,IACxC,CAAC6C,aAAaG,UAAU,CAAC,GAAG1D,OAAOzD,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,GACzD;4BACA,MAAM,IAAI7B,SAAS,sCAAsC;wBAC3D;wBACA,MAAM+H,WAAW,MAAMkB,iBAAiBhH,QAAQ4G;wBAChD,IAAI,CAACd,YAAY,CAACA,SAASE,IAAI,IAAIvB,QAAQqB,SAASpB,aAAa,MAAMrD,WAAW;4BAChF,MAAM,IAAItD,SAAS,oDAAoD;wBACzE;wBACAC,0BAA0B;4BACxBmD;4BACAiE,UAAUU,SAAShH,IAAI;4BACvB8G,UAAUE,SAASE,IAAI;wBACzB;wBACA9D,IAAIE,OAAO,CAACC,sBAAsB,GAAGyD;wBACrC,OAAO,MAAMmB,cAAc;4BACzBjD,MAAM8B;4BACN5D;4BACA6D,KAAKzC,SAASsD,cAAcvF,WAAW;wBACzC;oBACF,EAAE,OAAO6F,OAAO;wBACd,IAAIA,iBAAiBnJ,UAAU;4BAC7B,OAAOoJ,SAASC,IAAI,CAAC;gCAAEC,SAASH,MAAMG,OAAO;4BAAC,GAAG;gCAAEC,QAAQJ,MAAMI,MAAM;4BAAC;wBAC1E;wBACA,MAAMJ;oBACR;gBACF;gBACA,MAAMK,WACJtE,OACC,MAAMf,IAAIK,OAAO,CAACC,EAAE,CAACC,OAAO,CAAC;oBAC5B,sKAAsK;oBACtKtB,YAAYA,WAAWR,IAAI;oBAC3BuB;oBACAQ,OAAO;wBAAE0C,UAAU;4BAAEzC,QAAQ2D,OAAOlB,QAAQ;wBAAC;oBAAE;gBACjD;gBACF,MAAMb,SAASiD,gBAAgBD,UAAUjB,OAAOlB,QAAQ;gBACxD,MAAM5F,MAAM5B,qBAAqB;oBAC/B0H,kBAAkBjC;oBAClBgC,WAAWvH,KAAK8C,KAAK,CAACC,IAAI,CACxByF,OAAOjD,MAAM,IAAIkB,OAAOlB,MAAM,IAAIA,QAClCkB,OAAOuC,UAAU,IAAI;oBAEvB1B,UAAUkB,OAAOlB,QAAQ;gBAC3B,GAAGrB,eAAe;gBAClB,MAAM0D,cAAcvE,kBAAkBqE,UAAUlG;gBAChD,IAAIiF,OAAOtE,SAAS,KAAK,eAAe9D,cAAcqG,OAAOqB,QAAQ,IAAI,KAAK;oBAC5E,MAAM5B,OAAO,MAAMC,SAASjE,QAAQR;oBACpC,IAAI,CAACwE,MAAMgC,MAAM;wBACf,MAAM,IAAIjI,SAAS,8BAA8B;oBACnD;oBACA,OAAOkJ,cAAc;wBAAEjD;wBAAM9B;wBAAK6D,KAAKzC,SAAS9D,KAAKiI,aAAa;oBAAa;gBACjF;gBACA,MAAMC,KAAK,IAAIC,IAAIzF,IAAI6D,GAAG,IAAI,oBAAoB6B,YAAY,CAACC,GAAG,CAAC;gBACnE,IAAIlE,MAAMnE;gBACV,IAAIkI,MAAMjJ,gBAAgB8F,OAAOqB,QAAQ,GAAG;oBAC1CjC,MAAMhF,kBAAkBgF;gBAC1B,OAAO,IAAI+D,MAAMlJ,cAAc+F,OAAOqB,QAAQ,GAAG;oBAC/CjC,MAAMjF,wBAAwBiF;gBAChC;gBACA,2EAA2E;gBAC3E,MAAMmE,YAAaP,UACfQ,UAAUhC;gBACd,IACE,CAAC0B,eACD,CAACC,MACD,CAAEH,CAAAA,YAAY,cAAcA,YAAYA,SAASS,QAAQ,AAAD,KACxDF,WACA;oBACA,OAAOX,SAASc,QAAQ,CAACH,WAAW;gBACtC;gBACA,OAAOX,SAASc,QAAQ,CAAC3E,SAASK,KAAK8D,aAAaC,KAAK;YAC3D;YACAQ,mBAAmB;YACnBC,oBAAoB;gBAClBC,cAAc;oBAAEtK,MAAM;gBAAgE;gBACtFuK,SAASxJ,QAAQwJ,OAAO,KAAK,SAAS5D,QAAQ5F,QAAQyJ,aAAa;gBACnEC,UAAUlK,iCAAiC;oBACzCmK,QACE,OAAO3J,QAAQyJ,aAAa,KAAK,WAAWzJ,QAAQyJ,aAAa,CAACE,MAAM,GAAG9G;oBAC7EL;oBACAgC;oBACApD,YAAYpB,QAAQoB,UAAU;oBAC9BwI,WAAW5J,QAAQ4J,SAAS;gBAC9B;gBACAC,uBAAuB;gBACvBC,YAAY;YACd;QACF;IACF;IACA,MAAMC,SAASjL,mBAAmB;QAChCoB,aAAaC,OAAO6J,WAAW,CAC7B7J,OAAOC,IAAI,CAACF,aAAamC,GAAG,CAAC,CAACP,OAAS;gBACrCA;gBACA;oBACEyC;oBACA0F,qBAAqB;oBACrBxH,6BAA6BzC,QAAQyC,2BAA2B;oBAChE+B,QAAQ3C,UAAUC;gBACpB;aACD;QAEH0H,SAASxJ,QAAQwJ,OAAO;IAC1B,GAAGpH;IACH,oFAAoF;IACpF,iFAAiF;IACjF2H,OAAO7J,WAAW,GAAG6J,OAAO7J,WAAW,EAAEmC,IAAI,CAACC,aAC5C,CAAChB,WAAWiB,GAAG,CAACD,WAAWR,IAAI,IAC3BQ,aACA;YACE,GAAGA,UAAU;YACb8D,QAAQ9D,WAAW8D,MAAM,CAAC/D,GAAG,CAAC,CAAC6H,QAC7BA,MAAMpD,IAAI,KAAK,UAAUoD,MAAMjK,IAAI,KAAK,WACpC;oBACE,GAAGiK,KAAK;oBACRC,cAAc,CAAC,EAAE9G,GAAG,EAAE,GACpBA,IAAI8B,IAAI,IAAI,OAAO+E,MAAMC,YAAY,KAAK,WAAWD,MAAMC,YAAY,GAAG;gBAC9E,IACAD;QAER;IAEN,OAAOH;AACT;AAEA,eAAe3E,SAASjE,MAAgB,EAAE+D,eAAuB;IAC/D,MAAMkF,WAAW,CAAC,CAAC,EAAElF,gBAAgBnE,OAAO,CAAC,QAAQ,KAAK;IAC1D,MAAMd,OAAOhB,KAAK8C,KAAK,CAACgE,QAAQ,CAACqE;IACjC,IAAK,IAAIC,OAAO,IAAKA,QAAQ,IAAK;QAChC,MAAMC,SAAS,MAAMnJ,OAAOmJ,MAAM,CAACC,IAAI,CAAC;YACtCzD,MAAM;YACN0D,OAAO;YACPvL,MAAM,GAAGA,KAAK8C,KAAK,CAACiE,OAAO,CAACoE,UAAU,CAAC,CAAC;YACxCC;QACF;QACA,MAAMI,QAAQH,OAAOI,IAAI,CACvB,CAACC,QAAU,YAAYA,SAASA,MAAMP,QAAQ,KAAKA,YAAYO,MAAM1K,IAAI,KAAKA;QAEhF,IAAIwK,SAAS,YAAYA,SAASA,MAAM1G,MAAM,EAAE;YAC9C,MAAMoB,OAAO,MAAMhE,OAAOkE,KAAK,CAAC2D,GAAG,CAACyB,MAAM1G,MAAM;YAChD,IACEoB,KAAKpB,MAAM,KAAK0G,MAAM1G,MAAM,IAC5BoB,KAAKlF,IAAI,KAAKA,QACdkF,KAAKiF,QAAQ,KAAKA,YAClB,OAAOjF,KAAKiC,IAAI,KAAK,YACrB,CAACwD,OAAOC,aAAa,CAAC1F,KAAKiC,IAAI,KAC/BjC,KAAKiC,IAAI,GAAG,KACZ,CAACjC,KAAK+B,GAAG,EACT;gBACA,MAAM,IAAIrG,MAAM;YAClB;YACA,OAAO;gBAAE,GAAGsE,IAAI;gBAAElF,MAAMkF,KAAKlF,IAAI;gBAAE8D,QAAQoB,KAAKpB,MAAM;gBAAEqD,MAAMjC,KAAKiC,IAAI;gBAAEF,KAAK/B,KAAK+B,GAAG;YAAC;QACzF;QACA,IAAIoD,OAAOjJ,MAAM,GAAG,KAAK;YACvB,OAAOwB;QACT;IACF;AACF;AAEA,eAAesF,iBAAiBhH,MAAgB,EAAER,GAAW;IAC3D,+EAA+E;IAC/E,4EAA4E;IAC5E,IAAIwE,OAAO,MAAMC,SAASjE,QAAQR;IAClC,KAAK,MAAMmK,SAAS;QAAC;QAAK;QAAK;QAAM;KAAK,CAAE;QAC1C,IAAI3F,MAAM;YACR;QACF;QACA,MAAM,IAAI4F,QAAQ,CAACC,UAAYC,WAAWD,SAASF;QACnD3F,OAAO,MAAMC,SAASjE,QAAQR;IAChC;IACA,OAAOwE;AACT;AAEA,SAASd,kBAAkBD,GAAY,EAAE8G,QAAiB;IACxD,MAAMhJ,QAASkC,KAAuD8E,UAAU1G;IAChF,OAAO,OAAON,UAAU,YAAYA,QAAQgJ;AAC9C;AAEA,SAASvC,gBAAgBvE,GAAY,EAAEmC,QAAgB;IACrD,MAAMrE,QAASkC,OAAO,CAAC;IAIvB,OACE;QAAClC;QAAOA,MAAMiH,QAAQ;WAAKhJ,OAAOgL,MAAM,CAACjJ,MAAMkJ,QAAQ,IAAI,CAAC;KAAG,CAACV,IAAI,CAClE,CAACvF,OAASA,MAAMoB,aAAaA,aAC1BrE;AAET;AAEA,SAAS+B,cACPf,IAA6B,EAC7BiC,IAAkB,EAClB3C,SAAkB,EAClBV,IAAY,EACZN,QAAgB;IAEhB0B,KAAKgG,QAAQ,GAAG;QACdnF,QAAQoB,KAAKpB,MAAM;QACnBvB;QACA+E,cAAcpC,KAAKmC,SAAS;QAC5BJ,KAAK/B,KAAK+B,GAAG;IACf;IACAhE,KAAKmI,YAAY,GAAG7I,YAChB9C,4BAA4BwD,MAAMpB,MAAMN,YACxC/B,qBAAqByD;IACzB,OAAOA;AACT;AAEA,eAAekF,cAAc,EAC3BjD,IAAI,EACJ9B,GAAG,EACH6D,GAAG,EAKJ;IACC,MAAMoE,QAAQlM,oBAAoB;QAAEmM,UAAUpG,KAAKiC,IAAI;QAAEoE,aAAanI,IAAIoI,OAAO,CAACzC,GAAG,CAAC;IAAS;IAC/F,IAAIsC,MAAMxE,IAAI,KAAK,WAAW;QAC5B,OAAO,IAAIwB,SAAS,MAAM;YAAEmD,SAASH,MAAMG,OAAO;YAAEhD,QAAQ6C,MAAM7C,MAAM;QAAC;IAC3E;IACA,MAAMiD,WAAW,MAAMC,MAAMzE,KAAK;QAChC0E,OAAO;QACPH,SACEH,MAAMxE,IAAI,KAAK,YACX;YAAE+E,OAAO,CAAC,MAAM,EAAEP,MAAMQ,UAAU,CAAC,CAAC,EAAER,MAAMS,QAAQ,EAAE;QAAC,IACvDlJ;QACNmJ,QAAQ,IAAIC,kBAAkBD,MAAM;IACtC;IACA,IACEN,SAASjD,MAAM,KAAK6C,MAAM7C,MAAM,IAChCiD,SAASD,OAAO,CAACzC,GAAG,CAAC,sBAAsBsC,MAAMG,OAAO,CAAC,iBAAiB,IACzEH,MAAMxE,IAAI,KAAK,aACd4E,SAASD,OAAO,CAACzC,GAAG,CAAC,qBAAqBsC,MAAMG,OAAO,CAAC,gBAAgB,EAC1E;QACA,KAAKC,SAASQ,IAAI,EAAEC,SAASC,MAAM,IAAMvJ;QACzC,MAAM,IAAI3D,SAAS,uDAAuD;IAC5E;IACA,MAAMuM,UAAU,IAAIY,QAAQf,MAAMG,OAAO;IACzCA,QAAQa,GAAG,CAAC,gBAAgBnH,KAAKgC,IAAI,IAAI;IACzC,IAAI9H,cAAc8F,KAAKgC,IAAI,IAAI,KAAK;QAClCsE,QAAQa,GAAG,CAAC,2BAA2BhN;IACzC;IACA,OAAO,IAAIgJ,SAASoD,SAASQ,IAAI,EAAE;QAAET;QAAShD,QAAQ6C,MAAM7C,MAAM;IAAC;AACrE;AAEA,SAAS/F,YAAYJ,UAA4B;IAC/C,MAAM4B,SAAS,OAAO5B,WAAW4B,MAAM,KAAK,WAAW5B,WAAW4B,MAAM,GAAGrB;IAC3E,OACE+C,QAAQ1B,QAAQqI,6BAChB,CAACrI,QAAQsI,WAAWnL,UACpB6C,OAAOsI,SAAS,CAACvL,IAAI,CAAC,CAACkG,OAASA,KAAKsF,QAAQ,CAAC,QAAQpN,cAAc8H;AAExE;AAEA,SAASd,cAAc,EACrB5B,QAAQ,EACR9C,SAAS,EACTa,SAAS,EACTgC,MAAM,EAMP;IACC,OAAO;QACL;YACEsC,MAAM;YACN/D,OAAO;gBACL2J,WAAW,CAACxJ,OAAS0C,QAAQ1C,MAAMgG,UAAUhC;gBAC7CyF,eAAe;YACjB;YACAvG,QAAQ;gBACN;oBACEnG,MAAM;oBACN6G,MAAM;oBACN/D,OAAO;wBAAE6J,UAAU;4BAAEC,QAAQ;4BAAMC,QAAQ;wBAAK;oBAAE;oBAClD1G,QAAQ;wBACN;4BAAEnG,MAAM;4BAAU6G,MAAM;4BAAQ/D,OAAO;gCAAEgK,QAAQ;4BAAK;4BAAGC,QAAQ;wBAAK;wBACtE;4BAAE/M,MAAM;4BAAO6G,MAAM;4BAAQ/D,OAAO;gCAAEkK,UAAU;4BAAK;4BAAGC,OAAO;wBAAM;wBACrE;4BACEjN,MAAM;4BACN6G,MAAM;4BACN/D,OAAO;gCAAEkK,UAAU;4BAAK;4BACxBC,OAAO;wBACT;wBACA;4BACEjN,MAAM;4BACN6G,MAAM;4BACN/D,OAAO;gCACL2J,WAAW,CAACS,OAAOC,cACjB/I,kBAAkB;wCAAE6E,UAAUkE;oCAAY,GAAG5K;gCAC/CM,aAAa,CAAC,8BAA8B,EAAEnB,UAAU,+EAA+E,CAAC;gCACxIsL,UAAU;4BACZ;4BACAjK,OAAO;gCACLqK,WAAW;oCACT,CAAC,EAAEnK,IAAI,EAAEkK,WAAW,EAAE;wCACpB,IACE,CAAClK,MAAMqD,YACP,CAAClC,kBAAkB;4CAAE6E,UAAUkE;wCAAY,GAAG5K,YAC9C;4CACA,OAAOK;wCACT;wCACA,MAAMlC,MAAM5B,qBAAqB;4CAC/B0H,kBAAkBjC;4CAClBgC,WAAWvH,KAAK8C,KAAK,CAACC,IAAI,CAACkB,KAAKsB,MAAM,IAAIA,QAAQtB,KAAK+E,UAAU,IAAI;4CACrE1B,UAAUrD,KAAKqD,QAAQ;wCACzB,GAAGrB,eAAe;wCAClB,OAAOT,SAAS9D,KAAK;oCACvB;iCACD;4BACH;4BACAuM,OAAO;4BACPI,SAAS;wBACX;wBACA;4BAAErN,MAAM;4BAAgB6G,MAAM;4BAAQ/D,OAAO;gCAAEgK,QAAQ;4BAAK;wBAAE;qBAC/D;oBACDQ,eAAe;oBACfL,OAAO;gBACT;aACD;YACDA,OAAO;QACT;KACD;AACH"}

package/dist/migrate.js

@@ -88,6 +88,7 @@ const transferTag = (source, filePath, documentID, isPrivate)=>{
     if (!payload) {
         throw new Error('migrateFolder: `payload` is required.');
     }
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- Object.keys loses the generated consumer's UploadCollectionSlug union.
     const slugs = Object.keys(collections || {});
     if (!slugs.length) {
         throw new Error('migrateFolder: `collections` must include at least one upload collection.');
@@ -132,6 +133,7 @@ const transferTag = (source, filePath, documentID, isPrivate)=>{
                 collection: slug,
                 depth: 0,
                 limit: 100,
+                overrideAccess: true,
                 page,
                 sort: 'id'
             });
@@ -258,7 +260,8 @@ const transferTag = (source, filePath, documentID, isPrivate)=>{
                             data: {
                                 ...data,
                                 _objectKey: null
-                            }
+                            },
+                            overrideAccess: true
                         });
                     }
                     result.migrated += 1;

package/dist/migrate.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["/* eslint-disable no-console -- Migration progress is intentionally reported to the invoking process. */\n\nimport type { Payload, UploadCollectionSlug } from 'payload'\n\nimport ImageKit from '@imagekit/nodejs'\nimport { createHash } from 'node:crypto'\nimport path from 'node:path'\n\nimport { getAdminThumbnailURL, getPrivateAdminThumbnailURL } from './getAdminThumbnailURL.js'\n\nexport type MigrationLocation = {\n  /** Root folder, with collection subfolders beneath it. */\n  folder: string\n  privateKey: string\n  urlEndpoint: string\n}\n\nexport type MigrateFolderOptions = {\n  /** `true` preserves source privacy; an explicit `private` value sets destination privacy. */\n  collections: Partial<Record<UploadCollectionSlug, { private?: boolean } | true>>\n  /** Reads and reports the same plan without uploading or updating documents. Defaults to true. */\n  dryRun?: boolean\n  from: MigrationLocation\n  /** The database containing the records to update, including any already at the destination. */\n  payload: Payload\n  signedUrlExpiresIn?: number\n  to: MigrationLocation\n}\n\nexport type MigrationJobResult = {\n  collectionSlug: string\n  errors: { documentID: number | string; message: string }[]\n  failed: number\n  migrated: number\n  planned: number\n  /** Existing tagged transfers recovered after an interrupted run. Included in migrated when live. */\n  reused: number\n  skipped: number\n}\n\ntype Asset = {\n  fileId: string\n  filePath: string\n  isPrivateFile?: boolean\n  name: string\n  tags?: null | string[]\n  thumbnail?: string\n  updatedAt?: string\n  url: string\n  versionInfo?: { id?: string }\n}\n\nconst normalizeLocation = (location: MigrationLocation, label: string): MigrationLocation => {\n  if (!location?.privateKey?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.privateKey\\` is required.`)\n  }\n  if (!location.urlEndpoint?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.urlEndpoint\\` is required.`)\n  }\n  const endpoint = new URL(location.urlEndpoint)\n  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.search || endpoint.hash) {\n    throw new Error(\n      `migrateFolder: \\`${label}.urlEndpoint\\` must be an HTTP(S) URL without a query or fragment.`,\n    )\n  }\n  const folder = location.folder?.trim().replace(/^\\/+|\\/+$/g, '')\n  if (\n    !folder ||\n    folder.split('/').some((segment) => !segment || segment === '.' || segment === '..')\n  ) {\n    throw new Error(\n      `migrateFolder: \\`${label}.folder\\` must be a non-empty folder without dot segments.`,\n    )\n  }\n  return { ...location, folder: `/${folder}`, urlEndpoint: endpoint.href.replace(/\\/$/, '') }\n}\n\nconst isInFolder = (filePath: string, folder: string): boolean => filePath.startsWith(`${folder}/`)\n\nconst getAsset = async (client: ImageKit, fileId: string): Promise<Asset | undefined> => {\n  try {\n    const file = await client.files.get(fileId)\n    if (!file.fileId || !file.filePath || !file.url) {\n      throw new Error(`ImageKit returned incomplete file details for \"${fileId}\".`)\n    }\n    return {\n      ...file,\n      name: file.name || path.posix.basename(file.filePath),\n      fileId: file.fileId,\n      filePath: file.filePath,\n      url: file.url,\n    }\n  } catch (error) {\n    // Authentication errors, rate limits and outages are not evidence of a missing file.\n    if (error instanceof ImageKit.NotFoundError) {\n      return undefined\n    }\n    throw error\n  }\n}\n\nconst findDestination = async (client: ImageKit, filePath: string): Promise<Asset | undefined> => {\n  const limit = 100\n  for (let skip = 0; ; skip += limit) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit,\n      path: `${path.posix.dirname(filePath)}/`,\n      skip,\n    })\n    const match = assets.find((asset) => 'fileId' in asset && asset.filePath === filePath)\n    if (match && 'fileId' in match && match.fileId) {\n      return getAsset(client, match.fileId)\n    }\n    if (assets.length < limit) {\n      return undefined\n    }\n  }\n}\n\nconst transferTag = (\n  source: Asset,\n  filePath: string,\n  documentID: number | string,\n  isPrivate: boolean,\n): string => {\n  const identity = JSON.stringify([\n    source.fileId,\n    source.versionInfo?.id || source.updatedAt,\n    source.url,\n    filePath,\n    documentID,\n    isPrivate,\n  ])\n  return `payload-migration-${createHash('sha256').update(identity).digest('hex')}`\n}\n\n/**\n * Copy referenced originals between ImageKit folders/accounts and update Payload in place.\n * Transfers are tagged at upload time and never overwrite an existing destination file.\n * Reruns recover the upload/database-update gap without relying on filename equality.\n */\nexport const migrateFolder = async (\n  options: MigrateFolderOptions,\n): Promise<MigrationJobResult[]> => {\n  const { collections, dryRun = true, payload, signedUrlExpiresIn = 900 } = options\n  const from = normalizeLocation(options.from, 'from')\n  const to = normalizeLocation(options.to, 'to')\n  if (!payload) {\n    throw new Error('migrateFolder: `payload` is required.')\n  }\n  const slugs = Object.keys(collections || {})\n  if (!slugs.length) {\n    throw new Error('migrateFolder: `collections` must include at least one upload collection.')\n  }\n  for (const slug of slugs) {\n    if (!payload.collections[slug]?.config.upload) {\n      throw new Error(`migrateFolder: \"${slug}\" is not an upload collection.`)\n    }\n  }\n  if (!Number.isFinite(signedUrlExpiresIn) || signedUrlExpiresIn <= 0) {\n    throw new Error('migrateFolder: `signedUrlExpiresIn` must be positive.')\n  }\n\n  // A single transfer path for both cases gives uploads atomic provenance tags, including\n  // when an upload succeeds remotely but its response is lost. Native copy cannot add a tag.\n  const sourceClient = new ImageKit({ maxRetries: 0, privateKey: from.privateKey })\n  const destinationClient = new ImageKit({ maxRetries: 0, privateKey: to.privateKey })\n  const results: MigrationJobResult[] = []\n\n  for (const slug of slugs) {\n    const result: MigrationJobResult = {\n      collectionSlug: slug,\n      errors: [],\n      failed: 0,\n      migrated: 0,\n      planned: 0,\n      reused: 0,\n      skipped: 0,\n    }\n    const sourceFolder = path.posix.join(from.folder, slug)\n    const destinationFolder = path.posix.join(to.folder, slug)\n    const collectionOptions = collections[slug]\n    const plannedPaths = new Map<string, string>()\n    let page = 1\n    let hasNextPage: boolean\n\n    do {\n      const found = await payload.find({ collection: slug, depth: 0, limit: 100, page, sort: 'id' })\n      hasNextPage = found.hasNextPage\n      page += 1\n      for (const doc of found.docs) {\n        const reference = (doc as { imagekit?: { fileId?: string } }).imagekit\n        if (!reference?.fileId) {\n          result.skipped += 1\n          console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: no ImageKit file ID.`)\n          continue\n        }\n        try {\n          const atDestination = await getAsset(destinationClient, reference.fileId)\n          if (atDestination && isInFolder(atDestination.filePath, destinationFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: already at destination.`)\n            continue\n          }\n          const source = await getAsset(sourceClient, reference.fileId)\n          if (!source) {\n            throw new Error(`File \"${reference.fileId}\" was not found in the source account.`)\n          }\n          if (!isInFolder(source.filePath, sourceFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: outside ${sourceFolder}.`)\n            continue\n          }\n\n          const isPrivate =\n            collectionOptions !== true && typeof collectionOptions?.private === 'boolean'\n              ? collectionOptions.private\n              : source.isPrivateFile === true\n          const destinationPath = path.posix.join(destinationFolder, source.name)\n          const tag = transferTag(source, destinationPath, doc.id, isPrivate)\n          const previousTransfer = plannedPaths.get(destinationPath)\n          if (previousTransfer && previousTransfer !== tag) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": multiple source records target this path.`,\n            )\n          }\n          plannedPaths.set(destinationPath, tag)\n          let destination = await findDestination(destinationClient, destinationPath)\n          if (\n            destination &&\n            (!destination.tags?.includes(tag) || (destination.isPrivateFile === true) !== isPrivate)\n          ) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": existing asset is not this transfer.`,\n            )\n          }\n          if (destination) {\n            result.reused += 1\n          }\n          if (dryRun) {\n            result.planned += 1\n            console.log(\n              `[migrateFolder] [dry-run] Would ${destination ? 'reuse' : 'upload'} ${slug}/${doc.id}: ${source.filePath} -> ${destinationPath}`,\n            )\n            continue\n          }\n\n          if (!destination) {\n            const sourceURL = sourceClient.helper.buildSrc({\n              ...(source.isPrivateFile ? { expiresIn: signedUrlExpiresIn, signed: true } : {}),\n              src: source.filePath,\n              transformation: [{ raw: 'orig-true' }],\n              urlEndpoint: from.urlEndpoint,\n            })\n            const uploaded = await destinationClient.files.upload({\n              file: sourceURL,\n              fileName: source.name,\n              folder: destinationFolder,\n              isPrivateFile: isPrivate,\n              overwriteFile: false,\n              tags: [tag],\n              useUniqueFileName: false,\n            })\n            if (!uploaded.fileId) {\n              throw new Error(`Upload of \"${source.fileId}\" did not return a file ID.`)\n            }\n            destination = await getAsset(destinationClient, uploaded.fileId)\n            if (\n              !destination ||\n              destination.filePath !== destinationPath ||\n              !destination.tags?.includes(tag) ||\n              (destination.isPrivateFile === true) !== isPrivate\n            ) {\n              throw new Error(\n                `Upload of \"${source.fileId}\" returned unexpected destination details.`,\n              )\n            }\n          }\n\n          const imagekit = {\n            fileId: destination.fileId,\n            isPrivate,\n            thumbnailUrl: destination.thumbnail || null,\n            url: destinationClient.helper.buildSrc({\n              src: destination.filePath,\n              urlEndpoint: to.urlEndpoint,\n            }),\n          }\n          const updated = { ...doc, filename: destination.name, imagekit }\n          const data = {\n            filename: destination.name,\n            imagekit,\n            prefix: destinationFolder.replace(/^\\//, ''),\n            thumbnailURL: isPrivate\n              ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api)\n              : getAdminThumbnailURL(updated),\n          }\n          if (payload.db.name === 'mongoose') {\n            // A sparse unique MongoDB index permits missing keys, but only one null.\n            // Use the adapter directly: Local API merges the old key back into the\n            // update, which conflicts with $unset. Remove it and save the reference\n            // in one database write, so failed updates leave the source intact.\n            await payload.db.updateOne({\n              id: doc.id,\n              collection: slug,\n              data: { ...data, $unset: { _objectKey: 1 } },\n            })\n          } else {\n            await payload.update({\n              id: doc.id,\n              collection: slug,\n              context: { skipCloudStorage: true },\n              data: { ...data, _objectKey: null },\n            })\n          }\n          result.migrated += 1\n          console.log(`[migrateFolder] Migrated ${slug}/${doc.id} to ${destinationPath}.`)\n        } catch (error) {\n          const message = error instanceof Error ? error.message : 'Unknown migration error'\n          result.failed += 1\n          result.errors.push({ documentID: doc.id, message })\n          console.error(`[migrateFolder] Failed ${slug}/${doc.id}: ${message}`)\n        }\n      }\n    } while (hasNextPage)\n\n    results.push(result)\n    console.log(\n      `[migrateFolder] ${slug}: planned=${result.planned}, migrated=${result.migrated}, reused=${result.reused}, skipped=${result.skipped}, failed=${result.failed}.`,\n    )\n  }\n  return results\n}\n"],"names":["ImageKit","createHash","path","getAdminThumbnailURL","getPrivateAdminThumbnailURL","normalizeLocation","location","label","privateKey","trim","Error","urlEndpoint","endpoint","URL","includes","protocol","search","hash","folder","replace","split","some","segment","href","isInFolder","filePath","startsWith","getAsset","client","fileId","file","files","get","url","name","posix","basename","error","NotFoundError","undefined","findDestination","limit","skip","assets","list","type","dirname","match","find","asset","length","transferTag","source","documentID","isPrivate","identity","JSON","stringify","versionInfo","id","updatedAt","update","digest","migrateFolder","options","collections","dryRun","payload","signedUrlExpiresIn","from","to","slugs","Object","keys","slug","config","upload","Number","isFinite","sourceClient","maxRetries","destinationClient","results","result","collectionSlug","errors","failed","migrated","planned","reused","skipped","sourceFolder","join","destinationFolder","collectionOptions","plannedPaths","Map","page","hasNextPage","found","collection","depth","sort","doc","docs","reference","imagekit","console","log","atDestination","private","isPrivateFile","destinationPath","tag","previousTransfer","set","destination","tags","sourceURL","helper","buildSrc","expiresIn","signed","src","transformation","raw","uploaded","fileName","overwriteFile","useUniqueFileName","thumbnailUrl","thumbnail","updated","filename","data","prefix","thumbnailURL","routes","api","db","updateOne","$unset","_objectKey","context","skipCloudStorage","message","push"],"mappings":"AAAA,sGAAsG,GAItG,OAAOA,cAAc,mBAAkB;AACvC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,UAAU,YAAW;AAE5B,SAASC,oBAAoB,EAAEC,2BAA2B,QAAQ,4BAA2B;AA4C7F,MAAMC,oBAAoB,CAACC,UAA6BC;IACtD,IAAI,CAACD,UAAUE,YAAYC,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,0BAA0B,CAAC;IACvE;IACA,IAAI,CAACD,SAASK,WAAW,EAAEF,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,2BAA2B,CAAC;IACxE;IACA,MAAMK,WAAW,IAAIC,IAAIP,SAASK,WAAW;IAC7C,IAAI,CAAC;QAAC;QAAS;KAAS,CAACG,QAAQ,CAACF,SAASG,QAAQ,KAAKH,SAASI,MAAM,IAAIJ,SAASK,IAAI,EAAE;QACxF,MAAM,IAAIP,MACR,CAAC,iBAAiB,EAAEH,MAAM,kEAAkE,CAAC;IAEjG;IACA,MAAMW,SAASZ,SAASY,MAAM,EAAET,OAAOU,QAAQ,cAAc;IAC7D,IACE,CAACD,UACDA,OAAOE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAOA,YAAY,OAC/E;QACA,MAAM,IAAIZ,MACR,CAAC,iBAAiB,EAAEH,MAAM,0DAA0D,CAAC;IAEzF;IACA,OAAO;QAAE,GAAGD,QAAQ;QAAEY,QAAQ,CAAC,CAAC,EAAEA,QAAQ;QAAEP,aAAaC,SAASW,IAAI,CAACJ,OAAO,CAAC,OAAO;IAAI;AAC5F;AAEA,MAAMK,aAAa,CAACC,UAAkBP,SAA4BO,SAASC,UAAU,CAAC,GAAGR,OAAO,CAAC,CAAC;AAElG,MAAMS,WAAW,OAAOC,QAAkBC;IACxC,IAAI;QACF,MAAMC,OAAO,MAAMF,OAAOG,KAAK,CAACC,GAAG,CAACH;QACpC,IAAI,CAACC,KAAKD,MAAM,IAAI,CAACC,KAAKL,QAAQ,IAAI,CAACK,KAAKG,GAAG,EAAE;YAC/C,MAAM,IAAIvB,MAAM,CAAC,+CAA+C,EAAEmB,OAAO,EAAE,CAAC;QAC9E;QACA,OAAO;YACL,GAAGC,IAAI;YACPI,MAAMJ,KAAKI,IAAI,IAAIhC,KAAKiC,KAAK,CAACC,QAAQ,CAACN,KAAKL,QAAQ;YACpDI,QAAQC,KAAKD,MAAM;YACnBJ,UAAUK,KAAKL,QAAQ;YACvBQ,KAAKH,KAAKG,GAAG;QACf;IACF,EAAE,OAAOI,OAAO;QACd,qFAAqF;QACrF,IAAIA,iBAAiBrC,SAASsC,aAAa,EAAE;YAC3C,OAAOC;QACT;QACA,MAAMF;IACR;AACF;AAEA,MAAMG,kBAAkB,OAAOZ,QAAkBH;IAC/C,MAAMgB,QAAQ;IACd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMf,OAAOe,MAAM,CAACC,IAAI,CAAC;YACtCC,MAAM;YACNJ;YACAvC,MAAM,GAAGA,KAAKiC,KAAK,CAACW,OAAO,CAACrB,UAAU,CAAC,CAAC;YACxCiB;QACF;QACA,MAAMK,QAAQJ,OAAOK,IAAI,CAAC,CAACC,QAAU,YAAYA,SAASA,MAAMxB,QAAQ,KAAKA;QAC7E,IAAIsB,SAAS,YAAYA,SAASA,MAAMlB,MAAM,EAAE;YAC9C,OAAOF,SAASC,QAAQmB,MAAMlB,MAAM;QACtC;QACA,IAAIc,OAAOO,MAAM,GAAGT,OAAO;YACzB,OAAOF;QACT;IACF;AACF;AAEA,MAAMY,cAAc,CAClBC,QACA3B,UACA4B,YACAC;IAEA,MAAMC,WAAWC,KAAKC,SAAS,CAAC;QAC9BL,OAAOvB,MAAM;QACbuB,OAAOM,WAAW,EAAEC,MAAMP,OAAOQ,SAAS;QAC1CR,OAAOnB,GAAG;QACVR;QACA4B;QACAC;KACD;IACD,OAAO,CAAC,kBAAkB,EAAErD,WAAW,UAAU4D,MAAM,CAACN,UAAUO,MAAM,CAAC,QAAQ;AACnF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC;IAEA,MAAM,EAAEC,WAAW,EAAEC,SAAS,IAAI,EAAEC,OAAO,EAAEC,qBAAqB,GAAG,EAAE,GAAGJ;IAC1E,MAAMK,OAAOhE,kBAAkB2D,QAAQK,IAAI,EAAE;IAC7C,MAAMC,KAAKjE,kBAAkB2D,QAAQM,EAAE,EAAE;IACzC,IAAI,CAACH,SAAS;QACZ,MAAM,IAAIzD,MAAM;IAClB;IACA,MAAM6D,QAAQC,OAAOC,IAAI,CAACR,eAAe,CAAC;IAC1C,IAAI,CAACM,MAAMrB,MAAM,EAAE;QACjB,MAAM,IAAIxC,MAAM;IAClB;IACA,KAAK,MAAMgE,QAAQH,MAAO;QACxB,IAAI,CAACJ,QAAQF,WAAW,CAACS,KAAK,EAAEC,OAAOC,QAAQ;YAC7C,MAAM,IAAIlE,MAAM,CAAC,gBAAgB,EAAEgE,KAAK,8BAA8B,CAAC;QACzE;IACF;IACA,IAAI,CAACG,OAAOC,QAAQ,CAACV,uBAAuBA,sBAAsB,GAAG;QACnE,MAAM,IAAI1D,MAAM;IAClB;IAEA,wFAAwF;IACxF,2FAA2F;IAC3F,MAAMqE,eAAe,IAAI/E,SAAS;QAAEgF,YAAY;QAAGxE,YAAY6D,KAAK7D,UAAU;IAAC;IAC/E,MAAMyE,oBAAoB,IAAIjF,SAAS;QAAEgF,YAAY;QAAGxE,YAAY8D,GAAG9D,UAAU;IAAC;IAClF,MAAM0E,UAAgC,EAAE;IAExC,KAAK,MAAMR,QAAQH,MAAO;QACxB,MAAMY,SAA6B;YACjCC,gBAAgBV;YAChBW,QAAQ,EAAE;YACVC,QAAQ;YACRC,UAAU;YACVC,SAAS;YACTC,QAAQ;YACRC,SAAS;QACX;QACA,MAAMC,eAAezF,KAAKiC,KAAK,CAACyD,IAAI,CAACvB,KAAKnD,MAAM,EAAEwD;QAClD,MAAMmB,oBAAoB3F,KAAKiC,KAAK,CAACyD,IAAI,CAACtB,GAAGpD,MAAM,EAAEwD;QACrD,MAAMoB,oBAAoB7B,WAAW,CAACS,KAAK;QAC3C,MAAMqB,eAAe,IAAIC;QACzB,IAAIC,OAAO;QACX,IAAIC;QAEJ,GAAG;YACD,MAAMC,QAAQ,MAAMhC,QAAQnB,IAAI,CAAC;gBAAEoD,YAAY1B;gBAAM2B,OAAO;gBAAG5D,OAAO;gBAAKwD;gBAAMK,MAAM;YAAK;YAC5FJ,cAAcC,MAAMD,WAAW;YAC/BD,QAAQ;YACR,KAAK,MAAMM,OAAOJ,MAAMK,IAAI,CAAE;gBAC5B,MAAMC,YAAY,AAACF,IAA2CG,QAAQ;gBACtE,IAAI,CAACD,WAAW5E,QAAQ;oBACtBsD,OAAOO,OAAO,IAAI;oBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,sBAAsB,CAAC;oBAC9E;gBACF;gBACA,IAAI;oBACF,MAAMkD,gBAAgB,MAAMlF,SAASsD,mBAAmBwB,UAAU5E,MAAM;oBACxE,IAAIgF,iBAAiBrF,WAAWqF,cAAcpF,QAAQ,EAAEoE,oBAAoB;wBAC1EV,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,yBAAyB,CAAC;wBACjF;oBACF;oBACA,MAAMP,SAAS,MAAMzB,SAASoD,cAAc0B,UAAU5E,MAAM;oBAC5D,IAAI,CAACuB,QAAQ;wBACX,MAAM,IAAI1C,MAAM,CAAC,MAAM,EAAE+F,UAAU5E,MAAM,CAAC,sCAAsC,CAAC;oBACnF;oBACA,IAAI,CAACL,WAAW4B,OAAO3B,QAAQ,EAAEkE,eAAe;wBAC9CR,OAAOO,OAAO,IAAI;wBAClBiB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,UAAU,EAAEgC,aAAa,CAAC,CAAC;wBAClF;oBACF;oBAEA,MAAMrC,YACJwC,sBAAsB,QAAQ,OAAOA,mBAAmBgB,YAAY,YAChEhB,kBAAkBgB,OAAO,GACzB1D,OAAO2D,aAAa,KAAK;oBAC/B,MAAMC,kBAAkB9G,KAAKiC,KAAK,CAACyD,IAAI,CAACC,mBAAmBzC,OAAOlB,IAAI;oBACtE,MAAM+E,MAAM9D,YAAYC,QAAQ4D,iBAAiBT,IAAI5C,EAAE,EAAEL;oBACzD,MAAM4D,mBAAmBnB,aAAa/D,GAAG,CAACgF;oBAC1C,IAAIE,oBAAoBA,qBAAqBD,KAAK;wBAChD,MAAM,IAAIvG,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,4CAA4C,CAAC;oBAE7F;oBACAjB,aAAaoB,GAAG,CAACH,iBAAiBC;oBAClC,IAAIG,cAAc,MAAM5E,gBAAgByC,mBAAmB+B;oBAC3D,IACEI,eACC,CAAA,CAACA,YAAYC,IAAI,EAAEvG,SAASmG,QAAQ,AAACG,YAAYL,aAAa,KAAK,SAAUzD,SAAQ,GACtF;wBACA,MAAM,IAAI5C,MACR,CAAC,yBAAyB,EAAEsG,gBAAgB,uCAAuC,CAAC;oBAExF;oBACA,IAAII,aAAa;wBACfjC,OAAOM,MAAM,IAAI;oBACnB;oBACA,IAAIvB,QAAQ;wBACViB,OAAOK,OAAO,IAAI;wBAClBmB,QAAQC,GAAG,CACT,CAAC,gCAAgC,EAAEQ,cAAc,UAAU,SAAS,CAAC,EAAE1C,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEP,OAAO3B,QAAQ,CAAC,IAAI,EAAEuF,iBAAiB;wBAEnI;oBACF;oBAEA,IAAI,CAACI,aAAa;wBAChB,MAAME,YAAYvC,aAAawC,MAAM,CAACC,QAAQ,CAAC;4BAC7C,GAAIpE,OAAO2D,aAAa,GAAG;gCAAEU,WAAWrD;gCAAoBsD,QAAQ;4BAAK,IAAI,CAAC,CAAC;4BAC/EC,KAAKvE,OAAO3B,QAAQ;4BACpBmG,gBAAgB;gCAAC;oCAAEC,KAAK;gCAAY;6BAAE;4BACtClH,aAAa0D,KAAK1D,WAAW;wBAC/B;wBACA,MAAMmH,WAAW,MAAM7C,kBAAkBlD,KAAK,CAAC6C,MAAM,CAAC;4BACpD9C,MAAMwF;4BACNS,UAAU3E,OAAOlB,IAAI;4BACrBhB,QAAQ2E;4BACRkB,eAAezD;4BACf0E,eAAe;4BACfX,MAAM;gCAACJ;6BAAI;4BACXgB,mBAAmB;wBACrB;wBACA,IAAI,CAACH,SAASjG,MAAM,EAAE;4BACpB,MAAM,IAAInB,MAAM,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,2BAA2B,CAAC;wBAC1E;wBACAuF,cAAc,MAAMzF,SAASsD,mBAAmB6C,SAASjG,MAAM;wBAC/D,IACE,CAACuF,eACDA,YAAY3F,QAAQ,KAAKuF,mBACzB,CAACI,YAAYC,IAAI,EAAEvG,SAASmG,QAC5B,AAACG,YAAYL,aAAa,KAAK,SAAUzD,WACzC;4BACA,MAAM,IAAI5C,MACR,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,0CAA0C,CAAC;wBAE3E;oBACF;oBAEA,MAAM6E,WAAW;wBACf7E,QAAQuF,YAAYvF,MAAM;wBAC1ByB;wBACA4E,cAAcd,YAAYe,SAAS,IAAI;wBACvClG,KAAKgD,kBAAkBsC,MAAM,CAACC,QAAQ,CAAC;4BACrCG,KAAKP,YAAY3F,QAAQ;4BACzBd,aAAa2D,GAAG3D,WAAW;wBAC7B;oBACF;oBACA,MAAMyH,UAAU;wBAAE,GAAG7B,GAAG;wBAAE8B,UAAUjB,YAAYlF,IAAI;wBAAEwE;oBAAS;oBAC/D,MAAM4B,OAAO;wBACXD,UAAUjB,YAAYlF,IAAI;wBAC1BwE;wBACA6B,QAAQ1C,kBAAkB1E,OAAO,CAAC,OAAO;wBACzCqH,cAAclF,YACVlD,4BAA4BgI,SAAS1D,MAAMP,QAAQQ,MAAM,CAAC8D,MAAM,CAACC,GAAG,IACpEvI,qBAAqBiI;oBAC3B;oBACA,IAAIjE,QAAQwE,EAAE,CAACzG,IAAI,KAAK,YAAY;wBAClC,yEAAyE;wBACzE,uEAAuE;wBACvE,wEAAwE;wBACxE,oEAAoE;wBACpE,MAAMiC,QAAQwE,EAAE,CAACC,SAAS,CAAC;4BACzBjF,IAAI4C,IAAI5C,EAAE;4BACVyC,YAAY1B;4BACZ4D,MAAM;gCAAE,GAAGA,IAAI;gCAAEO,QAAQ;oCAAEC,YAAY;gCAAE;4BAAE;wBAC7C;oBACF,OAAO;wBACL,MAAM3E,QAAQN,MAAM,CAAC;4BACnBF,IAAI4C,IAAI5C,EAAE;4BACVyC,YAAY1B;4BACZqE,SAAS;gCAAEC,kBAAkB;4BAAK;4BAClCV,MAAM;gCAAE,GAAGA,IAAI;gCAAEQ,YAAY;4BAAK;wBACpC;oBACF;oBACA3D,OAAOI,QAAQ,IAAI;oBACnBoB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAElC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,IAAI,EAAEqD,gBAAgB,CAAC,CAAC;gBACjF,EAAE,OAAO3E,OAAO;oBACd,MAAM4G,UAAU5G,iBAAiB3B,QAAQ2B,MAAM4G,OAAO,GAAG;oBACzD9D,OAAOG,MAAM,IAAI;oBACjBH,OAAOE,MAAM,CAAC6D,IAAI,CAAC;wBAAE7F,YAAYkD,IAAI5C,EAAE;wBAAEsF;oBAAQ;oBACjDtC,QAAQtE,KAAK,CAAC,CAAC,uBAAuB,EAAEqC,KAAK,CAAC,EAAE6B,IAAI5C,EAAE,CAAC,EAAE,EAAEsF,SAAS;gBACtE;YACF;QACF,QAAS/C,YAAY;QAErBhB,QAAQgE,IAAI,CAAC/D;QACbwB,QAAQC,GAAG,CACT,CAAC,gBAAgB,EAAElC,KAAK,UAAU,EAAES,OAAOK,OAAO,CAAC,WAAW,EAAEL,OAAOI,QAAQ,CAAC,SAAS,EAAEJ,OAAOM,MAAM,CAAC,UAAU,EAAEN,OAAOO,OAAO,CAAC,SAAS,EAAEP,OAAOG,MAAM,CAAC,CAAC,CAAC;IAEnK;IACA,OAAOJ;AACT,EAAC"}
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["/* eslint-disable no-console -- Migration progress is intentionally reported to the invoking process. */\n\nimport type { Payload, UploadCollectionSlug } from 'payload'\n\nimport ImageKit from '@imagekit/nodejs'\nimport { createHash } from 'node:crypto'\nimport path from 'node:path'\n\nimport { getAdminThumbnailURL, getPrivateAdminThumbnailURL } from './getAdminThumbnailURL.js'\n\nexport type MigrationLocation = {\n  /** Root folder, with collection subfolders beneath it. */\n  folder: string\n  privateKey: string\n  urlEndpoint: string\n}\n\nexport type MigrateFolderOptions = {\n  /** `true` preserves source privacy; an explicit `private` value sets destination privacy. */\n  collections: Partial<Record<UploadCollectionSlug, { private?: boolean } | true>>\n  /** Reads and reports the same plan without uploading or updating documents. Defaults to true. */\n  dryRun?: boolean\n  from: MigrationLocation\n  /** The database containing the records to update, including any already at the destination. */\n  payload: Payload\n  signedUrlExpiresIn?: number\n  to: MigrationLocation\n}\n\nexport type MigrationJobResult = {\n  collectionSlug: string\n  errors: { documentID: number | string; message: string }[]\n  failed: number\n  migrated: number\n  planned: number\n  /** Existing tagged transfers recovered after an interrupted run. Included in migrated when live. */\n  reused: number\n  skipped: number\n}\n\ntype Asset = {\n  fileId: string\n  filePath: string\n  isPrivateFile?: boolean\n  name: string\n  tags?: null | string[]\n  thumbnail?: string\n  updatedAt?: string\n  url: string\n  versionInfo?: { id?: string }\n}\n\nconst normalizeLocation = (location: MigrationLocation, label: string): MigrationLocation => {\n  if (!location?.privateKey?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.privateKey\\` is required.`)\n  }\n  if (!location.urlEndpoint?.trim()) {\n    throw new Error(`migrateFolder: \\`${label}.urlEndpoint\\` is required.`)\n  }\n  const endpoint = new URL(location.urlEndpoint)\n  if (!['http:', 'https:'].includes(endpoint.protocol) || endpoint.search || endpoint.hash) {\n    throw new Error(\n      `migrateFolder: \\`${label}.urlEndpoint\\` must be an HTTP(S) URL without a query or fragment.`,\n    )\n  }\n  const folder = location.folder?.trim().replace(/^\\/+|\\/+$/g, '')\n  if (\n    !folder ||\n    folder.split('/').some((segment) => !segment || segment === '.' || segment === '..')\n  ) {\n    throw new Error(\n      `migrateFolder: \\`${label}.folder\\` must be a non-empty folder without dot segments.`,\n    )\n  }\n  return { ...location, folder: `/${folder}`, urlEndpoint: endpoint.href.replace(/\\/$/, '') }\n}\n\nconst isInFolder = (filePath: string, folder: string): boolean => filePath.startsWith(`${folder}/`)\n\nconst getAsset = async (client: ImageKit, fileId: string): Promise<Asset | undefined> => {\n  try {\n    const file = await client.files.get(fileId)\n    if (!file.fileId || !file.filePath || !file.url) {\n      throw new Error(`ImageKit returned incomplete file details for \"${fileId}\".`)\n    }\n    return {\n      ...file,\n      name: file.name || path.posix.basename(file.filePath),\n      fileId: file.fileId,\n      filePath: file.filePath,\n      url: file.url,\n    }\n  } catch (error) {\n    // Authentication errors, rate limits and outages are not evidence of a missing file.\n    if (error instanceof ImageKit.NotFoundError) {\n      return undefined\n    }\n    throw error\n  }\n}\n\nconst findDestination = async (client: ImageKit, filePath: string): Promise<Asset | undefined> => {\n  const limit = 100\n  for (let skip = 0; ; skip += limit) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit,\n      path: `${path.posix.dirname(filePath)}/`,\n      skip,\n    })\n    const match = assets.find((asset) => 'fileId' in asset && asset.filePath === filePath)\n    if (match && 'fileId' in match && match.fileId) {\n      return getAsset(client, match.fileId)\n    }\n    if (assets.length < limit) {\n      return undefined\n    }\n  }\n}\n\nconst transferTag = (\n  source: Asset,\n  filePath: string,\n  documentID: number | string,\n  isPrivate: boolean,\n): string => {\n  const identity = JSON.stringify([\n    source.fileId,\n    source.versionInfo?.id || source.updatedAt,\n    source.url,\n    filePath,\n    documentID,\n    isPrivate,\n  ])\n  return `payload-migration-${createHash('sha256').update(identity).digest('hex')}`\n}\n\n/**\n * Copy referenced originals between ImageKit folders/accounts and update Payload in place.\n * Transfers are tagged at upload time and never overwrite an existing destination file.\n * Reruns recover the upload/database-update gap without relying on filename equality.\n */\nexport const migrateFolder = async (\n  options: MigrateFolderOptions,\n): Promise<MigrationJobResult[]> => {\n  const { collections, dryRun = true, payload, signedUrlExpiresIn = 900 } = options\n  const from = normalizeLocation(options.from, 'from')\n  const to = normalizeLocation(options.to, 'to')\n  if (!payload) {\n    throw new Error('migrateFolder: `payload` is required.')\n  }\n  // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion -- Object.keys loses the generated consumer's UploadCollectionSlug union.\n  const slugs = Object.keys(collections || {}) as UploadCollectionSlug[]\n  if (!slugs.length) {\n    throw new Error('migrateFolder: `collections` must include at least one upload collection.')\n  }\n  for (const slug of slugs) {\n    if (!payload.collections[slug]?.config.upload) {\n      throw new Error(`migrateFolder: \"${slug}\" is not an upload collection.`)\n    }\n  }\n  if (!Number.isFinite(signedUrlExpiresIn) || signedUrlExpiresIn <= 0) {\n    throw new Error('migrateFolder: `signedUrlExpiresIn` must be positive.')\n  }\n\n  // A single transfer path for both cases gives uploads atomic provenance tags, including\n  // when an upload succeeds remotely but its response is lost. Native copy cannot add a tag.\n  const sourceClient = new ImageKit({ maxRetries: 0, privateKey: from.privateKey })\n  const destinationClient = new ImageKit({ maxRetries: 0, privateKey: to.privateKey })\n  const results: MigrationJobResult[] = []\n\n  for (const slug of slugs) {\n    const result: MigrationJobResult = {\n      collectionSlug: slug,\n      errors: [],\n      failed: 0,\n      migrated: 0,\n      planned: 0,\n      reused: 0,\n      skipped: 0,\n    }\n    const sourceFolder = path.posix.join(from.folder, slug)\n    const destinationFolder = path.posix.join(to.folder, slug)\n    const collectionOptions = collections[slug]\n    const plannedPaths = new Map<string, string>()\n    let page = 1\n    let hasNextPage: boolean\n\n    do {\n      const found = await payload.find({\n        collection: slug,\n        depth: 0,\n        limit: 100,\n        overrideAccess: true,\n        page,\n        sort: 'id',\n      })\n      hasNextPage = found.hasNextPage\n      page += 1\n      for (const doc of found.docs) {\n        const reference = (doc as { imagekit?: { fileId?: string } }).imagekit\n        if (!reference?.fileId) {\n          result.skipped += 1\n          console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: no ImageKit file ID.`)\n          continue\n        }\n        try {\n          const atDestination = await getAsset(destinationClient, reference.fileId)\n          if (atDestination && isInFolder(atDestination.filePath, destinationFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: already at destination.`)\n            continue\n          }\n          const source = await getAsset(sourceClient, reference.fileId)\n          if (!source) {\n            throw new Error(`File \"${reference.fileId}\" was not found in the source account.`)\n          }\n          if (!isInFolder(source.filePath, sourceFolder)) {\n            result.skipped += 1\n            console.log(`[migrateFolder] Skipping ${slug}/${doc.id}: outside ${sourceFolder}.`)\n            continue\n          }\n\n          const isPrivate =\n            collectionOptions !== true && typeof collectionOptions?.private === 'boolean'\n              ? collectionOptions.private\n              : source.isPrivateFile === true\n          const destinationPath = path.posix.join(destinationFolder, source.name)\n          const tag = transferTag(source, destinationPath, doc.id, isPrivate)\n          const previousTransfer = plannedPaths.get(destinationPath)\n          if (previousTransfer && previousTransfer !== tag) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": multiple source records target this path.`,\n            )\n          }\n          plannedPaths.set(destinationPath, tag)\n          let destination = await findDestination(destinationClient, destinationPath)\n          if (\n            destination &&\n            (!destination.tags?.includes(tag) || (destination.isPrivateFile === true) !== isPrivate)\n          ) {\n            throw new Error(\n              `Destination conflict at \"${destinationPath}\": existing asset is not this transfer.`,\n            )\n          }\n          if (destination) {\n            result.reused += 1\n          }\n          if (dryRun) {\n            result.planned += 1\n            console.log(\n              `[migrateFolder] [dry-run] Would ${destination ? 'reuse' : 'upload'} ${slug}/${doc.id}: ${source.filePath} -> ${destinationPath}`,\n            )\n            continue\n          }\n\n          if (!destination) {\n            const sourceURL = sourceClient.helper.buildSrc({\n              ...(source.isPrivateFile ? { expiresIn: signedUrlExpiresIn, signed: true } : {}),\n              src: source.filePath,\n              transformation: [{ raw: 'orig-true' }],\n              urlEndpoint: from.urlEndpoint,\n            })\n            const uploaded = await destinationClient.files.upload({\n              file: sourceURL,\n              fileName: source.name,\n              folder: destinationFolder,\n              isPrivateFile: isPrivate,\n              overwriteFile: false,\n              tags: [tag],\n              useUniqueFileName: false,\n            })\n            if (!uploaded.fileId) {\n              throw new Error(`Upload of \"${source.fileId}\" did not return a file ID.`)\n            }\n            destination = await getAsset(destinationClient, uploaded.fileId)\n            if (\n              !destination ||\n              destination.filePath !== destinationPath ||\n              !destination.tags?.includes(tag) ||\n              (destination.isPrivateFile === true) !== isPrivate\n            ) {\n              throw new Error(\n                `Upload of \"${source.fileId}\" returned unexpected destination details.`,\n              )\n            }\n          }\n\n          const imagekit = {\n            fileId: destination.fileId,\n            isPrivate,\n            thumbnailUrl: destination.thumbnail || null,\n            url: destinationClient.helper.buildSrc({\n              src: destination.filePath,\n              urlEndpoint: to.urlEndpoint,\n            }),\n          }\n          const updated = { ...doc, filename: destination.name, imagekit }\n          const data = {\n            filename: destination.name,\n            imagekit,\n            prefix: destinationFolder.replace(/^\\//, ''),\n            thumbnailURL: isPrivate\n              ? getPrivateAdminThumbnailURL(updated, slug, payload.config.routes.api)\n              : getAdminThumbnailURL(updated),\n          }\n          if (payload.db.name === 'mongoose') {\n            // A sparse unique MongoDB index permits missing keys, but only one null.\n            // Use the adapter directly: Local API merges the old key back into the\n            // update, which conflicts with $unset. Remove it and save the reference\n            // in one database write, so failed updates leave the source intact.\n            await payload.db.updateOne({\n              id: doc.id,\n              collection: slug,\n              data: { ...data, $unset: { _objectKey: 1 } },\n            })\n          } else {\n            await payload.update({\n              id: doc.id,\n              collection: slug,\n              context: { skipCloudStorage: true },\n              data: { ...data, _objectKey: null },\n              overrideAccess: true,\n            })\n          }\n          result.migrated += 1\n          console.log(`[migrateFolder] Migrated ${slug}/${doc.id} to ${destinationPath}.`)\n        } catch (error) {\n          const message = error instanceof Error ? error.message : 'Unknown migration error'\n          result.failed += 1\n          result.errors.push({ documentID: doc.id, message })\n          console.error(`[migrateFolder] Failed ${slug}/${doc.id}: ${message}`)\n        }\n      }\n    } while (hasNextPage)\n\n    results.push(result)\n    console.log(\n      `[migrateFolder] ${slug}: planned=${result.planned}, migrated=${result.migrated}, reused=${result.reused}, skipped=${result.skipped}, failed=${result.failed}.`,\n    )\n  }\n  return results\n}\n"],"names":["ImageKit","createHash","path","getAdminThumbnailURL","getPrivateAdminThumbnailURL","normalizeLocation","location","label","privateKey","trim","Error","urlEndpoint","endpoint","URL","includes","protocol","search","hash","folder","replace","split","some","segment","href","isInFolder","filePath","startsWith","getAsset","client","fileId","file","files","get","url","name","posix","basename","error","NotFoundError","undefined","findDestination","limit","skip","assets","list","type","dirname","match","find","asset","length","transferTag","source","documentID","isPrivate","identity","JSON","stringify","versionInfo","id","updatedAt","update","digest","migrateFolder","options","collections","dryRun","payload","signedUrlExpiresIn","from","to","slugs","Object","keys","slug","config","upload","Number","isFinite","sourceClient","maxRetries","destinationClient","results","result","collectionSlug","errors","failed","migrated","planned","reused","skipped","sourceFolder","join","destinationFolder","collectionOptions","plannedPaths","Map","page","hasNextPage","found","collection","depth","overrideAccess","sort","doc","docs","reference","imagekit","console","log","atDestination","private","isPrivateFile","destinationPath","tag","previousTransfer","set","destination","tags","sourceURL","helper","buildSrc","expiresIn","signed","src","transformation","raw","uploaded","fileName","overwriteFile","useUniqueFileName","thumbnailUrl","thumbnail","updated","filename","data","prefix","thumbnailURL","routes","api","db","updateOne","$unset","_objectKey","context","skipCloudStorage","message","push"],"mappings":"AAAA,sGAAsG,GAItG,OAAOA,cAAc,mBAAkB;AACvC,SAASC,UAAU,QAAQ,cAAa;AACxC,OAAOC,UAAU,YAAW;AAE5B,SAASC,oBAAoB,EAAEC,2BAA2B,QAAQ,4BAA2B;AA4C7F,MAAMC,oBAAoB,CAACC,UAA6BC;IACtD,IAAI,CAACD,UAAUE,YAAYC,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,0BAA0B,CAAC;IACvE;IACA,IAAI,CAACD,SAASK,WAAW,EAAEF,QAAQ;QACjC,MAAM,IAAIC,MAAM,CAAC,iBAAiB,EAAEH,MAAM,2BAA2B,CAAC;IACxE;IACA,MAAMK,WAAW,IAAIC,IAAIP,SAASK,WAAW;IAC7C,IAAI,CAAC;QAAC;QAAS;KAAS,CAACG,QAAQ,CAACF,SAASG,QAAQ,KAAKH,SAASI,MAAM,IAAIJ,SAASK,IAAI,EAAE;QACxF,MAAM,IAAIP,MACR,CAAC,iBAAiB,EAAEH,MAAM,kEAAkE,CAAC;IAEjG;IACA,MAAMW,SAASZ,SAASY,MAAM,EAAET,OAAOU,QAAQ,cAAc;IAC7D,IACE,CAACD,UACDA,OAAOE,KAAK,CAAC,KAAKC,IAAI,CAAC,CAACC,UAAY,CAACA,WAAWA,YAAY,OAAOA,YAAY,OAC/E;QACA,MAAM,IAAIZ,MACR,CAAC,iBAAiB,EAAEH,MAAM,0DAA0D,CAAC;IAEzF;IACA,OAAO;QAAE,GAAGD,QAAQ;QAAEY,QAAQ,CAAC,CAAC,EAAEA,QAAQ;QAAEP,aAAaC,SAASW,IAAI,CAACJ,OAAO,CAAC,OAAO;IAAI;AAC5F;AAEA,MAAMK,aAAa,CAACC,UAAkBP,SAA4BO,SAASC,UAAU,CAAC,GAAGR,OAAO,CAAC,CAAC;AAElG,MAAMS,WAAW,OAAOC,QAAkBC;IACxC,IAAI;QACF,MAAMC,OAAO,MAAMF,OAAOG,KAAK,CAACC,GAAG,CAACH;QACpC,IAAI,CAACC,KAAKD,MAAM,IAAI,CAACC,KAAKL,QAAQ,IAAI,CAACK,KAAKG,GAAG,EAAE;YAC/C,MAAM,IAAIvB,MAAM,CAAC,+CAA+C,EAAEmB,OAAO,EAAE,CAAC;QAC9E;QACA,OAAO;YACL,GAAGC,IAAI;YACPI,MAAMJ,KAAKI,IAAI,IAAIhC,KAAKiC,KAAK,CAACC,QAAQ,CAACN,KAAKL,QAAQ;YACpDI,QAAQC,KAAKD,MAAM;YACnBJ,UAAUK,KAAKL,QAAQ;YACvBQ,KAAKH,KAAKG,GAAG;QACf;IACF,EAAE,OAAOI,OAAO;QACd,qFAAqF;QACrF,IAAIA,iBAAiBrC,SAASsC,aAAa,EAAE;YAC3C,OAAOC;QACT;QACA,MAAMF;IACR;AACF;AAEA,MAAMG,kBAAkB,OAAOZ,QAAkBH;IAC/C,MAAMgB,QAAQ;IACd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMf,OAAOe,MAAM,CAACC,IAAI,CAAC;YACtCC,MAAM;YACNJ;YACAvC,MAAM,GAAGA,KAAKiC,KAAK,CAACW,OAAO,CAACrB,UAAU,CAAC,CAAC;YACxCiB;QACF;QACA,MAAMK,QAAQJ,OAAOK,IAAI,CAAC,CAACC,QAAU,YAAYA,SAASA,MAAMxB,QAAQ,KAAKA;QAC7E,IAAIsB,SAAS,YAAYA,SAASA,MAAMlB,MAAM,EAAE;YAC9C,OAAOF,SAASC,QAAQmB,MAAMlB,MAAM;QACtC;QACA,IAAIc,OAAOO,MAAM,GAAGT,OAAO;YACzB,OAAOF;QACT;IACF;AACF;AAEA,MAAMY,cAAc,CAClBC,QACA3B,UACA4B,YACAC;IAEA,MAAMC,WAAWC,KAAKC,SAAS,CAAC;QAC9BL,OAAOvB,MAAM;QACbuB,OAAOM,WAAW,EAAEC,MAAMP,OAAOQ,SAAS;QAC1CR,OAAOnB,GAAG;QACVR;QACA4B;QACAC;KACD;IACD,OAAO,CAAC,kBAAkB,EAAErD,WAAW,UAAU4D,MAAM,CAACN,UAAUO,MAAM,CAAC,QAAQ;AACnF;AAEA;;;;CAIC,GACD,OAAO,MAAMC,gBAAgB,OAC3BC;IAEA,MAAM,EAAEC,WAAW,EAAEC,SAAS,IAAI,EAAEC,OAAO,EAAEC,qBAAqB,GAAG,EAAE,GAAGJ;IAC1E,MAAMK,OAAOhE,kBAAkB2D,QAAQK,IAAI,EAAE;IAC7C,MAAMC,KAAKjE,kBAAkB2D,QAAQM,EAAE,EAAE;IACzC,IAAI,CAACH,SAAS;QACZ,MAAM,IAAIzD,MAAM;IAClB;IACA,sJAAsJ;IACtJ,MAAM6D,QAAQC,OAAOC,IAAI,CAACR,eAAe,CAAC;IAC1C,IAAI,CAACM,MAAMrB,MAAM,EAAE;QACjB,MAAM,IAAIxC,MAAM;IAClB;IACA,KAAK,MAAMgE,QAAQH,MAAO;QACxB,IAAI,CAACJ,QAAQF,WAAW,CAACS,KAAK,EAAEC,OAAOC,QAAQ;YAC7C,MAAM,IAAIlE,MAAM,CAAC,gBAAgB,EAAEgE,KAAK,8BAA8B,CAAC;QACzE;IACF;IACA,IAAI,CAACG,OAAOC,QAAQ,CAACV,uBAAuBA,sBAAsB,GAAG;QACnE,MAAM,IAAI1D,MAAM;IAClB;IAEA,wFAAwF;IACxF,2FAA2F;IAC3F,MAAMqE,eAAe,IAAI/E,SAAS;QAAEgF,YAAY;QAAGxE,YAAY6D,KAAK7D,UAAU;IAAC;IAC/E,MAAMyE,oBAAoB,IAAIjF,SAAS;QAAEgF,YAAY;QAAGxE,YAAY8D,GAAG9D,UAAU;IAAC;IAClF,MAAM0E,UAAgC,EAAE;IAExC,KAAK,MAAMR,QAAQH,MAAO;QACxB,MAAMY,SAA6B;YACjCC,gBAAgBV;YAChBW,QAAQ,EAAE;YACVC,QAAQ;YACRC,UAAU;YACVC,SAAS;YACTC,QAAQ;YACRC,SAAS;QACX;QACA,MAAMC,eAAezF,KAAKiC,KAAK,CAACyD,IAAI,CAACvB,KAAKnD,MAAM,EAAEwD;QAClD,MAAMmB,oBAAoB3F,KAAKiC,KAAK,CAACyD,IAAI,CAACtB,GAAGpD,MAAM,EAAEwD;QACrD,MAAMoB,oBAAoB7B,WAAW,CAACS,KAAK;QAC3C,MAAMqB,eAAe,IAAIC;QACzB,IAAIC,OAAO;QACX,IAAIC;QAEJ,GAAG;YACD,MAAMC,QAAQ,MAAMhC,QAAQnB,IAAI,CAAC;gBAC/BoD,YAAY1B;gBACZ2B,OAAO;gBACP5D,OAAO;gBACP6D,gBAAgB;gBAChBL;gBACAM,MAAM;YACR;YACAL,cAAcC,MAAMD,WAAW;YAC/BD,QAAQ;YACR,KAAK,MAAMO,OAAOL,MAAMM,IAAI,CAAE;gBAC5B,MAAMC,YAAY,AAACF,IAA2CG,QAAQ;gBACtE,IAAI,CAACD,WAAW7E,QAAQ;oBACtBsD,OAAOO,OAAO,IAAI;oBAClBkB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAEnC,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,sBAAsB,CAAC;oBAC9E;gBACF;gBACA,IAAI;oBACF,MAAMmD,gBAAgB,MAAMnF,SAASsD,mBAAmByB,UAAU7E,MAAM;oBACxE,IAAIiF,iBAAiBtF,WAAWsF,cAAcrF,QAAQ,EAAEoE,oBAAoB;wBAC1EV,OAAOO,OAAO,IAAI;wBAClBkB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAEnC,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,yBAAyB,CAAC;wBACjF;oBACF;oBACA,MAAMP,SAAS,MAAMzB,SAASoD,cAAc2B,UAAU7E,MAAM;oBAC5D,IAAI,CAACuB,QAAQ;wBACX,MAAM,IAAI1C,MAAM,CAAC,MAAM,EAAEgG,UAAU7E,MAAM,CAAC,sCAAsC,CAAC;oBACnF;oBACA,IAAI,CAACL,WAAW4B,OAAO3B,QAAQ,EAAEkE,eAAe;wBAC9CR,OAAOO,OAAO,IAAI;wBAClBkB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAEnC,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,UAAU,EAAEgC,aAAa,CAAC,CAAC;wBAClF;oBACF;oBAEA,MAAMrC,YACJwC,sBAAsB,QAAQ,OAAOA,mBAAmBiB,YAAY,YAChEjB,kBAAkBiB,OAAO,GACzB3D,OAAO4D,aAAa,KAAK;oBAC/B,MAAMC,kBAAkB/G,KAAKiC,KAAK,CAACyD,IAAI,CAACC,mBAAmBzC,OAAOlB,IAAI;oBACtE,MAAMgF,MAAM/D,YAAYC,QAAQ6D,iBAAiBT,IAAI7C,EAAE,EAAEL;oBACzD,MAAM6D,mBAAmBpB,aAAa/D,GAAG,CAACiF;oBAC1C,IAAIE,oBAAoBA,qBAAqBD,KAAK;wBAChD,MAAM,IAAIxG,MACR,CAAC,yBAAyB,EAAEuG,gBAAgB,4CAA4C,CAAC;oBAE7F;oBACAlB,aAAaqB,GAAG,CAACH,iBAAiBC;oBAClC,IAAIG,cAAc,MAAM7E,gBAAgByC,mBAAmBgC;oBAC3D,IACEI,eACC,CAAA,CAACA,YAAYC,IAAI,EAAExG,SAASoG,QAAQ,AAACG,YAAYL,aAAa,KAAK,SAAU1D,SAAQ,GACtF;wBACA,MAAM,IAAI5C,MACR,CAAC,yBAAyB,EAAEuG,gBAAgB,uCAAuC,CAAC;oBAExF;oBACA,IAAII,aAAa;wBACflC,OAAOM,MAAM,IAAI;oBACnB;oBACA,IAAIvB,QAAQ;wBACViB,OAAOK,OAAO,IAAI;wBAClBoB,QAAQC,GAAG,CACT,CAAC,gCAAgC,EAAEQ,cAAc,UAAU,SAAS,CAAC,EAAE3C,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,EAAE,EAAEP,OAAO3B,QAAQ,CAAC,IAAI,EAAEwF,iBAAiB;wBAEnI;oBACF;oBAEA,IAAI,CAACI,aAAa;wBAChB,MAAME,YAAYxC,aAAayC,MAAM,CAACC,QAAQ,CAAC;4BAC7C,GAAIrE,OAAO4D,aAAa,GAAG;gCAAEU,WAAWtD;gCAAoBuD,QAAQ;4BAAK,IAAI,CAAC,CAAC;4BAC/EC,KAAKxE,OAAO3B,QAAQ;4BACpBoG,gBAAgB;gCAAC;oCAAEC,KAAK;gCAAY;6BAAE;4BACtCnH,aAAa0D,KAAK1D,WAAW;wBAC/B;wBACA,MAAMoH,WAAW,MAAM9C,kBAAkBlD,KAAK,CAAC6C,MAAM,CAAC;4BACpD9C,MAAMyF;4BACNS,UAAU5E,OAAOlB,IAAI;4BACrBhB,QAAQ2E;4BACRmB,eAAe1D;4BACf2E,eAAe;4BACfX,MAAM;gCAACJ;6BAAI;4BACXgB,mBAAmB;wBACrB;wBACA,IAAI,CAACH,SAASlG,MAAM,EAAE;4BACpB,MAAM,IAAInB,MAAM,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,2BAA2B,CAAC;wBAC1E;wBACAwF,cAAc,MAAM1F,SAASsD,mBAAmB8C,SAASlG,MAAM;wBAC/D,IACE,CAACwF,eACDA,YAAY5F,QAAQ,KAAKwF,mBACzB,CAACI,YAAYC,IAAI,EAAExG,SAASoG,QAC5B,AAACG,YAAYL,aAAa,KAAK,SAAU1D,WACzC;4BACA,MAAM,IAAI5C,MACR,CAAC,WAAW,EAAE0C,OAAOvB,MAAM,CAAC,0CAA0C,CAAC;wBAE3E;oBACF;oBAEA,MAAM8E,WAAW;wBACf9E,QAAQwF,YAAYxF,MAAM;wBAC1ByB;wBACA6E,cAAcd,YAAYe,SAAS,IAAI;wBACvCnG,KAAKgD,kBAAkBuC,MAAM,CAACC,QAAQ,CAAC;4BACrCG,KAAKP,YAAY5F,QAAQ;4BACzBd,aAAa2D,GAAG3D,WAAW;wBAC7B;oBACF;oBACA,MAAM0H,UAAU;wBAAE,GAAG7B,GAAG;wBAAE8B,UAAUjB,YAAYnF,IAAI;wBAAEyE;oBAAS;oBAC/D,MAAM4B,OAAO;wBACXD,UAAUjB,YAAYnF,IAAI;wBAC1ByE;wBACA6B,QAAQ3C,kBAAkB1E,OAAO,CAAC,OAAO;wBACzCsH,cAAcnF,YACVlD,4BAA4BiI,SAAS3D,MAAMP,QAAQQ,MAAM,CAAC+D,MAAM,CAACC,GAAG,IACpExI,qBAAqBkI;oBAC3B;oBACA,IAAIlE,QAAQyE,EAAE,CAAC1G,IAAI,KAAK,YAAY;wBAClC,yEAAyE;wBACzE,uEAAuE;wBACvE,wEAAwE;wBACxE,oEAAoE;wBACpE,MAAMiC,QAAQyE,EAAE,CAACC,SAAS,CAAC;4BACzBlF,IAAI6C,IAAI7C,EAAE;4BACVyC,YAAY1B;4BACZ6D,MAAM;gCAAE,GAAGA,IAAI;gCAAEO,QAAQ;oCAAEC,YAAY;gCAAE;4BAAE;wBAC7C;oBACF,OAAO;wBACL,MAAM5E,QAAQN,MAAM,CAAC;4BACnBF,IAAI6C,IAAI7C,EAAE;4BACVyC,YAAY1B;4BACZsE,SAAS;gCAAEC,kBAAkB;4BAAK;4BAClCV,MAAM;gCAAE,GAAGA,IAAI;gCAAEQ,YAAY;4BAAK;4BAClCzC,gBAAgB;wBAClB;oBACF;oBACAnB,OAAOI,QAAQ,IAAI;oBACnBqB,QAAQC,GAAG,CAAC,CAAC,yBAAyB,EAAEnC,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,IAAI,EAAEsD,gBAAgB,CAAC,CAAC;gBACjF,EAAE,OAAO5E,OAAO;oBACd,MAAM6G,UAAU7G,iBAAiB3B,QAAQ2B,MAAM6G,OAAO,GAAG;oBACzD/D,OAAOG,MAAM,IAAI;oBACjBH,OAAOE,MAAM,CAAC8D,IAAI,CAAC;wBAAE9F,YAAYmD,IAAI7C,EAAE;wBAAEuF;oBAAQ;oBACjDtC,QAAQvE,KAAK,CAAC,CAAC,uBAAuB,EAAEqC,KAAK,CAAC,EAAE8B,IAAI7C,EAAE,CAAC,EAAE,EAAEuF,SAAS;gBACtE;YACF;QACF,QAAShD,YAAY;QAErBhB,QAAQiE,IAAI,CAAChE;QACbyB,QAAQC,GAAG,CACT,CAAC,gBAAgB,EAAEnC,KAAK,UAAU,EAAES,OAAOK,OAAO,CAAC,WAAW,EAAEL,OAAOI,QAAQ,CAAC,SAAS,EAAEJ,OAAOM,MAAM,CAAC,UAAU,EAAEN,OAAOO,OAAO,CAAC,SAAS,EAAEP,OAAOG,MAAM,CAAC,CAAC,CAAC;IAEnK;IACA,OAAOJ;AACT,EAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@humaan/payload-storage-imagekit",
-  "version": "2.9.1",
+  "version": "3.0.0-canary.0",
   "description": "ImageKit storage adapter plugin for Payload CMS uploads",
   "license": "MIT",
   "type": "module",
@@ -37,14 +37,14 @@
   ],
   "devDependencies": {
     "@eslint/eslintrc": "^3.3.7",
-    "@payloadcms/db-mongodb": "3.90.2",
-    "@payloadcms/db-postgres": "3.90.2",
-    "@payloadcms/db-sqlite": "3.90.2",
+    "@payloadcms/db-mongodb": "4.0.0-beta.1",
+    "@payloadcms/db-postgres": "4.0.0-beta.1",
+    "@payloadcms/db-sqlite": "4.0.0-beta.1",
     "@payloadcms/eslint-config": "3.28.0",
-    "@payloadcms/next": "3.90.2",
-    "@payloadcms/plugin-cloud-storage": "3.90.2",
-    "@payloadcms/richtext-lexical": "3.90.2",
-    "@payloadcms/ui": "3.90.2",
+    "@payloadcms/next": "4.0.0-beta.1",
+    "@payloadcms/plugin-cloud-storage": "4.0.0-beta.1",
+    "@payloadcms/richtext-lexical": "4.0.0-beta.1",
+    "@payloadcms/ui": "4.0.0-beta.1",
     "@swc-node/register": "1.12.1",
     "@swc/cli": "0.8.1",
     "@types/node": "26.6.3",
@@ -55,12 +55,12 @@
     "copyfiles": "2.4.1",
     "cross-env": "10.1.0",
     "eslint": "^9.39.5",
-    "eslint-config-next": "16.3.8",
+    "eslint-config-next": "16.4.0",
     "graphql": "^16.14.2",
     "mongodb-memory-server": "11.3.0",
-    "next": "16.3.8",
+    "next": "16.4.0",
     "open": "^11.0.4",
-    "payload": "3.90.2",
+    "payload": "4.0.0-beta.1",
     "prettier": "^3.9.9",
     "qs-esm": "8.0.2",
     "react": "19.3.0",
@@ -74,8 +74,8 @@
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@payloadcms/plugin-cloud-storage": ">=3.90.1 <4.0.0",
-    "payload": ">=3.90.1 <4.0.0"
+    "@payloadcms/plugin-cloud-storage": "4.0.0-beta.1",
+    "payload": "4.0.0-beta.1"
   },
   "engines": {
     "node": ">=24.15.0 <25"

package/dist/clientUploadVerification.d.ts

@@ -1,30 +0,0 @@
-import type ImageKit from '@imagekit/nodejs';
-import type { CollectionConfig } from 'payload';
-import type { ImageKitReceiptContext } from './clientUploads.js';
-export type VerifiedImageKitUpload = {
-    fileId: string;
-    filePath: string;
-    fileType?: string;
-    mimeType: string;
-    name: string;
-    size: number;
-    thumbnailUrl?: string;
-    url: string;
-};
-type CollectionSecurityConfig = {
-    collection: CollectionConfig;
-    isPrivate: boolean;
-    prefix: string;
-};
-export declare const getClientUploadStorageFilePath: ({ collectionPrefix, context, }: {
-    collectionPrefix: string;
-    context: ImageKitReceiptContext;
-}) => string;
-export declare const createImageKitClientUploadVerifier: ({ client, collections, }: {
-    client: ImageKit;
-    collections: Record<string, CollectionSecurityConfig>;
-}) => ({ collectionSlug, context, }: {
-    collectionSlug: string;
-    context: unknown;
-}) => Promise<VerifiedImageKitUpload>;
-export {};

package/dist/clientUploadVerification.js

@@ -1,106 +0,0 @@
-import { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities';
-import { APIError } from 'payload';
-import { assertClientUploadAllowed } from 'payload/internal';
-import { validateMimeType } from 'payload/shared';
-import { isImageKitReceiptContext } from './clientUploads.js';
-const getMimeTypeEssence = (mimeType)=>(mimeType.split(';', 1)[0] || '').trim().toLowerCase();
-const toImageKitPath = (storageFilePath)=>`/${storageFilePath.replace(/^\/+/, '')}`;
-const assetLookupRetryDelays = [
-    250,
-    500,
-    1000,
-    2000
-];
-const findFileIDByPath = async (client, filePath)=>{
-    const parentPath = `${filePath.slice(0, filePath.lastIndexOf('/') + 1)}`;
-    const name = filePath.slice(filePath.lastIndexOf('/') + 1);
-    const limit = 100;
-    for(let skip = 0;; skip += limit){
-        const assets = await client.assets.list({
-            type: 'file',
-            limit,
-            path: parentPath,
-            skip
-        });
-        const found = assets.find((asset)=>'fileId' in asset && asset.filePath === filePath && asset.name === name);
-        if (found && 'fileId' in found) {
-            return found.fileId;
-        }
-        if (assets.length < limit) {
-            return undefined;
-        }
-    }
-};
-export const getClientUploadStorageFilePath = ({ collectionPrefix, context })=>buildStoragePathData({
-        collectionPrefix,
-        docPrefix: [
-            context.prefix,
-            context._objectKey
-        ].filter(Boolean).join('/'),
-        filename: context.filename
-    }).storageFilePath;
-export const createImageKitClientUploadVerifier = ({ client, collections })=>{
-    const verifiedContexts = new WeakMap();
-    return async ({ collectionSlug, context })=>{
-        if (!isImageKitReceiptContext(context)) {
-            throw new APIError('Invalid ImageKit client upload context.', 400);
-        }
-        const collectionSecurity = collections[collectionSlug];
-        if (!collectionSecurity || context.collectionSlug !== collectionSlug || context.isPrivate !== collectionSecurity.isPrivate) {
-            throw new APIError('ImageKit client upload reference does not match this collection.', 400);
-        }
-        const cached = verifiedContexts.get(context);
-        if (cached) {
-            return cached;
-        }
-        const storageFilePath = getClientUploadStorageFilePath({
-            collectionPrefix: collectionSecurity.prefix,
-            context
-        });
-        const expectedFilePath = toImageKitPath(storageFilePath);
-        let fileId = context.fileId;
-        // Receipts without a file ID can still be verified by their signed path and binding.
-        // The completion handshake avoids depending on asset listing visibility.
-        if (!fileId) {
-            fileId = await findFileIDByPath(client, expectedFilePath);
-            for (const delay of assetLookupRetryDelays){
-                if (fileId) {
-                    break;
-                }
-                await new Promise((resolve)=>setTimeout(resolve, delay));
-                fileId = await findFileIDByPath(client, expectedFilePath);
-            }
-        }
-        if (!fileId) {
-            throw new APIError('ImageKit client upload was not found at its authorized path.', 400);
-        }
-        const uploadedFile = await client.files.get(fileId);
-        const uploadedMime = typeof uploadedFile.mime === 'string' ? getMimeTypeEssence(uploadedFile.mime) : '';
-        const uploadedSize = uploadedFile.size;
-        // ImageKit's detected type is authoritative. It may differ from the browser's
-        // extension-based type, so validate it against the collection, not the claim.
-        assertClientUploadAllowed({
-            collection: collectionSecurity.collection,
-            filename: context.filename,
-            mimeType: uploadedMime
-        });
-        const allowedMimeTypes = typeof collectionSecurity.collection.upload === 'object' && Array.isArray(collectionSecurity.collection.upload.mimeTypes) ? collectionSecurity.collection.upload.mimeTypes : [];
-        if (uploadedFile.fileId !== fileId || uploadedFile.filePath !== expectedFilePath || uploadedFile.name !== context.filename || context.uploadTag !== undefined && !uploadedFile.tags?.includes(context.uploadTag) || !uploadedMime || typeof uploadedSize !== 'number' || !Number.isSafeInteger(uploadedSize) || uploadedSize !== context.expectedSize || allowedMimeTypes.length > 0 && !validateMimeType(uploadedMime, allowedMimeTypes) || Boolean(uploadedFile.isPrivateFile) !== collectionSecurity.isPrivate || typeof uploadedFile.url !== 'string' || uploadedFile.url.length === 0) {
-            throw new APIError('ImageKit client upload metadata did not match its authorization.', 400);
-        }
-        const verified = {
-            name: uploadedFile.name,
-            fileId,
-            filePath: expectedFilePath,
-            fileType: uploadedFile.fileType,
-            mimeType: uploadedMime,
-            size: uploadedSize,
-            thumbnailUrl: typeof uploadedFile.thumbnail === 'string' ? uploadedFile.thumbnail : undefined,
-            url: uploadedFile.url
-        };
-        verifiedContexts.set(context, verified);
-        return verified;
-    };
-};
-
-//# sourceMappingURL=clientUploadVerification.js.map

package/dist/clientUploadVerification.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/clientUploadVerification.ts"],"sourcesContent":["import type ImageKit from '@imagekit/nodejs'\nimport type { CollectionConfig } from 'payload'\n\nimport { buildStoragePathData } from '@payloadcms/plugin-cloud-storage/utilities'\nimport { APIError } from 'payload'\nimport { assertClientUploadAllowed } from 'payload/internal'\nimport { validateMimeType } from 'payload/shared'\n\nimport type { ImageKitReceiptContext } from './clientUploads.js'\n\nimport { isImageKitReceiptContext } from './clientUploads.js'\n\nexport type VerifiedImageKitUpload = {\n  fileId: string\n  filePath: string\n  fileType?: string\n  mimeType: string\n  name: string\n  size: number\n  thumbnailUrl?: string\n  url: string\n}\n\ntype CollectionSecurityConfig = {\n  collection: CollectionConfig\n  isPrivate: boolean\n  prefix: string\n}\n\nconst getMimeTypeEssence = (mimeType: string): string =>\n  (mimeType.split(';', 1)[0] || '').trim().toLowerCase()\n\nconst toImageKitPath = (storageFilePath: string): string =>\n  `/${storageFilePath.replace(/^\\/+/, '')}`\n\nconst assetLookupRetryDelays = [250, 500, 1000, 2000]\n\nconst findFileIDByPath = async (\n  client: ImageKit,\n  filePath: string,\n): Promise<string | undefined> => {\n  const parentPath = `${filePath.slice(0, filePath.lastIndexOf('/') + 1)}`\n  const name = filePath.slice(filePath.lastIndexOf('/') + 1)\n  const limit = 100\n\n  for (let skip = 0; ; skip += limit) {\n    const assets = await client.assets.list({\n      type: 'file',\n      limit,\n      path: parentPath,\n      skip,\n    })\n    const found = assets.find(\n      (asset) => 'fileId' in asset && asset.filePath === filePath && asset.name === name,\n    )\n\n    if (found && 'fileId' in found) {\n      return found.fileId\n    }\n\n    if (assets.length < limit) {\n      return undefined\n    }\n  }\n}\n\nexport const getClientUploadStorageFilePath = ({\n  collectionPrefix,\n  context,\n}: {\n  collectionPrefix: string\n  context: ImageKitReceiptContext\n}): string =>\n  buildStoragePathData({\n    collectionPrefix,\n    docPrefix: [context.prefix, context._objectKey].filter(Boolean).join('/'),\n    filename: context.filename,\n  }).storageFilePath\n\nexport const createImageKitClientUploadVerifier = ({\n  client,\n  collections,\n}: {\n  client: ImageKit\n  collections: Record<string, CollectionSecurityConfig>\n}) => {\n  const verifiedContexts = new WeakMap<object, VerifiedImageKitUpload>()\n\n  return async ({\n    collectionSlug,\n    context,\n  }: {\n    collectionSlug: string\n    context: unknown\n  }): Promise<VerifiedImageKitUpload> => {\n    if (!isImageKitReceiptContext(context)) {\n      throw new APIError('Invalid ImageKit client upload context.', 400)\n    }\n\n    const collectionSecurity = collections[collectionSlug]\n    if (\n      !collectionSecurity ||\n      context.collectionSlug !== collectionSlug ||\n      context.isPrivate !== collectionSecurity.isPrivate\n    ) {\n      throw new APIError('ImageKit client upload reference does not match this collection.', 400)\n    }\n\n    const cached = verifiedContexts.get(context)\n    if (cached) {\n      return cached\n    }\n\n    const storageFilePath = getClientUploadStorageFilePath({\n      collectionPrefix: collectionSecurity.prefix,\n      context,\n    })\n    const expectedFilePath = toImageKitPath(storageFilePath)\n    let fileId = context.fileId\n\n    // Receipts without a file ID can still be verified by their signed path and binding.\n    // The completion handshake avoids depending on asset listing visibility.\n    if (!fileId) {\n      fileId = await findFileIDByPath(client, expectedFilePath)\n      for (const delay of assetLookupRetryDelays) {\n        if (fileId) {\n          break\n        }\n        await new Promise((resolve) => setTimeout(resolve, delay))\n        fileId = await findFileIDByPath(client, expectedFilePath)\n      }\n    }\n\n    if (!fileId) {\n      throw new APIError('ImageKit client upload was not found at its authorized path.', 400)\n    }\n\n    const uploadedFile = await client.files.get(fileId)\n    const uploadedMime =\n      typeof uploadedFile.mime === 'string' ? getMimeTypeEssence(uploadedFile.mime) : ''\n    const uploadedSize = uploadedFile.size\n\n    // ImageKit's detected type is authoritative. It may differ from the browser's\n    // extension-based type, so validate it against the collection, not the claim.\n    assertClientUploadAllowed({\n      collection: collectionSecurity.collection,\n      filename: context.filename,\n      mimeType: uploadedMime,\n    })\n    const allowedMimeTypes =\n      typeof collectionSecurity.collection.upload === 'object' &&\n      Array.isArray(collectionSecurity.collection.upload.mimeTypes)\n        ? collectionSecurity.collection.upload.mimeTypes\n        : []\n\n    if (\n      uploadedFile.fileId !== fileId ||\n      uploadedFile.filePath !== expectedFilePath ||\n      uploadedFile.name !== context.filename ||\n      (context.uploadTag !== undefined && !uploadedFile.tags?.includes(context.uploadTag)) ||\n      !uploadedMime ||\n      typeof uploadedSize !== 'number' ||\n      !Number.isSafeInteger(uploadedSize) ||\n      uploadedSize !== context.expectedSize ||\n      (allowedMimeTypes.length > 0 && !validateMimeType(uploadedMime, allowedMimeTypes)) ||\n      Boolean(uploadedFile.isPrivateFile) !== collectionSecurity.isPrivate ||\n      typeof uploadedFile.url !== 'string' ||\n      uploadedFile.url.length === 0\n    ) {\n      throw new APIError('ImageKit client upload metadata did not match its authorization.', 400)\n    }\n\n    const verified: VerifiedImageKitUpload = {\n      name: uploadedFile.name,\n      fileId,\n      filePath: expectedFilePath,\n      fileType: uploadedFile.fileType,\n      mimeType: uploadedMime,\n      size: uploadedSize,\n      thumbnailUrl: typeof uploadedFile.thumbnail === 'string' ? uploadedFile.thumbnail : undefined,\n      url: uploadedFile.url,\n    }\n\n    verifiedContexts.set(context, verified)\n    return verified\n  }\n}\n"],"names":["buildStoragePathData","APIError","assertClientUploadAllowed","validateMimeType","isImageKitReceiptContext","getMimeTypeEssence","mimeType","split","trim","toLowerCase","toImageKitPath","storageFilePath","replace","assetLookupRetryDelays","findFileIDByPath","client","filePath","parentPath","slice","lastIndexOf","name","limit","skip","assets","list","type","path","found","find","asset","fileId","length","undefined","getClientUploadStorageFilePath","collectionPrefix","context","docPrefix","prefix","_objectKey","filter","Boolean","join","filename","createImageKitClientUploadVerifier","collections","verifiedContexts","WeakMap","collectionSlug","collectionSecurity","isPrivate","cached","get","expectedFilePath","delay","Promise","resolve","setTimeout","uploadedFile","files","uploadedMime","mime","uploadedSize","size","collection","allowedMimeTypes","upload","Array","isArray","mimeTypes","uploadTag","tags","includes","Number","isSafeInteger","expectedSize","isPrivateFile","url","verified","fileType","thumbnailUrl","thumbnail","set"],"mappings":"AAGA,SAASA,oBAAoB,QAAQ,6CAA4C;AACjF,SAASC,QAAQ,QAAQ,UAAS;AAClC,SAASC,yBAAyB,QAAQ,mBAAkB;AAC5D,SAASC,gBAAgB,QAAQ,iBAAgB;AAIjD,SAASC,wBAAwB,QAAQ,qBAAoB;AAmB7D,MAAMC,qBAAqB,CAACC,WAC1B,AAACA,CAAAA,SAASC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAC,EAAGC,IAAI,GAAGC,WAAW;AAEtD,MAAMC,iBAAiB,CAACC,kBACtB,CAAC,CAAC,EAAEA,gBAAgBC,OAAO,CAAC,QAAQ,KAAK;AAE3C,MAAMC,yBAAyB;IAAC;IAAK;IAAK;IAAM;CAAK;AAErD,MAAMC,mBAAmB,OACvBC,QACAC;IAEA,MAAMC,aAAa,GAAGD,SAASE,KAAK,CAAC,GAAGF,SAASG,WAAW,CAAC,OAAO,IAAI;IACxE,MAAMC,OAAOJ,SAASE,KAAK,CAACF,SAASG,WAAW,CAAC,OAAO;IACxD,MAAME,QAAQ;IAEd,IAAK,IAAIC,OAAO,IAAKA,QAAQD,MAAO;QAClC,MAAME,SAAS,MAAMR,OAAOQ,MAAM,CAACC,IAAI,CAAC;YACtCC,MAAM;YACNJ;YACAK,MAAMT;YACNK;QACF;QACA,MAAMK,QAAQJ,OAAOK,IAAI,CACvB,CAACC,QAAU,YAAYA,SAASA,MAAMb,QAAQ,KAAKA,YAAYa,MAAMT,IAAI,KAAKA;QAGhF,IAAIO,SAAS,YAAYA,OAAO;YAC9B,OAAOA,MAAMG,MAAM;QACrB;QAEA,IAAIP,OAAOQ,MAAM,GAAGV,OAAO;YACzB,OAAOW;QACT;IACF;AACF;AAEA,OAAO,MAAMC,iCAAiC,CAAC,EAC7CC,gBAAgB,EAChBC,OAAO,EAIR,GACCnC,qBAAqB;QACnBkC;QACAE,WAAW;YAACD,QAAQE,MAAM;YAAEF,QAAQG,UAAU;SAAC,CAACC,MAAM,CAACC,SAASC,IAAI,CAAC;QACrEC,UAAUP,QAAQO,QAAQ;IAC5B,GAAG/B,eAAe,CAAA;AAEpB,OAAO,MAAMgC,qCAAqC,CAAC,EACjD5B,MAAM,EACN6B,WAAW,EAIZ;IACC,MAAMC,mBAAmB,IAAIC;IAE7B,OAAO,OAAO,EACZC,cAAc,EACdZ,OAAO,EAIR;QACC,IAAI,CAAC/B,yBAAyB+B,UAAU;YACtC,MAAM,IAAIlC,SAAS,2CAA2C;QAChE;QAEA,MAAM+C,qBAAqBJ,WAAW,CAACG,eAAe;QACtD,IACE,CAACC,sBACDb,QAAQY,cAAc,KAAKA,kBAC3BZ,QAAQc,SAAS,KAAKD,mBAAmBC,SAAS,EAClD;YACA,MAAM,IAAIhD,SAAS,oEAAoE;QACzF;QAEA,MAAMiD,SAASL,iBAAiBM,GAAG,CAAChB;QACpC,IAAIe,QAAQ;YACV,OAAOA;QACT;QAEA,MAAMvC,kBAAkBsB,+BAA+B;YACrDC,kBAAkBc,mBAAmBX,MAAM;YAC3CF;QACF;QACA,MAAMiB,mBAAmB1C,eAAeC;QACxC,IAAImB,SAASK,QAAQL,MAAM;QAE3B,qFAAqF;QACrF,yEAAyE;QACzE,IAAI,CAACA,QAAQ;YACXA,SAAS,MAAMhB,iBAAiBC,QAAQqC;YACxC,KAAK,MAAMC,SAASxC,uBAAwB;gBAC1C,IAAIiB,QAAQ;oBACV;gBACF;gBACA,MAAM,IAAIwB,QAAQ,CAACC,UAAYC,WAAWD,SAASF;gBACnDvB,SAAS,MAAMhB,iBAAiBC,QAAQqC;YAC1C;QACF;QAEA,IAAI,CAACtB,QAAQ;YACX,MAAM,IAAI7B,SAAS,gEAAgE;QACrF;QAEA,MAAMwD,eAAe,MAAM1C,OAAO2C,KAAK,CAACP,GAAG,CAACrB;QAC5C,MAAM6B,eACJ,OAAOF,aAAaG,IAAI,KAAK,WAAWvD,mBAAmBoD,aAAaG,IAAI,IAAI;QAClF,MAAMC,eAAeJ,aAAaK,IAAI;QAEtC,8EAA8E;QAC9E,8EAA8E;QAC9E5D,0BAA0B;YACxB6D,YAAYf,mBAAmBe,UAAU;YACzCrB,UAAUP,QAAQO,QAAQ;YAC1BpC,UAAUqD;QACZ;QACA,MAAMK,mBACJ,OAAOhB,mBAAmBe,UAAU,CAACE,MAAM,KAAK,YAChDC,MAAMC,OAAO,CAACnB,mBAAmBe,UAAU,CAACE,MAAM,CAACG,SAAS,IACxDpB,mBAAmBe,UAAU,CAACE,MAAM,CAACG,SAAS,GAC9C,EAAE;QAER,IACEX,aAAa3B,MAAM,KAAKA,UACxB2B,aAAazC,QAAQ,KAAKoC,oBAC1BK,aAAarC,IAAI,KAAKe,QAAQO,QAAQ,IACrCP,QAAQkC,SAAS,KAAKrC,aAAa,CAACyB,aAAaa,IAAI,EAAEC,SAASpC,QAAQkC,SAAS,KAClF,CAACV,gBACD,OAAOE,iBAAiB,YACxB,CAACW,OAAOC,aAAa,CAACZ,iBACtBA,iBAAiB1B,QAAQuC,YAAY,IACpCV,iBAAiBjC,MAAM,GAAG,KAAK,CAAC5B,iBAAiBwD,cAAcK,qBAChExB,QAAQiB,aAAakB,aAAa,MAAM3B,mBAAmBC,SAAS,IACpE,OAAOQ,aAAamB,GAAG,KAAK,YAC5BnB,aAAamB,GAAG,CAAC7C,MAAM,KAAK,GAC5B;YACA,MAAM,IAAI9B,SAAS,oEAAoE;QACzF;QAEA,MAAM4E,WAAmC;YACvCzD,MAAMqC,aAAarC,IAAI;YACvBU;YACAd,UAAUoC;YACV0B,UAAUrB,aAAaqB,QAAQ;YAC/BxE,UAAUqD;YACVG,MAAMD;YACNkB,cAAc,OAAOtB,aAAauB,SAAS,KAAK,WAAWvB,aAAauB,SAAS,GAAGhD;YACpF4C,KAAKnB,aAAamB,GAAG;QACvB;QAEA/B,iBAAiBoC,GAAG,CAAC9C,SAAS0C;QAC9B,OAAOA;IACT;AACF,EAAC"}