@10x-media/dual-session 0.1.0-beta.0

package/dist/plugin/selectCollections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectCollections.js","names":[],"sources":["../../src/plugin/selectCollections.ts"],"sourcesContent":["import type { CollectionConfig, Config } from 'payload'\n\nimport type { DualSessionPluginOptions, ResolvedIsolatedCollection } from '../types'\nimport { resolveCollections } from './resolveCollections'\n\n/**\n * The slug Payload will treat as the admin panel's user collection.\n *\n * Mirrors `sanitizeConfig`: an explicit `admin.user` wins, otherwise the first collection\n * declaring `auth`, otherwise the `users` collection core appends for you. Guessing\n * `'users'` outright would miss the case the check exists for: a project whose admin\n * collection is named something else and never set `admin.user`, where isolating it would\n * take the admin panel down.\n */\nexport const resolveAdminUserSlug = (config: Config): string =>\n\tconfig.admin?.user ??\n\t(config.collections ?? []).find(({ auth }) => Boolean(auth))?.slug ??\n\t'users'\n\n/**\n * Picks the collections this plugin will actually isolate, dropping the ones it cannot.\n *\n * Plugins run before `sanitizeConfig` and in array order, so a collection contributed by a\n * later plugin is genuinely absent here. That is a load-order problem, not a broken config,\n * and refusing to boot over it would be worse than saying so and moving on. Isolating the\n * admin collection wholesale stays fatal: it is the one mistake that silently breaks the\n * admin panel.\n *\n * Warnings are returned rather than logged: `payload.logger` does not exist while the config\n * is being built, so the caller replays them from `onInit`.\n */\nexport const selectCollections = ({\n\tadminUserSlug,\n\tcollections,\n\tcookiePrefix,\n\tincoming,\n}: {\n\tadminUserSlug: string\n\tcollections: DualSessionPluginOptions['collections']\n\tcookiePrefix: string\n\tincoming: CollectionConfig[]\n}): { collections: ResolvedIsolatedCollection[]; warnings: string[] } => {\n\tconst resolved = resolveCollections({ collections, cookiePrefix })\n\tconst warnings: string[] = []\n\tconst adminEntry = resolved.find(({ slug }) => slug === adminUserSlug)\n\n\tif (adminEntry && !adminEntry.isolate) {\n\t\tthrow new Error(\n\t\t\t`@10x-media/dual-session: \"${adminUserSlug}\" backs the admin panel and owns the shared \"${cookiePrefix}-token\" cookie, so isolating all of it takes the admin panel down. Give the entry an \\`isolate\\` predicate to move only some of its users onto a second cookie, or list the other auth collections instead.`\n\t\t)\n\t}\n\n\tif (adminEntry?.scopes.includes('admin')) {\n\t\t// The isolated strategy runs ahead of core's `local-jwt`, so an isolated cookie that\n\t\t// is allowed to answer admin-scoped requests would outrank the admin's own shared\n\t\t// cookie on the very collection the panel authenticates against.\n\t\tthrow new Error(\n\t\t\t`@10x-media/dual-session: \"${adminUserSlug}\" backs the admin panel, so its isolated cookie must not carry the \"admin\" scope. It would shadow the admin session it is supposed to sit beside. Use \\`scopes: ['frontend']\\`.`\n\t\t)\n\t}\n\n\tconst selected = resolved.filter(({ slug }) => {\n\t\tconst collection = incoming.find((entry) => entry.slug === slug)\n\n\t\tif (!collection) {\n\t\t\twarnings.push(\n\t\t\t\t`@10x-media/dual-session: collection \"${slug}\" is not in the config, so it was skipped. If another plugin adds it, list dualSession after that plugin.`\n\t\t\t)\n\t\t\treturn false\n\t\t}\n\n\t\tif (!collection.auth) {\n\t\t\twarnings.push(\n\t\t\t\t`@10x-media/dual-session: collection \"${slug}\" does not have auth enabled, so it was skipped.`\n\t\t\t)\n\t\t\treturn false\n\t\t}\n\n\t\tif (collection.endpoints === false) {\n\t\t\t// Kept, not skipped: core answers 501 for every route on such a collection with or\n\t\t\t// without this plugin, and a custom login route can still mint the isolated cookie.\n\t\t\twarnings.push(\n\t\t\t\t`@10x-media/dual-session: collection \"${slug}\" sets \"endpoints: false\", so it has no REST auth routes to shadow. Sessions for it can only be established outside REST, via generateIsolatedAuthCookie.`\n\t\t\t)\n\t\t}\n\n\t\treturn true\n\t})\n\n\treturn { collections: selected, warnings }\n}\n"],"mappings":";;;;;;;;;;;AAcA,MAAa,wBAAwB,WACpC,OAAO,OAAO,SACb,OAAO,eAAe,CAAC,GAAG,MAAM,EAAE,WAAW,QAAQ,IAAI,CAAC,GAAG,QAC9D;;;;;;;;;;;;;AAcD,MAAa,qBAAqB,EACjC,eACA,aACA,cACA,eAMwE;CACxE,MAAM,WAAW,mBAAmB;EAAE;EAAa;CAAa,CAAC;CACjE,MAAM,WAAqB,CAAC;CAC5B,MAAM,aAAa,SAAS,MAAM,EAAE,WAAW,SAAS,aAAa;CAErE,IAAI,cAAc,CAAC,WAAW,SAC7B,MAAM,IAAI,MACT,6BAA6B,cAAc,+CAA+C,aAAa,4MACxG;CAGD,IAAI,YAAY,OAAO,SAAS,OAAO,GAItC,MAAM,IAAI,MACT,6BAA6B,cAAc,gLAC5C;CA+BD,OAAO;EAAE,aA5BQ,SAAS,QAAQ,EAAE,WAAW;GAC9C,MAAM,aAAa,SAAS,MAAM,UAAU,MAAM,SAAS,IAAI;GAE/D,IAAI,CAAC,YAAY;IAChB,SAAS,KACR,wCAAwC,KAAK,0GAC9C;IACA,OAAO;GACR;GAEA,IAAI,CAAC,WAAW,MAAM;IACrB,SAAS,KACR,wCAAwC,KAAK,iDAC9C;IACA,OAAO;GACR;GAEA,IAAI,WAAW,cAAc,OAG5B,SAAS,KACR,wCAAwC,KAAK,0JAC9C;GAGD,OAAO;EACR,CAE6B;EAAG;CAAS;AAC1C"}

package/dist/scope/proxy.d.ts

@@ -0,0 +1,35 @@
+import { AuthScope } from "../types.js";
+import { AUTH_SCOPE_HEADER, resolveAuthScope } from "./resolveAuthScope.js";
+import { NextRequest, NextResponse } from "next/server.js";
+
+//#region src/scope/proxy.d.ts
+type AuthScopeProxyOptions = {
+  /** Admin panel route prefix. @default '/admin' */adminRoute?: string; /** Payload REST/GraphQL route prefix. @default '/api' */
+  apiRoute?: string; /** Override the default rule entirely. Return `undefined` to fall back to it. */
+  resolveScope?: (request: NextRequest) => AuthScope | undefined; /** Header to write the resolved scope into. @default 'x-payload-auth-scope' */
+  scopeHeader?: string;
+};
+/**
+ * Next.js proxy (`proxy.ts`, called middleware before Next 16) that stamps every
+ * request with its auth scope, so the isolated auth strategies know whether they are
+ * allowed to authenticate it.
+ *
+ * The header is replaced on every request, never merged, and is removed when the
+ * request cannot be attributed, so the scope a strategy reads is always this proxy's
+ * own answer.
+ *
+ * ```ts
+ * // proxy.ts (Next 16) or middleware.ts (Next 15)
+ * import { createAuthScopeProxy } from '@10x-media/dual-session/proxy'
+ *
+ * export default createAuthScopeProxy()
+ *
+ * export const config = {
+ *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+ * }
+ * ```
+ */
+declare const createAuthScopeProxy: (options?: AuthScopeProxyOptions) => (request: NextRequest) => NextResponse<unknown>;
+//#endregion
+export { AuthScopeProxyOptions, createAuthScopeProxy };
+//# sourceMappingURL=proxy.d.ts.map

package/dist/scope/proxy.js

@@ -0,0 +1,42 @@
+import { AUTH_SCOPE_HEADER, resolveAuthScope } from "./resolveAuthScope.js";
+import { NextResponse } from "next/server.js";
+//#region src/scope/proxy.ts
+/**
+* Next.js proxy (`proxy.ts`, called middleware before Next 16) that stamps every
+* request with its auth scope, so the isolated auth strategies know whether they are
+* allowed to authenticate it.
+*
+* The header is replaced on every request, never merged, and is removed when the
+* request cannot be attributed, so the scope a strategy reads is always this proxy's
+* own answer.
+*
+* ```ts
+* // proxy.ts (Next 16) or middleware.ts (Next 15)
+* import { createAuthScopeProxy } from '@10x-media/dual-session/proxy'
+*
+* export default createAuthScopeProxy()
+*
+* export const config = {
+*   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
+* }
+* ```
+*/
+const createAuthScopeProxy = (options = {}) => (request) => {
+	const { adminRoute, apiRoute, resolveScope, scopeHeader = AUTH_SCOPE_HEADER } = options;
+	const scope = resolveScope?.(request) ?? resolveAuthScope({
+		adminRoute,
+		apiRoute,
+		origin: request.nextUrl.origin,
+		pathname: request.nextUrl.pathname,
+		referer: request.headers.get("Referer"),
+		secFetchSite: request.headers.get("Sec-Fetch-Site")
+	});
+	const headers = new Headers(request.headers);
+	if (scope) headers.set(scopeHeader, scope);
+	else headers.delete(scopeHeader);
+	return NextResponse.next({ request: { headers } });
+};
+//#endregion
+export { createAuthScopeProxy };
+
+//# sourceMappingURL=proxy.js.map

package/dist/scope/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","names":[],"sources":["../../src/scope/proxy.ts"],"sourcesContent":["import { type NextRequest, NextResponse } from 'next/server'\nimport type { AuthScope } from '../types'\nimport { AUTH_SCOPE_HEADER, resolveAuthScope } from './resolveAuthScope'\n\nexport type AuthScopeProxyOptions = {\n\t/** Admin panel route prefix. @default '/admin' */\n\tadminRoute?: string\n\t/** Payload REST/GraphQL route prefix. @default '/api' */\n\tapiRoute?: string\n\t/** Override the default rule entirely. Return `undefined` to fall back to it. */\n\tresolveScope?: (request: NextRequest) => AuthScope | undefined\n\t/** Header to write the resolved scope into. @default 'x-payload-auth-scope' */\n\tscopeHeader?: string\n}\n\n/**\n * Next.js proxy (`proxy.ts`, called middleware before Next 16) that stamps every\n * request with its auth scope, so the isolated auth strategies know whether they are\n * allowed to authenticate it.\n *\n * The header is replaced on every request, never merged, and is removed when the\n * request cannot be attributed, so the scope a strategy reads is always this proxy's\n * own answer.\n *\n * ```ts\n * // proxy.ts (Next 16) or middleware.ts (Next 15)\n * import { createAuthScopeProxy } from '@10x-media/dual-session/proxy'\n *\n * export default createAuthScopeProxy()\n *\n * export const config = {\n *   matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n * }\n * ```\n */\nexport const createAuthScopeProxy =\n\t(options: AuthScopeProxyOptions = {}) =>\n\t(request: NextRequest) => {\n\t\tconst { adminRoute, apiRoute, resolveScope, scopeHeader = AUTH_SCOPE_HEADER } = options\n\n\t\tconst scope =\n\t\t\tresolveScope?.(request) ??\n\t\t\tresolveAuthScope({\n\t\t\t\tadminRoute,\n\t\t\t\tapiRoute,\n\t\t\t\torigin: request.nextUrl.origin,\n\t\t\t\tpathname: request.nextUrl.pathname,\n\t\t\t\treferer: request.headers.get('Referer'),\n\t\t\t\tsecFetchSite: request.headers.get('Sec-Fetch-Site'),\n\t\t\t})\n\n\t\tconst headers = new Headers(request.headers)\n\n\t\t// An unattributable request carries no scope at all. Stamping a guess here would\n\t\t// override `adminSessionPriority`, which answers the same question better by\n\t\t// looking at whether an admin session actually exists.\n\t\tif (scope) {\n\t\t\theaders.set(scopeHeader, scope)\n\t\t} else {\n\t\t\theaders.delete(scopeHeader)\n\t\t}\n\n\t\treturn NextResponse.next({ request: { headers } })\n\t}\n\nexport type { AuthScope } from '../types'\nexport { AUTH_SCOPE_HEADER, resolveAuthScope } from './resolveAuthScope'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmCA,MAAa,wBACX,UAAiC,CAAC,OAClC,YAAyB;CACzB,MAAM,EAAE,YAAY,UAAU,cAAc,cAAc,sBAAsB;CAEhF,MAAM,QACL,eAAe,OAAO,KACtB,iBAAiB;EAChB;EACA;EACA,QAAQ,QAAQ,QAAQ;EACxB,UAAU,QAAQ,QAAQ;EAC1B,SAAS,QAAQ,QAAQ,IAAI,SAAS;EACtC,cAAc,QAAQ,QAAQ,IAAI,gBAAgB;CACnD,CAAC;CAEF,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;CAK3C,IAAI,OACH,QAAQ,IAAI,aAAa,KAAK;MAE9B,QAAQ,OAAO,WAAW;CAG3B,OAAO,aAAa,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AAClD"}

package/dist/scope/resolveAuthScope.d.ts

@@ -0,0 +1,43 @@
+import { AuthScope } from "../types.js";
+
+//#region src/scope/resolveAuthScope.d.ts
+/** Request header carrying the resolved {@link AuthScope} for a request. */
+declare const AUTH_SCOPE_HEADER = "x-payload-auth-scope";
+/**
+ * Decides which session a request may authenticate against, or `undefined` when the
+ * request carries no signal to decide by.
+ *
+ * Admin panel pages and their server actions live under `adminRoute`, so those are
+ * unambiguous. Payload's REST namespace is shared between the admin panel and the
+ * website, so those calls are attributed by `Referer`, which on same-origin browser fetches
+ * carry the full originating path.
+ *
+ * A `Referer` only says something about the admin panel when it belongs to the same
+ * origin the API is served from: a frontend on another origin may well have an
+ * `/admin` route of its own. `Sec-Fetch-Site` is what distinguishes the two, and a
+ * page cannot forge it. Clients that send no `Sec-Fetch-Site` are held to the same
+ * rule by comparing the `Referer` against `origin`, so pass it whenever the caller
+ * knows it. Without both signals a `Referer` cannot be trusted to mean the admin
+ * panel, and the request resolves to `frontend`.
+ *
+ * `undefined` means "no attribution", not "admin": callers should leave the scope
+ * header unset so the strategies fall back to `adminSessionPriority`.
+ */
+declare const resolveAuthScope: ({
+  adminRoute,
+  apiRoute,
+  origin,
+  pathname,
+  referer,
+  secFetchSite
+}: {
+  adminRoute?: string;
+  apiRoute?: string; /** The origin the request was served from, used to vet a `Referer` from another site. */
+  origin?: null | string;
+  pathname: string;
+  referer?: null | string; /** The request's `Sec-Fetch-Site` header, when it has one. */
+  secFetchSite?: null | string;
+}) => AuthScope | undefined;
+//#endregion
+export { AUTH_SCOPE_HEADER, resolveAuthScope };
+//# sourceMappingURL=resolveAuthScope.d.ts.map

package/dist/scope/resolveAuthScope.js

@@ -0,0 +1,43 @@
+//#region src/scope/resolveAuthScope.ts
+/** Request header carrying the resolved {@link AuthScope} for a request. */
+const AUTH_SCOPE_HEADER = "x-payload-auth-scope";
+const isWithin = (pathname, base) => pathname === base || pathname.startsWith(`${base}/`);
+/**
+* Decides which session a request may authenticate against, or `undefined` when the
+* request carries no signal to decide by.
+*
+* Admin panel pages and their server actions live under `adminRoute`, so those are
+* unambiguous. Payload's REST namespace is shared between the admin panel and the
+* website, so those calls are attributed by `Referer`, which on same-origin browser fetches
+* carry the full originating path.
+*
+* A `Referer` only says something about the admin panel when it belongs to the same
+* origin the API is served from: a frontend on another origin may well have an
+* `/admin` route of its own. `Sec-Fetch-Site` is what distinguishes the two, and a
+* page cannot forge it. Clients that send no `Sec-Fetch-Site` are held to the same
+* rule by comparing the `Referer` against `origin`, so pass it whenever the caller
+* knows it. Without both signals a `Referer` cannot be trusted to mean the admin
+* panel, and the request resolves to `frontend`.
+*
+* `undefined` means "no attribution", not "admin": callers should leave the scope
+* header unset so the strategies fall back to `adminSessionPriority`.
+*/
+const resolveAuthScope = ({ adminRoute = "/admin", apiRoute = "/api", origin, pathname, referer, secFetchSite }) => {
+	if (isWithin(pathname, adminRoute)) return "admin";
+	if (isWithin(pathname, apiRoute)) {
+		if (!referer) return;
+		if (secFetchSite === "cross-site" || secFetchSite === "same-site") return "frontend";
+		try {
+			const url = new URL(referer);
+			if (secFetchSite !== "same-origin" && url.origin !== origin) return "frontend";
+			return isWithin(url.pathname, adminRoute) ? "admin" : "frontend";
+		} catch {
+			return;
+		}
+	}
+	return "frontend";
+};
+//#endregion
+export { AUTH_SCOPE_HEADER, resolveAuthScope };
+
+//# sourceMappingURL=resolveAuthScope.js.map

package/dist/scope/resolveAuthScope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveAuthScope.js","names":[],"sources":["../../src/scope/resolveAuthScope.ts"],"sourcesContent":["import type { AuthScope } from '../types'\n\n/** Request header carrying the resolved {@link AuthScope} for a request. */\nexport const AUTH_SCOPE_HEADER = 'x-payload-auth-scope'\n\nconst isWithin = (pathname: string, base: string) =>\n\tpathname === base || pathname.startsWith(`${base}/`)\n\n/**\n * Decides which session a request may authenticate against, or `undefined` when the\n * request carries no signal to decide by.\n *\n * Admin panel pages and their server actions live under `adminRoute`, so those are\n * unambiguous. Payload's REST namespace is shared between the admin panel and the\n * website, so those calls are attributed by `Referer`, which on same-origin browser fetches\n * carry the full originating path.\n *\n * A `Referer` only says something about the admin panel when it belongs to the same\n * origin the API is served from: a frontend on another origin may well have an\n * `/admin` route of its own. `Sec-Fetch-Site` is what distinguishes the two, and a\n * page cannot forge it. Clients that send no `Sec-Fetch-Site` are held to the same\n * rule by comparing the `Referer` against `origin`, so pass it whenever the caller\n * knows it. Without both signals a `Referer` cannot be trusted to mean the admin\n * panel, and the request resolves to `frontend`.\n *\n * `undefined` means \"no attribution\", not \"admin\": callers should leave the scope\n * header unset so the strategies fall back to `adminSessionPriority`.\n */\nexport const resolveAuthScope = ({\n\tadminRoute = '/admin',\n\tapiRoute = '/api',\n\torigin,\n\tpathname,\n\treferer,\n\tsecFetchSite,\n}: {\n\tadminRoute?: string\n\tapiRoute?: string\n\t/** The origin the request was served from, used to vet a `Referer` from another site. */\n\torigin?: null | string\n\tpathname: string\n\treferer?: null | string\n\t/** The request's `Sec-Fetch-Site` header, when it has one. */\n\tsecFetchSite?: null | string\n}): AuthScope | undefined => {\n\tif (isWithin(pathname, adminRoute)) {\n\t\treturn 'admin'\n\t}\n\n\tif (isWithin(pathname, apiRoute)) {\n\t\tif (!referer) {\n\t\t\treturn undefined\n\t\t}\n\n\t\tif (secFetchSite === 'cross-site' || secFetchSite === 'same-site') {\n\t\t\treturn 'frontend'\n\t\t}\n\n\t\ttry {\n\t\t\tconst url = new URL(referer)\n\n\t\t\t// Without `Sec-Fetch-Site` the origin is the only thing separating our own admin\n\t\t\t// panel from another site's `/admin` route, so an unverifiable origin means the\n\t\t\t// path is not evidence of anything.\n\t\t\tif (secFetchSite !== 'same-origin' && url.origin !== origin) {\n\t\t\t\treturn 'frontend'\n\t\t\t}\n\n\t\t\treturn isWithin(url.pathname, adminRoute) ? 'admin' : 'frontend'\n\t\t} catch {\n\t\t\treturn undefined\n\t\t}\n\t}\n\n\treturn 'frontend'\n}\n"],"mappings":";;AAGA,MAAa,oBAAoB;AAEjC,MAAM,YAAY,UAAkB,SACnC,aAAa,QAAQ,SAAS,WAAW,GAAG,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;AAsBpD,MAAa,oBAAoB,EAChC,aAAa,UACb,WAAW,QACX,QACA,UACA,SACA,mBAU4B;CAC5B,IAAI,SAAS,UAAU,UAAU,GAChC,OAAO;CAGR,IAAI,SAAS,UAAU,QAAQ,GAAG;EACjC,IAAI,CAAC,SACJ;EAGD,IAAI,iBAAiB,gBAAgB,iBAAiB,aACrD,OAAO;EAGR,IAAI;GACH,MAAM,MAAM,IAAI,IAAI,OAAO;GAK3B,IAAI,iBAAiB,iBAAiB,IAAI,WAAW,QACpD,OAAO;GAGR,OAAO,SAAS,IAAI,UAAU,UAAU,IAAI,UAAU;EACvD,QAAQ;GACP;EACD;CACD;CAEA,OAAO;AACR"}

package/dist/translations/en.js

@@ -0,0 +1,12 @@
+import { keys } from "./keys.js";
+//#region src/translations/en.ts
+/**
+* English values, keyed by the typed constants in `keys.ts` so the two stay in
+* lockstep. The `Record<TranslationKey, string>` annotation makes a missing or
+* unknown key a type error. `translations/index.ts` nests these for Payload.
+*/
+const en = { [keys.pluginName]: "Dual Session" };
+//#endregion
+export { en };
+
+//# sourceMappingURL=en.js.map

package/dist/translations/en.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"en.js","names":[],"sources":["../../src/translations/en.ts"],"sourcesContent":["import { keys, type TranslationKey } from './keys'\n\n/**\n * English values, keyed by the typed constants in `keys.ts` so the two stay in\n * lockstep. The `Record<TranslationKey, string>` annotation makes a missing or\n * unknown key a type error. `translations/index.ts` nests these for Payload.\n */\nexport const en: Record<TranslationKey, string> = {\n\t[keys.pluginName]: 'Dual Session',\n}\n"],"mappings":";;;;;;;AAOA,MAAa,KAAqC,GAChD,KAAK,aAAa,eACpB"}

package/dist/translations/index.d.ts

@@ -0,0 +1,14 @@
+import { TranslationKey, keys } from "./keys.js";
+
+//#region src/translations/index.d.ts
+/** Per-locale string overrides keyed by this plugin's typed translation keys. */
+type TranslationsOption = {
+  [locale: string]: Partial<Record<TranslationKey, string>>;
+};
+/** Per-locale messages merged into `config.i18n.translations`. English only for now. */
+declare const translations: {
+  en: Record<string, Record<string, string>>;
+};
+//#endregion
+export { TranslationsOption, translations };
+//# sourceMappingURL=index.d.ts.map

package/dist/translations/index.js

@@ -0,0 +1,27 @@
+import "./keys.js";
+import { en } from "./en.js";
+//#region src/translations/index.ts
+/**
+* Flat `dualSession:foo` entries to the nested `{ dualSession: { foo } }`
+* shape Payload resolves `t('dualSession:foo')` against (it splits on `:`).
+* Undefined values are skipped so `Partial` override maps pass through.
+*/
+const toNested = (flat) => {
+	const out = {};
+	for (const [fullKey, value] of Object.entries(flat)) {
+		if (typeof value !== "string") continue;
+		const separator = fullKey.indexOf(":");
+		if (separator < 1) continue;
+		const namespace = fullKey.slice(0, separator);
+		const bucket = out[namespace] ?? {};
+		bucket[fullKey.slice(separator + 1)] = value;
+		out[namespace] = bucket;
+	}
+	return out;
+};
+/** Per-locale messages merged into `config.i18n.translations`. English only for now. */
+const translations = { en: toNested(en) };
+//#endregion
+export { toNested, translations };
+
+//# sourceMappingURL=index.js.map

package/dist/translations/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","names":[],"sources":["../../src/translations/index.ts"],"sourcesContent":["import { en } from './en'\nimport type { TranslationKey } from './keys'\n\nexport type { TranslationKey } from './keys'\nexport { keys } from './keys'\n\n/** Per-locale string overrides keyed by this plugin's typed translation keys. */\nexport type TranslationsOption = {\n\t[locale: string]: Partial<Record<TranslationKey, string>>\n}\n\n/**\n * Flat `dualSession:foo` entries to the nested `{ dualSession: { foo } }`\n * shape Payload resolves `t('dualSession:foo')` against (it splits on `:`).\n * Undefined values are skipped so `Partial` override maps pass through.\n */\nexport const toNested = (flat: {\n\t[key: string]: string | undefined\n}): Record<string, Record<string, string>> => {\n\tconst out: Record<string, Record<string, string>> = {}\n\tfor (const [fullKey, value] of Object.entries(flat)) {\n\t\tif (typeof value !== 'string') {\n\t\t\tcontinue\n\t\t}\n\t\tconst separator = fullKey.indexOf(':')\n\t\t// An unnamespaced key has no bucket to go in, and `slice(0, -1)` would invent one\n\t\t// out of the key with its last character cut off.\n\t\tif (separator < 1) {\n\t\t\tcontinue\n\t\t}\n\t\tconst namespace = fullKey.slice(0, separator)\n\t\tconst bucket = out[namespace] ?? {}\n\t\tbucket[fullKey.slice(separator + 1)] = value\n\t\tout[namespace] = bucket\n\t}\n\treturn out\n}\n\n/** Per-locale messages merged into `config.i18n.translations`. English only for now. */\nexport const translations = {\n\ten: toNested(en),\n}\n"],"mappings":";;;;;;;;AAgBA,MAAa,YAAY,SAEqB;CAC7C,MAAM,MAA8C,CAAC;CACrD,KAAK,MAAM,CAAC,SAAS,UAAU,OAAO,QAAQ,IAAI,GAAG;EACpD,IAAI,OAAO,UAAU,UACpB;EAED,MAAM,YAAY,QAAQ,QAAQ,GAAG;EAGrC,IAAI,YAAY,GACf;EAED,MAAM,YAAY,QAAQ,MAAM,GAAG,SAAS;EAC5C,MAAM,SAAS,IAAI,cAAc,CAAC;EAClC,OAAO,QAAQ,MAAM,YAAY,CAAC,KAAK;EACvC,IAAI,aAAa;CAClB;CACA,OAAO;AACR;;AAGA,MAAa,eAAe,EAC3B,IAAI,SAAS,EAAE,EAChB"}

package/dist/translations/keys.d.ts

@@ -0,0 +1,13 @@
+//#region src/translations/keys.d.ts
+/**
+ * Typed translation keys. Lookups must go through these constants, not string
+ * literals (enforced by requireI18nKeysTyped.grit). Every key here must have a
+ * value in every locale (`en.ts`), or it is a type error.
+ */
+declare const keys: {
+  readonly pluginName: "dualSession:pluginName";
+};
+type TranslationKey = (typeof keys)[keyof typeof keys];
+//#endregion
+export { TranslationKey, keys };
+//# sourceMappingURL=keys.d.ts.map

package/dist/translations/keys.js

@@ -0,0 +1,11 @@
+//#region src/translations/keys.ts
+/**
+* Typed translation keys. Lookups must go through these constants, not string
+* literals (enforced by requireI18nKeysTyped.grit). Every key here must have a
+* value in every locale (`en.ts`), or it is a type error.
+*/
+const keys = { pluginName: "dualSession:pluginName" };
+//#endregion
+export { keys };
+
+//# sourceMappingURL=keys.js.map

package/dist/translations/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","names":[],"sources":["../../src/translations/keys.ts"],"sourcesContent":["/**\n * Typed translation keys. Lookups must go through these constants, not string\n * literals (enforced by requireI18nKeysTyped.grit). Every key here must have a\n * value in every locale (`en.ts`), or it is a type error.\n */\nexport const keys = {\n\tpluginName: 'dualSession:pluginName',\n} as const\n\nexport type TranslationKey = (typeof keys)[keyof typeof keys]\n"],"mappings":";;;;;;AAKA,MAAa,OAAO,EACnB,YAAY,yBACb"}

package/dist/types.d.ts

@@ -0,0 +1,78 @@
+import { TranslationsOption } from "./translations/index.js";
+import { CollectionSlug, TypedUser } from "payload";
+
+//#region src/types.d.ts
+/**
+ * Which session a request is allowed to be authenticated against.
+ *
+ * - `admin`: only the admin panel's own cookie (`${cookiePrefix}-token`) may populate `req.user`
+ * - `frontend`: isolated collection cookies may populate `req.user`
+ */
+type AuthScope = 'admin' | 'frontend';
+type IsolatedCollection = {
+  /**
+   * Full cookie name holding this collection's token.
+   * @default `${cookiePrefix}-${slug}-token`
+   */
+  cookieName?: string;
+  /**
+   * Which of this collection's users get a cookie of their own. Users it returns `false`
+   * for stay on the shared `${cookiePrefix}-token`, so the admin panel is untouched.
+   *
+   * This is what lets one collection with roles back both sessions: the admin panel keeps
+   * the shared cookie byte for byte as core writes it, and only the users this predicate
+   * claims are moved onto a second one. It is also the only way to list the collection
+   * named by `admin.user`.
+   *
+   * Roles live in the user document, so the predicate should read them from there. It is
+   * never asked about a request, only about a user.
+   *
+   * @default every session of the collection is isolated
+   */
+  isolate?: (user: TypedUser) => boolean;
+  /**
+   * Scopes in which this collection's cookie is allowed to authenticate a request.
+   * Only enforced when the auth-scope proxy is installed.
+   * @default ['frontend']
+   */
+  scopes?: AuthScope[];
+  slug: CollectionSlug;
+};
+type DualSessionPluginOptions = {
+  /**
+   * When no scope header is present on a request, ignore isolated cookies as long as a
+   * valid admin-collection token is also present. Keeps the admin panel usable in
+   * projects that have not installed the auth-scope proxy.
+   * @default true
+   */
+  adminSessionPriority?: boolean;
+  /**
+   * Auth collections to move off the shared `${cookiePrefix}-token` cookie.
+   * The collection configured as `admin.user` may only be listed together with an
+   * `isolate` predicate. Without one it would lose the shared cookie it owns.
+   *
+   * Order is priority: when a visitor holds sessions for more than one of these at
+   * once, the earliest listed collection wins.
+   */
+  collections: (CollectionSlug | IsolatedCollection)[];
+  /**
+   * Disable the plugin entirely (incoming config returned untouched).
+   * Useful for opting out per environment without removing the plugin call.
+   */
+  disabled?: boolean;
+  /**
+   * Request header the auth-scope proxy writes the resolved scope into.
+   * @default 'x-payload-auth-scope'
+   */
+  scopeHeader?: string;
+  /**
+   * Per-locale overrides for this plugin's UI strings, keyed by the typed
+   * translation keys exported from `@10x-media/dual-session/i18n`. Values win
+   * over the built-in locales key-by-key; locales the plugin does not ship are
+   * added whole. App-level `i18n.translations` still wins over both.
+   */
+  translations?: TranslationsOption;
+};
+//#endregion
+export { AuthScope, DualSessionPluginOptions, IsolatedCollection };
+//# sourceMappingURL=types.d.ts.map

package/package.json

@@ -0,0 +1,124 @@
+{
+  "name": "@10x-media/dual-session",
+  "version": "0.1.0-beta.0",
+  "description": "Give each Payload auth collection its own session cookie, so an admin session and a frontend session can coexist.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/10x-media/payload-plugins.git",
+    "directory": "packages/dual-session"
+  },
+  "homepage": "https://github.com/10x-media/payload-plugins/tree/main/packages/dual-session",
+  "bugs": "https://github.com/10x-media/payload-plugins/issues",
+  "keywords": [
+    "payload",
+    "payloadcms",
+    "plugin",
+    "auth",
+    "session",
+    "cookie"
+  ],
+  "author": "10x-media",
+  "engines": {
+    "node": ">=22.18.0"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/exports/types.d.ts",
+      "import": "./dist/exports/types.js",
+      "default": "./dist/exports/types.js"
+    },
+    "./client": {
+      "types": "./dist/exports/client.d.ts",
+      "import": "./dist/exports/client.js",
+      "default": "./dist/exports/client.js"
+    },
+    "./i18n": {
+      "types": "./dist/exports/i18n.d.ts",
+      "import": "./dist/exports/i18n.js",
+      "default": "./dist/exports/i18n.js"
+    },
+    "./proxy": {
+      "types": "./dist/exports/proxy.d.ts",
+      "import": "./dist/exports/proxy.js",
+      "default": "./dist/exports/proxy.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "jose": "^5.10.0"
+  },
+  "peerDependencies": {
+    "@payloadcms/ui": "^3.83.0",
+    "next": "^15.0.0 || ^16.0.0",
+    "payload": "^3.83.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@payloadcms/db-mongodb": "3.85.0",
+    "@payloadcms/db-postgres": "3.85.0",
+    "@payloadcms/ui": "3.85.0",
+    "@playwright/test": "1.60.0",
+    "@types/node": "22.19.19",
+    "@types/react": "19.2.15",
+    "@types/react-dom": "19.2.3",
+    "next": "16.2.6",
+    "payload": "3.85.0",
+    "playwright": "1.60.0",
+    "react": "19.2.6",
+    "react-dom": "19.2.6",
+    "tsdown": "0.22.1",
+    "typescript": "5.9.3",
+    "vitest": "4.1.7",
+    "@10x-media/tsconfig": "0.0.0",
+    "@10x-media/vitest-config": "0.0.0",
+    "@10x-media/tsdown-config": "0.0.0",
+    "@10x-media/payload-test-harness": "0.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "lint": "biome check src tests dev",
+    "lint:fix": "biome check --write src tests dev",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "test:unit": "vitest run src",
+    "test:int": "vitest run tests/int",
+    "test:matrix": "DB_MATRIX=mongo vitest run tests/int/matrix.int.spec.ts && DB_MATRIX=postgres vitest run tests/int/matrix.int.spec.ts",
+    "test:container": "TEST_DB=container DB_MATRIX=mongo vitest run tests/int/matrix.int.spec.ts && TEST_DB=container DB_MATRIX=postgres vitest run tests/int/matrix.int.spec.ts",
+    "test:e2e": "bash scripts/e2e.sh",
+    "dev": "pnpm --filter @10x-media/dual-session-dev dev",
+    "start": "pnpm --filter @10x-media/dual-session-dev start",
+    "generate": "pnpm --filter @10x-media/dual-session-dev generate",
+    "generate:types": "pnpm --filter @10x-media/dual-session-dev generate:types",
+    "generate:importmap": "pnpm --filter @10x-media/dual-session-dev generate:importmap",
+    "migrate": "pnpm --filter @10x-media/dual-session-dev migrate",
+    "migrate:create": "pnpm --filter @10x-media/dual-session-dev migrate:create",
+    "migrate:down": "pnpm --filter @10x-media/dual-session-dev migrate:down",
+    "migrate:refresh": "pnpm --filter @10x-media/dual-session-dev migrate:refresh",
+    "migrate:reset": "pnpm --filter @10x-media/dual-session-dev migrate:reset",
+    "migrate:status": "pnpm --filter @10x-media/dual-session-dev migrate:status",
+    "migrate:fresh": "pnpm --filter @10x-media/dual-session-dev migrate:fresh",
+    "clean": "rm -rf dist *.tsbuildinfo dev/.next"
+  }
+}