@mvriu5/payload-ai 0.5.6 → 0.5.9

package/dist/endpoints/aiApplyActionEndpointHandler.js

@@ -1,6 +1,7 @@
 import { verifyAIActionProposal } from "../ai/proposals.js";
-import { containsSensitiveData } from "../ai/sensitiveData.js";
+import { containsSensitiveData, redactSensitiveData } from "../ai/sensitiveData.js";
 import { getCollectionFields, isAuthCollection, normalizeAuthData, normalizeDataForFields } from "../payload/normalizeData.js";
+import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
 const getProposalMeta = (proposal)=>{
     if (!proposal) return {};
     return {
@@ -15,12 +16,13 @@ const getAppliedDocReference = (doc)=>{
         id: doc.id
     };
 };
-const isKnownCollection = (req, collection)=>{
-    return req.payload.config.collections.some((item)=>item.slug === collection);
-};
-const isAllowedCollection = (req, collection, collections)=>{
-    if (!collections) return isKnownCollection(req, collection);
-    return collections.includes(collection) && isKnownCollection(req, collection);
+const isAllowedCollection = (req, collection, collections, action = "read")=>{
+    return isCollectionActionAllowed({
+        action,
+        permissions: collections,
+        req,
+        slug: collection
+    });
 };
 const isKnownGlobal = (req, slug)=>{
     return req.payload.config.globals?.some((item)=>item.slug === slug) || false;
@@ -28,6 +30,151 @@ const isKnownGlobal = (req, slug)=>{
 const isRecord = (value)=>{
     return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 };
+const mergeData = (current, next)=>{
+    return Object.fromEntries(Object.entries({
+        ...current,
+        ...next
+    }).map(([key, value])=>{
+        const currentValue = current[key];
+        if (isRecord(currentValue) && isRecord(value)) {
+            return [
+                key,
+                mergeData(currentValue, value)
+            ];
+        }
+        return [
+            key,
+            value
+        ];
+    }));
+};
+const getJSONLineKey = (line)=>{
+    const match = /^(\s*)"([^"]+)":/.exec(line);
+    return match ? `${match[1]}${match[2]}` : null;
+};
+const countDiffChanges = ({ after, before })=>{
+    const beforeLines = JSON.stringify(before, null, 2).split("\n");
+    const afterLines = JSON.stringify(after, null, 2).split("\n");
+    const dp = Array.from({
+        length: beforeLines.length + 1
+    }, ()=>Array(afterLines.length + 1).fill(0));
+    let additions = 0;
+    let removals = 0;
+    for(let i = beforeLines.length - 1; i >= 0; i -= 1){
+        for(let j = afterLines.length - 1; j >= 0; j -= 1){
+            dp[i][j] = beforeLines[i] === afterLines[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+        }
+    }
+    let beforeIndex = 0;
+    let afterIndex = 0;
+    while(beforeIndex < beforeLines.length && afterIndex < afterLines.length){
+        if (beforeLines[beforeIndex] === afterLines[afterIndex]) {
+            beforeIndex += 1;
+            afterIndex += 1;
+            continue;
+        }
+        const beforeKey = getJSONLineKey(beforeLines[beforeIndex]);
+        const afterKey = getJSONLineKey(afterLines[afterIndex]);
+        if (beforeKey && beforeKey === afterKey) {
+            removals += 1;
+            additions += 1;
+            beforeIndex += 1;
+            afterIndex += 1;
+            continue;
+        }
+        if (dp[beforeIndex + 1][afterIndex] >= dp[beforeIndex][afterIndex + 1]) {
+            removals += 1;
+            beforeIndex += 1;
+        } else {
+            additions += 1;
+            afterIndex += 1;
+        }
+    }
+    removals += beforeLines.length - beforeIndex;
+    additions += afterLines.length - afterIndex;
+    return {
+        additions,
+        removals
+    };
+};
+const getTargetURL = ({ documentID, proposal, req })=>{
+    const adminRoute = req.payload.config.routes.admin || "/admin";
+    if (proposal.action === "updateGlobal") {
+        return `${adminRoute}/globals/${proposal.slug}`;
+    }
+    if (proposal.action === "delete") {
+        return null;
+    }
+    const id = proposal.action === "create" ? documentID : proposal.id;
+    if (!id) return null;
+    return `${adminRoute}/collections/${proposal.collection}/${id}`;
+};
+const getUserID = (req)=>{
+    const user = req.user;
+    return user?.id === undefined ? undefined : String(user.id);
+};
+const logAIChange = async ({ changeLogCollection, target, proposal, req })=>{
+    if (!changeLogCollection) return null;
+    const before = redactSensitiveData(target.before);
+    const after = redactSensitiveData(target.after);
+    const { additions, removals } = countDiffChanges({
+        after,
+        before
+    });
+    const proposalForLog = {
+        ...proposal
+    };
+    delete proposalForLog._aiSignature;
+    try {
+        await req.payload.create({
+            collection: changeLogCollection,
+            data: {
+                action: proposal.action,
+                additions,
+                after,
+                before,
+                collection: "collection" in proposal ? proposal.collection : undefined,
+                documentID: target.documentID === undefined ? undefined : String(target.documentID),
+                proposal: redactSensitiveData(proposalForLog),
+                removals,
+                slug: "slug" in proposal ? proposal.slug : undefined,
+                targetType: proposal.action === "updateGlobal" ? "global" : "collection",
+                targetURL: getTargetURL({
+                    documentID: target.documentID,
+                    proposal,
+                    req
+                }),
+                title: proposal.label,
+                userID: getUserID(req)
+            },
+            overrideAccess: true,
+            req
+        });
+        return {
+            action: proposal.action,
+            additions,
+            after,
+            before,
+            collection: "collection" in proposal ? proposal.collection : null,
+            documentID: target.documentID === undefined ? null : String(target.documentID),
+            removals,
+            slug: "slug" in proposal ? proposal.slug : null,
+            title: proposal.label,
+            url: getTargetURL({
+                documentID: target.documentID,
+                proposal,
+                req
+            })
+        };
+    } catch (err) {
+        req.payload.logger.error({
+            err,
+            msg: "AI change log entry could not be written",
+            proposal: getProposalMeta(proposal)
+        });
+        return null;
+    }
+};
 const isActionProposal = (proposal)=>{
     if (!isRecord(proposal) || typeof proposal.label !== "string") return false;
     if (proposal.action === "create") {
@@ -82,18 +229,33 @@ export const createAIApplyActionEndpointHandler = (options = {})=>async (req)=>{
                 });
                 const globalConfig = req.payload.config.globals?.find((global)=>global.slug === proposal.slug);
                 normalized = normalizeDataForFields(globalConfig?.fields || [], proposal.data);
+                const before = await req.payload.findGlobal({
+                    depth: 2,
+                    req,
+                    slug: proposal.slug
+                });
                 const doc = await req.payload.updateGlobal({
                     data: normalized.data,
                     overrideAccess: false,
                     req,
                     slug: proposal.slug
                 });
+                const change = await logAIChange({
+                    changeLogCollection: options.changeLogCollection,
+                    proposal,
+                    req,
+                    target: {
+                        after: mergeData(before, normalized.data),
+                        before
+                    }
+                });
                 return Response.json({
+                    change,
                     doc: getAppliedDocReference(doc),
                     status: "applied"
                 });
             }
-            if (!isAllowedCollection(req, proposal.collection, options.collections)) return Response.json({
+            if (!isAllowedCollection(req, proposal.collection, options.collections, proposal.action)) return Response.json({
                 error: "Unknown collection"
             }, {
                 status: 400
@@ -105,7 +267,18 @@ export const createAIApplyActionEndpointHandler = (options = {})=>async (req)=>{
                     overrideAccess: false,
                     req
                 });
+                const change = await logAIChange({
+                    changeLogCollection: options.changeLogCollection,
+                    proposal,
+                    req,
+                    target: {
+                        after: {},
+                        before: doc,
+                        documentID: proposal.id
+                    }
+                });
                 return Response.json({
+                    change,
                     doc: getAppliedDocReference(doc),
                     status: "applied"
                 });
@@ -133,11 +306,28 @@ export const createAIApplyActionEndpointHandler = (options = {})=>async (req)=>{
                     overrideAccess: false,
                     req
                 });
+                const change = await logAIChange({
+                    changeLogCollection: options.changeLogCollection,
+                    proposal,
+                    req,
+                    target: {
+                        after: doc,
+                        before: {},
+                        documentID: doc.id
+                    }
+                });
                 return Response.json({
+                    change,
                     doc: getAppliedDocReference(doc),
                     status: "applied"
                 });
             }
+            const before = await req.payload.findByID({
+                collection: proposal.collection,
+                depth: 2,
+                id: proposal.id,
+                req
+            });
             const doc = await req.payload.update({
                 collection: proposal.collection,
                 data: normalized.data,
@@ -145,7 +335,18 @@ export const createAIApplyActionEndpointHandler = (options = {})=>async (req)=>{
                 overrideAccess: false,
                 req
             });
+            const change = await logAIChange({
+                changeLogCollection: options.changeLogCollection,
+                proposal,
+                req,
+                target: {
+                    after: mergeData(before, normalized.data),
+                    before,
+                    documentID: proposal.id
+                }
+            });
             return Response.json({
+                change,
                 doc: getAppliedDocReference(doc),
                 status: "applied"
             });

package/dist/endpoints/aiChatEndpointHandler.d.ts

@@ -1,5 +1,7 @@
 import type { PayloadHandler } from "payload";
 import { type AIActionSignature } from "../ai/proposals.js";
+import { type AIModelConfig } from "../ai/providerOptions.js";
+import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
 export type AIActionProposal = ({
     action: "create";
     collection: string;
@@ -25,7 +27,9 @@ export type AIActionProposal = ({
     _aiSignature?: AIActionSignature;
 };
 type AIChatEndpointOptions = {
-    collections?: string[];
+    allowUserApiKeys?: boolean;
+    collections?: ResolvedAICollectionPermissionMap;
+    models?: AIModelConfig;
 };
 export declare const createAIChatEndpointHandler: (options?: AIChatEndpointOptions) => PayloadHandler;
 export {};

package/dist/endpoints/aiChatEndpointHandler.js

@@ -1,10 +1,18 @@
-import { generateText, stepCountIs } from "ai";
+import { streamText, stepCountIs } from "ai";
 import { z } from "zod";
 import { signAIActionProposal } from "../ai/proposals.js";
 import { getModel, getProviderConfig } from "../ai/providerRuntime.js";
 import { isAIProvider } from "../ai/providerOptions.js";
 import { containsSensitiveData } from "../ai/sensitiveData.js";
-import { buildPromptWithMentionContext, collectBlocks, describeField, getAllowedCollectionSlugs, getMentionContext } from "../payload/schemaContext.js";
+import { buildPromptWithMentionContext, collectBlocks, describeCollectionLikeConfig, getAllowedCollectionSlugs, getMentionContext } from "../payload/schemaContext.js";
+import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
+const maxProposalLabelLength = 90;
+const getSafeProposalLabel = (label)=>{
+    const firstLine = label.replace(/[*_`>#-]/g, "").split("\n").map((line)=>line.trim()).find(Boolean);
+    if (!firstLine) return "Review proposed CMS change";
+    if (firstLine.length <= maxProposalLabelLength) return firstLine;
+    return `${firstLine.slice(0, maxProposalLabelLength - 3).trim()}...`;
+};
 export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
         if (!req.user) return Response.json({
             error: "Unauthorized"
@@ -26,8 +34,10 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
             status: 400
         });
         const provider = requestedProvider;
+        const userApiKey = options.allowUserApiKeys === false ? null : user.aiApiKey;
         const providerConfig = getProviderConfig({
-            apiKey: user.aiApiKey,
+            apiKey: userApiKey,
+            defaultModels: options.models?.defaults,
             model: body?.model,
             provider
         });
@@ -48,7 +58,7 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
         };
         if (!providerConfig.apiKey) {
             return Response.json({
-                error: `Add a ${provider} API key to your account settings first.`
+                error: options.allowUserApiKeys === false ? `Configure a ${provider} API key in the server environment first.` : `Add a ${provider} API key to your account settings or configure it in the server environment first.`
             }, {
                 status: 400
             });
@@ -88,11 +98,23 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
             const mentionContext = await getMentionContext({
                 blockContexts,
                 collectionSlugs,
+                collections: options.collections,
                 globalSlugs,
                 mentions: body?.mentions,
                 req
             });
             const collectionSlugSchema = z.enum(collectionSlugs);
+            const getDisallowedCollectionActionError = (collection, action)=>{
+                if (isCollectionActionAllowed({
+                    action,
+                    permissions: options.collections,
+                    req,
+                    slug: collection
+                })) return null;
+                return {
+                    error: `${action} is not enabled for collection: ${collection}`
+                };
+            };
             const tools = {
                 getDoc: {
                     description: "Read one document by collection slug and document id.",
@@ -114,10 +136,10 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                     description: "List all Payload CMS collections available in this app.",
                     inputSchema: z.object({}),
                     execute: async ()=>{
-                        return allowedCollections.map((collection)=>({
-                                fields: collection.fields.map(describeField),
-                                label: collection.labels?.plural || collection.slug,
-                                slug: collection.slug
+                        return allowedCollections.map((collection)=>describeCollectionLikeConfig({
+                                config: collection,
+                                permissions: options.collections,
+                                type: "collection"
                             }));
                     }
                 },
@@ -143,10 +165,9 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                     description: "List all Payload CMS globals available in this app.",
                     inputSchema: z.object({}),
                     execute: async ()=>{
-                        return req.payload.config.globals?.map((global)=>({
-                                fields: global.fields.map(describeField),
-                                label: global.label || global.slug,
-                                slug: global.slug
+                        return req.payload.config.globals?.map((global)=>describeCollectionLikeConfig({
+                                config: global,
+                                type: "global"
                             })) || [];
                     }
                 },
@@ -158,11 +179,13 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, data, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "create");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "create",
                             collection,
                             data,
-                            label
+                            label: getSafeProposalLabel(label)
                         };
                         return addSignedProposal(proposal);
                     }
@@ -175,11 +198,13 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, id, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "delete");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "delete",
                             collection,
                             id,
-                            label
+                            label: getSafeProposalLabel(label)
                         };
                         return addSignedProposal(proposal);
                     }
@@ -193,12 +218,14 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         label: z.string().min(1)
                     }),
                     execute: async ({ collection, data, id, label })=>{
+                        const permissionError = getDisallowedCollectionActionError(collection, "update");
+                        if (permissionError) return permissionError;
                         const proposal = {
                             action: "update",
                             collection,
                             data,
                             id,
-                            label
+                            label: getSafeProposalLabel(label)
                         };
                         return addSignedProposal(proposal);
                     }
@@ -218,7 +245,7 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                         const proposal = {
                             action: "updateGlobal",
                             data,
-                            label,
+                            label: getSafeProposalLabel(label),
                             slug
                         };
                         return addSignedProposal(proposal);
@@ -256,7 +283,11 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                     }
                 }
             };
-            const result = await generateText({
+            const encoder = new TextEncoder();
+            const sendEvent = (controller, event, data)=>{
+                controller.enqueue(encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`));
+            };
+            const result = streamText({
                 maxOutputTokens: 700,
                 model: getModel({
                     apiKey: providerConfig.apiKey,
@@ -274,13 +305,67 @@ export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
                     "When mention context is provided, use it as the selected CMS scope and prefer it over guessing collection names.",
                     "Never claim that a write has been applied unless the user confirms an action proposal in the UI.",
                     "For create, update, and delete requests, call the proposal tools instead of directly changing data.",
-                    "Keep the visible response under 80 words. Put concrete changes in proposal tool calls instead of long prose."
+                    "Keep the visible response under 40 words and describe only what kind of change was proposed.",
+                    "Write visible responses as plain text only. Do not use Markdown formatting, bold markers (**), headings, bullets, tables, or code fences.",
+                    "Do not include proposed field values, full replacement text, quoted content, markdown sections, code blocks, or headings like 'New content'/'Neuer Inhalt' in the visible response.",
+                    "Put all concrete field values and replacement content only in proposal tool data. Proposal labels must be short action summaries and must not contain proposed content."
                 ].join("\n"),
                 tools
             });
-            return Response.json({
-                proposals,
-                text: result.text
+            const stream = new ReadableStream({
+                start: async (controller)=>{
+                    let didSendTerminalEvent = false;
+                    try {
+                        for await (const part of result.fullStream){
+                            if (part.type === "text-delta") {
+                                sendEvent(controller, "text", {
+                                    delta: part.text
+                                });
+                                continue;
+                            }
+                            if (part.type === "error") {
+                                didSendTerminalEvent = true;
+                                sendEvent(controller, "error", {
+                                    error: "AI request failed."
+                                });
+                                break;
+                            }
+                            if (part.type === "finish") {
+                                sendEvent(controller, "proposals", {
+                                    proposals
+                                });
+                                sendEvent(controller, "done", {});
+                                didSendTerminalEvent = true;
+                            }
+                        }
+                        if (!didSendTerminalEvent) {
+                            sendEvent(controller, "proposals", {
+                                proposals
+                            });
+                            sendEvent(controller, "done", {});
+                        }
+                    } catch (err) {
+                        req.payload.logger.error({
+                            debug,
+                            err,
+                            msg: "AI chat stream failed"
+                        });
+                        if (!didSendTerminalEvent) {
+                            sendEvent(controller, "error", {
+                                error: "AI request failed."
+                            });
+                        }
+                    } finally{
+                        controller.close();
+                    }
+                }
+            });
+            return new Response(stream, {
+                headers: {
+                    "Cache-Control": "no-cache, no-transform",
+                    Connection: "keep-alive",
+                    "Content-Type": "text/event-stream; charset=utf-8"
+                }
             });
         } catch (err) {
             req.payload.logger.error({

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.d.ts

@@ -1,6 +1,7 @@
 import type { PayloadHandler } from "payload";
+import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
 type AIMentionSuggestionsEndpointOptions = {
-    collections?: string[];
+    collections?: ResolvedAICollectionPermissionMap;
 };
 export declare const createAIMentionSuggestionsEndpointHandler: (options?: AIMentionSuggestionsEndpointOptions) => PayloadHandler;
 export {};

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.js

@@ -1,9 +1,4 @@
-import { isInternalCollection } from "../payload/shared.js";
-const isAllowedCollectionSlug = (slug, collections)=>{
-    if (isInternalCollection(slug)) return false;
-    if (!collections) return true;
-    return collections.includes(slug);
-};
+import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
 const getDocLabel = (doc, useAsTitle)=>{
     const titleField = useAsTitle && typeof doc[useAsTitle] === "string" ? doc[useAsTitle] : null;
     return (titleField || doc.title || doc.name || doc.email || doc.id || "Untitled").toString();
@@ -22,7 +17,12 @@ export const createAIMentionSuggestionsEndpointHandler = (options = {})=>async (
         });
         const suggestions = [];
         const collections = req.payload.config.collections.filter((collection)=>{
-            if (!isAllowedCollectionSlug(collection.slug, options.collections)) return false;
+            if (!isCollectionActionAllowed({
+                action: "read",
+                permissions: options.collections,
+                req,
+                slug: collection.slug
+            })) return false;
             if (collectionSlug) return collection.slug === collectionSlug;
             return true;
         });

package/dist/endpoints/aiProposalDiffEndpointHandler.d.ts

@@ -0,0 +1,7 @@
+import type { PayloadHandler } from "payload";
+import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
+type AIProposalDiffEndpointOptions = {
+    collections?: ResolvedAICollectionPermissionMap;
+};
+export declare const createAIProposalDiffEndpointHandler: (options?: AIProposalDiffEndpointOptions) => PayloadHandler;
+export {};