@mvriu5/payload-ai 0.5.9 → 0.5.10

package/dist/endpoints/aiChatEndpointHandler.js

@@ -1,382 +0,0 @@
-import { streamText, stepCountIs } from "ai";
-import { z } from "zod";
-import { signAIActionProposal } from "../ai/proposals.js";
-import { getModel, getProviderConfig } from "../ai/providerRuntime.js";
-import { isAIProvider } from "../ai/providerOptions.js";
-import { containsSensitiveData } from "../ai/sensitiveData.js";
-import { buildPromptWithMentionContext, collectBlocks, describeCollectionLikeConfig, getAllowedCollectionSlugs, getMentionContext } from "../payload/schemaContext.js";
-import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
-const maxProposalLabelLength = 90;
-const getSafeProposalLabel = (label)=>{
-    const firstLine = label.replace(/[*_`>#-]/g, "").split("\n").map((line)=>line.trim()).find(Boolean);
-    if (!firstLine) return "Review proposed CMS change";
-    if (firstLine.length <= maxProposalLabelLength) return firstLine;
-    return `${firstLine.slice(0, maxProposalLabelLength - 3).trim()}...`;
-};
-export const createAIChatEndpointHandler = (options = {})=>async (req)=>{
-        if (!req.user) return Response.json({
-            error: "Unauthorized"
-        }, {
-            status: 401
-        });
-        const body = req.json ? await req.json().catch(()=>null) : null;
-        const prompt = body?.prompt?.trim();
-        if (!prompt) return Response.json({
-            error: "Prompt is required"
-        }, {
-            status: 400
-        });
-        const user = req.user;
-        const requestedProvider = body?.provider || user.aiProvider || "openai";
-        if (!isAIProvider(requestedProvider)) return Response.json({
-            error: `Unsupported AI provider: ${requestedProvider}`
-        }, {
-            status: 400
-        });
-        const provider = requestedProvider;
-        const userApiKey = options.allowUserApiKeys === false ? null : user.aiApiKey;
-        const providerConfig = getProviderConfig({
-            apiKey: userApiKey,
-            defaultModels: options.models?.defaults,
-            model: body?.model,
-            provider
-        });
-        const debug = {
-            model: providerConfig.modelID,
-            provider,
-            tools: [
-                "getDoc",
-                "getGlobal",
-                "listCollections",
-                "listGlobals",
-                "proposeCreateDoc",
-                "proposeDeleteDoc",
-                "proposeUpdateDoc",
-                "proposeUpdateGlobal",
-                "searchDocs"
-            ]
-        };
-        if (!providerConfig.apiKey) {
-            return Response.json({
-                error: options.allowUserApiKeys === false ? `Configure a ${provider} API key in the server environment first.` : `Add a ${provider} API key to your account settings or configure it in the server environment first.`
-            }, {
-                status: 400
-            });
-        }
-        try {
-            const proposals = [];
-            const addSignedProposal = (proposal)=>{
-                if ("data" in proposal && containsSensitiveData(proposal.data)) {
-                    return {
-                        error: "Proposal contains sensitive fields and cannot be created."
-                    };
-                }
-                const signedProposal = signAIActionProposal(proposal);
-                proposals.push(signedProposal);
-                return signedProposal;
-            };
-            const collectionSlugs = getAllowedCollectionSlugs(req, options.collections);
-            const globalSlugs = req.payload.config.globals?.map((global)=>global.slug) || [];
-            const allowedCollections = req.payload.config.collections.filter((collection)=>collectionSlugs.includes(collection.slug));
-            if (collectionSlugs.length === 0) {
-                return Response.json({
-                    error: "No AI-enabled collections are configured."
-                }, {
-                    status: 400
-                });
-            }
-            const blockContexts = [
-                ...allowedCollections.flatMap((collection)=>collectBlocks({
-                        fields: collection.fields,
-                        parent: collection.slug
-                    })),
-                ...req.payload.config.globals?.flatMap((global)=>collectBlocks({
-                        fields: global.fields,
-                        parent: global.slug
-                    })) || []
-            ];
-            const mentionContext = await getMentionContext({
-                blockContexts,
-                collectionSlugs,
-                collections: options.collections,
-                globalSlugs,
-                mentions: body?.mentions,
-                req
-            });
-            const collectionSlugSchema = z.enum(collectionSlugs);
-            const getDisallowedCollectionActionError = (collection, action)=>{
-                if (isCollectionActionAllowed({
-                    action,
-                    permissions: options.collections,
-                    req,
-                    slug: collection
-                })) return null;
-                return {
-                    error: `${action} is not enabled for collection: ${collection}`
-                };
-            };
-            const tools = {
-                getDoc: {
-                    description: "Read one document by collection slug and document id.",
-                    inputSchema: z.object({
-                        collection: collectionSlugSchema,
-                        id: z.string().min(1)
-                    }),
-                    execute: async ({ collection, id })=>{
-                        return req.payload.findByID({
-                            collection: collection,
-                            depth: 2,
-                            id,
-                            overrideAccess: false,
-                            req
-                        });
-                    }
-                },
-                listCollections: {
-                    description: "List all Payload CMS collections available in this app.",
-                    inputSchema: z.object({}),
-                    execute: async ()=>{
-                        return allowedCollections.map((collection)=>describeCollectionLikeConfig({
-                                config: collection,
-                                permissions: options.collections,
-                                type: "collection"
-                            }));
-                    }
-                },
-                getGlobal: {
-                    description: "Read one Payload CMS global by slug.",
-                    inputSchema: z.object({
-                        slug: z.string().min(1)
-                    }),
-                    execute: async ({ slug })=>{
-                        const globalConfig = req.payload.config.globals?.find((global)=>global.slug === slug);
-                        if (!globalConfig) return {
-                            error: `Unknown global: ${slug}`
-                        };
-                        return req.payload.findGlobal({
-                            depth: 2,
-                            overrideAccess: false,
-                            req,
-                            slug: slug
-                        });
-                    }
-                },
-                listGlobals: {
-                    description: "List all Payload CMS globals available in this app.",
-                    inputSchema: z.object({}),
-                    execute: async ()=>{
-                        return req.payload.config.globals?.map((global)=>describeCollectionLikeConfig({
-                                config: global,
-                                type: "global"
-                            })) || [];
-                    }
-                },
-                proposeCreateDoc: {
-                    description: "Prepare a CMS document creation proposal. This does not write to the database. Use exact field names from listCollections. For array fields, provide arrays of objects matching their child fields. For richText fields, prefer plain text or omit if unsure.",
-                    inputSchema: z.object({
-                        collection: collectionSlugSchema,
-                        data: z.record(z.string(), z.unknown()),
-                        label: z.string().min(1)
-                    }),
-                    execute: async ({ collection, data, label })=>{
-                        const permissionError = getDisallowedCollectionActionError(collection, "create");
-                        if (permissionError) return permissionError;
-                        const proposal = {
-                            action: "create",
-                            collection,
-                            data,
-                            label: getSafeProposalLabel(label)
-                        };
-                        return addSignedProposal(proposal);
-                    }
-                },
-                proposeDeleteDoc: {
-                    description: "Prepare a CMS document deletion proposal. This does not write to the database.",
-                    inputSchema: z.object({
-                        collection: collectionSlugSchema,
-                        id: z.string().min(1),
-                        label: z.string().min(1)
-                    }),
-                    execute: async ({ collection, id, label })=>{
-                        const permissionError = getDisallowedCollectionActionError(collection, "delete");
-                        if (permissionError) return permissionError;
-                        const proposal = {
-                            action: "delete",
-                            collection,
-                            id,
-                            label: getSafeProposalLabel(label)
-                        };
-                        return addSignedProposal(proposal);
-                    }
-                },
-                proposeUpdateDoc: {
-                    description: "Prepare a CMS document update proposal. This does not write to the database. Use exact field names from listCollections. For array fields, provide arrays of objects matching their child fields. For richText fields, prefer plain text or omit if unsure.",
-                    inputSchema: z.object({
-                        collection: collectionSlugSchema,
-                        data: z.record(z.string(), z.unknown()),
-                        id: z.string().min(1),
-                        label: z.string().min(1)
-                    }),
-                    execute: async ({ collection, data, id, label })=>{
-                        const permissionError = getDisallowedCollectionActionError(collection, "update");
-                        if (permissionError) return permissionError;
-                        const proposal = {
-                            action: "update",
-                            collection,
-                            data,
-                            id,
-                            label: getSafeProposalLabel(label)
-                        };
-                        return addSignedProposal(proposal);
-                    }
-                },
-                proposeUpdateGlobal: {
-                    description: "Prepare a Payload global update proposal. This does not write to the database.",
-                    inputSchema: z.object({
-                        data: z.record(z.string(), z.unknown()),
-                        label: z.string().min(1),
-                        slug: z.string().min(1)
-                    }),
-                    execute: async ({ data, label, slug })=>{
-                        const globalConfig = req.payload.config.globals?.find((global)=>global.slug === slug);
-                        if (!globalConfig) return {
-                            error: `Unknown global: ${slug}`
-                        };
-                        const proposal = {
-                            action: "updateGlobal",
-                            data,
-                            label: getSafeProposalLabel(label),
-                            slug
-                        };
-                        return addSignedProposal(proposal);
-                    }
-                },
-                searchDocs: {
-                    description: "Search documents in one collection. Use query for a loose text search where possible.",
-                    inputSchema: z.object({
-                        collection: collectionSlugSchema,
-                        limit: z.number().int().min(1).max(10).default(5),
-                        query: z.string().optional()
-                    }),
-                    execute: async ({ collection, limit, query })=>{
-                        const collectionConfig = allowedCollections.find((item)=>item.slug === collection);
-                        const searchableFields = collectionConfig?.fields.filter((field)=>"name" in field && [
-                                "email",
-                                "text",
-                                "textarea"
-                            ].includes(field.type)).map((field)=>"name" in field ? field.name : null).filter(Boolean) || [];
-                        const where = query && searchableFields.length > 0 ? {
-                            or: searchableFields.map((field)=>({
-                                    [field]: {
-                                        contains: query
-                                    }
-                                }))
-                        } : undefined;
-                        return req.payload.find({
-                            collection: collection,
-                            depth: 1,
-                            limit,
-                            overrideAccess: false,
-                            req,
-                            where
-                        });
-                    }
-                }
-            };
-            const encoder = new TextEncoder();
-            const sendEvent = (controller, event, data)=>{
-                controller.enqueue(encoder.encode(`event: ${event}\ndata: ${JSON.stringify(data)}\n\n`));
-            };
-            const result = streamText({
-                maxOutputTokens: 700,
-                model: getModel({
-                    apiKey: providerConfig.apiKey,
-                    model: providerConfig.modelID,
-                    provider
-                }),
-                prompt: buildPromptWithMentionContext({
-                    mentionContext,
-                    prompt
-                }),
-                stopWhen: stepCountIs(6),
-                system: [
-                    "You are a CMS assistant inside Payload CMS.",
-                    "Use tools to inspect CMS schema and content before answering content questions.",
-                    "When mention context is provided, use it as the selected CMS scope and prefer it over guessing collection names.",
-                    "Never claim that a write has been applied unless the user confirms an action proposal in the UI.",
-                    "For create, update, and delete requests, call the proposal tools instead of directly changing data.",
-                    "Keep the visible response under 40 words and describe only what kind of change was proposed.",
-                    "Write visible responses as plain text only. Do not use Markdown formatting, bold markers (**), headings, bullets, tables, or code fences.",
-                    "Do not include proposed field values, full replacement text, quoted content, markdown sections, code blocks, or headings like 'New content'/'Neuer Inhalt' in the visible response.",
-                    "Put all concrete field values and replacement content only in proposal tool data. Proposal labels must be short action summaries and must not contain proposed content."
-                ].join("\n"),
-                tools
-            });
-            const stream = new ReadableStream({
-                start: async (controller)=>{
-                    let didSendTerminalEvent = false;
-                    try {
-                        for await (const part of result.fullStream){
-                            if (part.type === "text-delta") {
-                                sendEvent(controller, "text", {
-                                    delta: part.text
-                                });
-                                continue;
-                            }
-                            if (part.type === "error") {
-                                didSendTerminalEvent = true;
-                                sendEvent(controller, "error", {
-                                    error: "AI request failed."
-                                });
-                                break;
-                            }
-                            if (part.type === "finish") {
-                                sendEvent(controller, "proposals", {
-                                    proposals
-                                });
-                                sendEvent(controller, "done", {});
-                                didSendTerminalEvent = true;
-                            }
-                        }
-                        if (!didSendTerminalEvent) {
-                            sendEvent(controller, "proposals", {
-                                proposals
-                            });
-                            sendEvent(controller, "done", {});
-                        }
-                    } catch (err) {
-                        req.payload.logger.error({
-                            debug,
-                            err,
-                            msg: "AI chat stream failed"
-                        });
-                        if (!didSendTerminalEvent) {
-                            sendEvent(controller, "error", {
-                                error: "AI request failed."
-                            });
-                        }
-                    } finally{
-                        controller.close();
-                    }
-                }
-            });
-            return new Response(stream, {
-                headers: {
-                    "Cache-Control": "no-cache, no-transform",
-                    Connection: "keep-alive",
-                    "Content-Type": "text/event-stream; charset=utf-8"
-                }
-            });
-        } catch (err) {
-            req.payload.logger.error({
-                debug,
-                err,
-                msg: "AI chat request failed"
-            });
-            return Response.json({
-                error: "AI request failed."
-            }, {
-                status: 500
-            });
-        }
-    };

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.d.ts

@@ -1,7 +0,0 @@
-import type { PayloadHandler } from "payload";
-import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
-type AIMentionSuggestionsEndpointOptions = {
-    collections?: ResolvedAICollectionPermissionMap;
-};
-export declare const createAIMentionSuggestionsEndpointHandler: (options?: AIMentionSuggestionsEndpointOptions) => PayloadHandler;
-export {};

package/dist/endpoints/aiMentionSuggestionsEndpointHandler.js

@@ -1,63 +0,0 @@
-import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
-const getDocLabel = (doc, useAsTitle)=>{
-    const titleField = useAsTitle && typeof doc[useAsTitle] === "string" ? doc[useAsTitle] : null;
-    return (titleField || doc.title || doc.name || doc.email || doc.id || "Untitled").toString();
-};
-export const createAIMentionSuggestionsEndpointHandler = (options = {})=>async (req)=>{
-        if (!req.user) return Response.json({
-            error: "Unauthorized"
-        }, {
-            status: 401
-        });
-        const body = req.json ? await req.json().catch(()=>null) : null;
-        const query = body?.query?.trim();
-        const collectionSlug = body?.collectionSlug?.trim();
-        if (!query && !collectionSlug) return Response.json({
-            suggestions: []
-        });
-        const suggestions = [];
-        const collections = req.payload.config.collections.filter((collection)=>{
-            if (!isCollectionActionAllowed({
-                action: "read",
-                permissions: options.collections,
-                req,
-                slug: collection.slug
-            })) return false;
-            if (collectionSlug) return collection.slug === collectionSlug;
-            return true;
-        });
-        for (const collection of collections){
-            const searchableFields = collection.fields.filter((field)=>"name" in field && [
-                    "email",
-                    "text",
-                    "textarea"
-                ].includes(field.type)).map((field)=>"name" in field ? field.name : null).filter(Boolean);
-            if (query && searchableFields.length === 0) continue;
-            const result = await req.payload.find({
-                collection: collection.slug,
-                depth: 0,
-                limit: 3,
-                overrideAccess: false,
-                req,
-                where: query && searchableFields.length > 0 ? {
-                    or: searchableFields.map((field)=>({
-                            [field]: {
-                                contains: query
-                            }
-                        }))
-                } : undefined
-            });
-            for (const doc of result.docs){
-                suggestions.push({
-                    collection: collection.slug,
-                    id: doc.id?.toString(),
-                    label: getDocLabel(doc, collection.admin?.useAsTitle),
-                    slug: `${collection.slug}:${doc.id?.toString()}`,
-                    type: "doc"
-                });
-            }
-        }
-        return Response.json({
-            suggestions: suggestions.slice(0, 5)
-        });
-    };

package/dist/endpoints/aiProposalDiffEndpointHandler.d.ts

@@ -1,7 +0,0 @@
-import type { PayloadHandler } from "payload";
-import { type ResolvedAICollectionPermissionMap } from "../payload/collectionPermissions.js";
-type AIProposalDiffEndpointOptions = {
-    collections?: ResolvedAICollectionPermissionMap;
-};
-export declare const createAIProposalDiffEndpointHandler: (options?: AIProposalDiffEndpointOptions) => PayloadHandler;
-export {};

package/dist/endpoints/aiProposalDiffEndpointHandler.js

@@ -1,138 +0,0 @@
-import { verifyAIActionProposal } from "../ai/proposals.js";
-import { redactSensitiveData } from "../ai/sensitiveData.js";
-import { getCollectionFields, normalizeAuthData, normalizeDataForFields } from "../payload/normalizeData.js";
-import { isCollectionActionAllowed } from "../payload/collectionPermissions.js";
-const isRecord = (value)=>{
-    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
-};
-const isActionProposal = (proposal)=>{
-    if (!isRecord(proposal) || typeof proposal.label !== "string") return false;
-    if (proposal.action === "create") {
-        return typeof proposal.collection === "string" && isRecord(proposal.data);
-    }
-    if (proposal.action === "update") {
-        return typeof proposal.collection === "string" && typeof proposal.id === "string" && isRecord(proposal.data);
-    }
-    if (proposal.action === "delete") {
-        return typeof proposal.collection === "string" && typeof proposal.id === "string";
-    }
-    if (proposal.action === "updateGlobal") {
-        return typeof proposal.slug === "string" && isRecord(proposal.data);
-    }
-    return false;
-};
-const mergeData = (current, next)=>{
-    return Object.fromEntries(Object.entries({
-        ...current,
-        ...next
-    }).map(([key, value])=>{
-        const currentValue = current[key];
-        if (isRecord(currentValue) && isRecord(value)) {
-            return [
-                key,
-                mergeData(currentValue, value)
-            ];
-        }
-        return [
-            key,
-            value
-        ];
-    }));
-};
-export const createAIProposalDiffEndpointHandler = (options = {})=>async (req)=>{
-        if (!req.user) return Response.json({
-            error: "Unauthorized"
-        }, {
-            status: 401
-        });
-        const body = req.json ? await req.json().catch(()=>null) : null;
-        const proposal = body?.proposal;
-        if (!proposal) return Response.json({
-            error: "Proposal is required"
-        }, {
-            status: 400
-        });
-        if (!verifyAIActionProposal(proposal)) return Response.json({
-            error: "Proposal signature is invalid or expired."
-        }, {
-            status: 400
-        });
-        if (!isActionProposal(proposal)) return Response.json({
-            error: "Proposal is invalid."
-        }, {
-            status: 400
-        });
-        try {
-            if (proposal.action === "updateGlobal") {
-                const globalConfig = req.payload.config.globals?.find((global)=>global.slug === proposal.slug);
-                if (!globalConfig) return Response.json({
-                    error: "Unknown global"
-                }, {
-                    status: 400
-                });
-                const normalized = normalizeDataForFields(globalConfig.fields || [], proposal.data);
-                const doc = await req.payload.findGlobal({
-                    depth: 2,
-                    overrideAccess: false,
-                    req,
-                    slug: proposal.slug
-                });
-                return Response.json({
-                    after: redactSensitiveData(mergeData(doc, normalized.data)),
-                    before: redactSensitiveData(doc)
-                });
-            }
-            if (!isCollectionActionAllowed({
-                action: proposal.action === "delete" ? "delete" : "read",
-                permissions: options.collections,
-                req,
-                slug: proposal.collection
-            })) return Response.json({
-                error: "Unknown collection"
-            }, {
-                status: 400
-            });
-            if (proposal.action === "delete") {
-                const doc = await req.payload.findByID({
-                    collection: proposal.collection,
-                    depth: 2,
-                    id: proposal.id,
-                    overrideAccess: false,
-                    req
-                });
-                return Response.json({
-                    after: {},
-                    before: redactSensitiveData(doc)
-                });
-            }
-            const collectionConfig = req.payload.config.collections.find((collection)=>collection.slug === proposal.collection);
-            const normalized = normalizeAuthData(collectionConfig, normalizeDataForFields(getCollectionFields(collectionConfig), proposal.data));
-            if (proposal.action === "create") {
-                return Response.json({
-                    after: redactSensitiveData(normalized.data),
-                    before: {}
-                });
-            }
-            const doc = await req.payload.findByID({
-                collection: proposal.collection,
-                depth: 2,
-                id: proposal.id,
-                overrideAccess: false,
-                req
-            });
-            return Response.json({
-                after: redactSensitiveData(mergeData(doc, normalized.data)),
-                before: redactSensitiveData(doc)
-            });
-        } catch (err) {
-            req.payload.logger.error({
-                err,
-                msg: "AI proposal diff failed"
-            });
-            return Response.json({
-                error: "Could not load proposal diff."
-            }, {
-                status: 400
-            });
-        }
-    };

package/dist/endpoints/aiRecentChangesEndpointHandler.d.ts

@@ -1,6 +0,0 @@
-import type { PayloadHandler } from "payload";
-type AIRecentChangesEndpointOptions = {
-    changeLogCollection: string;
-};
-export declare const createAIRecentChangesEndpointHandler: (options: AIRecentChangesEndpointOptions) => PayloadHandler;
-export {};