@next-buildr/payload 0.0.0-stage → 2.0.1

package/dist/plugin/endpoints/forms.test.js

@@ -0,0 +1,346 @@
+import { createRegistryMeta, p, s, } from '@next-buildr/core';
+import { handleEndpoints } from 'payload';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { buildrPlugin } from '../index.js';
+import { BUILDR_WRITE } from '../write-guard.js';
+import { meta as baseMeta, migrations as baseMigrations, boot, } from './endpoints.test-kit.js';
+const field = (type, label, props, formField) => ({
+    type,
+    version: 1,
+    label,
+    category: 'forms',
+    props,
+    contentCategories: ['flow', 'form-control'],
+    styles: { groups: [] },
+    runtime: 'shared',
+    formField,
+});
+const common = {
+    name: p.text({ label: 'Name', default: '' }),
+    required: p.boolean({ label: 'Required', default: false }),
+};
+const components = [
+    {
+        type: 'buildr/form',
+        version: 1,
+        label: 'Form',
+        category: 'forms',
+        props: {},
+        contentCategories: ['flow'],
+        styles: { groups: [] },
+        runtime: 'shared',
+        slots: { default: {} },
+    },
+    field('buildr/text-field', 'Text', { ...common, maxLength: p.number({ label: 'Max length', default: 100 }) }, { valueType: 'string', nameProp: 'name', requiredProp: 'required', maxLengthProp: 'maxLength' }),
+    field('buildr/email-field', 'Email', common, {
+        valueType: 'email',
+        nameProp: 'name',
+        requiredProp: 'required',
+    }),
+    field('buildr/choice', 'Choice', {
+        ...common,
+        options: p.list(p.object({
+            label: p.text({ label: 'Label', default: 'Option' }),
+            value: p.text({ label: 'Value', default: '' }),
+        }), { label: 'Options' }),
+    }, { valueType: 'enum', nameProp: 'name', requiredProp: 'required', optionsProp: 'options' }),
+    field('buildr/check', 'Check', common, {
+        valueType: 'boolean',
+        nameProp: 'name',
+        requiredProp: 'required',
+    }),
+];
+const meta = createRegistryMeta({ components: [...baseMeta.list(), ...components] });
+const migrations = {
+    ...baseMigrations,
+    ...Object.fromEntries(components.map((component) => [component.type, { currentVersion: 1, steps: [] }])),
+};
+const FORM = 'form000001';
+const fieldNodes = (extra = []) => [
+    {
+        id: 'field00001',
+        type: 'buildr/text-field',
+        props: { name: s('subject'), required: s(true), maxLength: s(10) },
+    },
+    { id: 'field00002', type: 'buildr/email-field', props: { name: s('email'), required: s(true) } },
+    {
+        id: 'field00003',
+        type: 'buildr/choice',
+        props: {
+            name: s('topic'),
+            options: s([
+                { label: 'Sales', value: 'sales' },
+                { label: 'Help', value: 'help' },
+            ]),
+        },
+    },
+    { id: 'field00004', type: 'buildr/check', props: { name: s('consent') } },
+    ...extra,
+];
+/** A page holding one form with `fields` inside it. */
+const formLayout = (fields = fieldNodes()) => {
+    const types = new Set(['buildr/page', 'buildr/form', ...fields.map((node) => node.type)]);
+    return {
+        schemaVersion: 1,
+        root: 'root',
+        nodes: {
+            root: { id: 'root', type: 'buildr/page', slots: { default: [FORM] } },
+            [FORM]: { id: FORM, type: 'buildr/form', slots: { default: fields.map((node) => node.id) } },
+            ...Object.fromEntries(fields.map((node) => [node.id, node])),
+        },
+        components: Object.fromEntries([...types].map((type) => [type, 1])),
+    };
+};
+const valid = { subject: 'Hello', email: 'a@b.co', topic: 'help', consent: 'on' };
+let h;
+let counter = 0;
+const mails = [];
+let mailDown = false;
+beforeAll(async () => {
+    h = await boot('forms', {
+        registry: { meta, migrations },
+        collections: { pages: { context: 'page', templates: true } },
+        forms: {
+            enabled: true,
+            notifyAllowlist: ['@example.com'],
+            notifyTo: ['ops@example.com'],
+            rateLimit: { limit: 4, windowMs: 60_000 },
+        },
+    }, {
+        email: () => ({
+            name: 'test',
+            defaultFromAddress: 'noreply@example.com',
+            defaultFromName: 'Site',
+            sendEmail: async (message) => {
+                if (mailDown)
+                    throw new Error('smtp down');
+                mails.push(message);
+            },
+        }),
+    });
+});
+afterAll(() => h.close());
+const publish = (layout, data = {}) => h.payload.create({
+    collection: 'pages',
+    data: {
+        title: 'Contact',
+        slug: `p${++counter}`,
+        layout,
+        _status: 'published',
+        ...data,
+    },
+});
+/** POSTs to the form endpoint from a fresh address (the limiter is per address). */
+async function submit(path, values, options = {}) {
+    const urlencoded = options.as === 'urlencoded';
+    const response = await handleEndpoints({
+        config: h.payload.config,
+        request: new Request(`http://localhost/api/buildr/forms/${path}`, {
+            method: 'POST',
+            headers: {
+                'content-type': urlencoded ? 'application/x-www-form-urlencoded' : 'application/json',
+                'x-forwarded-for': options.ip ?? `10.0.0.${++counter}`,
+                ...options.headers,
+            },
+            body: urlencoded
+                ? new URLSearchParams(values).toString()
+                : JSON.stringify(values),
+        }),
+    });
+    const text = await response.text();
+    return {
+        status: response.status,
+        body: text === '' ? undefined : JSON.parse(text),
+        headers: response.headers,
+    };
+}
+const submissions = async () => (await h.payload.find({ collection: 'buildr-form-submissions', limit: 100, depth: 0 }))
+    .docs;
+describe('POST /buildr/forms/:collection/:id/:nodeId', () => {
+    it('stores a valid submission and notifies the allowlisted recipient', async () => {
+        const page = await publish(formLayout());
+        const before = (await submissions()).length;
+        const sent = await submit(`pages/${page.id}/${FORM}`, valid, {
+            headers: { 'user-agent': 'vitest' },
+        });
+        expect(sent).toMatchObject({ status: 200, body: { ok: true } });
+        const stored = (await submissions()).find((doc) => doc['form'].documentId === String(page.id));
+        expect((await submissions()).length).toBe(before + 1);
+        expect(stored).toMatchObject({
+            form: { collection: 'pages', documentId: String(page.id), nodeId: FORM },
+            data: { subject: 'Hello', email: 'a@b.co', topic: 'help', consent: true },
+            meta: { userAgent: 'vitest' },
+        });
+        expect(stored?.['meta'].ipHash).toMatch(/^[0-9a-f]{32}$/);
+        expect(mails).toEqual([
+            expect.objectContaining({
+                to: 'ops@example.com',
+                text: expect.stringContaining('subject: Hello'),
+            }),
+        ]);
+    });
+    it('does not lose the submission when the notification fails', async () => {
+        const page = await publish(formLayout());
+        mailDown = true;
+        const answer = await submit(`pages/${page.id}/${FORM}`, valid);
+        mailDown = false;
+        expect(answer.status).toBe(200);
+        expect((await submissions()).some((doc) => doc['form'].documentId === String(page.id))).toBe(true);
+    });
+    it('rejects invalid values, field by field', async () => {
+        const page = await publish(formLayout());
+        const sent = await submit(`pages/${page.id}/${FORM}`, {
+            subject: 'much too long for this field',
+            email: 'not-an-email',
+            topic: 'refunds',
+        });
+        expect(sent.status).toBe(422);
+        expect(sent.body.codes).toEqual({
+            subject: 'too-long',
+            email: 'invalid',
+            topic: 'invalid',
+        });
+        expect(Object.keys(sent.body.errors)).toEqual(['subject', 'email', 'topic']);
+        const missing = await submit(`pages/${page.id}/${FORM}`, {});
+        expect(missing.body.codes).toEqual({ subject: 'required', email: 'required' });
+    });
+    it('never accepts a field the published document does not have', async () => {
+        const page = await publish(formLayout());
+        const sent = await submit(`pages/${page.id}/${FORM}`, {
+            ...valid,
+            isAdmin: 'true',
+            _redirect: 'https://evil.example',
+        });
+        expect(sent.status).toBe(422);
+        expect(sent.body.codes['isAdmin']).toBe('unknown');
+        expect(sent.body.codes['_redirect']).toBe('unknown');
+    });
+    it('derives the schema from the published layout, not from a newer draft', async () => {
+        const page = await publish(formLayout());
+        const extended = formLayout(fieldNodes([
+            {
+                id: 'field00005',
+                type: 'buildr/text-field',
+                props: { name: s('phone'), maxLength: s(20) },
+            },
+        ]));
+        await h.payload.update({
+            collection: 'pages',
+            id: page.id,
+            data: { layout: extended },
+            draft: true,
+            context: { [BUILDR_WRITE]: true },
+        });
+        const sent = await submit(`pages/${page.id}/${FORM}`, { ...valid, phone: '123' });
+        expect(sent.status).toBe(422);
+        expect(sent.body.codes).toEqual({ phone: 'unknown' });
+    });
+    it('is unreachable for a document that was never published', async () => {
+        const draft = await h.payload.create({
+            collection: 'pages',
+            data: { title: 'Wip', slug: `d${++counter}`, layout: formLayout() },
+            draft: true,
+        });
+        const sent = await submit(`pages/${draft.id}/${FORM}`, valid);
+        expect(sent.status).toBe(404);
+    });
+    it('answers 404 for a node that is not a form, a missing node and a collection it does not serve', async () => {
+        const page = await publish(formLayout());
+        expect((await submit(`pages/${page.id}/field00001`, valid)).status).toBe(404);
+        expect((await submit(`pages/${page.id}/nothing0001`, valid)).status).toBe(404);
+        expect((await submit(`pages/99999/${FORM}`, valid)).status).toBe(404);
+        expect((await submit(`users/${page.id}/${FORM}`, valid)).status).toBe(404);
+    });
+    it('turns a bot away quietly: the honeypot is answered as a success and stores nothing', async () => {
+        const page = await publish(formLayout());
+        const before = (await submissions()).length;
+        const sent = await submit(`pages/${page.id}/${FORM}`, { ...valid, _hp: 'buy now' });
+        expect(sent).toMatchObject({ status: 200, body: { ok: true } });
+        expect((await submissions()).length).toBe(before);
+        // An empty honeypot is what a person sends.
+        expect((await submit(`pages/${page.id}/${FORM}`, { ...valid, _hp: '' })).status).toBe(200);
+    });
+    it('limits the submissions of one visitor to one form, with a 429 and a retry-after', async () => {
+        const page = await publish(formLayout());
+        const ip = '203.0.113.9';
+        for (let attempt = 0; attempt < 4; attempt += 1) {
+            expect((await submit(`pages/${page.id}/${FORM}`, valid, { ip })).status).toBe(200);
+        }
+        const limited = await submit(`pages/${page.id}/${FORM}`, valid, { ip });
+        expect(limited.status).toBe(429);
+        expect(Number(limited.headers.get('retry-after'))).toBeGreaterThan(0);
+        // Another visitor is not affected.
+        expect((await submit(`pages/${page.id}/${FORM}`, valid)).status).toBe(200);
+    });
+    it('refuses a body that is not a form or JSON, and an oversized one', async () => {
+        const page = await publish(formLayout());
+        const url = `http://localhost/api/buildr/forms/pages/${page.id}/${FORM}`;
+        const text = await handleEndpoints({
+            config: h.payload.config,
+            request: new Request(url, {
+                method: 'POST',
+                headers: { 'content-type': 'text/plain' },
+                body: 'x',
+            }),
+        });
+        expect(text.status).toBe(415);
+        const big = await handleEndpoints({
+            config: h.payload.config,
+            request: new Request(url, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', 'content-length': '1000000' },
+                body: '{}',
+            }),
+        });
+        expect(big.status).toBe(413);
+    });
+    it('serves a plain HTML form with a 303 back to the page it came from', async () => {
+        const page = await publish(formLayout());
+        const referer = 'http://localhost/contact?utm=1';
+        const sent = await submit(`pages/${page.id}/${FORM}`, valid, {
+            as: 'urlencoded',
+            headers: { referer },
+        });
+        expect(sent.status).toBe(303);
+        expect(sent.headers.get('location')).toBe('/contact?utm=1&buildr-form=sent');
+        const invalid = await submit(`pages/${page.id}/${FORM}`, { subject: 'x' }, {
+            as: 'urlencoded',
+            headers: { referer },
+        });
+        expect(invalid.status).toBe(303);
+        expect(invalid.headers.get('location')).toBe('/contact?utm=1&buildr-form=invalid');
+    });
+    it('never redirects off the site', async () => {
+        const page = await publish(formLayout());
+        const sent = await submit(`pages/${page.id}/${FORM}`, valid, {
+            as: 'urlencoded',
+            headers: { referer: 'https://evil.example/phish' },
+        });
+        expect(sent.status).toBe(303);
+        expect(sent.headers.get('location')).toBe('/');
+    });
+    it('finds the form of an inherited layout in its template', async () => {
+        const template = await h.payload.create({
+            collection: 'buildr-templates',
+            data: {
+                title: 'With form',
+                targetCollection: 'pages',
+                layout: formLayout(),
+                _status: 'published',
+            },
+        });
+        const page = await publish(undefined, { template: template.id });
+        expect((await submit(`pages/${page.id}/${FORM}`, valid)).status).toBe(200);
+        expect((await submit(`buildr-templates/${template.id}/${FORM}`, valid)).status).toBe(200);
+    });
+});
+describe('forms configuration', () => {
+    it('needs a registry, and notifies only allowlisted recipients', () => {
+        expect(() => buildrPlugin({ collections: {}, forms: { enabled: true } })).toThrow(/registry/);
+        expect(() => buildrPlugin({
+            collections: {},
+            registry: { meta },
+            forms: { enabled: true, notifyAllowlist: ['@example.com'], notifyTo: ['x@evil.example'] },
+        })).toThrow(/notifyAllowlist/);
+    });
+});

package/dist/plugin/endpoints/guards.d.ts

@@ -0,0 +1,9 @@
+import type { PayloadRequest } from 'payload';
+/**
+ * The CSRF guard of a mutating request: the body must be declared JSON (a cross-site form cannot
+ * send that without a preflight), and a browser-supplied `Origin` must be this server's own origin
+ * or one of Payload's `csrf` allowlist. Requests without an `Origin` (scripts, server-to-server)
+ * pass: browsers always send it on `PUT`/`POST`. Returns the response to send, or `undefined`.
+ */
+export declare function mutationGuard(req: PayloadRequest, kind?: 'json' | 'multipart'): Response | undefined;
+//# sourceMappingURL=guards.d.ts.map

package/dist/plugin/endpoints/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/guards.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAY9C;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,cAAc,EACnB,IAAI,GAAE,MAAM,GAAG,WAAoB,GAClC,QAAQ,GAAG,SAAS,CAmBtB"}

package/dist/plugin/endpoints/guards.js

@@ -0,0 +1,35 @@
+import { fail } from './respond.js';
+const originOf = (value) => {
+    if (value === null || value === undefined || value === '')
+        return undefined;
+    try {
+        return new URL(value).origin;
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * The CSRF guard of a mutating request: the body must be declared JSON (a cross-site form cannot
+ * send that without a preflight), and a browser-supplied `Origin` must be this server's own origin
+ * or one of Payload's `csrf` allowlist. Requests without an `Origin` (scripts, server-to-server)
+ * pass: browsers always send it on `PUT`/`POST`. Returns the response to send, or `undefined`.
+ */
+export function mutationGuard(req, kind = 'json') {
+    const contentType = req.headers.get('content-type') ?? '';
+    // An upload is multipart, which a cross-site form can send: only the Origin check protects it.
+    const expected = kind === 'json' ? /^application\/json\s*(;|$)/i : /^multipart\/form-data\s*;/i;
+    if (!expected.test(contentType)) {
+        return fail(415, `The content type must be ${kind === 'json' ? 'application/json' : 'multipart/form-data'}.`);
+    }
+    const origin = req.headers.get('origin');
+    if (origin === null)
+        return undefined;
+    const requested = originOf(origin);
+    const own = originOf(req.url);
+    const allowlist = (req.payload.config.csrf ?? []).map(originOf);
+    if (requested === undefined || (requested !== own && !allowlist.includes(requested))) {
+        return fail(403, 'The origin of the request is not allowed.');
+    }
+    return undefined;
+}

package/dist/plugin/endpoints/index.d.ts

@@ -0,0 +1,6 @@
+import type { Endpoint } from 'payload';
+import type { EndpointEnv } from './context.ts';
+/** The builder API (docs/payload.md#endpoint-contract) as Payload endpoints, served under `/api`. */
+export declare const buildrEndpoints: (env: EndpointEnv) => Endpoint[];
+export type { EndpointEnv } from './context.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/plugin/endpoints/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAehD,qGAAqG;AACrG,eAAO,MAAM,eAAe,QAAS,WAAW,KAAG,QAAQ,EAiB1D,CAAC;AAEF,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/plugin/endpoints/index.js

@@ -0,0 +1,32 @@
+import { dataMediaEndpoint, dataQueryEndpoint } from './data.js';
+import { dataContextEndpoint } from './data-context.js';
+import { dataSchemaEndpoint } from './data-schema.js';
+import { getDocumentEndpoint, revisionEndpoint } from './document.js';
+import { createDocumentEndpoint, listDocumentsEndpoint } from './documents.js';
+import { formsEndpoint } from './forms.js';
+import { manifestEndpoint } from './manifest.js';
+import { mediaListEndpoint, mediaUploadEndpoint } from './media.js';
+import { publishEndpoint } from './publish.js';
+import { renameEndpoint } from './rename.js';
+import { samplesEndpoint } from './samples.js';
+import { saveEndpoint } from './save.js';
+import { sessionEndpoint } from './session.js';
+/** The builder API (docs/payload.md#endpoint-contract) as Payload endpoints, served under `/api`. */
+export const buildrEndpoints = (env) => [
+    sessionEndpoint(env),
+    manifestEndpoint(env),
+    getDocumentEndpoint(env),
+    revisionEndpoint(env),
+    saveEndpoint(env),
+    renameEndpoint(env),
+    publishEndpoint(env),
+    dataSchemaEndpoint(env),
+    dataContextEndpoint(env),
+    samplesEndpoint(env),
+    dataQueryEndpoint(env),
+    dataMediaEndpoint(env),
+    mediaListEndpoint(env),
+    mediaUploadEndpoint(env),
+    ...(env.options.mcp.enabled ? [listDocumentsEndpoint(env), createDocumentEndpoint(env)] : []),
+    ...(env.options.forms.enabled ? [formsEndpoint(env)] : []),
+];

package/dist/plugin/endpoints/locales-no-fallback.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=locales-no-fallback.test.d.ts.map

package/dist/plugin/endpoints/locales-no-fallback.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locales-no-fallback.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/locales-no-fallback.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/locales-no-fallback.test.js

@@ -0,0 +1,30 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { boot } from './endpoints.test-kit.js';
+let h;
+beforeAll(async () => {
+    h = await boot('locales-no-fallback', {}, {
+        localization: {
+            locales: [
+                { code: 'pl', label: 'Polski' },
+                { code: 'en', label: 'English' },
+            ],
+            defaultLocale: 'pl',
+            fallback: false,
+        },
+    });
+});
+afterAll(() => h.close());
+describe('localization with fallback off', () => {
+    it('does not fall back to the default language and says so in the session', async () => {
+        const page = await h.payload.create({
+            collection: 'pages',
+            data: { title: 'Tylko polski', slug: 'pl-only' },
+            draft: true,
+            locale: 'pl',
+        });
+        const { body } = await h.call('GET', `/buildr/data/context?collection=pages&id=${page.id}&locale=en`);
+        expect(body.scopes.page.title ?? null).toBeNull();
+        const session = await h.call('GET', '/buildr/session');
+        expect(session.body.locales).toMatchObject({ default: 'pl', fallback: false });
+    });
+});

package/dist/plugin/endpoints/locales.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=locales.test.d.ts.map

package/dist/plugin/endpoints/locales.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"locales.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/locales.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/locales.test.js

@@ -0,0 +1,128 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { processLayout } from '../hooks/process-layout.js';
+import { chooseLocale, configuredLocales, localeConfigOf } from '../locales.js';
+import { boot, meta, migrations, withChild } from './endpoints.test-kit.js';
+let h;
+let id;
+beforeAll(async () => {
+    h = await boot('locales', {}, {
+        localization: {
+            locales: [
+                { code: 'pl', label: 'Polski' },
+                { code: 'en', label: 'English' },
+            ],
+            defaultLocale: 'pl',
+            fallback: true,
+        },
+    });
+    const page = await h.payload.create({
+        collection: 'pages',
+        data: { title: 'Cześć', slug: 'czesc' },
+        draft: true,
+        locale: 'pl',
+    });
+    id = page.id;
+    await h.payload.update({
+        collection: 'pages',
+        id,
+        data: { title: 'Hello' },
+        draft: true,
+        locale: 'en',
+    });
+});
+afterAll(() => h.close());
+const titleIn = async (locale) => {
+    const query = `collection=pages&id=${id}${locale === undefined ? '' : `&locale=${locale}`}`;
+    const { status, body } = await h.call('GET', `/buildr/data/context?${query}`);
+    expect(status).toBe(200);
+    return { title: body.scopes.page.title, route: body.scopes.route };
+};
+describe('locales', () => {
+    it('derives the LocaleConfig from the Payload localization', () => {
+        expect(configuredLocales(h.payload.config)).toEqual({
+            locales: ['pl', 'en'],
+            default: 'pl',
+            fallback: true,
+            intl: { pl: 'Polski', en: 'English' },
+        });
+    });
+    it('builds the data context of a post in both languages', async () => {
+        expect(await titleIn('pl')).toMatchObject({ title: 'Cześć', route: { locale: 'pl' } });
+        expect(await titleIn('en')).toMatchObject({ title: 'Hello', route: { locale: 'en' } });
+        // No locale means the default language.
+        expect(await titleIn()).toMatchObject({ title: 'Cześć', route: { locale: 'pl' } });
+    });
+    it('falls back to the default language for a missing translation', async () => {
+        const page = await h.payload.create({
+            collection: 'pages',
+            data: { title: 'Tylko polski', slug: 'pl-only' },
+            draft: true,
+            locale: 'pl',
+        });
+        const { body } = await h.call('GET', `/buildr/data/context?collection=pages&id=${page.id}&locale=en`);
+        expect(body.scopes.page.title).toBe('Tylko polski');
+    });
+    it('opens a document in the language asked for', async () => {
+        const opened = await h.call('GET', `/buildr/documents/pages/${id}?locale=en`);
+        expect(opened.status).toBe(200);
+        expect(opened.body.title).toBe('Hello');
+        expect((await h.call('GET', `/buildr/documents/pages/${id}`)).body.title).toBe('Cześć');
+    });
+    it('lists samples with the titles of the language', async () => {
+        const en = await h.call('GET', '/buildr/samples/pages?locale=en');
+        expect(en.body.items.map((item) => item.title)).toContain('Hello');
+        const pl = await h.call('GET', '/buildr/samples/pages');
+        expect(pl.body.items.map((item) => item.title)).toContain('Cześć');
+    });
+    it('answers 400 for a locale that is not configured, on every endpoint that takes one', async () => {
+        const calls = [
+            h.call('GET', `/buildr/documents/pages/${id}?locale=de`),
+            h.call('GET', `/buildr/data/context?collection=pages&id=${id}&locale=de`),
+            h.call('GET', '/buildr/samples/pages?locale=de'),
+            h.call('GET', '/buildr/samples/pages?locale=all'),
+            h.call('POST', '/buildr/data/query', {
+                body: {
+                    spec: { source: 'pages', limit: 1, page: 1 },
+                    locale: 'de',
+                },
+            }),
+            h.call('POST', '/buildr/data/media', { body: { ids: [], locale: 'de' } }),
+        ];
+        for (const { status, body } of await Promise.all(calls)) {
+            expect(status).toBe(400);
+            expect(body.error).toMatch(/locale/);
+        }
+    });
+    it('reports an l10n key outside the configured languages as a warning', () => {
+        const doc = withChild({
+            title: { kind: 'static', value: 'Hi', l10n: { pl: 'Cześć', de: 'Hallo' } },
+        });
+        const options = {
+            registry: { meta, migrations },
+            limits: { maxNodes: 5000, maxBytes: 2_000_000 },
+        };
+        const withLocales = processLayout(doc, {
+            ...options,
+            locales: configuredLocales(h.payload.config),
+        });
+        expect(withLocales.ok).toBe(true);
+        if (withLocales.ok) {
+            expect(withLocales.warnings.some((warning) => JSON.stringify(warning).includes('de'))).toBe(true);
+        }
+        const without = processLayout(doc, options);
+        expect(without.ok && without.warnings.every((warning) => !JSON.stringify(warning).includes('"de"'))).toBe(true);
+    });
+});
+describe('without localization', () => {
+    const plain = { payload: { config: { localization: false } } };
+    it('behaves as before: one locale, the parameter is ignored', () => {
+        expect(chooseLocale(plain, 'de')).toEqual({ ok: true, locale: undefined, args: {} });
+        expect(chooseLocale(plain, undefined)).toEqual({ ok: true, locale: undefined, args: {} });
+        expect(localeConfigOf({ localization: false })).toEqual({
+            locales: ['en'],
+            default: 'en',
+            fallback: false,
+            intl: { en: 'English' },
+        });
+    });
+});

package/dist/plugin/endpoints/manifest.d.ts

@@ -0,0 +1,5 @@
+import type { Endpoint } from 'payload';
+import { type EndpointEnv } from './context.ts';
+/** `GET /api/buildr/manifest`: the registry the editor builds with (only present when the plugin has one). */
+export declare const manifestEndpoint: (env: EndpointEnv) => Endpoint;
+//# sourceMappingURL=manifest.d.ts.map

package/dist/plugin/endpoints/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/manifest.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAGzD,8GAA8G;AAC9G,eAAO,MAAM,gBAAgB,QAAS,WAAW,KAAG,QAUlD,CAAC"}

package/dist/plugin/endpoints/manifest.js

@@ -0,0 +1,18 @@
+import { toManifest } from '@next-buildr/core';
+import { allowed } from './context.js';
+import { fail, json, unauthorized } from './respond.js';
+/** `GET /api/buildr/manifest`: the registry the editor builds with (only present when the plugin has one). */
+export const manifestEndpoint = (env) => ({
+    path: '/buildr/manifest',
+    method: 'get',
+    handler: async (req) => {
+        if (req.user === null || req.user === undefined)
+            return unauthorized();
+        if (!(await allowed(env, 'edit', req)))
+            return fail(403, 'You may not edit with the builder.');
+        const registry = env.options.registry;
+        if (registry === undefined)
+            return fail(404, 'The plugin was configured without a registry.');
+        return json(toManifest(registry.meta));
+    },
+});

package/dist/plugin/endpoints/mcp-http-backend.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-http-backend.test.d.ts.map

package/dist/plugin/endpoints/mcp-http-backend.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-http-backend.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/mcp-http-backend.test.ts"],"names":[],"mappings":""}