@payload-onpage/plugin 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jellologic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# @payload-onpage/plugin
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The Payload side: endpoints (enter/mode/exit/preview links/schema), access through Payload's own `docAccessOperation`, the editor schema, marker hooks, a stale-write guard, and **Edit on page** / **Copy preview link** in the admin.
+
+```ts
+import { onpage } from '@payload-onpage/plugin'
+import { nextSession } from '@payload-onpage/next/session'
+
+plugins: [onpage({ collections: ['pages'], globals: ['header'], session: nextSession() })]
+```
+
+Options: `collections`, `globals` (with per-document `fields` and `url`), `access`, `session`, `encode`, `previewLinkTTL`, `validatePreviewLink`, `secret`, `authCookie`, `routePrefix`, `enabled`. See [security](https://github.com/jellologic/payload-onpage/blob/main/docs/concepts/security.md).
+
+Part of [**payload-onpage**](https://github.com/jellologic/payload-onpage): on-page editing and draft previews for Payload CMS + Next.js. Start with the [getting started guide](https://github.com/jellologic/payload-onpage/blob/main/docs/getting-started.md).
+
+MIT licensed.

package/dist/access.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Who may use on-page editing, and edit which documents. Document access is
+ * evaluated by Payload itself (`docAccessOperation`), so row-level rules
+ * (access functions that return a query) and field permissions behave exactly
+ * as in the admin.
+ */
+import type { DocRef } from '@payload-onpage/core';
+import { type PayloadRequest, type SanitizedCollectionPermission, type SanitizedGlobalPermission } from 'payload';
+import type { OnPageOptions } from './options.ts';
+/** Signed in as an admin user (or allowed by the `access` option). */
+export declare function canUseOnPage(req: PayloadRequest, options: OnPageOptions): Promise<boolean>;
+/** Payload's sanitized permissions for one document (or the collection, without an id). */
+export declare function documentPermissions(req: PayloadRequest, ref: DocRef | {
+    kind: 'collection';
+    slug: string;
+    id?: undefined;
+}): Promise<SanitizedCollectionPermission | SanitizedGlobalPermission | null>;
+/** May this user edit this document on the page? */
+export declare function canEditDocument(req: PayloadRequest, ref: DocRef, options: OnPageOptions): Promise<boolean>;
+//# sourceMappingURL=access.d.ts.map

package/dist/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAClD,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,6BAA6B,EAClC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAChB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAEjD,sEAAsE;AACtE,wBAAsB,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhG;AAED,2FAA2F;AAC3F,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,SAAS,CAAA;CAAE,GACjE,OAAO,CAAC,6BAA6B,GAAG,yBAAyB,GAAG,IAAI,CAAC,CAY3E;AAED,oDAAoD;AACpD,wBAAsB,eAAe,CACnC,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/access.js

@@ -0,0 +1,51 @@
+import { docAccessOperation, docAccessOperationGlobal, } from 'payload';
+/** Signed in as an admin user (or allowed by the `access` option). */
+export async function canUseOnPage(req, options) {
+    if (!req.user)
+        return false;
+    if (options.access)
+        return Boolean(await options.access({ req }));
+    return req.user.collection === req.payload.config.admin.user;
+}
+/** Payload's sanitized permissions for one document (or the collection, without an id). */
+export async function documentPermissions(req, ref) {
+    try {
+        if (ref.kind === 'global') {
+            const globalConfig = req.payload.globals.config.find((g) => g.slug === ref.slug);
+            return globalConfig ? await docAccessOperationGlobal({ globalConfig, req }) : null;
+        }
+        const collection = req.payload.collections[ref.slug];
+        if (!collection)
+            return null;
+        return await docAccessOperation({ collection, id: ref.id, req });
+    }
+    catch {
+        return null;
+    }
+}
+/** May this user edit this document on the page? */
+export async function canEditDocument(req, ref, options) {
+    if (!req.user)
+        return false;
+    if (options.access)
+        return Boolean(await options.access({ req, ref }));
+    if (!(await canUseOnPage(req, options)))
+        return false;
+    const perms = await documentPermissions(req, ref);
+    const update = perms?.update;
+    if (update === true)
+        return true;
+    if (!update?.permission)
+        return false;
+    // A row-level rule comes back as a query: check that this document matches it.
+    if (!update.where || ref.kind !== 'collection')
+        return !update.where;
+    const { totalDocs } = await req.payload.count({
+        collection: ref.slug,
+        where: { and: [{ id: { equals: ref.id } }, update.where] },
+        overrideAccess: true,
+        req,
+    });
+    return totalDocs > 0;
+}
+//# sourceMappingURL=access.js.map

package/dist/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,SAAS,CAAA;AAGhB,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAmB,EAAE,OAAsB;IAC5E,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3B,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACjE,OAAO,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAA;AAC9D,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAmB,EACnB,GAAkE;IAElE,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAA;YAChF,OAAO,YAAY,CAAC,CAAC,CAAC,MAAM,wBAAwB,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACpF,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAA;QAC5B,OAAO,MAAM,kBAAkB,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAA;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAmB,EACnB,GAAW,EACX,OAAsB;IAEtB,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3B,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IACtE,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACrD,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,KAAK,EAAE,MACwD,CAAA;IAC9E,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,MAAM,EAAE,UAAU;QAAE,OAAO,KAAK,CAAA;IACrC,+EAA+E;IAC/E,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAA;IACpE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;QAC5C,UAAU,EAAE,GAAG,CAAC,IAAa;QAC7B,KAAK,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAW;QACnE,cAAc,EAAE,IAAI;QACpB,GAAG;KACJ,CAAC,CAAA;IACF,OAAO,SAAS,GAAG,CAAC,CAAA;AACtB,CAAC"}

package/dist/admin/OnPageAdminControls.d.ts

@@ -0,0 +1,9 @@
+export interface OnPageAdminControlsProps {
+    kind: 'collection' | 'global';
+    slug: string;
+    /** Plugin endpoint prefix (`routePrefix`). */
+    prefix: string;
+}
+export declare function OnPageAdminControls({ kind, slug, prefix }: OnPageAdminControlsProps): import("react").JSX.Element | null;
+export default OnPageAdminControls;
+//# sourceMappingURL=OnPageAdminControls.d.ts.map

package/dist/admin/OnPageAdminControls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OnPageAdminControls.d.ts","sourceRoot":"","sources":["../../src/admin/OnPageAdminControls.tsx"],"names":[],"mappings":"AAmBA,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAA;CACf;AAgBD,wBAAgB,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,wBAAwB,sCAwDnF;AAED,eAAe,mBAAmB,CAAA"}

package/dist/admin/OnPageAdminControls.js

@@ -0,0 +1,59 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * Document controls added by payload-onpage: open this document's page in edit
+ * mode, or copy a sealed read-only preview link. Hidden for users who can't
+ * update the document.
+ */
+import { payloadRest } from '@payload-onpage/core/payload';
+import { Button, toast, useConfig, useDocumentInfo, useLocale, useTranslation, } from '@payloadcms/ui';
+import { useMemo, useState } from 'react';
+/**
+ * Same-origin POST (the endpoint refuses cross-site requests) opened in a new tab.
+ * A detached form: these controls render inside the admin's document <form>, and forms can't nest.
+ */
+function postInNewTab(action) {
+    const form = document.createElement('form');
+    form.method = 'post';
+    form.action = action;
+    form.target = '_blank';
+    document.body.appendChild(form);
+    form.submit();
+    form.remove();
+}
+export function OnPageAdminControls({ kind, slug, prefix }) {
+    const { id, hasSavePermission } = useDocumentInfo();
+    const { config } = useConfig();
+    const locale = useLocale();
+    const { t: translate } = useTranslation();
+    const t = (key, vars) => translate(key, vars);
+    const [busy, setBusy] = useState(false);
+    const apiBase = `${config.serverURL ?? ''}${config.routes.api}`;
+    const dataSource = useMemo(() => payloadRest({ apiBase, prefix }), [apiBase, prefix]);
+    if ((kind === 'collection' && !id) || hasSavePermission === false)
+        return null;
+    const ref = kind === 'global' ? { kind, slug } : { kind, slug, id: id };
+    const params = new URLSearchParams({ kind, slug, mode: 'edit' });
+    if (kind === 'collection')
+        params.set('id', String(id));
+    if (locale?.code)
+        params.set('locale', locale.code);
+    const copyLink = async () => {
+        setBusy(true);
+        try {
+            const link = await dataSource.createPreviewLink(ref, { locale: locale?.code });
+            await navigator.clipboard.writeText(link.url);
+            toast.success(`Preview link copied — valid until ${new Date(link.expiresAt).toLocaleString()}`);
+        }
+        catch (e) {
+            toast.error(t('onpage:linkFailed', { message: e.message }));
+        }
+        finally {
+            setBusy(false);
+        }
+    };
+    const style = { whiteSpace: 'nowrap', flexShrink: 0 };
+    return (_jsxs("div", { style: { display: 'flex', gap: 6 }, "data-testid": "onpage-admin-controls", children: [_jsx(Button, { buttonStyle: "secondary", size: "medium", onClick: () => postInNewTab(`${apiBase}${prefix}/enter?${params}`), extraButtonProps: { style, 'data-testid': 'onpage-edit-on-page' }, children: t('onpage:editOnPage') }), _jsx(Button, { buttonStyle: "subtle", size: "medium", onClick: () => void copyLink(), disabled: busy, tooltip: t('onpage:copyPreviewLinkHint'), extraButtonProps: { style, 'data-testid': 'onpage-copy-preview-link' }, children: t('onpage:copyPreviewLink') })] }));
+}
+export default OnPageAdminControls;
+//# sourceMappingURL=OnPageAdminControls.js.map

package/dist/admin/OnPageAdminControls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OnPageAdminControls.js","sourceRoot":"","sources":["../../src/admin/OnPageAdminControls.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAA;;AAEZ;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC1D,OAAO,EACL,MAAM,EACN,KAAK,EACL,SAAS,EACT,eAAe,EACf,SAAS,EACT,cAAc,GACf,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAA;AASzC;;;GAGG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACpB,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAA;IACb,IAAI,CAAC,MAAM,EAAE,CAAA;AACf,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAA4B;IAClF,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,eAAe,EAAE,CAAA;IACnD,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,SAAS,EAAE,CAAA;IAC1B,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAA;IACzC,MAAM,CAAC,GAAG,CAAC,GAAyB,EAAE,IAA6B,EAAE,EAAE,CACpE,SAA+D,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IACvC,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAA;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAErF,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,EAAE,CAAC,IAAI,iBAAiB,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAE9E,MAAM,GAAG,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAY,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAG,EAAY,CAAA;IAC9F,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IAChE,IAAI,IAAI,KAAK,YAAY;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAA;IACvD,IAAI,MAAM,EAAE,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;IAEnD,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,OAAO,CAAC,IAAI,CAAC,CAAA;QACb,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,iBAAkB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;YAC/E,MAAM,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7C,KAAK,CAAC,OAAO,CACX,qCAAqC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CACjF,CAAA;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QACxE,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;IACH,CAAC,CAAA;IAED,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,QAAiB,EAAE,UAAU,EAAE,CAAC,EAAE,CAAA;IAC9D,OAAO,CACL,eAAK,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,iBAAc,uBAAuB,aAC1E,KAAC,MAAM,IACL,WAAW,EAAC,WAAW,EACvB,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,MAAM,EAAE,CAAC,EAClE,gBAAgB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,qBAAqB,EAAE,YAEhE,CAAC,CAAC,mBAAmB,CAAC,GAChB,EACT,KAAC,MAAM,IACL,WAAW,EAAC,QAAQ,EACpB,IAAI,EAAC,QAAQ,EACb,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,EAC9B,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,CAAC,CAAC,4BAA4B,CAAC,EACxC,gBAAgB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,0BAA0B,EAAE,YAErE,CAAC,CAAC,wBAAwB,CAAC,GACrB,IACL,CACP,CAAA;AACH,CAAC;AAED,eAAe,mBAAmB,CAAA"}

package/dist/admin/index.d.ts

@@ -0,0 +1,3 @@
+export { OnPageAdminControls } from './OnPageAdminControls.tsx';
+export type { OnPageAdminControlsProps } from './OnPageAdminControls.tsx';
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAA;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA"}

package/dist/admin/index.js

@@ -0,0 +1,2 @@
+export { OnPageAdminControls } from "./OnPageAdminControls.js";
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA2B,CAAA"}

package/dist/endpoints.d.ts

@@ -0,0 +1,11 @@
+import type { Endpoint, PayloadRequest } from 'payload';
+import type { Entry, OnPageOptions } from './options.ts';
+export interface EndpointContext {
+    options: OnPageOptions;
+    prefix: string;
+    apiRoute: string;
+    entry: (kind: string, slug: string) => Entry | undefined;
+}
+export declare const secretOf: (req: PayloadRequest, options: OnPageOptions) => string;
+export declare function createEndpoints(ctx: EndpointContext): Endpoint[];
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../src/endpoints.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAoB,QAAQ,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAA;AAavF,OAAO,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAKxD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAA;CACzD;AAID,eAAO,MAAM,QAAQ,GAAI,KAAK,cAAc,EAAE,SAAS,aAAa,KAAG,MAC1B,CAAA;AAc7C,wBAAgB,eAAe,CAAC,GAAG,EAAE,eAAe,GAAG,QAAQ,EAAE,CAyMhE"}

package/dist/endpoints.js

@@ -0,0 +1,223 @@
+/**
+ * The plugin's endpoints, under `${api}${routePrefix}` (default /api/onpage):
+ *
+ *   GET  /schema/:kind/:slug   editable field schema for the signed-in editor
+ *   POST /enter                start editing or previewing a document's page
+ *   POST /mode                 switch the current page between editing and previewing
+ *   POST /exit                 leave edit/preview mode
+ *   POST /preview-link         create a sealed, expiring read-only link (JSON)
+ *   GET  /preview?token=       open a preview link
+ *
+ * State-changing endpoints are same-origin POSTs (CSRF-safe). Every
+ * authorization decision goes through ./access (Payload's own access rules).
+ */
+import { parseRefKey, pathnameOf, refKey, safePath, samePath, SEAL_PURPOSE, seal, } from '@payload-onpage/core';
+import { hasAutosaveEnabled, hasDraftsEnabled, getAutosaveInterval } from 'payload/shared';
+import { canEditDocument, canUseOnPage, documentPermissions } from "./access.js";
+import { isSecure, json, originOf, queryOf, readRef, redirectTo, rejectCrossSite, text, } from "./http.js";
+import { resolvePath } from "./paths.js";
+import { relationTargets, serializeFields } from "./schema.js";
+import { createPreviewToken, verifyPreviewToken } from "./tokens.js";
+const DAY = 24 * 3600;
+export const secretOf = (req, options) => options.secret ?? req.payload.config.secret;
+/** Name of the auth cookie an editor's mode is bound to. */
+const authCookieOf = (req, options) => options.authCookie ?? `${req.payload.config.cookiePrefix || 'payload'}-token`;
+function requireSession(options) {
+    if (!options.session)
+        throw new Error('payload-onpage: pass `session` (e.g. nextSession()) to use the enter, mode, exit and preview endpoints');
+    return options.session;
+}
+export function createEndpoints(ctx) {
+    const { options, prefix, apiRoute } = ctx;
+    const schema = {
+        path: `${prefix}/schema/:kind/:slug`,
+        method: 'get',
+        handler: async (req) => {
+            const kind = req.routeParams?.kind === 'global' ? 'global' : 'collection';
+            const slug = typeof req.routeParams?.slug === 'string' ? req.routeParams.slug : '';
+            const entry = ctx.entry(kind, slug);
+            const cfg = kind === 'global'
+                ? req.payload.globals.config.find((g) => g.slug === slug)
+                : req.payload.collections[slug]?.config;
+            if (!entry || !cfg)
+                return json({ error: 'Not enabled for on-page editing' }, 404);
+            if (!(await canUseOnPage(req, options)))
+                return json({ error: 'Forbidden' }, 403);
+            const perms = await documentPermissions(req, kind === 'global' ? { kind, slug } : { kind, slug });
+            const pending = [];
+            const all = serializeFields(cfg.fields, {
+                i18n: req.i18n,
+                blocks: req.payload.config.blocks,
+                permissions: perms?.fields,
+                defaults: { req, pending },
+            });
+            await Promise.all(pending);
+            const fields = entry.options.fields
+                ? all.filter((f) => entry.options.fields.includes(f.name))
+                : all;
+            const relations = {};
+            for (const target of relationTargets(fields)) {
+                const c = req.payload.collections[target]?.config;
+                if (!c)
+                    continue;
+                relations[target] = {
+                    titleField: c.admin?.useAsTitle ?? 'id',
+                    label: typeof c.labels?.singular === 'string' ? c.labels.singular : target,
+                };
+            }
+            const localization = req.payload.config.localization;
+            const labelOf = (v) => (typeof v === 'string' ? v : slug);
+            const body = {
+                kind,
+                slug,
+                labels: kind === 'global'
+                    ? {
+                        singular: labelOf(cfg.label),
+                        plural: labelOf(cfg.label),
+                    }
+                    : {
+                        singular: labelOf(cfg.labels?.singular),
+                        plural: labelOf(cfg.labels?.plural),
+                    },
+                editable: fields.map((f) => f.name),
+                fields,
+                drafts: hasDraftsEnabled(cfg),
+                ...(hasAutosaveEnabled(cfg) ? { autosaveInterval: getAutosaveInterval(cfg) } : {}),
+                ...(kind === 'collection' && cfg.admin?.useAsTitle
+                    ? { useAsTitle: cfg.admin.useAsTitle }
+                    : {}),
+                ...(Object.keys(relations).length ? { relations } : {}),
+                ...(localization
+                    ? {
+                        defaultLocale: localization.defaultLocale,
+                        locales: localization.locales.map((l) => (typeof l === 'string' ? l : l.code)),
+                    }
+                    : {}),
+            };
+            return json(body);
+        },
+    };
+    const enter = {
+        path: `${prefix}/enter`,
+        method: 'post',
+        handler: async (req) => {
+            const refused = rejectCrossSite(req);
+            if (refused)
+                return refused;
+            const q = queryOf(req);
+            const ref = readRef({ kind: q.get('kind'), slug: q.get('slug'), id: q.get('id') });
+            const entry = ref && ctx.entry(ref.kind, ref.slug);
+            if (!ref || !entry)
+                return text('Unknown document', 400);
+            if (!req.user)
+                return text('Sign in to the admin first', 401);
+            if (!(await canEditDocument(req, ref, options)))
+                return text('You cannot edit this document', 403);
+            const locale = q.get('locale') ?? undefined;
+            const path = safePath(q.get('path')) ?? (await resolvePath(req, ref, entry, locale));
+            if (!path)
+                return text('This document has no page to open', 404);
+            const mode = q.get('mode') === 'view' ? 'view' : 'edit';
+            await requireSession(options).enable(mode, {
+                secure: isSecure(req),
+                bindTo: authCookieOf(req, options),
+            });
+            return redirectTo(req, path);
+        },
+    };
+    const mode = {
+        path: `${prefix}/mode`,
+        method: 'post',
+        handler: async (req) => {
+            const refused = rejectCrossSite(req);
+            if (refused)
+                return refused;
+            if (!(await canUseOnPage(req, options)))
+                return text('Sign in as an editor first', 401);
+            const q = queryOf(req);
+            await requireSession(options).enable(q.get('mode') === 'view' ? 'view' : 'edit', {
+                secure: isSecure(req),
+                bindTo: authCookieOf(req, options),
+            });
+            return redirectTo(req, q.get('path'));
+        },
+    };
+    const exit = {
+        path: `${prefix}/exit`,
+        method: 'post',
+        handler: async (req) => {
+            const refused = rejectCrossSite(req);
+            if (refused)
+                return refused;
+            await requireSession(options).disable();
+            return redirectTo(req, queryOf(req).get('path'));
+        },
+    };
+    const previewLink = {
+        path: `${prefix}/preview-link`,
+        method: 'post',
+        handler: async (req) => {
+            const refused = rejectCrossSite(req);
+            if (refused)
+                return refused;
+            if (!req.headers.get('content-type')?.includes('application/json'))
+                return json({ error: 'Expected JSON' }, 415);
+            const body = ((await req.json?.().catch(() => null)) ?? {});
+            const ref = readRef(body);
+            const entry = ref && ctx.entry(ref.kind, ref.slug);
+            if (!ref || !entry)
+                return json({ error: 'Unknown document' }, 400);
+            if (!(await canEditDocument(req, ref, options)))
+                return json({ error: 'Forbidden' }, 403);
+            const locale = typeof body.locale === 'string' ? body.locale : undefined;
+            // The path is always derived on the server: a link opens this document's page and nothing else.
+            const path = await resolvePath(req, ref, entry, locale);
+            if (!path)
+                return json({ error: 'This document has no page' }, 404);
+            const ttl = options.previewLinkTTL ?? DAY;
+            const { token, payload } = await createPreviewToken({ ref: refKey(ref), path, locale }, secretOf(req, options), ttl);
+            return json({
+                url: `${originOf(req)}${apiRoute}${prefix}/preview?token=${encodeURIComponent(token)}`,
+                expiresAt: new Date(payload.exp * 1000).toISOString(),
+                id: payload.jti,
+            });
+        },
+    };
+    const preview = {
+        path: `${prefix}/preview`,
+        method: 'get',
+        handler: async (req) => {
+            const invalid = () => text('This preview link is invalid or has expired.', 403);
+            const secret = secretOf(req, options);
+            const token = await verifyPreviewToken(queryOf(req).get('token') ?? '', secret);
+            const ref = token && parseRefKey(token.ref);
+            const entry = ref && ctx.entry(ref.kind, ref.slug);
+            if (!token || !ref || !entry)
+                return invalid();
+            // Still the document's page? (It may have been deleted, or its slug changed.)
+            const current = await resolvePath(req, ref, entry, token.locale);
+            if (!current || !samePath(current, token.path))
+                return invalid();
+            if (options.validatePreviewLink &&
+                !(await options.validatePreviewLink({
+                    req,
+                    ref,
+                    path: token.path,
+                    issuedAt: token.iat,
+                    id: token.jti,
+                }))) {
+                return invalid();
+            }
+            const expiresAt = new Date(token.exp * 1000);
+            await requireSession(options).enableLink({
+                secure: isSecure(req),
+                path: pathnameOf(token.path),
+                expiresAt,
+                seal: (draftSecret) => seal({ path: pathnameOf(token.path), ref: token.ref, exp: token.exp, draft: draftSecret }, secret, SEAL_PURPOSE.previewCookie),
+            });
+            return redirectTo(req, token.path, 307);
+        },
+    };
+    return [schema, enter, mode, exit, previewLink, preview];
+}
+//# sourceMappingURL=endpoints.js.map

package/dist/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../src/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,WAAW,EACX,UAAU,EACV,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,YAAY,EACZ,IAAI,GAIL,MAAM,sBAAsB,CAAA;AAE7B,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAC1F,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAChF,OAAO,EACL,QAAQ,EACR,IAAI,EACJ,QAAQ,EACR,OAAO,EACP,OAAO,EACP,UAAU,EACV,eAAe,EACf,IAAI,GACL,MAAM,WAAW,CAAA;AAElB,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AASpE,MAAM,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;AAErB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,GAAmB,EAAE,OAAsB,EAAU,EAAE,CAC9E,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAA;AAE7C,4DAA4D;AAC5D,MAAM,YAAY,GAAG,CAAC,GAAmB,EAAE,OAAsB,EAAU,EAAE,CAC3E,OAAO,CAAC,UAAU,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,IAAI,SAAS,QAAQ,CAAA;AAE/E,SAAS,cAAc,CAAC,OAAsB;IAC5C,IAAI,CAAC,OAAO,CAAC,OAAO;QAClB,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAA;IACH,OAAO,OAAO,CAAC,OAAO,CAAA;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAoB;IAClD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAA;IAEzC,MAAM,MAAM,GAAa;QACvB,IAAI,EAAE,GAAG,MAAM,qBAAqB;QACpC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;YACzE,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,WAAW,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;YAClF,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YACnC,MAAM,GAAG,GACP,IAAI,KAAK,QAAQ;gBACf,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;gBACzD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;YAC3C,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,GAAG,CAAC,CAAA;YAClF,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;YAEjF,MAAM,KAAK,GAAG,MAAM,mBAAmB,CACrC,GAAG,EACH,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CACpD,CAAA;YACD,MAAM,OAAO,GAAoB,EAAE,CAAA;YACnC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE;gBACtC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;gBACjC,WAAW,EAAE,KAAK,EAAE,MAAM;gBAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;aAC3B,CAAC,CAAA;YACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM;gBACjC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3D,CAAC,CAAC,GAAG,CAAA;YAEP,MAAM,SAAS,GAA6C,EAAE,CAAA;YAC9D,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;gBACjD,IAAI,CAAC,CAAC;oBAAE,SAAQ;gBAChB,SAAS,CAAC,MAAM,CAAC,GAAG;oBAClB,UAAU,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI;oBACvC,KAAK,EAAE,OAAO,CAAC,CAAC,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;iBAC3E,CAAA;YACH,CAAC;YACD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAA;YACpD,MAAM,OAAO,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;YAClE,MAAM,IAAI,GAAmB;gBAC3B,IAAI;gBACJ,IAAI;gBACJ,MAAM,EACJ,IAAI,KAAK,QAAQ;oBACf,CAAC,CAAC;wBACE,QAAQ,EAAE,OAAO,CAAE,GAAoB,CAAC,KAAK,CAAC;wBAC9C,MAAM,EAAE,OAAO,CAAE,GAAoB,CAAC,KAAK,CAAC;qBAC7C;oBACH,CAAC,CAAC;wBACE,QAAQ,EAAE,OAAO,CAAE,GAAwB,CAAC,MAAM,EAAE,QAAQ,CAAC;wBAC7D,MAAM,EAAE,OAAO,CAAE,GAAwB,CAAC,MAAM,EAAE,MAAM,CAAC;qBAC1D;gBACP,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnC,MAAM;gBACN,MAAM,EAAE,gBAAgB,CAAC,GAAG,CAAC;gBAC7B,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClF,GAAG,CAAC,IAAI,KAAK,YAAY,IAAK,GAAwB,CAAC,KAAK,EAAE,UAAU;oBACtE,CAAC,CAAC,EAAE,UAAU,EAAG,GAAwB,CAAC,KAAM,CAAC,UAAU,EAAE;oBAC7D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,YAAY;oBACd,CAAC,CAAC;wBACE,aAAa,EAAE,YAAY,CAAC,aAAa;wBACzC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBAC/E;oBACH,CAAC,CAAC,EAAE,CAAC;aACR,CAAA;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;KACF,CAAA;IAED,MAAM,KAAK,GAAa;QACtB,IAAI,EAAE,GAAG,MAAM,QAAQ;QACvB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YACtB,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClF,MAAM,KAAK,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YAClD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAA;YACxD,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;YAC7D,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC7C,OAAO,IAAI,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAA;YAC3C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;YACpF,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAA;YAChE,MAAM,IAAI,GAAe,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;YACnE,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;gBACzC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC9B,CAAC;KACF,CAAA;IAED,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,GAAG,MAAM,OAAO;QACtB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAA;YACvF,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YACtB,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE;gBAC/E,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACrB,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC;aACnC,CAAC,CAAA;YACF,OAAO,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QACvC,CAAC;KACF,CAAA;IAED,MAAM,IAAI,GAAa;QACrB,IAAI,EAAE,GAAG,MAAM,OAAO;QACtB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAA;YACvC,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;QAClD,CAAC;KACF,CAAA;IAED,MAAM,WAAW,GAAa;QAC5B,IAAI,EAAE,GAAG,MAAM,eAAe;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACpC,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC;gBAChE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,GAAG,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAA4B,CAAA;YACtF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;YACzB,MAAM,KAAK,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YAClD,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;YACnE,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,GAAG,CAAC,CAAA;YACzF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YACxE,gGAAgG;YAChG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;YACvD,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAA;YACnE,MAAM,GAAG,GAAG,OAAO,CAAC,cAAc,IAAI,GAAG,CAAA;YACzC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CACjD,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAClC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,EACtB,GAAG,CACJ,CAAA;YACD,OAAO,IAAI,CAAC;gBACV,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,GAAG,MAAM,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,EAAE;gBACtF,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gBACrD,EAAE,EAAE,OAAO,CAAC,GAAG;aAChB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;IAED,MAAM,OAAO,GAAa;QACxB,IAAI,EAAE,GAAG,MAAM,UAAU;QACzB,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,8CAA8C,EAAE,GAAG,CAAC,CAAA;YAC/E,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YACrC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAA;YAC/E,MAAM,GAAG,GAAG,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC3C,MAAM,KAAK,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;YAClD,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK;gBAAE,OAAO,OAAO,EAAE,CAAA;YAC9C,8EAA8E;YAC9E,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAChE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,OAAO,EAAE,CAAA;YAChE,IACE,OAAO,CAAC,mBAAmB;gBAC3B,CAAC,CAAC,MAAM,OAAO,CAAC,mBAAmB,CAAC;oBAClC,GAAG;oBACH,GAAG;oBACH,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,QAAQ,EAAE,KAAK,CAAC,GAAG;oBACnB,EAAE,EAAE,KAAK,CAAC,GAAG;iBACd,CAAC,CAAC,EACH,CAAC;gBACD,OAAO,OAAO,EAAE,CAAA;YAClB,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAA;YAC5C,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC;gBACvC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC;gBACrB,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;gBAC5B,SAAS;gBACT,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CACpB,IAAI,CACF,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,EACpF,MAAM,EACN,YAAY,CAAC,aAAa,CAC3B;aACJ,CAAC,CAAA;YACF,OAAO,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;KACF,CAAA;IAED,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAA;AAC1D,CAAC"}

package/dist/hooks.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Collection/global hooks added by the plugin:
+ *  - afterRead: auto-mapping markers, only on reads that ask (`context.onpage`)
+ *  - beforeValidate/beforeChange: strip markers from every write, so they can't be stored
+ *  - beforeChange: stale-write guard (409) when the editor sends the version it last saw
+ */
+import { type EncodeFilter, type SchemaField } from '@payload-onpage/core';
+import { type PayloadRequest } from 'payload';
+/** True when a read asked for auto-mapping markers (see `onpageContext()`). */
+export declare const wantsMarkers: (context: unknown) => boolean;
+export declare const stripMarkers: ({ data }: {
+    data?: unknown;
+}) => unknown;
+export declare function encodeOnRead(opts: {
+    kind: 'collection' | 'global';
+    slug: string;
+    fields: () => SchemaField[];
+    only?: string[];
+    filter?: EncodeFilter;
+}): ({ doc, req, context, }: {
+    doc: Record<string, unknown>;
+    req: PayloadRequest;
+    context: unknown;
+}) => Record<string, unknown>;
+/**
+ * Optimistic concurrency: the editor sends `x-onpage-if-unmodified-since` with
+ * the `updatedAt` it last saw; if the document changed since, the write fails
+ * with 409 and the editor offers to reload. Writes without the header (admin,
+ * API, other tools) are untouched.
+ */
+export declare const guardStaleWrite: <T>({ data, req, originalDoc, }: {
+    data: T;
+    req: PayloadRequest;
+    originalDoc?: {
+        updatedAt?: unknown;
+    };
+}) => T;
+//# sourceMappingURL=hooks.d.ts.map

package/dist/hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAKL,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAEvD,+EAA+E;AAC/E,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,KAAG,OACoD,CAAA;AAEpG,eAAO,MAAM,YAAY,GAAI,UAAU;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,YAAyC,CAAA;AAElG,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,WAAW,EAAE,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,CAAC,EAAE,YAAY,CAAA;CACtB,IACS,wBAIL;IACD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5B,GAAG,EAAE,cAAc,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;CACjB,6BAYF;AAED;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAAE,6BAIhC;IACD,IAAI,EAAE,CAAC,CAAA;IACP,GAAG,EAAE,cAAc,CAAA;IACnB,WAAW,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CACtC,KAAG,CAaH,CAAA"}

package/dist/hooks.js

@@ -0,0 +1,42 @@
+/**
+ * Collection/global hooks added by the plugin:
+ *  - afterRead: auto-mapping markers, only on reads that ask (`context.onpage`)
+ *  - beforeValidate/beforeChange: strip markers from every write, so they can't be stored
+ *  - beforeChange: stale-write guard (409) when the editor sends the version it last saw
+ */
+import { encodeDocument, HEADER, refKey, stegaCleanDeep, } from '@payload-onpage/core';
+import { APIError } from 'payload';
+/** True when a read asked for auto-mapping markers (see `onpageContext()`). */
+export const wantsMarkers = (context) => !!(context && typeof context === 'object' && context.onpage === true);
+export const stripMarkers = ({ data }) => (data ? stegaCleanDeep(data) : data);
+export function encodeOnRead(opts) {
+    return ({ doc, req, context, }) => {
+        if (!wantsMarkers(context) || req.locale === 'all' || !doc)
+            return doc;
+        const ref = opts.kind === 'global'
+            ? refKey({ kind: 'global', slug: opts.slug })
+            : doc.id != null
+                ? refKey({ kind: 'collection', slug: opts.slug, id: doc.id })
+                : null;
+        return ref
+            ? encodeDocument(doc, opts.fields(), ref, { only: opts.only, filter: opts.filter })
+            : doc;
+    };
+}
+/**
+ * Optimistic concurrency: the editor sends `x-onpage-if-unmodified-since` with
+ * the `updatedAt` it last saw; if the document changed since, the write fails
+ * with 409 and the editor offers to reload. Writes without the header (admin,
+ * API, other tools) are untouched.
+ */
+export const guardStaleWrite = ({ data, req, originalDoc, }) => {
+    const seen = req.headers?.get(HEADER.ifUnmodifiedSince);
+    const current = originalDoc?.updatedAt;
+    if (!seen || typeof current !== 'string')
+        return data;
+    if (new Date(seen).getTime() !== new Date(current).getTime()) {
+        throw new APIError('This document was changed by someone else since you loaded it.', 409, undefined, true);
+    }
+    return data;
+};
+//# sourceMappingURL=hooks.js.map

package/dist/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../src/hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,cAAc,EACd,MAAM,EACN,MAAM,EACN,cAAc,GAGf,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,QAAQ,EAAuB,MAAM,SAAS,CAAA;AAEvD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,OAAgB,EAAW,EAAE,CACxD,CAAC,CAAC,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAK,OAAmC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;AAEpG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAE,IAAI,EAAsB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AAElG,MAAM,UAAU,YAAY,CAAC,IAM5B;IACC,OAAO,CAAC,EACN,GAAG,EACH,GAAG,EACH,OAAO,GAKR,EAAE,EAAE;QACH,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAA;QACtE,MAAM,GAAG,GACP,IAAI,CAAC,IAAI,KAAK,QAAQ;YACpB,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI;gBACd,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAqB,EAAE,CAAC;gBAChF,CAAC,CAAC,IAAI,CAAA;QACZ,OAAO,GAAG;YACR,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACnF,CAAC,CAAC,GAAG,CAAA;IACT,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAI,EACjC,IAAI,EACJ,GAAG,EACH,WAAW,GAKZ,EAAK,EAAE;IACN,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACvD,MAAM,OAAO,GAAG,WAAW,EAAE,SAAS,CAAA;IACtC,IAAI,CAAC,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACrD,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,QAAQ,CAChB,gEAAgE,EAChE,GAAG,EACH,SAAS,EACT,IAAI,CACL,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/dist/http.d.ts

@@ -0,0 +1,23 @@
+/** Request helpers shared by the endpoints. */
+import { type DocRef } from '@payload-onpage/core';
+import type { PayloadRequest } from 'payload';
+/** The site origin: `serverURL` when configured, else the request's own origin. */
+export declare function originOf(req: PayloadRequest): string;
+export declare const isSecure: (req: PayloadRequest) => boolean;
+export declare const queryOf: (req: PayloadRequest) => URLSearchParams;
+export declare const text: (body: string, status: number) => Response;
+export declare const json: (body: unknown, status?: number) => Response;
+/** Redirect to a same-origin path (anything unsafe becomes "/"). 303 turns a POST into a GET. */
+export declare const redirectTo: (req: PayloadRequest, path: unknown, status?: 303 | 307) => Response;
+/**
+ * CSRF guard for state-changing endpoints: a POST from this site (Origin, or
+ * Sec-Fetch-Site when Origin is absent). Returns an error response or null.
+ */
+export declare function rejectCrossSite(req: PayloadRequest): Response | null;
+/** A document ref from `kind`, `slug`, `id` query/body values. */
+export declare function readRef(values: {
+    kind?: unknown;
+    slug?: unknown;
+    id?: unknown;
+}): DocRef | null;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,OAAO,EAAyB,KAAK,MAAM,EAAE,MAAM,sBAAsB,CAAA;AACzE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAUpD;AAED,eAAO,MAAM,QAAQ,GAAI,KAAK,cAAc,KAAG,OAA6C,CAAA;AAE5F,eAAO,MAAM,OAAO,GAAI,KAAK,cAAc,KAAG,eACY,CAAA;AAE1D,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,QAIhD,CAAA;AAEJ,eAAO,MAAM,IAAI,GAAI,MAAM,OAAO,EAAE,eAAY,KAAG,QACiC,CAAA;AAEpF,iGAAiG;AACjG,eAAO,MAAM,UAAU,GAAI,KAAK,cAAc,EAAE,MAAM,OAAO,EAAE,SAAQ,GAAG,GAAG,GAAS,KAAG,QACf,CAAA;AAE1E;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,QAAQ,GAAG,IAAI,CAMpE;AAED,kEAAkE;AAClE,wBAAgB,OAAO,CAAC,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,EAAE,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,GAAG,IAAI,CAQ/F"}