@payload-onpage/plugin 0.0.0-stage → 0.2.0

package/src/endpoints.ts

@@ -0,0 +1,269 @@
+/**
+ * The plugin's endpoints, under `${api}${routePrefix}` (default /api/onpage):
+ *
+ *   GET  /schema/:kind/:slug   editable field schema for the signed-in editor
+ *   POST /enter                start editing or previewing a document's page
+ *   POST /mode                 switch the current page between editing and previewing
+ *   POST /exit                 leave edit/preview mode
+ *   POST /preview-link         create a sealed, expiring read-only link (JSON)
+ *   GET  /preview?token=       open a preview link
+ *
+ * State-changing endpoints are same-origin POSTs (CSRF-safe). Every
+ * authorization decision goes through ./access (Payload's own access rules).
+ */
+import {
+  parseRefKey,
+  pathnameOf,
+  refKey,
+  safePath,
+  samePath,
+  SEAL_PURPOSE,
+  seal,
+  type DocumentSchema,
+  type OnPageMode,
+  type SessionAdapter,
+} from '@payload-onpage/core'
+import type { CollectionConfig, Endpoint, GlobalConfig, PayloadRequest } from 'payload'
+import { hasAutosaveEnabled, hasDraftsEnabled, getAutosaveInterval } from 'payload/shared'
+import { canEditDocument, canUseOnPage, documentPermissions } from './access.ts'
+import {
+  isSecure,
+  json,
+  originOf,
+  queryOf,
+  readRef,
+  redirectTo,
+  rejectCrossSite,
+  text,
+} from './http.ts'
+import type { Entry, OnPageOptions } from './options.ts'
+import { resolvePath } from './paths.ts'
+import { relationTargets, serializeFields } from './schema.ts'
+import { createPreviewToken, verifyPreviewToken } from './tokens.ts'
+
+export interface EndpointContext {
+  options: OnPageOptions
+  prefix: string
+  apiRoute: string
+  entry: (kind: string, slug: string) => Entry | undefined
+}
+
+const DAY = 24 * 3600
+
+export const secretOf = (req: PayloadRequest, options: OnPageOptions): string =>
+  options.secret ?? req.payload.config.secret
+
+/** Name of the auth cookie an editor's mode is bound to. */
+const authCookieOf = (req: PayloadRequest, options: OnPageOptions): string =>
+  options.authCookie ?? `${req.payload.config.cookiePrefix || 'payload'}-token`
+
+function requireSession(options: OnPageOptions): SessionAdapter {
+  if (!options.session)
+    throw new Error(
+      'payload-onpage: pass `session` (e.g. nextSession()) to use the enter, mode, exit and preview endpoints',
+    )
+  return options.session
+}
+
+export function createEndpoints(ctx: EndpointContext): Endpoint[] {
+  const { options, prefix, apiRoute } = ctx
+
+  const schema: Endpoint = {
+    path: `${prefix}/schema/:kind/:slug`,
+    method: 'get',
+    handler: async (req) => {
+      const kind = req.routeParams?.kind === 'global' ? 'global' : 'collection'
+      const slug = typeof req.routeParams?.slug === 'string' ? req.routeParams.slug : ''
+      const entry = ctx.entry(kind, slug)
+      const cfg: CollectionConfig | GlobalConfig | undefined =
+        kind === 'global'
+          ? req.payload.globals.config.find((g) => g.slug === slug)
+          : req.payload.collections[slug]?.config
+      if (!entry || !cfg) return json({ error: 'Not enabled for on-page editing' }, 404)
+      if (!(await canUseOnPage(req, options))) return json({ error: 'Forbidden' }, 403)
+
+      const perms = await documentPermissions(
+        req,
+        kind === 'global' ? { kind, slug } : { kind, slug },
+      )
+      const pending: Promise<void>[] = []
+      const all = serializeFields(cfg.fields, {
+        i18n: req.i18n,
+        blocks: req.payload.config.blocks,
+        permissions: perms?.fields,
+        defaults: { req, pending },
+      })
+      await Promise.all(pending)
+      const fields = entry.options.fields
+        ? all.filter((f) => entry.options.fields!.includes(f.name))
+        : all
+
+      const relations: NonNullable<DocumentSchema['relations']> = {}
+      for (const target of relationTargets(fields)) {
+        const c = req.payload.collections[target]?.config
+        if (!c) continue
+        relations[target] = {
+          titleField: c.admin?.useAsTitle ?? 'id',
+          label: typeof c.labels?.singular === 'string' ? c.labels.singular : target,
+        }
+      }
+      const localization = req.payload.config.localization
+      const labelOf = (v: unknown) => (typeof v === 'string' ? v : slug)
+      const body: DocumentSchema = {
+        kind,
+        slug,
+        labels:
+          kind === 'global'
+            ? {
+                singular: labelOf((cfg as GlobalConfig).label),
+                plural: labelOf((cfg as GlobalConfig).label),
+              }
+            : {
+                singular: labelOf((cfg as CollectionConfig).labels?.singular),
+                plural: labelOf((cfg as CollectionConfig).labels?.plural),
+              },
+        editable: fields.map((f) => f.name),
+        fields,
+        drafts: hasDraftsEnabled(cfg),
+        ...(hasAutosaveEnabled(cfg) ? { autosaveInterval: getAutosaveInterval(cfg) } : {}),
+        ...(kind === 'collection' && (cfg as CollectionConfig).admin?.useAsTitle
+          ? { useAsTitle: (cfg as CollectionConfig).admin!.useAsTitle }
+          : {}),
+        ...(Object.keys(relations).length ? { relations } : {}),
+        ...(localization
+          ? {
+              defaultLocale: localization.defaultLocale,
+              locales: localization.locales.map((l) => (typeof l === 'string' ? l : l.code)),
+            }
+          : {}),
+      }
+      return json(body)
+    },
+  }
+
+  const enter: Endpoint = {
+    path: `${prefix}/enter`,
+    method: 'post',
+    handler: async (req) => {
+      const refused = rejectCrossSite(req)
+      if (refused) return refused
+      const q = queryOf(req)
+      const ref = readRef({ kind: q.get('kind'), slug: q.get('slug'), id: q.get('id') })
+      const entry = ref && ctx.entry(ref.kind, ref.slug)
+      if (!ref || !entry) return text('Unknown document', 400)
+      if (!req.user) return text('Sign in to the admin first', 401)
+      if (!(await canEditDocument(req, ref, options)))
+        return text('You cannot edit this document', 403)
+      const locale = q.get('locale') ?? undefined
+      const path = safePath(q.get('path')) ?? (await resolvePath(req, ref, entry, locale))
+      if (!path) return text('This document has no page to open', 404)
+      const mode: OnPageMode = q.get('mode') === 'view' ? 'view' : 'edit'
+      await requireSession(options).enable(mode, {
+        secure: isSecure(req),
+        bindTo: authCookieOf(req, options),
+      })
+      return redirectTo(req, path)
+    },
+  }
+
+  const mode: Endpoint = {
+    path: `${prefix}/mode`,
+    method: 'post',
+    handler: async (req) => {
+      const refused = rejectCrossSite(req)
+      if (refused) return refused
+      if (!(await canUseOnPage(req, options))) return text('Sign in as an editor first', 401)
+      const q = queryOf(req)
+      await requireSession(options).enable(q.get('mode') === 'view' ? 'view' : 'edit', {
+        secure: isSecure(req),
+        bindTo: authCookieOf(req, options),
+      })
+      return redirectTo(req, q.get('path'))
+    },
+  }
+
+  const exit: Endpoint = {
+    path: `${prefix}/exit`,
+    method: 'post',
+    handler: async (req) => {
+      const refused = rejectCrossSite(req)
+      if (refused) return refused
+      await requireSession(options).disable()
+      return redirectTo(req, queryOf(req).get('path'))
+    },
+  }
+
+  const previewLink: Endpoint = {
+    path: `${prefix}/preview-link`,
+    method: 'post',
+    handler: async (req) => {
+      const refused = rejectCrossSite(req)
+      if (refused) return refused
+      if (!req.headers.get('content-type')?.includes('application/json'))
+        return json({ error: 'Expected JSON' }, 415)
+      const body = ((await req.json?.().catch(() => null)) ?? {}) as Record<string, unknown>
+      const ref = readRef(body)
+      const entry = ref && ctx.entry(ref.kind, ref.slug)
+      if (!ref || !entry) return json({ error: 'Unknown document' }, 400)
+      if (!(await canEditDocument(req, ref, options))) return json({ error: 'Forbidden' }, 403)
+      const locale = typeof body.locale === 'string' ? body.locale : undefined
+      // The path is always derived on the server: a link opens this document's page and nothing else.
+      const path = await resolvePath(req, ref, entry, locale)
+      if (!path) return json({ error: 'This document has no page' }, 404)
+      const ttl = options.previewLinkTTL ?? DAY
+      const { token, payload } = await createPreviewToken(
+        { ref: refKey(ref), path, locale },
+        secretOf(req, options),
+        ttl,
+      )
+      return json({
+        url: `${originOf(req)}${apiRoute}${prefix}/preview?token=${encodeURIComponent(token)}`,
+        expiresAt: new Date(payload.exp * 1000).toISOString(),
+        id: payload.jti,
+      })
+    },
+  }
+
+  const preview: Endpoint = {
+    path: `${prefix}/preview`,
+    method: 'get',
+    handler: async (req) => {
+      const invalid = () => text('This preview link is invalid or has expired.', 403)
+      const secret = secretOf(req, options)
+      const token = await verifyPreviewToken(queryOf(req).get('token') ?? '', secret)
+      const ref = token && parseRefKey(token.ref)
+      const entry = ref && ctx.entry(ref.kind, ref.slug)
+      if (!token || !ref || !entry) return invalid()
+      // Still the document's page? (It may have been deleted, or its slug changed.)
+      const current = await resolvePath(req, ref, entry, token.locale)
+      if (!current || !samePath(current, token.path)) return invalid()
+      if (
+        options.validatePreviewLink &&
+        !(await options.validatePreviewLink({
+          req,
+          ref,
+          path: token.path,
+          issuedAt: token.iat,
+          id: token.jti,
+        }))
+      ) {
+        return invalid()
+      }
+      const expiresAt = new Date(token.exp * 1000)
+      await requireSession(options).enableLink({
+        secure: isSecure(req),
+        path: pathnameOf(token.path),
+        expiresAt,
+        seal: (draftSecret) =>
+          seal(
+            { path: pathnameOf(token.path), ref: token.ref, exp: token.exp, draft: draftSecret },
+            secret,
+            SEAL_PURPOSE.previewCookie,
+          ),
+      })
+      return redirectTo(req, token.path, 307)
+    },
+  }
+
+  return [schema, enter, mode, exit, previewLink, preview]
+}

package/src/hooks.ts

@@ -0,0 +1,79 @@
+/**
+ * Collection/global hooks added by the plugin:
+ *  - afterRead: auto-mapping markers, only on reads that ask (`context.onpage`)
+ *  - beforeValidate/beforeChange: strip markers from every write, so they can't be stored
+ *  - beforeChange: stale-write guard (409) when the editor sends the version it last saw
+ */
+import {
+  encodeDocument,
+  HEADER,
+  refKey,
+  stegaCleanDeep,
+  type EncodeFilter,
+  type SchemaField,
+} from '@payload-onpage/core'
+import { APIError, type PayloadRequest } from 'payload'
+
+/** True when a read asked for auto-mapping markers (see `onpageContext()`). */
+export const wantsMarkers = (context: unknown): boolean =>
+  !!(context && typeof context === 'object' && (context as Record<string, unknown>).onpage === true)
+
+export const stripMarkers = ({ data }: { data?: unknown }) => (data ? stegaCleanDeep(data) : data)
+
+export function encodeOnRead(opts: {
+  kind: 'collection' | 'global'
+  slug: string
+  fields: () => SchemaField[]
+  only?: string[]
+  filter?: EncodeFilter
+}) {
+  return ({
+    doc,
+    req,
+    context,
+  }: {
+    doc: Record<string, unknown>
+    req: PayloadRequest
+    context: unknown
+  }) => {
+    if (!wantsMarkers(context) || req.locale === 'all' || !doc) return doc
+    const ref =
+      opts.kind === 'global'
+        ? refKey({ kind: 'global', slug: opts.slug })
+        : doc.id != null
+          ? refKey({ kind: 'collection', slug: opts.slug, id: doc.id as string | number })
+          : null
+    return ref
+      ? encodeDocument(doc, opts.fields(), ref, { only: opts.only, filter: opts.filter })
+      : doc
+  }
+}
+
+/**
+ * Optimistic concurrency: the editor sends `x-onpage-if-unmodified-since` with
+ * the `updatedAt` it last saw; if the document changed since, the write fails
+ * with 409 and the editor offers to reload. Writes without the header (admin,
+ * API, other tools) are untouched.
+ */
+export const guardStaleWrite = <T>({
+  data,
+  req,
+  originalDoc,
+}: {
+  data: T
+  req: PayloadRequest
+  originalDoc?: { updatedAt?: unknown }
+}): T => {
+  const seen = req.headers?.get(HEADER.ifUnmodifiedSince)
+  const current = originalDoc?.updatedAt
+  if (!seen || typeof current !== 'string') return data
+  if (new Date(seen).getTime() !== new Date(current).getTime()) {
+    throw new APIError(
+      'This document was changed by someone else since you loaded it.',
+      409,
+      undefined,
+      true,
+    )
+  }
+  return data
+}

package/src/http.ts

@@ -0,0 +1,57 @@
+/** Request helpers shared by the endpoints. */
+import { parseRefKey, safePath, type DocRef } from '@payload-onpage/core'
+import type { PayloadRequest } from 'payload'
+
+/** The site origin: `serverURL` when configured, else the request's own origin. */
+export function originOf(req: PayloadRequest): string {
+  const configured = req.payload.config.serverURL
+  if (configured) return configured.replace(/\/$/, '')
+  try {
+    return new URL(req.url ?? '').origin
+  } catch {
+    const host = req.headers.get('x-forwarded-host') ?? req.headers.get('host') ?? 'localhost'
+    const proto = req.headers.get('x-forwarded-proto') ?? 'http'
+    return `${proto}://${host}`
+  }
+}
+
+export const isSecure = (req: PayloadRequest): boolean => originOf(req).startsWith('https:')
+
+export const queryOf = (req: PayloadRequest): URLSearchParams =>
+  new URL(req.url ?? '/', 'http://localhost').searchParams
+
+export const text = (body: string, status: number): Response =>
+  new Response(body, {
+    status,
+    headers: { 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' },
+  })
+
+export const json = (body: unknown, status = 200): Response =>
+  Response.json(body, { status, headers: { 'cache-control': 'private, no-store' } })
+
+/** Redirect to a same-origin path (anything unsafe becomes "/"). 303 turns a POST into a GET. */
+export const redirectTo = (req: PayloadRequest, path: unknown, status: 303 | 307 = 303): Response =>
+  Response.redirect(new URL(safePath(path) ?? '/', originOf(req)), status)
+
+/**
+ * CSRF guard for state-changing endpoints: a POST from this site (Origin, or
+ * Sec-Fetch-Site when Origin is absent). Returns an error response or null.
+ */
+export function rejectCrossSite(req: PayloadRequest): Response | null {
+  if (req.method?.toUpperCase() !== 'POST') return text('Method not allowed', 405)
+  const origin = req.headers.get('origin')
+  if (origin) return origin === originOf(req) ? null : text('Cross-site request refused', 403)
+  const site = req.headers.get('sec-fetch-site')
+  return site === 'same-origin' || site === 'none' ? null : text('Cross-site request refused', 403)
+}
+
+/** A document ref from `kind`, `slug`, `id` query/body values. */
+export function readRef(values: { kind?: unknown; slug?: unknown; id?: unknown }): DocRef | null {
+  const slug = typeof values.slug === 'string' ? values.slug : ''
+  if (!slug) return null
+  if (values.kind === 'global') return { kind: 'global', slug }
+  const id = values.id
+  if (typeof id === 'number') return { kind: 'collection', slug, id }
+  if (typeof id !== 'string' || !id) return null
+  return parseRefKey(`c:${slug}:${id}`)
+}

package/src/index.ts

@@ -0,0 +1,167 @@
+/**
+ * @payload-onpage/plugin — the Payload side of payload-onpage.
+ *
+ *   plugins: [onpage({ collections: ['pages'], globals: ['header'], session: nextSession() })]
+ *
+ * Adds the endpoints in ./endpoints, auto-mapping on reads that ask for it,
+ * marker stripping and a stale-write guard on every write, and "Edit on page" /
+ * "Copy preview link" controls in the admin. Saves from the editor go through
+ * Payload's REST API, so access control, hooks, validation, drafts and versions
+ * apply unchanged.
+ */
+import { DEFAULTS, type SchemaField } from '@payload-onpage/core'
+import type { CollectionConfig, Config, GlobalConfig, Plugin } from 'payload'
+import { createEndpoints } from './endpoints.ts'
+import { encodeOnRead, guardStaleWrite, stripMarkers } from './hooks.ts'
+import { normalizeEntries, type Entry, type OnPageOptions } from './options.ts'
+import { serializeFields } from './schema.ts'
+import { translations } from './translations.ts'
+
+const APPLIED = 'payload-onpage'
+
+type Translations = Record<string, Record<string, unknown>>
+/** Ours first; the site's own translations (any language, any key) win. */
+function mergeTranslations(
+  ours: Translations,
+  theirs: unknown,
+): NonNullable<Config['i18n']>['translations'] {
+  const out: Translations = { ...ours }
+  for (const [lang, table] of Object.entries((theirs ?? {}) as Translations)) {
+    const mine = out[lang] ?? {}
+    out[lang] = {
+      ...mine,
+      ...table,
+      onpage: { ...(mine.onpage as object), ...(table.onpage ?? {}) },
+    }
+  }
+  return out
+}
+
+export function onpage(options: OnPageOptions): Plugin {
+  return (incoming: Config): Config => {
+    if (options.enabled === false || incoming.custom?.[APPLIED]) return incoming
+    const prefix = options.routePrefix ?? DEFAULTS.routePrefix
+    const apiRoute = incoming.routes?.api ?? DEFAULTS.apiRoute
+    const entries = [
+      ...normalizeEntries(options.collections, 'collection'),
+      ...normalizeEntries(options.globals, 'global'),
+    ]
+    const byKey = new Map(entries.map((e) => [`${e.kind}:${e.slug}`, e]))
+
+    const withHooks = <T extends CollectionConfig | GlobalConfig>(cfg: T, entry: Entry): T => {
+      let fields: SchemaField[] | undefined
+      // Encoding only needs names, types and editors: serialize once, lazily, without request context.
+      const lazyFields = () => (fields ??= serializeFields(cfg.fields, { blocks: incoming.blocks }))
+      const hooks = { ...(cfg.hooks ?? {}) } as Record<string, unknown[]>
+      hooks.beforeValidate = [...(hooks.beforeValidate ?? []), stripMarkers]
+      hooks.beforeChange = [...(hooks.beforeChange ?? []), stripMarkers, guardStaleWrite]
+      hooks.afterRead = [
+        ...(hooks.afterRead ?? []),
+        encodeOnRead({
+          kind: entry.kind,
+          slug: cfg.slug,
+          fields: lazyFields,
+          only: entry.options.fields,
+          filter: options.encode,
+        }),
+      ]
+      return { ...cfg, hooks }
+    }
+
+    const control = (kind: Entry['kind'], slug: string) => ({
+      path: '@payload-onpage/plugin/admin#OnPageAdminControls',
+      clientProps: { kind, slug, prefix },
+    })
+
+    const withCollectionAdmin = (c: CollectionConfig): CollectionConfig => {
+      const edit = c.admin?.components?.edit ?? {}
+      return {
+        ...c,
+        admin: {
+          ...c.admin,
+          components: {
+            ...c.admin?.components,
+            edit: {
+              ...edit,
+              beforeDocumentControls: [
+                ...(edit.beforeDocumentControls ?? []),
+                control('collection', c.slug),
+              ],
+            },
+          },
+        },
+      }
+    }
+    const withGlobalAdmin = (g: GlobalConfig): GlobalConfig => {
+      const elements = g.admin?.components?.elements ?? {}
+      return {
+        ...g,
+        admin: {
+          ...g.admin,
+          components: {
+            ...g.admin?.components,
+            elements: {
+              ...elements,
+              beforeDocumentControls: [
+                ...(elements.beforeDocumentControls ?? []),
+                control('global', g.slug),
+              ],
+            },
+          },
+        },
+      }
+    }
+
+    const missing = entries.filter((e) =>
+      e.kind === 'global'
+        ? !incoming.globals?.some((g) => g.slug === e.slug)
+        : !incoming.collections?.some((c) => c.slug === e.slug),
+    )
+    if (missing.length) {
+      throw new Error(
+        `payload-onpage: unknown ${missing.map((e) => `${e.kind} "${e.slug}"`).join(', ')}`,
+      )
+    }
+
+    return {
+      ...incoming,
+      custom: { ...incoming.custom, [APPLIED]: true },
+      i18n: {
+        ...incoming.i18n,
+        translations: mergeTranslations(translations, incoming.i18n?.translations),
+      },
+      collections: (incoming.collections ?? []).map((c) => {
+        const entry = byKey.get(`collection:${c.slug}`)
+        return entry ? withCollectionAdmin(withHooks(c, entry)) : c
+      }),
+      globals: (incoming.globals ?? []).map((g) => {
+        const entry = byKey.get(`global:${g.slug}`)
+        return entry ? withGlobalAdmin(withHooks(g, entry)) : g
+      }),
+      endpoints: [
+        ...(incoming.endpoints ?? []),
+        ...createEndpoints({
+          options,
+          prefix,
+          apiRoute,
+          entry: (kind, slug) => byKey.get(`${kind}:${slug}`),
+        }),
+      ],
+      onInit: async (payload) => {
+        if (process.env.NODE_ENV === 'production' && !payload.config.serverURL) {
+          payload.logger.warn(
+            'payload-onpage: set `serverURL` in production so redirects, preview links and Secure cookies use the public origin.',
+          )
+        }
+        await incoming.onInit?.(payload)
+      },
+    }
+  }
+}
+
+export type { OnPageDocOptions, OnPageOptions } from './options.ts'
+export { canEditDocument, canUseOnPage } from './access.ts'
+export { createPreviewToken, verifyPreviewToken, type PreviewTokenPayload } from './tokens.ts'
+export { serializeFields, type SerializeContext } from './schema.ts'
+export { wantsMarkers } from './hooks.ts'
+export { translations } from './translations.ts'

package/src/options.ts

@@ -0,0 +1,65 @@
+import type { DocRef, EncodeFilter, SessionAdapter } from '@payload-onpage/core'
+import type { PayloadRequest } from 'payload'
+
+export interface OnPageDocOptions {
+  /** Top-level fields editable on the page. Default: every top-level field the user may update. */
+  fields?: string[]
+  /**
+   * The site path that shows this document. Default for collections: the
+   * collection's `admin.preview` URL, else `/${doc.slug}`. Globals: "/".
+   */
+  url?: (args: {
+    doc: Record<string, unknown>
+    locale?: string
+    req: PayloadRequest
+  }) => string | null | Promise<string | null>
+}
+
+export interface OnPageOptions {
+  collections?: string[] | Record<string, OnPageDocOptions | true>
+  globals?: string[] | Record<string, OnPageDocOptions | true>
+  /**
+   * Who may use on-page editing (`ref` undefined) and edit a given document.
+   * Default: users of the admin user collection, with the document's own
+   * `update` access (evaluated by Payload, including row-level rules).
+   */
+  access?: (args: { req: PayloadRequest; ref?: DocRef }) => boolean | Promise<boolean>
+  /** Framework adapter that switches edit/preview mode (e.g. `nextSession()`). Required for the enter/exit/preview endpoints. */
+  session?: SessionAdapter
+  /** Narrow which strings get auto-mapping markers. */
+  encode?: EncodeFilter
+  /** Lifetime of shareable preview links, in seconds. Default 1 day. */
+  previewLinkTTL?: number
+  /** Extra check when a preview link is opened (e.g. a revocation list). Return false to refuse it. */
+  validatePreviewLink?: (args: {
+    req: PayloadRequest
+    ref: DocRef
+    path: string
+    issuedAt: number
+    id: string
+  }) => boolean | Promise<boolean>
+  /**
+   * Secret for preview links and the preview cookie. Default: Payload's `secret`
+   * (`PAYLOAD_SECRET`). The Next.js proxy must be given the same value.
+   */
+  secret?: string
+  /** Auth cookie an editor's session is bound to. Default `${cookiePrefix}-token` ("payload-token"). */
+  authCookie?: string
+  /** Endpoint prefix under the API route. Default "/onpage". */
+  routePrefix?: string
+  enabled?: boolean
+}
+
+export interface Entry {
+  kind: 'collection' | 'global'
+  slug: string
+  options: OnPageDocOptions
+}
+
+export const normalizeEntries = (
+  input: OnPageOptions['collections'],
+  kind: Entry['kind'],
+): Entry[] =>
+  Array.isArray(input)
+    ? input.map((slug) => ({ kind, slug, options: {} }))
+    : Object.entries(input ?? {}).map(([slug, o]) => ({ kind, slug, options: o === true ? {} : o }))