@payloadcms/tanstack-start 4.0.0-canary.8

package/dist/utilities/serverFunctionClient.js

@@ -0,0 +1,109 @@
+/**
+ * Builds the client-side `ServerFunctionClient` wired into
+ * `RootProvider.serverFunction`, given the app's `createServerFn`-based
+ * dispatcher (`runServerFn`).
+ *
+ * Strips functions / symbols / RegExps / React elements from the args before
+ * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped
+ * those, but TanStack Start's seroval-based wire format errors instead. We
+ * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in
+ * `ServerFunctionsProvider`) that may pass the live form state — which can
+ * carry stray functions — keep working without each call site sanitising.
+ *
+ * Delegates to `runServerFn`, so the response (including any RSC handles for
+ * server-rendered custom components) is decoded by TanStack Start back into
+ * renderable React nodes on the client.
+ */ export function createServerFunctionClient({ runServerFn }) {
+    return async (args)=>{
+        const safeArgs = stripUnserializable(args);
+        return await runServerFn({
+            data: safeArgs
+        });
+    };
+}
+/**
+ * Recursively removes values TanStack Start's seroval wire format cannot
+ * serialize (functions, symbols, RegExps, React elements, cyclic refs) and
+ * normalizes `Date` subclasses to plain `Date`.
+ */ export function stripUnserializable(value, cache = new WeakMap(), ancestors = new WeakSet()) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    const t = typeof value;
+    if (t === 'function' || t === 'symbol') {
+        return undefined;
+    }
+    if (t !== 'object') {
+        return value;
+    }
+    const obj = value;
+    if (typeof obj.$$typeof === 'symbol') {
+        return undefined;
+    }
+    if (ancestors.has(obj)) {
+        return undefined;
+    }
+    if (cache.has(obj)) {
+        return cache.get(obj);
+    }
+    if (obj instanceof Date) {
+        // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,
+        // used by the schedule-publish drawer) are `instanceof Date` but have a
+        // different `constructor`, which TanStack Start's seroval serializer
+        // rejects with "The value [object Date] ... cannot be parsed/serialized".
+        return new Date(obj.getTime());
+    }
+    if (obj instanceof RegExp) {
+        return undefined;
+    }
+    ancestors.add(obj);
+    if (obj instanceof Map) {
+        const cleaned = new Map();
+        cache.set(obj, cleaned);
+        for (const [k, v] of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.set(k, cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (obj instanceof Set) {
+        const cleaned = new Set();
+        cache.set(obj, cleaned);
+        for (const v of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.add(cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (Array.isArray(obj)) {
+        const arr = [];
+        cache.set(obj, arr);
+        for (const item of obj){
+            arr.push(stripUnserializable(item, cache, ancestors));
+        }
+        ancestors.delete(obj);
+        return arr;
+    }
+    if (ArrayBuffer.isView(obj)) {
+        ancestors.delete(obj);
+        return obj;
+    }
+    const result = {};
+    cache.set(obj, result);
+    for (const key of Object.keys(obj)){
+        const v = stripUnserializable(obj[key], cache, ancestors);
+        if (v !== undefined) {
+            result[key] = v;
+        }
+    }
+    ancestors.delete(obj);
+    return result;
+}
+
+//# sourceMappingURL=serverFunctionClient.js.map

package/dist/utilities/serverFunctionClient.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\n/**\n * Builds the client-side `ServerFunctionClient` wired into\n * `RootProvider.serverFunction`, given the app's `createServerFn`-based\n * dispatcher (`runServerFn`).\n *\n * Strips functions / symbols / RegExps / React elements from the args before\n * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped\n * those, but TanStack Start's seroval-based wire format errors instead. We\n * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in\n * `ServerFunctionsProvider`) that may pass the live form state — which can\n * carry stray functions — keep working without each call site sanitising.\n *\n * Delegates to `runServerFn`, so the response (including any RSC handles for\n * server-rendered custom components) is decoded by TanStack Start back into\n * renderable React nodes on the client.\n */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<unknown>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const safeArgs = stripUnserializable(args) as ServerFunctionClientArgs\n    return await runServerFn({ data: safeArgs })\n  }) as ServerFunctionClient\n}\n\n/**\n * Recursively removes values TanStack Start's seroval wire format cannot\n * serialize (functions, symbols, RegExps, React elements, cyclic refs) and\n * normalizes `Date` subclasses to plain `Date`.\n */\nexport function stripUnserializable(\n  value: unknown,\n  cache: WeakMap<object, unknown> = new WeakMap(),\n  ancestors: WeakSet<object> = new WeakSet(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,\n    // used by the schedule-publish drawer) are `instanceof Date` but have a\n    // different `constructor`, which TanStack Start's seroval serializer\n    // rejects with \"The value [object Date] ... cannot be parsed/serialized\".\n    return new Date(obj.getTime())\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["createServerFunctionClient","runServerFn","args","safeArgs","stripUnserializable","data","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","getTime","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys"],"mappings":"AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASA,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAWC,oBAAoBF;QACrC,OAAO,MAAMD,YAAY;YAAEI,MAAMF;QAAS;IAC5C;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASC,oBACdE,KAAc,EACdC,QAAkC,IAAIC,SAAS,EAC/CC,YAA6B,IAAIC,SAAS;IAE1C,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,IAAIA,KAAKJ,IAAIK,OAAO;IAC7B;IAEA,IAAIL,eAAeM,QAAQ;QACzB,OAAOR;IACT;IAEAF,UAAUW,GAAG,CAACP;IAEd,IAAIA,eAAeQ,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBd,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIZ,IAAK;YACxB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIT,eAAee,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBrB,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAMG,KAAKZ,IAAK;YACnB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQF,GAAG,CAACM;YACd;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIO,MAAMC,OAAO,CAACjB,MAAM;QACtB,MAAMkB,MAAiB,EAAE;QACzBxB,MAAMgB,GAAG,CAACV,KAAKkB;QACf,KAAK,MAAMC,QAAQnB,IAAK;YACtBkB,IAAIE,IAAI,CAAC7B,oBAAoB4B,MAAMzB,OAAOE;QAC5C;QACAA,UAAUkB,MAAM,CAACd;QACjB,OAAOkB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACtB,MAAM;QAC3BJ,UAAUkB,MAAM,CAACd;QACjB,OAAOA;IACT;IAEA,MAAMuB,SAAkC,CAAC;IACzC7B,MAAMgB,GAAG,CAACV,KAAKuB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC1B,KAAM;QAClC,MAAMY,IAAIrB,oBAAoBS,GAAG,CAACwB,IAAI,EAAE9B,OAAOE;QAC/C,IAAIgB,MAAMd,WAAW;YACnByB,MAAM,CAACC,IAAI,GAAGZ;QAChB;IACF;IACAhB,UAAUkB,MAAM,CAACd;IACjB,OAAOuB;AACT"}

package/dist/utilities/serverFunctionHandlers.d.ts

@@ -0,0 +1,18 @@
+import type { ServerFunction } from 'payload';
+/**
+ * Framework-agnostic server-function handlers the TanStack Start dispatcher
+ * registers to reach parity with the Next.js adapter
+ * (`packages/next/src/utilities/handleServerFunctions.ts`).
+ */
+type SwitchLanguageArgs = {
+    lang: string;
+};
+/**
+ * Dispatched from `TranslationProvider` when the user switches the admin
+ * language. Writes the `<cookiePrefix>-lng` cookie via the request's
+ * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by
+ * the provider's `router.refresh()` — reads the new language.
+ */
+export declare const switchLanguageHandler: ServerFunction<SwitchLanguageArgs, Promise<void>>;
+export {};
+//# sourceMappingURL=serverFunctionHandlers.d.ts.map

package/dist/utilities/serverFunctionHandlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverFunctionHandlers.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C;;;;GAIG;AAEH,KAAK,kBAAkB,GAAG;IACxB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,CAcnF,CAAA"}

package/dist/utilities/serverFunctionHandlers.js

@@ -0,0 +1,17 @@
+/**
+ * Dispatched from `TranslationProvider` when the user switches the admin
+ * language. Writes the `<cookiePrefix>-lng` cookie via the request's
+ * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by
+ * the provider's `router.refresh()` — reads the new language.
+ */ export const switchLanguageHandler = async ({ lang, req })=>{
+    if (!req.server) {
+        throw new Error('switch-language requires a ServerAdapter on the request');
+    }
+    const cookieName = `${req.payload.config.cookiePrefix || 'payload'}-lng`;
+    await req.server.setCookie(cookieName, lang, {
+        maxAge: 60 * 60 * 24 * 365,
+        path: '/'
+    });
+};
+
+//# sourceMappingURL=serverFunctionHandlers.js.map

package/dist/utilities/serverFunctionHandlers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/serverFunctionHandlers.ts"],"sourcesContent":["import type { ServerFunction } from 'payload'\n\n/**\n * Framework-agnostic server-function handlers the TanStack Start dispatcher\n * registers to reach parity with the Next.js adapter\n * (`packages/next/src/utilities/handleServerFunctions.ts`).\n */\n\ntype SwitchLanguageArgs = {\n  lang: string\n}\n\n/**\n * Dispatched from `TranslationProvider` when the user switches the admin\n * language. Writes the `<cookiePrefix>-lng` cookie via the request's\n * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by\n * the provider's `router.refresh()` — reads the new language.\n */\nexport const switchLanguageHandler: ServerFunction<SwitchLanguageArgs, Promise<void>> = async ({\n  lang,\n  req,\n}) => {\n  if (!req.server) {\n    throw new Error('switch-language requires a ServerAdapter on the request')\n  }\n\n  const cookieName = `${req.payload.config.cookiePrefix || 'payload'}-lng`\n\n  await req.server.setCookie(cookieName, lang, {\n    maxAge: 60 * 60 * 24 * 365,\n    path: '/',\n  })\n}\n"],"names":["switchLanguageHandler","lang","req","server","Error","cookieName","payload","config","cookiePrefix","setCookie","maxAge","path"],"mappings":"AAYA;;;;;CAKC,GACD,OAAO,MAAMA,wBAA2E,OAAO,EAC7FC,IAAI,EACJC,GAAG,EACJ;IACC,IAAI,CAACA,IAAIC,MAAM,EAAE;QACf,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,aAAa,GAAGH,IAAII,OAAO,CAACC,MAAM,CAACC,YAAY,IAAI,UAAU,IAAI,CAAC;IAExE,MAAMN,IAAIC,MAAM,CAACM,SAAS,CAACJ,YAAYJ,MAAM;QAC3CS,QAAQ,KAAK,KAAK,KAAK;QACvBC,MAAM;IACR;AACF,EAAC"}

package/dist/utilities/setPayloadAuthCookie.d.ts

@@ -0,0 +1,9 @@
+import type { Auth } from 'payload';
+type SetPayloadAuthCookieArgs = {
+    authConfig: Auth;
+    cookiePrefix: string;
+    token: string;
+};
+export declare function setPayloadAuthCookie({ authConfig, cookiePrefix, token, }: SetPayloadAuthCookieArgs): void;
+export {};
+//# sourceMappingURL=setPayloadAuthCookie.d.ts.map

package/dist/utilities/setPayloadAuthCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setPayloadAuthCookie.d.ts","sourceRoot":"","sources":["../../src/utilities/setPayloadAuthCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAKnC,KAAK,wBAAwB,GAAG;IAC9B,UAAU,EAAE,IAAI,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,YAAY,EACZ,KAAK,GACN,EAAE,wBAAwB,GAAG,IAAI,CAoCjC"}

package/dist/utilities/setPayloadAuthCookie.js

@@ -0,0 +1,31 @@
+import { setResponseHeader } from '@tanstack/react-start/server';
+import { generatePayloadCookie } from 'payload';
+export function setPayloadAuthCookie({ authConfig, cookiePrefix, token }) {
+    const cookieExpiration = authConfig.tokenExpiration ? new Date(Date.now() + authConfig.tokenExpiration) : undefined;
+    const payloadCookie = generatePayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        expires: cookieExpiration,
+        returnCookieAsObject: true,
+        token
+    });
+    if (payloadCookie.value) {
+        const sameSite = typeof authConfig.cookies.sameSite === 'string' ? authConfig.cookies.sameSite : 'Lax';
+        let cookie = `${encodeURIComponent(payloadCookie.name)}=${encodeURIComponent(payloadCookie.value)}`;
+        cookie += '; HttpOnly';
+        cookie += `; SameSite=${sameSite}`;
+        cookie += '; Path=/';
+        if (authConfig.cookies.secure) {
+            cookie += '; Secure';
+        }
+        if (authConfig.cookies.domain) {
+            cookie += `; Domain=${authConfig.cookies.domain}`;
+        }
+        if (payloadCookie.expires) {
+            cookie += `; Expires=${new Date(payloadCookie.expires).toUTCString()}`;
+        }
+        setResponseHeader('Set-Cookie', cookie);
+    }
+}
+
+//# sourceMappingURL=setPayloadAuthCookie.js.map

package/dist/utilities/setPayloadAuthCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/setPayloadAuthCookie.ts"],"sourcesContent":["import type { Auth } from 'payload'\n\nimport { setResponseHeader } from '@tanstack/react-start/server'\nimport { generatePayloadCookie } from 'payload'\n\ntype SetPayloadAuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  token: string\n}\n\nexport function setPayloadAuthCookie({\n  authConfig,\n  cookiePrefix,\n  token,\n}: SetPayloadAuthCookieArgs): void {\n  const cookieExpiration = authConfig.tokenExpiration\n    ? new Date(Date.now() + authConfig.tokenExpiration)\n    : undefined\n\n  const payloadCookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    expires: cookieExpiration,\n    returnCookieAsObject: true,\n    token,\n  })\n\n  if (payloadCookie.value) {\n    const sameSite =\n      typeof authConfig.cookies.sameSite === 'string' ? authConfig.cookies.sameSite : 'Lax'\n\n    let cookie = `${encodeURIComponent(payloadCookie.name)}=${encodeURIComponent(payloadCookie.value)}`\n    cookie += '; HttpOnly'\n    cookie += `; SameSite=${sameSite}`\n    cookie += '; Path=/'\n\n    if (authConfig.cookies.secure) {\n      cookie += '; Secure'\n    }\n\n    if (authConfig.cookies.domain) {\n      cookie += `; Domain=${authConfig.cookies.domain}`\n    }\n\n    if (payloadCookie.expires) {\n      cookie += `; Expires=${new Date(payloadCookie.expires).toUTCString()}`\n    }\n\n    setResponseHeader('Set-Cookie', cookie)\n  }\n}\n"],"names":["setResponseHeader","generatePayloadCookie","setPayloadAuthCookie","authConfig","cookiePrefix","token","cookieExpiration","tokenExpiration","Date","now","undefined","payloadCookie","collectionAuthConfig","expires","returnCookieAsObject","value","sameSite","cookies","cookie","encodeURIComponent","name","secure","domain","toUTCString"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,+BAA8B;AAChE,SAASC,qBAAqB,QAAQ,UAAS;AAQ/C,OAAO,SAASC,qBAAqB,EACnCC,UAAU,EACVC,YAAY,EACZC,KAAK,EACoB;IACzB,MAAMC,mBAAmBH,WAAWI,eAAe,GAC/C,IAAIC,KAAKA,KAAKC,GAAG,KAAKN,WAAWI,eAAe,IAChDG;IAEJ,MAAMC,gBAAgBV,sBAAsB;QAC1CW,sBAAsBT;QACtBC;QACAS,SAASP;QACTQ,sBAAsB;QACtBT;IACF;IAEA,IAAIM,cAAcI,KAAK,EAAE;QACvB,MAAMC,WACJ,OAAOb,WAAWc,OAAO,CAACD,QAAQ,KAAK,WAAWb,WAAWc,OAAO,CAACD,QAAQ,GAAG;QAElF,IAAIE,SAAS,GAAGC,mBAAmBR,cAAcS,IAAI,EAAE,CAAC,EAAED,mBAAmBR,cAAcI,KAAK,GAAG;QACnGG,UAAU;QACVA,UAAU,CAAC,WAAW,EAAEF,UAAU;QAClCE,UAAU;QAEV,IAAIf,WAAWc,OAAO,CAACI,MAAM,EAAE;YAC7BH,UAAU;QACZ;QAEA,IAAIf,WAAWc,OAAO,CAACK,MAAM,EAAE;YAC7BJ,UAAU,CAAC,SAAS,EAAEf,WAAWc,OAAO,CAACK,MAAM,EAAE;QACnD;QAEA,IAAIX,cAAcE,OAAO,EAAE;YACzBK,UAAU,CAAC,UAAU,EAAE,IAAIV,KAAKG,cAAcE,OAAO,EAAEU,WAAW,IAAI;QACxE;QAEAvB,kBAAkB,cAAckB;IAClC;AACF"}

package/dist/utilities/toSerializable.d.ts

@@ -0,0 +1,2 @@
+export declare function toSerializable<T>(value: T): T;
+//# sourceMappingURL=toSerializable.d.ts.map

package/dist/utilities/toSerializable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toSerializable.d.ts","sourceRoot":"","sources":["../../src/utilities/toSerializable.ts"],"names":[],"mappings":"AA6HA,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE7C"}

package/dist/utilities/toSerializable.js

@@ -0,0 +1,111 @@
+/**
+ * Recursively strip values that seroval cannot serialize (React elements,
+ * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.
+ *
+ * TanStack Start uses seroval to transfer server function return values to
+ * the client.  Payload's `getClientConfig` / `getLayoutData` may include
+ * callback functions or RegExp instances that seroval chokes on.  Running
+ * the data through this function before returning from a `createServerFn`
+ * handler keeps the transfer safe.
+ *
+ * For server functions whose payloads contain React elements (e.g. the
+ * shared `form-state` / `render-list` / `render-document` handlers), use
+ * `serializeForRsc` instead — it converts elements into RSC handles rather
+ * than stripping them.
+ *
+ * Uses a WeakMap cache so that shared object references (e.g. the same array
+ * referenced by both `doc.hasMany` and `formState.hasMany.value`) are
+ * returned correctly instead of being dropped as "already seen".
+ *
+ * A separate `ancestors` WeakSet tracks objects currently being recursed into.
+ * If an object is encountered while it is still on the recursion stack, the
+ * reference is circular and is replaced with `undefined` to keep the output
+ * JSON-safe.  Once recursion completes the object is removed from `ancestors`,
+ * so sibling/cousin references to the same (fully-processed) object still
+ * resolve to the cached clone.
+ */ function stripUnserializable(value, cache = new WeakMap(), ancestors = new WeakSet()) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    const t = typeof value;
+    if (t === 'function' || t === 'symbol') {
+        return undefined;
+    }
+    if (t !== 'object') {
+        return value;
+    }
+    const obj = value;
+    if (typeof obj.$$typeof === 'symbol') {
+        return undefined;
+    }
+    if (ancestors.has(obj)) {
+        return undefined;
+    }
+    if (cache.has(obj)) {
+        return cache.get(obj);
+    }
+    if (obj instanceof Date) {
+        return obj;
+    }
+    // RegExp: seroval's SSR bootstrap emits regex literals with broken escape
+    // sequences (e.g. `/!\\[.../` instead of `/!\[.../`), crashing the client
+    // script that populates `window.$_TSR` and preventing hydration. Rich-text
+    // feature transformer regexes aren't needed on the client (they drive
+    // server-side markdown import/export), so strip them here.
+    if (obj instanceof RegExp) {
+        return undefined;
+    }
+    ancestors.add(obj);
+    if (obj instanceof Map) {
+        const cleaned = new Map();
+        cache.set(obj, cleaned);
+        for (const [k, v] of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.set(k, cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (obj instanceof Set) {
+        const cleaned = new Set();
+        cache.set(obj, cleaned);
+        for (const v of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.add(cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (Array.isArray(obj)) {
+        const arr = [];
+        cache.set(obj, arr);
+        for (const item of obj){
+            arr.push(stripUnserializable(item, cache, ancestors));
+        }
+        ancestors.delete(obj);
+        return arr;
+    }
+    if (ArrayBuffer.isView(obj)) {
+        ancestors.delete(obj);
+        return obj;
+    }
+    const result = {};
+    cache.set(obj, result);
+    for (const key of Object.keys(obj)){
+        const v = stripUnserializable(obj[key], cache, ancestors);
+        if (v !== undefined) {
+            result[key] = v;
+        }
+    }
+    ancestors.delete(obj);
+    return result;
+}
+export function toSerializable(value) {
+    return stripUnserializable(value);
+}
+
+//# sourceMappingURL=toSerializable.js.map

package/dist/utilities/toSerializable.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/toSerializable.ts"],"sourcesContent":["/**\n * Recursively strip values that seroval cannot serialize (React elements,\n * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.\n *\n * TanStack Start uses seroval to transfer server function return values to\n * the client.  Payload's `getClientConfig` / `getLayoutData` may include\n * callback functions or RegExp instances that seroval chokes on.  Running\n * the data through this function before returning from a `createServerFn`\n * handler keeps the transfer safe.\n *\n * For server functions whose payloads contain React elements (e.g. the\n * shared `form-state` / `render-list` / `render-document` handlers), use\n * `serializeForRsc` instead — it converts elements into RSC handles rather\n * than stripping them.\n *\n * Uses a WeakMap cache so that shared object references (e.g. the same array\n * referenced by both `doc.hasMany` and `formState.hasMany.value`) are\n * returned correctly instead of being dropped as \"already seen\".\n *\n * A separate `ancestors` WeakSet tracks objects currently being recursed into.\n * If an object is encountered while it is still on the recursion stack, the\n * reference is circular and is replaced with `undefined` to keep the output\n * JSON-safe.  Once recursion completes the object is removed from `ancestors`,\n * so sibling/cousin references to the same (fully-processed) object still\n * resolve to the cached clone.\n */\nfunction stripUnserializable(\n  value: unknown,\n  cache = new WeakMap<object, unknown>(),\n  ancestors = new WeakSet<object>(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  // RegExp: seroval's SSR bootstrap emits regex literals with broken escape\n  // sequences (e.g. `/!\\\\[.../` instead of `/!\\[.../`), crashing the client\n  // script that populates `window.$_TSR` and preventing hydration. Rich-text\n  // feature transformer regexes aren't needed on the client (they drive\n  // server-side markdown import/export), so strip them here.\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n\nexport function toSerializable<T>(value: T): T {\n  return stripUnserializable(value) as T\n}\n"],"names":["stripUnserializable","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","toSerializable"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,SAASA,oBACPC,KAAc,EACdC,QAAQ,IAAIC,SAA0B,EACtCC,YAAY,IAAIC,SAAiB;IAEjC,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,2DAA2D;IAC3D,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAF,UAAUU,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBb,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBpB,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,MAAMiB,MAAiB,EAAE;QACzBvB,MAAMe,GAAG,CAACT,KAAKiB;QACf,KAAK,MAAMC,QAAQlB,IAAK;YACtBiB,IAAIE,IAAI,CAAC3B,oBAAoB0B,MAAMxB,OAAOE;QAC5C;QACAA,UAAUiB,MAAM,CAACb;QACjB,OAAOiB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACrB,MAAM;QAC3BJ,UAAUiB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAMsB,SAAkC,CAAC;IACzC5B,MAAMe,GAAG,CAACT,KAAKsB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACzB,KAAM;QAClC,MAAMW,IAAInB,oBAAoBQ,GAAG,CAACuB,IAAI,EAAE7B,OAAOE;QAC/C,IAAIe,MAAMb,WAAW;YACnBwB,MAAM,CAACC,IAAI,GAAGZ;QAChB;IACF;IACAf,UAAUiB,MAAM,CAACb;IACjB,OAAOsB;AACT;AAEA,OAAO,SAASI,eAAkBjC,KAAQ;IACxC,OAAOD,oBAAoBC;AAC7B"}

package/dist/vite/constants.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Vite-level configuration constants used by `payloadPlugin`. Kept separate so
+ * `plugin.ts` stays focused on wiring.
+ */
+/**
+ * Server-only packages (Node-only or only ever used by the server bundle).
+ * These are the Vite equivalent of Next.js's `serverExternalPackages`.
+ */
+export declare const ssrExternalPackages: string[];
+/**
+ * Payload packages whose source must be processed by Vite even on the server
+ * (because they are workspace `.ts` files in dev). Server-only adapters
+ * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are
+ * intentionally not included — those should stay external on the SSR side.
+ */
+export declare const payloadNoExternalPatterns: Array<RegExp | string>;
+/**
+ * The subset of `payloadNoExternalPatterns` that needs to participate in the
+ * RSC environment. Plugins and storage adapters must be included: they register
+ * custom providers/components (e.g. `plugin-multi-tenant`'s `'use client'`
+ * `TenantSelectionProvider`) that render in the RSC graph via
+ * `RenderServerComponent`. If the package stays external to RSC, `plugin-rsc`
+ * never transforms its `'use client'` modules into client references, so the
+ * component executes server-side and crashes on the first hook
+ * (`Cannot read properties of null (reading 'useState')`).
+ */
+export declare const payloadRscNoExternalPatterns: Array<RegExp | string>;
+/**
+ * Packages we know contain Node-only code or top-level side effects requiring
+ * Node APIs. Excluding them from the client optimizer prevents Vite from
+ * walking into their main entries and trying to bundle server-only imports
+ * for the browser.
+ */
+export declare const optimizeDepsExcludeDefaults: string[];
+/**
+ * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be
+ * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick
+ * these up because their parent packages are in `optimizeDeps.exclude`, so we
+ * list them explicitly using the `parent > child` syntax.
+ */
+export declare const optimizeDepsIncludeDefaults: string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/vite/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/vite/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA0BvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO/D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAsB/C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EA8E/C,CAAA"}

package/dist/vite/constants.js

@@ -0,0 +1,177 @@
+/**
+ * Vite-level configuration constants used by `payloadPlugin`. Kept separate so
+ * `plugin.ts` stays focused on wiring.
+ */ /**
+ * Server-only packages (Node-only or only ever used by the server bundle).
+ * These are the Vite equivalent of Next.js's `serverExternalPackages`.
+ */ export const ssrExternalPackages = [
+    'ajv',
+    'fast-uri',
+    'drizzle-kit',
+    'drizzle-kit/api',
+    'drizzle-orm',
+    'sharp',
+    'libsql',
+    'require-in-the-middle',
+    'json-schema-to-typescript',
+    'pino',
+    'pino-pretty',
+    'graphql',
+    'mongodb',
+    'mongoose',
+    'better-sqlite3',
+    'pg',
+    'pg-native',
+    'nodemailer',
+    'aws4',
+    'pluralize',
+    'console-table-printer',
+    '@azure/storage-blob',
+    '@aws-sdk/client-s3',
+    '@aws-sdk/s3-request-presigner',
+    '@google-cloud/storage'
+];
+/**
+ * Payload packages whose source must be processed by Vite even on the server
+ * (because they are workspace `.ts` files in dev). Server-only adapters
+ * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are
+ * intentionally not included — those should stay external on the SSR side.
+ */ export const payloadNoExternalPatterns = [
+    '@payloadcms/ui',
+    '@payloadcms/translations',
+    '@payloadcms/tanstack-start',
+    /^@payloadcms\/richtext-lexical/,
+    /^@payloadcms\/plugin-/,
+    /^@payloadcms\/storage-/
+];
+/**
+ * The subset of `payloadNoExternalPatterns` that needs to participate in the
+ * RSC environment. Plugins and storage adapters must be included: they register
+ * custom providers/components (e.g. `plugin-multi-tenant`'s `'use client'`
+ * `TenantSelectionProvider`) that render in the RSC graph via
+ * `RenderServerComponent`. If the package stays external to RSC, `plugin-rsc`
+ * never transforms its `'use client'` modules into client references, so the
+ * component executes server-side and crashes on the first hook
+ * (`Cannot read properties of null (reading 'useState')`).
+ */ export const payloadRscNoExternalPatterns = [
+    '@payloadcms/ui',
+    '@payloadcms/translations',
+    '@payloadcms/tanstack-start',
+    /^@payloadcms\/richtext-lexical/,
+    /^@payloadcms\/plugin-/,
+    /^@payloadcms\/storage-/
+];
+/**
+ * Packages we know contain Node-only code or top-level side effects requiring
+ * Node APIs. Excluding them from the client optimizer prevents Vite from
+ * walking into their main entries and trying to bundle server-only imports
+ * for the browser.
+ */ export const optimizeDepsExcludeDefaults = [
+    'sharp',
+    '@payloadcms/ui',
+    '@payloadcms/tanstack-start',
+    'payload',
+    'pino',
+    'pino-pretty',
+    'busboy',
+    'get-tsconfig',
+    'ws',
+    'croner',
+    'prompts',
+    'file-type',
+    // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite
+    // sometimes walks these from the main package entry while scanning
+    // workspace deps, and the browser sub-bundles do not expose the
+    // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev
+    // server with a `MISSING_EXPORT` error before any test runs.
+    '@azure/storage-blob',
+    '@aws-sdk/client-s3',
+    '@aws-sdk/s3-request-presigner',
+    '@google-cloud/storage'
+];
+/**
+ * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be
+ * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick
+ * these up because their parent packages are in `optimizeDeps.exclude`, so we
+ * list them explicitly using the `parent > child` syntax.
+ */ export const optimizeDepsIncludeDefaults = [
+    '@payloadcms/ui > sonner',
+    '@payloadcms/ui > @faceless-ui/modal',
+    '@payloadcms/ui > @faceless-ui/window-info',
+    '@payloadcms/ui > @faceless-ui/scroll-info',
+    '@payloadcms/ui > @dnd-kit/core',
+    '@payloadcms/ui > @dnd-kit/sortable',
+    '@payloadcms/ui > @dnd-kit/utilities',
+    '@payloadcms/ui > react-datepicker',
+    '@payloadcms/ui > react-select',
+    '@payloadcms/ui > react-select/creatable',
+    '@payloadcms/ui > react-image-crop',
+    '@payloadcms/ui > @monaco-editor/react',
+    '@payloadcms/ui > date-fns',
+    '@payloadcms/ui > date-fns/transpose',
+    '@payloadcms/ui > @date-fns/tz/date/mini',
+    '@payloadcms/ui > uuid',
+    '@payloadcms/ui > use-context-selector',
+    '@payloadcms/ui > bson-objectid',
+    '@payloadcms/ui > dequal',
+    '@payloadcms/ui > object-to-formdata',
+    '@payloadcms/ui > md5',
+    'payload > deepmerge',
+    'payload > pluralize',
+    // `scheduler` is a transitive dep of `react-dom`, not a direct dependency of
+    // the app, so a bare `'scheduler'` specifier fails to resolve from an isolated
+    // install (`test/node_modules` built with `pnpm i --ignore-workspace`), where
+    // it isn't hoisted to the top level. Path it through `react-dom` so the
+    // optimizer resolves the exact copy the runtime loads.
+    'react-dom > scheduler',
+    // `@payloadcms/ui` (in `optimizeDeps.exclude`) ships compiled output that the
+    // React Compiler rewrote to `import { c } from 'react/compiler-runtime'`.
+    // Because its parent is excluded, the optimizer never crawls in to discover
+    // this entry, so Vite serves `react/compiler-runtime` raw. That file is
+    // CommonJS (`module.exports = require(...)`), so the named `c` export can't be
+    // statically extracted and every client component throws "does not provide an
+    // export named 'c'". Pre-bundling it lets esbuild synthesize the named export.
+    'react/compiler-runtime',
+    // Transitive deps that Vite otherwise discovers *after* the initial crawl
+    // (react-select pulls in @floating-ui at runtime; react-is is reached via
+    // react-transition-group/prop-types; the default date-fns locale is loaded
+    // through a dynamic `date-fns/locale/${key}` import). A late discovery forces
+    // a full dep re-optimization mid-session, which 404s every in-flight
+    // `.vite/deps/*` chunk ("Pre-transform error: file does not exist in the
+    // optimize deps directory") and breaks the admin UI in CI cold starts.
+    // Pre-bundling them keeps the first optimization pass complete.
+    '@payloadcms/ui > react-select > @floating-ui/dom',
+    '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',
+    '@payloadcms/ui > react-select > prop-types > react-is',
+    '@payloadcms/ui > date-fns/locale/en-US',
+    // Further late discoveries observed re-optimizing mid-run in CI cold starts
+    // (see CI logs: "✨ new dependencies optimized: @dnd-kit/modifiers / ajv /
+    // dequal/lite"). The modular dashboard pulls in `@dnd-kit/modifiers` on first
+    // render; form-state diffing reaches `dequal/lite` (a distinct entry point
+    // from the already-listed `dequal`); client-side field validation reaches
+    // `ajv` *through `payload`* — it is `ssrExternal` server-side but still
+    // bundled into the client, and must be pathed via `payload` so the optimizer
+    // pre-bundles the exact copy the runtime loads.
+    '@payloadcms/ui > @dnd-kit/modifiers',
+    '@payloadcms/ui > dequal/lite',
+    'payload > ajv',
+    // The storage client-upload suites (esp. vercel-blob) crawl part of the
+    // `payload` server runtime into the client bundle and discover these late,
+    // triggering several "optimized dependencies changed. reloading" waves that
+    // reload the page mid-test (the bulk-upload drawer's Create New button /
+    // dropzone vanish and the direct-to-bucket PUT never fires). Pre-bundle the
+    // whole observed set so the first pass is complete.
+    'payload > undici',
+    'payload > jose',
+    'payload > dataloader',
+    'payload > path-to-regexp',
+    'payload > console-table-printer',
+    'payload > ci-info',
+    'payload > image-size',
+    'payload > image-size/fromFile',
+    'payload > ipaddr.js',
+    'payload > range-parser',
+    'payload > sanitize-filename'
+];
+
+//# sourceMappingURL=constants.js.map

package/dist/vite/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/vite/constants.ts"],"sourcesContent":["/**\n * Vite-level configuration constants used by `payloadPlugin`. Kept separate so\n * `plugin.ts` stays focused on wiring.\n */\n\n/**\n * Server-only packages (Node-only or only ever used by the server bundle).\n * These are the Vite equivalent of Next.js's `serverExternalPackages`.\n */\nexport const ssrExternalPackages: string[] = [\n  'ajv',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'libsql',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'mongodb',\n  'mongoose',\n  'better-sqlite3',\n  'pg',\n  'pg-native',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n]\n\n/**\n * Payload packages whose source must be processed by Vite even on the server\n * (because they are workspace `.ts` files in dev). Server-only adapters\n * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are\n * intentionally not included — those should stay external on the SSR side.\n */\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n\n/**\n * The subset of `payloadNoExternalPatterns` that needs to participate in the\n * RSC environment. Plugins and storage adapters must be included: they register\n * custom providers/components (e.g. `plugin-multi-tenant`'s `'use client'`\n * `TenantSelectionProvider`) that render in the RSC graph via\n * `RenderServerComponent`. If the package stays external to RSC, `plugin-rsc`\n * never transforms its `'use client'` modules into client references, so the\n * component executes server-side and crashes on the first hook\n * (`Cannot read properties of null (reading 'useState')`).\n */\nexport const payloadRscNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n\n/**\n * Packages we know contain Node-only code or top-level side effects requiring\n * Node APIs. Excluding them from the client optimizer prevents Vite from\n * walking into their main entries and trying to bundle server-only imports\n * for the browser.\n */\nexport const optimizeDepsExcludeDefaults: string[] = [\n  'sharp',\n  '@payloadcms/ui',\n  '@payloadcms/tanstack-start',\n  'payload',\n  'pino',\n  'pino-pretty',\n  'busboy',\n  'get-tsconfig',\n  'ws',\n  'croner',\n  'prompts',\n  'file-type',\n  // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite\n  // sometimes walks these from the main package entry while scanning\n  // workspace deps, and the browser sub-bundles do not expose the\n  // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev\n  // server with a `MISSING_EXPORT` error before any test runs.\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n]\n\n/**\n * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be\n * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick\n * these up because their parent packages are in `optimizeDeps.exclude`, so we\n * list them explicitly using the `parent > child` syntax.\n */\nexport const optimizeDepsIncludeDefaults: string[] = [\n  '@payloadcms/ui > sonner',\n  '@payloadcms/ui > @faceless-ui/modal',\n  '@payloadcms/ui > @faceless-ui/window-info',\n  '@payloadcms/ui > @faceless-ui/scroll-info',\n  '@payloadcms/ui > @dnd-kit/core',\n  '@payloadcms/ui > @dnd-kit/sortable',\n  '@payloadcms/ui > @dnd-kit/utilities',\n  '@payloadcms/ui > react-datepicker',\n  '@payloadcms/ui > react-select',\n  '@payloadcms/ui > react-select/creatable',\n  '@payloadcms/ui > react-image-crop',\n  '@payloadcms/ui > @monaco-editor/react',\n  '@payloadcms/ui > date-fns',\n  '@payloadcms/ui > date-fns/transpose',\n  '@payloadcms/ui > @date-fns/tz/date/mini',\n  '@payloadcms/ui > uuid',\n  '@payloadcms/ui > use-context-selector',\n  '@payloadcms/ui > bson-objectid',\n  '@payloadcms/ui > dequal',\n  '@payloadcms/ui > object-to-formdata',\n  '@payloadcms/ui > md5',\n  'payload > deepmerge',\n  'payload > pluralize',\n  // `scheduler` is a transitive dep of `react-dom`, not a direct dependency of\n  // the app, so a bare `'scheduler'` specifier fails to resolve from an isolated\n  // install (`test/node_modules` built with `pnpm i --ignore-workspace`), where\n  // it isn't hoisted to the top level. Path it through `react-dom` so the\n  // optimizer resolves the exact copy the runtime loads.\n  'react-dom > scheduler',\n  // `@payloadcms/ui` (in `optimizeDeps.exclude`) ships compiled output that the\n  // React Compiler rewrote to `import { c } from 'react/compiler-runtime'`.\n  // Because its parent is excluded, the optimizer never crawls in to discover\n  // this entry, so Vite serves `react/compiler-runtime` raw. That file is\n  // CommonJS (`module.exports = require(...)`), so the named `c` export can't be\n  // statically extracted and every client component throws \"does not provide an\n  // export named 'c'\". Pre-bundling it lets esbuild synthesize the named export.\n  'react/compiler-runtime',\n  // Transitive deps that Vite otherwise discovers *after* the initial crawl\n  // (react-select pulls in @floating-ui at runtime; react-is is reached via\n  // react-transition-group/prop-types; the default date-fns locale is loaded\n  // through a dynamic `date-fns/locale/${key}` import). A late discovery forces\n  // a full dep re-optimization mid-session, which 404s every in-flight\n  // `.vite/deps/*` chunk (\"Pre-transform error: file does not exist in the\n  // optimize deps directory\") and breaks the admin UI in CI cold starts.\n  // Pre-bundling them keeps the first optimization pass complete.\n  '@payloadcms/ui > react-select > @floating-ui/dom',\n  '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',\n  '@payloadcms/ui > react-select > prop-types > react-is',\n  '@payloadcms/ui > date-fns/locale/en-US',\n  // Further late discoveries observed re-optimizing mid-run in CI cold starts\n  // (see CI logs: \"✨ new dependencies optimized: @dnd-kit/modifiers / ajv /\n  // dequal/lite\"). The modular dashboard pulls in `@dnd-kit/modifiers` on first\n  // render; form-state diffing reaches `dequal/lite` (a distinct entry point\n  // from the already-listed `dequal`); client-side field validation reaches\n  // `ajv` *through `payload`* — it is `ssrExternal` server-side but still\n  // bundled into the client, and must be pathed via `payload` so the optimizer\n  // pre-bundles the exact copy the runtime loads.\n  '@payloadcms/ui > @dnd-kit/modifiers',\n  '@payloadcms/ui > dequal/lite',\n  'payload > ajv',\n  // The storage client-upload suites (esp. vercel-blob) crawl part of the\n  // `payload` server runtime into the client bundle and discover these late,\n  // triggering several \"optimized dependencies changed. reloading\" waves that\n  // reload the page mid-test (the bulk-upload drawer's Create New button /\n  // dropzone vanish and the direct-to-bucket PUT never fires). Pre-bundle the\n  // whole observed set so the first pass is complete.\n  'payload > undici',\n  'payload > jose',\n  'payload > dataloader',\n  'payload > path-to-regexp',\n  'payload > console-table-printer',\n  'payload > ci-info',\n  'payload > image-size',\n  'payload > image-size/fromFile',\n  'payload > ipaddr.js',\n  'payload > range-parser',\n  'payload > sanitize-filename',\n]\n"],"names":["ssrExternalPackages","payloadNoExternalPatterns","payloadRscNoExternalPatterns","optimizeDepsExcludeDefaults","optimizeDepsIncludeDefaults"],"mappings":"AAAA;;;CAGC,GAED;;;CAGC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;CASC,GACD,OAAO,MAAMC,+BAAuD;IAClE;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,sEAAsE;IACtE,6DAA6D;IAC7D;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,uDAAuD;IACvD;IACA,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E;IACA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD;IACA;IACA;IACA,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,oDAAoD;IACpD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/dist/vite/importProtection.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Specifiers that must never appear in the client module graph. These are the
+ * server-only Payload entry points plus Node.js built-ins and a handful of
+ * Node-only npm packages that Payload pulls in transitively.
+ */
+export declare const serverOnlyClientSpecifiers: Array<RegExp | string>;
+/**
+ * Allowlist callback for the `tanstackStart` plugin's import-protection. These
+ * are the legitimate cross-environment imports in our monorepo that we want
+ * to permit even when they appear to cross a server/client boundary.
+ */
+export declare function onImportProtectionViolation(violation: unknown): boolean | void;
+export declare const defaultImportProtectionIgnoreImporters: RegExp[];
+//# sourceMappingURL=importProtection.d.ts.map

package/dist/vite/importProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importProtection.d.ts","sourceRoot":"","sources":["../../src/vite/importProtection.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAoB7D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAoC9E;AAED,eAAO,MAAM,sCAAsC,EAAE,MAAM,EAAsC,CAAA"}