@payloadcms/tanstack-start 4.0.0-internal.183b315

package/dist/utilities/serverAdapter.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverAdapter.server.d.ts","sourceRoot":"","sources":["../../src/utilities/serverAdapter.server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAA8B,aAAa,EAAE,MAAM,SAAS,CAAA;AAsDxE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,aA8CnC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,UAAU,GAAG,UAAU,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,6BAA6B,GAAI,KAAK,aAAa,KAAG,aAgBjE,CAAA"}

package/dist/utilities/serverAdapter.server.js

@@ -0,0 +1,130 @@
+import { notFound, redirect } from '@tanstack/react-router';
+import { getRequest, setResponseHeader } from '@tanstack/react-start/server';
+import { parseCookies } from 'payload';
+function buildCookieStore(headers) {
+    const cookies = parseCookies(headers);
+    return {
+        get: (name)=>{
+            const value = cookies.get(name);
+            return value !== undefined ? {
+                name,
+                value
+            } : undefined;
+        },
+        getAll: ()=>{
+            return Array.from(cookies.entries()).map(([name, value])=>({
+                    name,
+                    value
+                }));
+        }
+    };
+}
+function serializeCookie(name, value, options) {
+    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+    if (options?.path) {
+        cookie += `; Path=${options.path}`;
+    }
+    if (options?.domain) {
+        cookie += `; Domain=${options.domain}`;
+    }
+    if (options?.maxAge !== undefined) {
+        cookie += `; Max-Age=${options.maxAge}`;
+    }
+    if (options?.expires) {
+        cookie += `; Expires=${options.expires.toUTCString()}`;
+    }
+    if (options?.httpOnly) {
+        cookie += '; HttpOnly';
+    }
+    if (options?.secure) {
+        cookie += '; Secure';
+    }
+    if (options?.sameSite) {
+        cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`;
+    }
+    return cookie;
+}
+/**
+ * Server-side adapter for TanStack Start.
+ * Uses `@tanstack/react-start/server` utilities for request/response handling.
+ */ export const tanstackServerAdapter = {
+    getCookies: ()=>{
+        const request = getRequest();
+        const headers = new Headers(request.headers);
+        return buildCookieStore(headers);
+    },
+    getHeaders: ()=>{
+        const request = getRequest();
+        return new Headers(request.headers);
+    },
+    notFound: ()=>{
+        // TanStack Router requires throwing the notFound() result directly
+        // eslint-disable-next-line @typescript-eslint/only-throw-error
+        throw notFound();
+    },
+    redirect: (path)=>{
+        // TanStack Router requires throwing the redirect() result directly
+        // eslint-disable-next-line @typescript-eslint/only-throw-error
+        throw redirect({
+            to: path
+        });
+    },
+    permanentRedirect: (path)=>{
+        // TanStack Router does not have a separate permanent redirect primitive;
+        // fall back to a regular redirect so existing behavior is preserved.
+        // eslint-disable-next-line @typescript-eslint/only-throw-error
+        throw redirect({
+            to: path
+        });
+    },
+    forbidden: ()=>{
+        // TanStack Router does not have a dedicated forbidden() helper; surface
+        // a generic error so the request boundary still terminates the request.
+        throw new Error('Forbidden');
+    },
+    unauthorized: ()=>{
+        // TanStack Router does not have a dedicated unauthorized() helper; surface
+        // a generic error so the request boundary still terminates the request.
+        throw new Error('Unauthorized');
+    },
+    setCookie: (name, value, options)=>{
+        setResponseHeader('Set-Cookie', serializeCookie(name, value, options));
+    }
+};
+/**
+ * Builds the `ServerAdapter` for the admin page render (`renderRoot`). Like
+ * `tanstackServerAdapter` for cookies/headers, but navigation **records the
+ * intent on `nav` and throws** the framework-agnostic string error-contract
+ * (`Error('not-found')` / `Error('redirect:<url>')`) instead of TanStack's
+ * native `notFound`/`redirect`.
+ *
+ * `renderRoot` navigates via `req.server.*` in two places:
+ * - during orchestration (e.g. the unauthenticated login redirect) — the throw
+ *   propagates out of `renderRoot` and is caught by the loader's try/catch;
+ * - deep inside streamed view components (e.g. `DocumentView` access checks,
+ *   `LoginView` already-authenticated) — here the throw happens during
+ *   `renderServerComponent` and is swallowed into the RSC stream, so it never
+ *   rejects the render promise.
+ *
+ * Recording the intent on `nav` lets the loader honor the second case by
+ * inspecting `nav` after the render resolves, then re-throwing native TanStack
+ * nav at the loader boundary.
+ */ export const createPageRenderServerAdapter = (nav)=>({
+        ...tanstackServerAdapter,
+        notFound: ()=>{
+            nav.type = 'notFound';
+            throw new Error('not-found');
+        },
+        permanentRedirect: (path)=>{
+            nav.type = 'redirect';
+            nav.url = path;
+            throw new Error(`redirect:${path}`);
+        },
+        redirect: (path)=>{
+            nav.type = 'redirect';
+            nav.url = path;
+            throw new Error(`redirect:${path}`);
+        }
+    });
+
+//# sourceMappingURL=serverAdapter.server.js.map

package/dist/utilities/serverAdapter.server.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/serverAdapter.server.ts"],"sourcesContent":["import type { CookieOptions, CookieStore, ServerAdapter } from 'payload'\n\nimport { notFound, redirect } from '@tanstack/react-router'\nimport { getRequest, setResponseHeader } from '@tanstack/react-start/server'\nimport { parseCookies } from 'payload'\n\nfunction buildCookieStore(headers: Headers): CookieStore {\n  const cookies = parseCookies(headers)\n\n  return {\n    get: (name: string) => {\n      const value = cookies.get(name)\n      return value !== undefined ? { name, value } : undefined\n    },\n    getAll: () => {\n      return Array.from(cookies.entries()).map(([name, value]) => ({ name, value }))\n    },\n  }\n}\n\nfunction serializeCookie(name: string, value: string, options?: CookieOptions): string {\n  let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`\n\n  if (options?.path) {\n    cookie += `; Path=${options.path}`\n  }\n\n  if (options?.domain) {\n    cookie += `; Domain=${options.domain}`\n  }\n\n  if (options?.maxAge !== undefined) {\n    cookie += `; Max-Age=${options.maxAge}`\n  }\n\n  if (options?.expires) {\n    cookie += `; Expires=${options.expires.toUTCString()}`\n  }\n\n  if (options?.httpOnly) {\n    cookie += '; HttpOnly'\n  }\n\n  if (options?.secure) {\n    cookie += '; Secure'\n  }\n\n  if (options?.sameSite) {\n    cookie += `; SameSite=${options.sameSite.charAt(0).toUpperCase() + options.sameSite.slice(1)}`\n  }\n\n  return cookie\n}\n\n/**\n * Server-side adapter for TanStack Start.\n * Uses `@tanstack/react-start/server` utilities for request/response handling.\n */\nexport const tanstackServerAdapter: ServerAdapter = {\n  getCookies: () => {\n    const request = getRequest()\n    const headers = new Headers(request.headers)\n    return buildCookieStore(headers)\n  },\n\n  getHeaders: () => {\n    const request = getRequest()\n    return new Headers(request.headers)\n  },\n\n  notFound: () => {\n    // TanStack Router requires throwing the notFound() result directly\n    // eslint-disable-next-line @typescript-eslint/only-throw-error\n    throw notFound()\n  },\n\n  redirect: (path: string) => {\n    // TanStack Router requires throwing the redirect() result directly\n    // eslint-disable-next-line @typescript-eslint/only-throw-error\n    throw redirect({ to: path })\n  },\n\n  permanentRedirect: (path: string) => {\n    // TanStack Router does not have a separate permanent redirect primitive;\n    // fall back to a regular redirect so existing behavior is preserved.\n    // eslint-disable-next-line @typescript-eslint/only-throw-error\n    throw redirect({ to: path })\n  },\n\n  forbidden: () => {\n    // TanStack Router does not have a dedicated forbidden() helper; surface\n    // a generic error so the request boundary still terminates the request.\n    throw new Error('Forbidden')\n  },\n\n  unauthorized: () => {\n    // TanStack Router does not have a dedicated unauthorized() helper; surface\n    // a generic error so the request boundary still terminates the request.\n    throw new Error('Unauthorized')\n  },\n\n  setCookie: (name: string, value: string, options?: CookieOptions) => {\n    setResponseHeader('Set-Cookie', serializeCookie(name, value, options))\n  },\n}\n\n/**\n * Navigation requested during an admin page render, recorded by\n * `createPageRenderServerAdapter`. The admin-page server function reads this\n * after `renderServerComponent` resolves.\n */\nexport type PageNavIntent = {\n  type?: 'notFound' | 'redirect'\n  url?: string\n}\n\n/**\n * Builds the `ServerAdapter` for the admin page render (`renderRoot`). Like\n * `tanstackServerAdapter` for cookies/headers, but navigation **records the\n * intent on `nav` and throws** the framework-agnostic string error-contract\n * (`Error('not-found')` / `Error('redirect:<url>')`) instead of TanStack's\n * native `notFound`/`redirect`.\n *\n * `renderRoot` navigates via `req.server.*` in two places:\n * - during orchestration (e.g. the unauthenticated login redirect) — the throw\n *   propagates out of `renderRoot` and is caught by the loader's try/catch;\n * - deep inside streamed view components (e.g. `DocumentView` access checks,\n *   `LoginView` already-authenticated) — here the throw happens during\n *   `renderServerComponent` and is swallowed into the RSC stream, so it never\n *   rejects the render promise.\n *\n * Recording the intent on `nav` lets the loader honor the second case by\n * inspecting `nav` after the render resolves, then re-throwing native TanStack\n * nav at the loader boundary.\n */\nexport const createPageRenderServerAdapter = (nav: PageNavIntent): ServerAdapter => ({\n  ...tanstackServerAdapter,\n  notFound: () => {\n    nav.type = 'notFound'\n    throw new Error('not-found')\n  },\n  permanentRedirect: (path: string) => {\n    nav.type = 'redirect'\n    nav.url = path\n    throw new Error(`redirect:${path}`)\n  },\n  redirect: (path: string) => {\n    nav.type = 'redirect'\n    nav.url = path\n    throw new Error(`redirect:${path}`)\n  },\n})\n"],"names":["notFound","redirect","getRequest","setResponseHeader","parseCookies","buildCookieStore","headers","cookies","get","name","value","undefined","getAll","Array","from","entries","map","serializeCookie","options","cookie","encodeURIComponent","path","domain","maxAge","expires","toUTCString","httpOnly","secure","sameSite","charAt","toUpperCase","slice","tanstackServerAdapter","getCookies","request","Headers","getHeaders","to","permanentRedirect","forbidden","Error","unauthorized","setCookie","createPageRenderServerAdapter","nav","type","url"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,QAAQ,QAAQ,yBAAwB;AAC3D,SAASC,UAAU,EAAEC,iBAAiB,QAAQ,+BAA8B;AAC5E,SAASC,YAAY,QAAQ,UAAS;AAEtC,SAASC,iBAAiBC,OAAgB;IACxC,MAAMC,UAAUH,aAAaE;IAE7B,OAAO;QACLE,KAAK,CAACC;YACJ,MAAMC,QAAQH,QAAQC,GAAG,CAACC;YAC1B,OAAOC,UAAUC,YAAY;gBAAEF;gBAAMC;YAAM,IAAIC;QACjD;QACAC,QAAQ;YACN,OAAOC,MAAMC,IAAI,CAACP,QAAQQ,OAAO,IAAIC,GAAG,CAAC,CAAC,CAACP,MAAMC,MAAM,GAAM,CAAA;oBAAED;oBAAMC;gBAAM,CAAA;QAC7E;IACF;AACF;AAEA,SAASO,gBAAgBR,IAAY,EAAEC,KAAa,EAAEQ,OAAuB;IAC3E,IAAIC,SAAS,GAAGC,mBAAmBX,MAAM,CAAC,EAAEW,mBAAmBV,QAAQ;IAEvE,IAAIQ,SAASG,MAAM;QACjBF,UAAU,CAAC,OAAO,EAAED,QAAQG,IAAI,EAAE;IACpC;IAEA,IAAIH,SAASI,QAAQ;QACnBH,UAAU,CAAC,SAAS,EAAED,QAAQI,MAAM,EAAE;IACxC;IAEA,IAAIJ,SAASK,WAAWZ,WAAW;QACjCQ,UAAU,CAAC,UAAU,EAAED,QAAQK,MAAM,EAAE;IACzC;IAEA,IAAIL,SAASM,SAAS;QACpBL,UAAU,CAAC,UAAU,EAAED,QAAQM,OAAO,CAACC,WAAW,IAAI;IACxD;IAEA,IAAIP,SAASQ,UAAU;QACrBP,UAAU;IACZ;IAEA,IAAID,SAASS,QAAQ;QACnBR,UAAU;IACZ;IAEA,IAAID,SAASU,UAAU;QACrBT,UAAU,CAAC,WAAW,EAAED,QAAQU,QAAQ,CAACC,MAAM,CAAC,GAAGC,WAAW,KAAKZ,QAAQU,QAAQ,CAACG,KAAK,CAAC,IAAI;IAChG;IAEA,OAAOZ;AACT;AAEA;;;CAGC,GACD,OAAO,MAAMa,wBAAuC;IAClDC,YAAY;QACV,MAAMC,UAAUhC;QAChB,MAAMI,UAAU,IAAI6B,QAAQD,QAAQ5B,OAAO;QAC3C,OAAOD,iBAAiBC;IAC1B;IAEA8B,YAAY;QACV,MAAMF,UAAUhC;QAChB,OAAO,IAAIiC,QAAQD,QAAQ5B,OAAO;IACpC;IAEAN,UAAU;QACR,mEAAmE;QACnE,+DAA+D;QAC/D,MAAMA;IACR;IAEAC,UAAU,CAACoB;QACT,mEAAmE;QACnE,+DAA+D;QAC/D,MAAMpB,SAAS;YAAEoC,IAAIhB;QAAK;IAC5B;IAEAiB,mBAAmB,CAACjB;QAClB,yEAAyE;QACzE,qEAAqE;QACrE,+DAA+D;QAC/D,MAAMpB,SAAS;YAAEoC,IAAIhB;QAAK;IAC5B;IAEAkB,WAAW;QACT,wEAAwE;QACxE,wEAAwE;QACxE,MAAM,IAAIC,MAAM;IAClB;IAEAC,cAAc;QACZ,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,IAAID,MAAM;IAClB;IAEAE,WAAW,CAACjC,MAAcC,OAAeQ;QACvCf,kBAAkB,cAAcc,gBAAgBR,MAAMC,OAAOQ;IAC/D;AACF,EAAC;AAYD;;;;;;;;;;;;;;;;;;CAkBC,GACD,OAAO,MAAMyB,gCAAgC,CAACC,MAAuC,CAAA;QACnF,GAAGZ,qBAAqB;QACxBhC,UAAU;YACR4C,IAAIC,IAAI,GAAG;YACX,MAAM,IAAIL,MAAM;QAClB;QACAF,mBAAmB,CAACjB;YAClBuB,IAAIC,IAAI,GAAG;YACXD,IAAIE,GAAG,GAAGzB;YACV,MAAM,IAAImB,MAAM,CAAC,SAAS,EAAEnB,MAAM;QACpC;QACApB,UAAU,CAACoB;YACTuB,IAAIC,IAAI,GAAG;YACXD,IAAIE,GAAG,GAAGzB;YACV,MAAM,IAAImB,MAAM,CAAC,SAAS,EAAEnB,MAAM;QACpC;IACF,CAAA,EAAE"}

package/dist/utilities/serverFunctionHandlers.d.ts

@@ -0,0 +1,18 @@
+import type { ServerFunction } from 'payload';
+/**
+ * Framework-agnostic server-function handlers the TanStack Start dispatcher
+ * registers to reach parity with the Next.js adapter
+ * (`packages/next/src/utilities/handleServerFunctions.ts`).
+ */
+type SwitchLanguageArgs = {
+    lang: string;
+};
+/**
+ * Dispatched from `TranslationProvider` when the user switches the admin
+ * language. Writes the `<cookiePrefix>-lng` cookie via the request's
+ * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by
+ * the provider's `router.refresh()` — reads the new language.
+ */
+export declare const switchLanguageHandler: ServerFunction<SwitchLanguageArgs, Promise<void>>;
+export {};
+//# sourceMappingURL=serverFunctionHandlers.d.ts.map

package/dist/utilities/serverFunctionHandlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverFunctionHandlers.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionHandlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C;;;;GAIG;AAEH,KAAK,kBAAkB,GAAG;IACxB,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,CAcnF,CAAA"}

package/dist/utilities/serverFunctionHandlers.js

@@ -0,0 +1,17 @@
+/**
+ * Dispatched from `TranslationProvider` when the user switches the admin
+ * language. Writes the `<cookiePrefix>-lng` cookie via the request's
+ * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by
+ * the provider's `router.refresh()` — reads the new language.
+ */ export const switchLanguageHandler = async ({ lang, req })=>{
+    if (!req.server) {
+        throw new Error('switch-language requires a ServerAdapter on the request');
+    }
+    const cookieName = `${req.payload.config.cookiePrefix || 'payload'}-lng`;
+    await req.server.setCookie(cookieName, lang, {
+        maxAge: 60 * 60 * 24 * 365,
+        path: '/'
+    });
+};
+
+//# sourceMappingURL=serverFunctionHandlers.js.map

package/dist/utilities/serverFunctionHandlers.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/serverFunctionHandlers.ts"],"sourcesContent":["import type { ServerFunction } from 'payload'\n\n/**\n * Framework-agnostic server-function handlers the TanStack Start dispatcher\n * registers to reach parity with the Next.js adapter\n * (`packages/next/src/utilities/handleServerFunctions.ts`).\n */\n\ntype SwitchLanguageArgs = {\n  lang: string\n}\n\n/**\n * Dispatched from `TranslationProvider` when the user switches the admin\n * language. Writes the `<cookiePrefix>-lng` cookie via the request's\n * `ServerAdapter` (wired up in `initReq`) so the next render — triggered by\n * the provider's `router.refresh()` — reads the new language.\n */\nexport const switchLanguageHandler: ServerFunction<SwitchLanguageArgs, Promise<void>> = async ({\n  lang,\n  req,\n}) => {\n  if (!req.server) {\n    throw new Error('switch-language requires a ServerAdapter on the request')\n  }\n\n  const cookieName = `${req.payload.config.cookiePrefix || 'payload'}-lng`\n\n  await req.server.setCookie(cookieName, lang, {\n    maxAge: 60 * 60 * 24 * 365,\n    path: '/',\n  })\n}\n"],"names":["switchLanguageHandler","lang","req","server","Error","cookieName","payload","config","cookiePrefix","setCookie","maxAge","path"],"mappings":"AAYA;;;;;CAKC,GACD,OAAO,MAAMA,wBAA2E,OAAO,EAC7FC,IAAI,EACJC,GAAG,EACJ;IACC,IAAI,CAACA,IAAIC,MAAM,EAAE;QACf,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,aAAa,GAAGH,IAAII,OAAO,CAACC,MAAM,CAACC,YAAY,IAAI,UAAU,IAAI,CAAC;IAExE,MAAMN,IAAIC,MAAM,CAACM,SAAS,CAACJ,YAAYJ,MAAM;QAC3CS,QAAQ,KAAK,KAAK,KAAK;QACvBC,MAAM;IACR;AACF,EAAC"}

package/dist/utilities/setPayloadAuthCookie.d.ts

@@ -0,0 +1,9 @@
+import type { Auth } from 'payload';
+type SetPayloadAuthCookieArgs = {
+    authConfig: Auth;
+    cookiePrefix: string;
+    token: string;
+};
+export declare function setPayloadAuthCookie({ authConfig, cookiePrefix, token, }: SetPayloadAuthCookieArgs): void;
+export {};
+//# sourceMappingURL=setPayloadAuthCookie.d.ts.map

package/dist/utilities/setPayloadAuthCookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setPayloadAuthCookie.d.ts","sourceRoot":"","sources":["../../src/utilities/setPayloadAuthCookie.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAA;AAKnC,KAAK,wBAAwB,GAAG;IAC9B,UAAU,EAAE,IAAI,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,wBAAgB,oBAAoB,CAAC,EACnC,UAAU,EACV,YAAY,EACZ,KAAK,GACN,EAAE,wBAAwB,GAAG,IAAI,CAoCjC"}

package/dist/utilities/setPayloadAuthCookie.js

@@ -0,0 +1,31 @@
+import { setResponseHeader } from '@tanstack/react-start/server';
+import { generatePayloadCookie } from 'payload';
+export function setPayloadAuthCookie({ authConfig, cookiePrefix, token }) {
+    const cookieExpiration = authConfig.tokenExpiration ? new Date(Date.now() + authConfig.tokenExpiration) : undefined;
+    const payloadCookie = generatePayloadCookie({
+        collectionAuthConfig: authConfig,
+        cookiePrefix,
+        expires: cookieExpiration,
+        returnCookieAsObject: true,
+        token
+    });
+    if (payloadCookie.value) {
+        const sameSite = typeof authConfig.cookies.sameSite === 'string' ? authConfig.cookies.sameSite : 'Lax';
+        let cookie = `${encodeURIComponent(payloadCookie.name)}=${encodeURIComponent(payloadCookie.value)}`;
+        cookie += '; HttpOnly';
+        cookie += `; SameSite=${sameSite}`;
+        cookie += '; Path=/';
+        if (authConfig.cookies.secure) {
+            cookie += '; Secure';
+        }
+        if (authConfig.cookies.domain) {
+            cookie += `; Domain=${authConfig.cookies.domain}`;
+        }
+        if (payloadCookie.expires) {
+            cookie += `; Expires=${new Date(payloadCookie.expires).toUTCString()}`;
+        }
+        setResponseHeader('Set-Cookie', cookie);
+    }
+}
+
+//# sourceMappingURL=setPayloadAuthCookie.js.map

package/dist/utilities/setPayloadAuthCookie.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/setPayloadAuthCookie.ts"],"sourcesContent":["import type { Auth } from 'payload'\n\nimport { setResponseHeader } from '@tanstack/react-start/server'\nimport { generatePayloadCookie } from 'payload'\n\ntype SetPayloadAuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  token: string\n}\n\nexport function setPayloadAuthCookie({\n  authConfig,\n  cookiePrefix,\n  token,\n}: SetPayloadAuthCookieArgs): void {\n  const cookieExpiration = authConfig.tokenExpiration\n    ? new Date(Date.now() + authConfig.tokenExpiration)\n    : undefined\n\n  const payloadCookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    expires: cookieExpiration,\n    returnCookieAsObject: true,\n    token,\n  })\n\n  if (payloadCookie.value) {\n    const sameSite =\n      typeof authConfig.cookies.sameSite === 'string' ? authConfig.cookies.sameSite : 'Lax'\n\n    let cookie = `${encodeURIComponent(payloadCookie.name)}=${encodeURIComponent(payloadCookie.value)}`\n    cookie += '; HttpOnly'\n    cookie += `; SameSite=${sameSite}`\n    cookie += '; Path=/'\n\n    if (authConfig.cookies.secure) {\n      cookie += '; Secure'\n    }\n\n    if (authConfig.cookies.domain) {\n      cookie += `; Domain=${authConfig.cookies.domain}`\n    }\n\n    if (payloadCookie.expires) {\n      cookie += `; Expires=${new Date(payloadCookie.expires).toUTCString()}`\n    }\n\n    setResponseHeader('Set-Cookie', cookie)\n  }\n}\n"],"names":["setResponseHeader","generatePayloadCookie","setPayloadAuthCookie","authConfig","cookiePrefix","token","cookieExpiration","tokenExpiration","Date","now","undefined","payloadCookie","collectionAuthConfig","expires","returnCookieAsObject","value","sameSite","cookies","cookie","encodeURIComponent","name","secure","domain","toUTCString"],"mappings":"AAEA,SAASA,iBAAiB,QAAQ,+BAA8B;AAChE,SAASC,qBAAqB,QAAQ,UAAS;AAQ/C,OAAO,SAASC,qBAAqB,EACnCC,UAAU,EACVC,YAAY,EACZC,KAAK,EACoB;IACzB,MAAMC,mBAAmBH,WAAWI,eAAe,GAC/C,IAAIC,KAAKA,KAAKC,GAAG,KAAKN,WAAWI,eAAe,IAChDG;IAEJ,MAAMC,gBAAgBV,sBAAsB;QAC1CW,sBAAsBT;QACtBC;QACAS,SAASP;QACTQ,sBAAsB;QACtBT;IACF;IAEA,IAAIM,cAAcI,KAAK,EAAE;QACvB,MAAMC,WACJ,OAAOb,WAAWc,OAAO,CAACD,QAAQ,KAAK,WAAWb,WAAWc,OAAO,CAACD,QAAQ,GAAG;QAElF,IAAIE,SAAS,GAAGC,mBAAmBR,cAAcS,IAAI,EAAE,CAAC,EAAED,mBAAmBR,cAAcI,KAAK,GAAG;QACnGG,UAAU;QACVA,UAAU,CAAC,WAAW,EAAEF,UAAU;QAClCE,UAAU;QAEV,IAAIf,WAAWc,OAAO,CAACI,MAAM,EAAE;YAC7BH,UAAU;QACZ;QAEA,IAAIf,WAAWc,OAAO,CAACK,MAAM,EAAE;YAC7BJ,UAAU,CAAC,SAAS,EAAEf,WAAWc,OAAO,CAACK,MAAM,EAAE;QACnD;QAEA,IAAIX,cAAcE,OAAO,EAAE;YACzBK,UAAU,CAAC,UAAU,EAAE,IAAIV,KAAKG,cAAcE,OAAO,EAAEU,WAAW,IAAI;QACxE;QAEAvB,kBAAkB,cAAckB;IAClC;AACF"}

package/dist/utilities/toSerializable.d.ts

@@ -0,0 +1,2 @@
+export declare function toSerializable<T>(value: T): T;
+//# sourceMappingURL=toSerializable.d.ts.map

package/dist/utilities/toSerializable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toSerializable.d.ts","sourceRoot":"","sources":["../../src/utilities/toSerializable.ts"],"names":[],"mappings":"AA6HA,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE7C"}

package/dist/utilities/toSerializable.js

@@ -0,0 +1,111 @@
+/**
+ * Recursively strip values that seroval cannot serialize (React elements,
+ * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.
+ *
+ * TanStack Start uses seroval to transfer server function return values to
+ * the client.  Payload's `getClientConfig` / `getLayoutData` may include
+ * callback functions or RegExp instances that seroval chokes on.  Running
+ * the data through this function before returning from a `createServerFn`
+ * handler keeps the transfer safe.
+ *
+ * For server functions whose payloads contain React elements (e.g. the
+ * shared `form-state` / `render-list` / `render-document` handlers), use
+ * `serializeForRsc` instead — it converts elements into RSC handles rather
+ * than stripping them.
+ *
+ * Uses a WeakMap cache so that shared object references (e.g. the same array
+ * referenced by both `doc.hasMany` and `formState.hasMany.value`) are
+ * returned correctly instead of being dropped as "already seen".
+ *
+ * A separate `ancestors` WeakSet tracks objects currently being recursed into.
+ * If an object is encountered while it is still on the recursion stack, the
+ * reference is circular and is replaced with `undefined` to keep the output
+ * JSON-safe.  Once recursion completes the object is removed from `ancestors`,
+ * so sibling/cousin references to the same (fully-processed) object still
+ * resolve to the cached clone.
+ */ function stripUnserializable(value, cache = new WeakMap(), ancestors = new WeakSet()) {
+    if (value === null || value === undefined) {
+        return value;
+    }
+    const t = typeof value;
+    if (t === 'function' || t === 'symbol') {
+        return undefined;
+    }
+    if (t !== 'object') {
+        return value;
+    }
+    const obj = value;
+    if (typeof obj.$$typeof === 'symbol') {
+        return undefined;
+    }
+    if (ancestors.has(obj)) {
+        return undefined;
+    }
+    if (cache.has(obj)) {
+        return cache.get(obj);
+    }
+    if (obj instanceof Date) {
+        return obj;
+    }
+    // RegExp: seroval's SSR bootstrap emits regex literals with broken escape
+    // sequences (e.g. `/!\\[.../` instead of `/!\[.../`), crashing the client
+    // script that populates `window.$_TSR` and preventing hydration. Rich-text
+    // feature transformer regexes aren't needed on the client (they drive
+    // server-side markdown import/export), so strip them here.
+    if (obj instanceof RegExp) {
+        return undefined;
+    }
+    ancestors.add(obj);
+    if (obj instanceof Map) {
+        const cleaned = new Map();
+        cache.set(obj, cleaned);
+        for (const [k, v] of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.set(k, cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (obj instanceof Set) {
+        const cleaned = new Set();
+        cache.set(obj, cleaned);
+        for (const v of obj){
+            const cv = stripUnserializable(v, cache, ancestors);
+            if (cv !== undefined) {
+                cleaned.add(cv);
+            }
+        }
+        ancestors.delete(obj);
+        return cleaned;
+    }
+    if (Array.isArray(obj)) {
+        const arr = [];
+        cache.set(obj, arr);
+        for (const item of obj){
+            arr.push(stripUnserializable(item, cache, ancestors));
+        }
+        ancestors.delete(obj);
+        return arr;
+    }
+    if (ArrayBuffer.isView(obj)) {
+        ancestors.delete(obj);
+        return obj;
+    }
+    const result = {};
+    cache.set(obj, result);
+    for (const key of Object.keys(obj)){
+        const v = stripUnserializable(obj[key], cache, ancestors);
+        if (v !== undefined) {
+            result[key] = v;
+        }
+    }
+    ancestors.delete(obj);
+    return result;
+}
+export function toSerializable(value) {
+    return stripUnserializable(value);
+}
+
+//# sourceMappingURL=toSerializable.js.map

package/dist/utilities/toSerializable.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/toSerializable.ts"],"sourcesContent":["/**\n * Recursively strip values that seroval cannot serialize (React elements,\n * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.\n *\n * TanStack Start uses seroval to transfer server function return values to\n * the client.  Payload's `getClientConfig` / `getLayoutData` may include\n * callback functions or RegExp instances that seroval chokes on.  Running\n * the data through this function before returning from a `createServerFn`\n * handler keeps the transfer safe.\n *\n * For server functions whose payloads contain React elements (e.g. the\n * shared `form-state` / `render-list` / `render-document` handlers), use\n * `serializeForRsc` instead — it converts elements into RSC handles rather\n * than stripping them.\n *\n * Uses a WeakMap cache so that shared object references (e.g. the same array\n * referenced by both `doc.hasMany` and `formState.hasMany.value`) are\n * returned correctly instead of being dropped as \"already seen\".\n *\n * A separate `ancestors` WeakSet tracks objects currently being recursed into.\n * If an object is encountered while it is still on the recursion stack, the\n * reference is circular and is replaced with `undefined` to keep the output\n * JSON-safe.  Once recursion completes the object is removed from `ancestors`,\n * so sibling/cousin references to the same (fully-processed) object still\n * resolve to the cached clone.\n */\nfunction stripUnserializable(\n  value: unknown,\n  cache = new WeakMap<object, unknown>(),\n  ancestors = new WeakSet<object>(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  // RegExp: seroval's SSR bootstrap emits regex literals with broken escape\n  // sequences (e.g. `/!\\\\[.../` instead of `/!\\[.../`), crashing the client\n  // script that populates `window.$_TSR` and preventing hydration. Rich-text\n  // feature transformer regexes aren't needed on the client (they drive\n  // server-side markdown import/export), so strip them here.\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n\nexport function toSerializable<T>(value: T): T {\n  return stripUnserializable(value) as T\n}\n"],"names":["stripUnserializable","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","toSerializable"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,SAASA,oBACPC,KAAc,EACdC,QAAQ,IAAIC,SAA0B,EACtCC,YAAY,IAAIC,SAAiB;IAEjC,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,2DAA2D;IAC3D,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAF,UAAUU,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBb,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBpB,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,MAAMiB,MAAiB,EAAE;QACzBvB,MAAMe,GAAG,CAACT,KAAKiB;QACf,KAAK,MAAMC,QAAQlB,IAAK;YACtBiB,IAAIE,IAAI,CAAC3B,oBAAoB0B,MAAMxB,OAAOE;QAC5C;QACAA,UAAUiB,MAAM,CAACb;QACjB,OAAOiB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACrB,MAAM;QAC3BJ,UAAUiB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAMsB,SAAkC,CAAC;IACzC5B,MAAMe,GAAG,CAACT,KAAKsB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACzB,KAAM;QAClC,MAAMW,IAAInB,oBAAoBQ,GAAG,CAACuB,IAAI,EAAE7B,OAAOE;QAC/C,IAAIe,MAAMb,WAAW;YACnBwB,MAAM,CAACC,IAAI,GAAGZ;QAChB;IACF;IACAf,UAAUiB,MAAM,CAACb;IACjB,OAAOsB;AACT;AAEA,OAAO,SAASI,eAAkBjC,KAAQ;IACxC,OAAOD,oBAAoBC;AAC7B"}

package/dist/vite/constants.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Vite-level configuration constants used by `payloadPlugin`. Kept separate so
+ * `plugin.ts` stays focused on wiring.
+ */
+/**
+ * Server-only packages (Node-only or only ever used by the server bundle).
+ * These are the Vite equivalent of Next.js's `serverExternalPackages`.
+ */
+export declare const ssrExternalPackages: string[];
+/**
+ * Payload packages whose source must be processed by Vite even on the server
+ * (because they are workspace `.ts` files in dev). Server-only adapters
+ * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are
+ * intentionally not included — those should stay external on the SSR side.
+ */
+export declare const payloadNoExternalPatterns: Array<RegExp | string>;
+/**
+ * The subset of `payloadNoExternalPatterns` that needs to participate in the
+ * RSC environment. The RSC graph is narrower — plugins and storage adapters
+ * don't run in RSC, only the admin UI surface does.
+ */
+export declare const payloadRscNoExternalPatterns: Array<RegExp | string>;
+/**
+ * Packages we know contain Node-only code or top-level side effects requiring
+ * Node APIs. Excluding them from the client optimizer prevents Vite from
+ * walking into their main entries and trying to bundle server-only imports
+ * for the browser.
+ */
+export declare const optimizeDepsExcludeDefaults: string[];
+/**
+ * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be
+ * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick
+ * these up because their parent packages are in `optimizeDeps.exclude`, so we
+ * list them explicitly using the `parent > child` syntax.
+ */
+export declare const optimizeDepsIncludeDefaults: string[];
+//# sourceMappingURL=constants.d.ts.map

package/dist/vite/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/vite/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA0BvC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAK/D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAsB/C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAqC/C,CAAA"}

package/dist/vite/constants.js

@@ -0,0 +1,129 @@
+/**
+ * Vite-level configuration constants used by `payloadPlugin`. Kept separate so
+ * `plugin.ts` stays focused on wiring.
+ */ /**
+ * Server-only packages (Node-only or only ever used by the server bundle).
+ * These are the Vite equivalent of Next.js's `serverExternalPackages`.
+ */ export const ssrExternalPackages = [
+    'ajv',
+    'fast-uri',
+    'drizzle-kit',
+    'drizzle-kit/api',
+    'drizzle-orm',
+    'sharp',
+    'libsql',
+    'require-in-the-middle',
+    'json-schema-to-typescript',
+    'pino',
+    'pino-pretty',
+    'graphql',
+    'mongodb',
+    'mongoose',
+    'better-sqlite3',
+    'pg',
+    'pg-native',
+    'nodemailer',
+    'aws4',
+    'pluralize',
+    'console-table-printer',
+    '@azure/storage-blob',
+    '@aws-sdk/client-s3',
+    '@aws-sdk/s3-request-presigner',
+    '@google-cloud/storage'
+];
+/**
+ * Payload packages whose source must be processed by Vite even on the server
+ * (because they are workspace `.ts` files in dev). Server-only adapters
+ * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are
+ * intentionally not included — those should stay external on the SSR side.
+ */ export const payloadNoExternalPatterns = [
+    '@payloadcms/ui',
+    '@payloadcms/translations',
+    '@payloadcms/tanstack-start',
+    /^@payloadcms\/richtext-lexical/,
+    /^@payloadcms\/plugin-/,
+    /^@payloadcms\/storage-/
+];
+/**
+ * The subset of `payloadNoExternalPatterns` that needs to participate in the
+ * RSC environment. The RSC graph is narrower — plugins and storage adapters
+ * don't run in RSC, only the admin UI surface does.
+ */ export const payloadRscNoExternalPatterns = [
+    '@payloadcms/ui',
+    '@payloadcms/translations',
+    '@payloadcms/tanstack-start',
+    /^@payloadcms\/richtext-lexical/
+];
+/**
+ * Packages we know contain Node-only code or top-level side effects requiring
+ * Node APIs. Excluding them from the client optimizer prevents Vite from
+ * walking into their main entries and trying to bundle server-only imports
+ * for the browser.
+ */ export const optimizeDepsExcludeDefaults = [
+    'sharp',
+    '@payloadcms/ui',
+    '@payloadcms/tanstack-start',
+    'payload',
+    'pino',
+    'pino-pretty',
+    'busboy',
+    'get-tsconfig',
+    'ws',
+    'croner',
+    'prompts',
+    'file-type',
+    // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite
+    // sometimes walks these from the main package entry while scanning
+    // workspace deps, and the browser sub-bundles do not expose the
+    // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev
+    // server with a `MISSING_EXPORT` error before any test runs.
+    '@azure/storage-blob',
+    '@aws-sdk/client-s3',
+    '@aws-sdk/s3-request-presigner',
+    '@google-cloud/storage'
+];
+/**
+ * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be
+ * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick
+ * these up because their parent packages are in `optimizeDeps.exclude`, so we
+ * list them explicitly using the `parent > child` syntax.
+ */ export const optimizeDepsIncludeDefaults = [
+    '@payloadcms/ui > sonner',
+    '@payloadcms/ui > @faceless-ui/modal',
+    '@payloadcms/ui > @faceless-ui/window-info',
+    '@payloadcms/ui > @faceless-ui/scroll-info',
+    '@payloadcms/ui > @dnd-kit/core',
+    '@payloadcms/ui > @dnd-kit/sortable',
+    '@payloadcms/ui > @dnd-kit/utilities',
+    '@payloadcms/ui > react-datepicker',
+    '@payloadcms/ui > react-select',
+    '@payloadcms/ui > react-select/creatable',
+    '@payloadcms/ui > react-image-crop',
+    '@payloadcms/ui > @monaco-editor/react',
+    '@payloadcms/ui > date-fns',
+    '@payloadcms/ui > date-fns/transpose',
+    '@payloadcms/ui > @date-fns/tz/date/mini',
+    '@payloadcms/ui > uuid',
+    '@payloadcms/ui > use-context-selector',
+    '@payloadcms/ui > bson-objectid',
+    '@payloadcms/ui > dequal',
+    '@payloadcms/ui > object-to-formdata',
+    '@payloadcms/ui > md5',
+    'payload > deepmerge',
+    'payload > pluralize',
+    'scheduler',
+    // Transitive deps that Vite otherwise discovers *after* the initial crawl
+    // (react-select pulls in @floating-ui at runtime; react-is is reached via
+    // react-transition-group/prop-types; the default date-fns locale is loaded
+    // through a dynamic `date-fns/locale/${key}` import). A late discovery forces
+    // a full dep re-optimization mid-session, which 404s every in-flight
+    // `.vite/deps/*` chunk ("Pre-transform error: file does not exist in the
+    // optimize deps directory") and breaks the admin UI in CI cold starts.
+    // Pre-bundling them keeps the first optimization pass complete.
+    '@payloadcms/ui > react-select > @floating-ui/dom',
+    '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',
+    '@payloadcms/ui > react-select > prop-types > react-is',
+    '@payloadcms/ui > date-fns/locale/en-US'
+];
+
+//# sourceMappingURL=constants.js.map

package/dist/vite/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/vite/constants.ts"],"sourcesContent":["/**\n * Vite-level configuration constants used by `payloadPlugin`. Kept separate so\n * `plugin.ts` stays focused on wiring.\n */\n\n/**\n * Server-only packages (Node-only or only ever used by the server bundle).\n * These are the Vite equivalent of Next.js's `serverExternalPackages`.\n */\nexport const ssrExternalPackages: string[] = [\n  'ajv',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'libsql',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'mongodb',\n  'mongoose',\n  'better-sqlite3',\n  'pg',\n  'pg-native',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n]\n\n/**\n * Payload packages whose source must be processed by Vite even on the server\n * (because they are workspace `.ts` files in dev). Server-only adapters\n * (`@payloadcms/db-*`, `@payloadcms/email-*`, `@payloadcms/next`, etc.) are\n * intentionally not included — those should stay external on the SSR side.\n */\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n\n/**\n * The subset of `payloadNoExternalPatterns` that needs to participate in the\n * RSC environment. The RSC graph is narrower — plugins and storage adapters\n * don't run in RSC, only the admin UI surface does.\n */\nexport const payloadRscNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n]\n\n/**\n * Packages we know contain Node-only code or top-level side effects requiring\n * Node APIs. Excluding them from the client optimizer prevents Vite from\n * walking into their main entries and trying to bundle server-only imports\n * for the browser.\n */\nexport const optimizeDepsExcludeDefaults: string[] = [\n  'sharp',\n  '@payloadcms/ui',\n  '@payloadcms/tanstack-start',\n  'payload',\n  'pino',\n  'pino-pretty',\n  'busboy',\n  'get-tsconfig',\n  'ws',\n  'croner',\n  'prompts',\n  'file-type',\n  // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite\n  // sometimes walks these from the main package entry while scanning\n  // workspace deps, and the browser sub-bundles do not expose the\n  // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev\n  // server with a `MISSING_EXPORT` error before any test runs.\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n]\n\n/**\n * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be\n * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick\n * these up because their parent packages are in `optimizeDeps.exclude`, so we\n * list them explicitly using the `parent > child` syntax.\n */\nexport const optimizeDepsIncludeDefaults: string[] = [\n  '@payloadcms/ui > sonner',\n  '@payloadcms/ui > @faceless-ui/modal',\n  '@payloadcms/ui > @faceless-ui/window-info',\n  '@payloadcms/ui > @faceless-ui/scroll-info',\n  '@payloadcms/ui > @dnd-kit/core',\n  '@payloadcms/ui > @dnd-kit/sortable',\n  '@payloadcms/ui > @dnd-kit/utilities',\n  '@payloadcms/ui > react-datepicker',\n  '@payloadcms/ui > react-select',\n  '@payloadcms/ui > react-select/creatable',\n  '@payloadcms/ui > react-image-crop',\n  '@payloadcms/ui > @monaco-editor/react',\n  '@payloadcms/ui > date-fns',\n  '@payloadcms/ui > date-fns/transpose',\n  '@payloadcms/ui > @date-fns/tz/date/mini',\n  '@payloadcms/ui > uuid',\n  '@payloadcms/ui > use-context-selector',\n  '@payloadcms/ui > bson-objectid',\n  '@payloadcms/ui > dequal',\n  '@payloadcms/ui > object-to-formdata',\n  '@payloadcms/ui > md5',\n  'payload > deepmerge',\n  'payload > pluralize',\n  'scheduler',\n  // Transitive deps that Vite otherwise discovers *after* the initial crawl\n  // (react-select pulls in @floating-ui at runtime; react-is is reached via\n  // react-transition-group/prop-types; the default date-fns locale is loaded\n  // through a dynamic `date-fns/locale/${key}` import). A late discovery forces\n  // a full dep re-optimization mid-session, which 404s every in-flight\n  // `.vite/deps/*` chunk (\"Pre-transform error: file does not exist in the\n  // optimize deps directory\") and breaks the admin UI in CI cold starts.\n  // Pre-bundling them keeps the first optimization pass complete.\n  '@payloadcms/ui > react-select > @floating-ui/dom',\n  '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',\n  '@payloadcms/ui > react-select > prop-types > react-is',\n  '@payloadcms/ui > date-fns/locale/en-US',\n]\n"],"names":["ssrExternalPackages","payloadNoExternalPatterns","payloadRscNoExternalPatterns","optimizeDepsExcludeDefaults","optimizeDepsIncludeDefaults"],"mappings":"AAAA;;;CAGC,GAED;;;CAGC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,MAAMC,+BAAuD;IAClE;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,sEAAsE;IACtE,6DAA6D;IAC7D;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;CAKC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE;IACA;IACA;IACA;CACD,CAAA"}

package/dist/vite/importProtection.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Specifiers that must never appear in the client module graph. These are the
+ * server-only Payload entry points plus Node.js built-ins and a handful of
+ * Node-only npm packages that Payload pulls in transitively.
+ */
+export declare const serverOnlyClientSpecifiers: Array<RegExp | string>;
+/**
+ * Allowlist callback for the `tanstackStart` plugin's import-protection. These
+ * are the legitimate cross-environment imports in our monorepo that we want
+ * to permit even when they appear to cross a server/client boundary.
+ */
+export declare function onImportProtectionViolation(violation: unknown): boolean | void;
+export declare const defaultImportProtectionIgnoreImporters: RegExp[];
+//# sourceMappingURL=importProtection.d.ts.map

package/dist/vite/importProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importProtection.d.ts","sourceRoot":"","sources":["../../src/vite/importProtection.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAoB7D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAoC9E;AAED,eAAO,MAAM,sCAAsC,EAAE,MAAM,EAAsC,CAAA"}