@payloadcms/tanstack-start 4.0.0-internal.c7d5de4 → 4.0.0-internal.cb69780

package/dist/utilities/serializeForRsc.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/serializeForRsc.ts"],"sourcesContent":["import type React from 'react'\n\nimport { renderServerComponent } from '@tanstack/react-start/rsc'\nimport { createElement, Fragment } from 'react'\n\n/**\n * Recursively walk a server-function return value and prepare it for transit\n * to the client as an RSC payload.\n *\n * Mirrors `toSerializable`'s walk (Maps, Sets, Dates, typed arrays, circular\n * refs) with two key differences:\n *\n * 1. React elements are NOT stripped. They are passed through\n *    `renderServerComponent` from `@tanstack/react-start/rsc` to produce a\n *    \"renderable RSC handle\". TanStack Start's `$RSC` serialization adapter\n *    streams the underlying Flight payload to the client, where it is\n *    decoded back into a renderable React node. This matches the way\n *    Next.js's RSC payload format ships React elements over server actions\n *    and lets server-rendered custom field components (e.g. those returned\n *    by `buildFormState` / `RenderServerComponent`) survive a `form-state`\n *    round trip.\n *\n * 2. Functions, Symbols, and RegExps are still stripped — TanStack's seroval\n *    transport cannot handle them, and Payload doesn't intentionally include\n *    them in server-function return values.\n *\n * Use this in `createServerFn` handlers that return Payload form/view state\n * containing React elements (e.g. `state[path].customComponents.Field`).\n */\nexport async function serializeForRsc<T>(value: T): Promise<T> {\n  return (await walk(value, new WeakMap<object, unknown>(), new WeakSet<object>())) as T\n}\n\nasync function walk(\n  value: unknown,\n  cache: WeakMap<object, unknown>,\n  ancestors: WeakSet<object>,\n): Promise<unknown> {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return await renderServerComponent(value as React.ReactElement)\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = await walk(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = await walk(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    // An array consisting entirely of React elements (e.g. a field's\n    // `beforeInput` / `afterInput` component list, produced by\n    // `RenderServerComponent`) must be rendered as a SINGLE RSC handle.\n    // Converting each element individually below turns every item into its own\n    // `renderServerComponent` handle, which drops the element's React `key` —\n    // the client then renders `{[handle, handle]}` as unkeyed array children\n    // and React warns \"Each child in a list should have a unique key prop\".\n    // Payload always renders these component arrays wholesale (`{BeforeInput}`),\n    // so collapsing them into one Fragment-rendered handle is render-equivalent\n    // and keeps the per-element keys intact inside the single Flight payload.\n    const items = obj.filter((item) => item !== null && item !== undefined)\n    const isReactElementArray =\n      items.length > 0 &&\n      items.every(\n        (item) => typeof item === 'object' && typeof (item as { $$typeof?: unknown }).$$typeof === 'symbol',\n      )\n    if (isReactElementArray) {\n      ancestors.delete(obj)\n      return await renderServerComponent(createElement(Fragment, null, ...(obj as React.ReactNode[])))\n    }\n\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(await walk(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = await walk(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["renderServerComponent","createElement","Fragment","serializeForRsc","value","walk","WeakMap","WeakSet","cache","ancestors","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","items","filter","item","isReactElementArray","length","every","arr","push","ArrayBuffer","isView","result","key","Object","keys"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,4BAA2B;AACjE,SAASC,aAAa,EAAEC,QAAQ,QAAQ,QAAO;AAE/C;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,gBAAmBC,KAAQ;IAC/C,OAAQ,MAAMC,KAAKD,OAAO,IAAIE,WAA4B,IAAIC;AAChE;AAEA,eAAeF,KACbD,KAAc,EACdI,KAA+B,EAC/BC,SAA0B;IAE1B,IAAIL,UAAU,QAAQA,UAAUM,WAAW;QACzC,OAAON;IACT;IAEA,MAAMO,IAAI,OAAOP;IACjB,IAAIO,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAOP;IACT;IAEA,MAAMQ,MAAMR;IAEZ,IAAI,OAAOQ,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAO,MAAMb,sBAAsBI;IACrC;IAEA,IAAIK,UAAUK,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIF,MAAMM,GAAG,CAACF,MAAM;QAClB,OAAOJ,MAAMO,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAD,UAAUS,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBX,MAAMa,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAK,MAAMnB,KAAKkB,GAAGf,OAAOC;YAChC,IAAIe,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAf,UAAUgB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBlB,MAAMa,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAK,MAAMnB,KAAKkB,GAAGf,OAAOC;YAChC,IAAIe,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAf,UAAUgB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,iEAAiE;QACjE,2DAA2D;QAC3D,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAMiB,QAAQjB,IAAIkB,MAAM,CAAC,CAACC,OAASA,SAAS,QAAQA,SAASrB;QAC7D,MAAMsB,sBACJH,MAAMI,MAAM,GAAG,KACfJ,MAAMK,KAAK,CACT,CAACH,OAAS,OAAOA,SAAS,YAAY,OAAO,AAACA,KAAgClB,QAAQ,KAAK;QAE/F,IAAImB,qBAAqB;YACvBvB,UAAUgB,MAAM,CAACb;YACjB,OAAO,MAAMZ,sBAAsBC,cAAcC,UAAU,SAAUU;QACvE;QAEA,MAAMuB,MAAiB,EAAE;QACzB3B,MAAMa,GAAG,CAACT,KAAKuB;QACf,KAAK,MAAMJ,QAAQnB,IAAK;YACtBuB,IAAIC,IAAI,CAAC,MAAM/B,KAAK0B,MAAMvB,OAAOC;QACnC;QACAA,UAAUgB,MAAM,CAACb;QACjB,OAAOuB;IACT;IAEA,IAAIE,YAAYC,MAAM,CAAC1B,MAAM;QAC3BH,UAAUgB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAM2B,SAAkC,CAAC;IACzC/B,MAAMa,GAAG,CAACT,KAAK2B;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC9B,KAAM;QAClC,MAAMW,IAAI,MAAMlB,KAAKO,GAAG,CAAC4B,IAAI,EAAEhC,OAAOC;QACtC,IAAIc,MAAMb,WAAW;YACnB6B,MAAM,CAACC,IAAI,GAAGjB;QAChB;IACF;IACAd,UAAUgB,MAAM,CAACb;IACjB,OAAO2B;AACT"}
+{"version":3,"sources":["../../src/utilities/serializeForRsc.ts"],"sourcesContent":["import type React from 'react'\n\nimport { renderServerComponent } from '@tanstack/react-start/rsc'\nimport { setOwnProperty } from 'payload/shared'\nimport { createElement, Fragment } from 'react'\n\n/**\n * Recursively walk a server-function return value and prepare it for transit\n * to the client as an RSC payload.\n *\n * Mirrors `toSerializable`'s walk (Maps, Sets, Dates, typed arrays, circular\n * refs) with two key differences:\n *\n * 1. React elements are NOT stripped. They are passed through\n *    `renderServerComponent` from `@tanstack/react-start/rsc` to produce a\n *    \"renderable RSC handle\". TanStack Start's `$RSC` serialization adapter\n *    streams the underlying Flight payload to the client, where it is\n *    decoded back into a renderable React node. This matches the way\n *    Next.js's RSC payload format ships React elements over server actions\n *    and lets server-rendered custom field components (e.g. those returned\n *    by `buildFormState` / `RenderServerComponent`) survive a `form-state`\n *    round trip.\n *\n * 2. Functions, Symbols, and RegExps are still stripped — TanStack's seroval\n *    transport cannot handle them, and Payload doesn't intentionally include\n *    them in server-function return values.\n *\n * Use this in `createServerFn` handlers that return Payload form/view state\n * containing React elements (e.g. `state[path].customComponents.Field`).\n */\nexport async function serializeForRsc<T>(value: T): Promise<T> {\n  return (await walk(value, new WeakMap<object, unknown>(), new WeakSet<object>())) as T\n}\n\nasync function walk(\n  value: unknown,\n  cache: WeakMap<object, unknown>,\n  ancestors: WeakSet<object>,\n): Promise<unknown> {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return await renderServerComponent(value as React.ReactElement)\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = await walk(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = await walk(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    // An array consisting entirely of React elements (e.g. a field's\n    // `beforeInput` / `afterInput` component list, produced by\n    // `RenderServerComponent`) must be rendered as a SINGLE RSC handle.\n    // Converting each element individually below turns every item into its own\n    // `renderServerComponent` handle, which drops the element's React `key` —\n    // the client then renders `{[handle, handle]}` as unkeyed array children\n    // and React warns \"Each child in a list should have a unique key prop\".\n    // Payload always renders these component arrays wholesale (`{BeforeInput}`),\n    // so collapsing them into one Fragment-rendered handle is render-equivalent\n    // and keeps the per-element keys intact inside the single Flight payload.\n    const items = obj.filter((item) => item !== null && item !== undefined)\n    const isReactElementArray =\n      items.length > 0 &&\n      items.every(\n        (item) =>\n          typeof item === 'object' && typeof (item as { $$typeof?: unknown }).$$typeof === 'symbol',\n      )\n    if (isReactElementArray) {\n      ancestors.delete(obj)\n      return await renderServerComponent(\n        createElement(Fragment, null, ...(obj as React.ReactNode[])),\n      )\n    }\n\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(await walk(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = await walk(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      setOwnProperty({ key, target: result, value: v })\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["renderServerComponent","setOwnProperty","createElement","Fragment","serializeForRsc","value","walk","WeakMap","WeakSet","cache","ancestors","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","items","filter","item","isReactElementArray","length","every","arr","push","ArrayBuffer","isView","result","key","Object","keys","target"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,4BAA2B;AACjE,SAASC,cAAc,QAAQ,iBAAgB;AAC/C,SAASC,aAAa,EAAEC,QAAQ,QAAQ,QAAO;AAE/C;;;;;;;;;;;;;;;;;;;;;;;CAuBC,GACD,OAAO,eAAeC,gBAAmBC,KAAQ;IAC/C,OAAQ,MAAMC,KAAKD,OAAO,IAAIE,WAA4B,IAAIC;AAChE;AAEA,eAAeF,KACbD,KAAc,EACdI,KAA+B,EAC/BC,SAA0B;IAE1B,IAAIL,UAAU,QAAQA,UAAUM,WAAW;QACzC,OAAON;IACT;IAEA,MAAMO,IAAI,OAAOP;IACjB,IAAIO,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAOP;IACT;IAEA,MAAMQ,MAAMR;IAEZ,IAAI,OAAOQ,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAO,MAAMd,sBAAsBK;IACrC;IAEA,IAAIK,UAAUK,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIF,MAAMM,GAAG,CAACF,MAAM;QAClB,OAAOJ,MAAMO,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAD,UAAUS,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBX,MAAMa,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAK,MAAMnB,KAAKkB,GAAGf,OAAOC;YAChC,IAAIe,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAf,UAAUgB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBlB,MAAMa,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAK,MAAMnB,KAAKkB,GAAGf,OAAOC;YAChC,IAAIe,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAf,UAAUgB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,iEAAiE;QACjE,2DAA2D;QAC3D,oEAAoE;QACpE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,6EAA6E;QAC7E,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAMiB,QAAQjB,IAAIkB,MAAM,CAAC,CAACC,OAASA,SAAS,QAAQA,SAASrB;QAC7D,MAAMsB,sBACJH,MAAMI,MAAM,GAAG,KACfJ,MAAMK,KAAK,CACT,CAACH,OACC,OAAOA,SAAS,YAAY,OAAO,AAACA,KAAgClB,QAAQ,KAAK;QAEvF,IAAImB,qBAAqB;YACvBvB,UAAUgB,MAAM,CAACb;YACjB,OAAO,MAAMb,sBACXE,cAAcC,UAAU,SAAUU;QAEtC;QAEA,MAAMuB,MAAiB,EAAE;QACzB3B,MAAMa,GAAG,CAACT,KAAKuB;QACf,KAAK,MAAMJ,QAAQnB,IAAK;YACtBuB,IAAIC,IAAI,CAAC,MAAM/B,KAAK0B,MAAMvB,OAAOC;QACnC;QACAA,UAAUgB,MAAM,CAACb;QACjB,OAAOuB;IACT;IAEA,IAAIE,YAAYC,MAAM,CAAC1B,MAAM;QAC3BH,UAAUgB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAM2B,SAAkC,CAAC;IACzC/B,MAAMa,GAAG,CAACT,KAAK2B;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC9B,KAAM;QAClC,MAAMW,IAAI,MAAMlB,KAAKO,GAAG,CAAC4B,IAAI,EAAEhC,OAAOC;QACtC,IAAIc,MAAMb,WAAW;YACnBV,eAAe;gBAAEwC;gBAAKG,QAAQJ;gBAAQnC,OAAOmB;YAAE;QACjD;IACF;IACAd,UAAUgB,MAAM,CAACb;IACjB,OAAO2B;AACT"}

package/dist/utilities/serverFunctionClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7E,GAAG,oBAAoB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAiB,EAC/C,SAAS,GAAE,OAAO,CAAC,MAAM,CAAiB,GACzC,OAAO,CA4FT"}
+{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAI7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7E,GAAG,oBAAoB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAiB,EAC/C,SAAS,GAAE,OAAO,CAAC,MAAM,CAAiB,GACzC,OAAO,CA4FT"}

package/dist/utilities/serverFunctionClient.js

@@ -1,3 +1,4 @@
+import { setOwnProperty } from 'payload/shared';
 /**
  * Builds the client-side `ServerFunctionClient` wired into
  * `RootProvider.serverFunction`, given the app's `createServerFn`-based
@@ -99,7 +100,11 @@
     for (const key of Object.keys(obj)){
         const v = stripUnserializable(obj[key], cache, ancestors);
         if (v !== undefined) {
-            result[key] = v;
+            setOwnProperty({
+                key,
+                target: result,
+                value: v
+            });
         }
     }
     ancestors.delete(obj);

package/dist/utilities/serverFunctionClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\n/**\n * Builds the client-side `ServerFunctionClient` wired into\n * `RootProvider.serverFunction`, given the app's `createServerFn`-based\n * dispatcher (`runServerFn`).\n *\n * Strips functions / symbols / RegExps / React elements from the args before\n * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped\n * those, but TanStack Start's seroval-based wire format errors instead. We\n * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in\n * `ServerFunctionsProvider`) that may pass the live form state — which can\n * carry stray functions — keep working without each call site sanitising.\n *\n * Delegates to `runServerFn`, so the response (including any RSC handles for\n * server-rendered custom components) is decoded by TanStack Start back into\n * renderable React nodes on the client.\n */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<unknown>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const safeArgs = stripUnserializable(args) as ServerFunctionClientArgs\n    return await runServerFn({ data: safeArgs })\n  }) as ServerFunctionClient\n}\n\n/**\n * Recursively removes values TanStack Start's seroval wire format cannot\n * serialize (functions, symbols, RegExps, React elements, cyclic refs) and\n * normalizes `Date` subclasses to plain `Date`.\n */\nexport function stripUnserializable(\n  value: unknown,\n  cache: WeakMap<object, unknown> = new WeakMap(),\n  ancestors: WeakSet<object> = new WeakSet(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,\n    // used by the schedule-publish drawer) are `instanceof Date` but have a\n    // different `constructor`, which TanStack Start's seroval serializer\n    // rejects with \"The value [object Date] ... cannot be parsed/serialized\".\n    return new Date(obj.getTime())\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["createServerFunctionClient","runServerFn","args","safeArgs","stripUnserializable","data","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","getTime","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys"],"mappings":"AAEA;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASA,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAWC,oBAAoBF;QACrC,OAAO,MAAMD,YAAY;YAAEI,MAAMF;QAAS;IAC5C;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASC,oBACdE,KAAc,EACdC,QAAkC,IAAIC,SAAS,EAC/CC,YAA6B,IAAIC,SAAS;IAE1C,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,IAAIA,KAAKJ,IAAIK,OAAO;IAC7B;IAEA,IAAIL,eAAeM,QAAQ;QACzB,OAAOR;IACT;IAEAF,UAAUW,GAAG,CAACP;IAEd,IAAIA,eAAeQ,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBd,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIZ,IAAK;YACxB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIT,eAAee,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBrB,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAMG,KAAKZ,IAAK;YACnB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQF,GAAG,CAACM;YACd;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIO,MAAMC,OAAO,CAACjB,MAAM;QACtB,MAAMkB,MAAiB,EAAE;QACzBxB,MAAMgB,GAAG,CAACV,KAAKkB;QACf,KAAK,MAAMC,QAAQnB,IAAK;YACtBkB,IAAIE,IAAI,CAAC7B,oBAAoB4B,MAAMzB,OAAOE;QAC5C;QACAA,UAAUkB,MAAM,CAACd;QACjB,OAAOkB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACtB,MAAM;QAC3BJ,UAAUkB,MAAM,CAACd;QACjB,OAAOA;IACT;IAEA,MAAMuB,SAAkC,CAAC;IACzC7B,MAAMgB,GAAG,CAACV,KAAKuB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC1B,KAAM;QAClC,MAAMY,IAAIrB,oBAAoBS,GAAG,CAACwB,IAAI,EAAE9B,OAAOE;QAC/C,IAAIgB,MAAMd,WAAW;YACnByB,MAAM,CAACC,IAAI,GAAGZ;QAChB;IACF;IACAhB,UAAUkB,MAAM,CAACd;IACjB,OAAOuB;AACT"}
+{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\nimport { setOwnProperty } from 'payload/shared'\n\n/**\n * Builds the client-side `ServerFunctionClient` wired into\n * `RootProvider.serverFunction`, given the app's `createServerFn`-based\n * dispatcher (`runServerFn`).\n *\n * Strips functions / symbols / RegExps / React elements from the args before\n * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped\n * those, but TanStack Start's seroval-based wire format errors instead. We\n * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in\n * `ServerFunctionsProvider`) that may pass the live form state — which can\n * carry stray functions — keep working without each call site sanitising.\n *\n * Delegates to `runServerFn`, so the response (including any RSC handles for\n * server-rendered custom components) is decoded by TanStack Start back into\n * renderable React nodes on the client.\n */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<unknown>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const safeArgs = stripUnserializable(args) as ServerFunctionClientArgs\n    return await runServerFn({ data: safeArgs })\n  }) as ServerFunctionClient\n}\n\n/**\n * Recursively removes values TanStack Start's seroval wire format cannot\n * serialize (functions, symbols, RegExps, React elements, cyclic refs) and\n * normalizes `Date` subclasses to plain `Date`.\n */\nexport function stripUnserializable(\n  value: unknown,\n  cache: WeakMap<object, unknown> = new WeakMap(),\n  ancestors: WeakSet<object> = new WeakSet(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,\n    // used by the schedule-publish drawer) are `instanceof Date` but have a\n    // different `constructor`, which TanStack Start's seroval serializer\n    // rejects with \"The value [object Date] ... cannot be parsed/serialized\".\n    return new Date(obj.getTime())\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      setOwnProperty({ key, target: result, value: v })\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["setOwnProperty","createServerFunctionClient","runServerFn","args","safeArgs","stripUnserializable","data","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","getTime","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","target"],"mappings":"AAEA,SAASA,cAAc,QAAQ,iBAAgB;AAE/C;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAWC,oBAAoBF;QACrC,OAAO,MAAMD,YAAY;YAAEI,MAAMF;QAAS;IAC5C;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASC,oBACdE,KAAc,EACdC,QAAkC,IAAIC,SAAS,EAC/CC,YAA6B,IAAIC,SAAS;IAE1C,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,IAAIA,KAAKJ,IAAIK,OAAO;IAC7B;IAEA,IAAIL,eAAeM,QAAQ;QACzB,OAAOR;IACT;IAEAF,UAAUW,GAAG,CAACP;IAEd,IAAIA,eAAeQ,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBd,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIZ,IAAK;YACxB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIT,eAAee,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBrB,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAMG,KAAKZ,IAAK;YACnB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQF,GAAG,CAACM;YACd;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIO,MAAMC,OAAO,CAACjB,MAAM;QACtB,MAAMkB,MAAiB,EAAE;QACzBxB,MAAMgB,GAAG,CAACV,KAAKkB;QACf,KAAK,MAAMC,QAAQnB,IAAK;YACtBkB,IAAIE,IAAI,CAAC7B,oBAAoB4B,MAAMzB,OAAOE;QAC5C;QACAA,UAAUkB,MAAM,CAACd;QACjB,OAAOkB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACtB,MAAM;QAC3BJ,UAAUkB,MAAM,CAACd;QACjB,OAAOA;IACT;IAEA,MAAMuB,SAAkC,CAAC;IACzC7B,MAAMgB,GAAG,CAACV,KAAKuB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC1B,KAAM;QAClC,MAAMY,IAAIrB,oBAAoBS,GAAG,CAACwB,IAAI,EAAE9B,OAAOE;QAC/C,IAAIgB,MAAMd,WAAW;YACnBZ,eAAe;gBAAEsC;gBAAKG,QAAQJ;gBAAQ9B,OAAOmB;YAAE;QACjD;IACF;IACAhB,UAAUkB,MAAM,CAACd;IACjB,OAAOuB;AACT"}

package/dist/utilities/toSerializable.d.ts

@@ -1,2 +1,11 @@
+import type { Serializable, SerializableExtensions } from '@tanstack/react-router';
+/** A record sanitized for TanStack's server-function transport. */
+export type SerializableRecord = Record<string, unknown> & SerializableExtensions['TsrSerializable'];
+/**
+ * Removes values unsupported by TanStack's serializer. Trusted serializable
+ * additions are merged afterward so opaque handles such as RSC payloads are
+ * preserved while the source record is sanitized.
+ */
 export declare function toSerializable<T>(value: T): T;
+export declare function toSerializable(value: Record<string, unknown>, additions: Record<string, Serializable>): SerializableRecord;
 //# sourceMappingURL=toSerializable.d.ts.map

package/dist/utilities/toSerializable.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toSerializable.d.ts","sourceRoot":"","sources":["../../src/utilities/toSerializable.ts"],"names":[],"mappings":"AA6HA,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAE7C"}
+{"version":3,"file":"toSerializable.d.ts","sourceRoot":"","sources":["../../src/utilities/toSerializable.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAIlF,mEAAmE;AACnE,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,sBAAsB,CAAC,iBAAiB,CAAC,CAAA;AA+HpG;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;AAC9C,wBAAgB,cAAc,CAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GACtC,kBAAkB,CAAA"}

package/dist/utilities/toSerializable.js

@@ -1,3 +1,4 @@
+import { setOwnProperty } from 'payload/shared';
 /**
  * Recursively strip values that seroval cannot serialize (React elements,
  * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.
@@ -98,14 +99,29 @@
     for (const key of Object.keys(obj)){
         const v = stripUnserializable(obj[key], cache, ancestors);
         if (v !== undefined) {
-            result[key] = v;
+            setOwnProperty({
+                key,
+                target: result,
+                value: v
+            });
         }
     }
     ancestors.delete(obj);
     return result;
 }
-export function toSerializable(value) {
-    return stripUnserializable(value);
+export function toSerializable(value, additions) {
+    const serialized = stripUnserializable(value);
+    if (additions) {
+        if (typeof serialized !== 'object' || serialized === null || Array.isArray(serialized)) {
+            throw new TypeError('Serializable additions require an object source');
+        }
+        const result = {
+            ...serialized,
+            ...additions
+        };
+        return result;
+    }
+    return serialized;
 }
 
 //# sourceMappingURL=toSerializable.js.map

package/dist/utilities/toSerializable.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/toSerializable.ts"],"sourcesContent":["/**\n * Recursively strip values that seroval cannot serialize (React elements,\n * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.\n *\n * TanStack Start uses seroval to transfer server function return values to\n * the client.  Payload's `getClientConfig` / `getLayoutData` may include\n * callback functions or RegExp instances that seroval chokes on.  Running\n * the data through this function before returning from a `createServerFn`\n * handler keeps the transfer safe.\n *\n * For server functions whose payloads contain React elements (e.g. the\n * shared `form-state` / `render-list` / `render-document` handlers), use\n * `serializeForRsc` instead — it converts elements into RSC handles rather\n * than stripping them.\n *\n * Uses a WeakMap cache so that shared object references (e.g. the same array\n * referenced by both `doc.hasMany` and `formState.hasMany.value`) are\n * returned correctly instead of being dropped as \"already seen\".\n *\n * A separate `ancestors` WeakSet tracks objects currently being recursed into.\n * If an object is encountered while it is still on the recursion stack, the\n * reference is circular and is replaced with `undefined` to keep the output\n * JSON-safe.  Once recursion completes the object is removed from `ancestors`,\n * so sibling/cousin references to the same (fully-processed) object still\n * resolve to the cached clone.\n */\nfunction stripUnserializable(\n  value: unknown,\n  cache = new WeakMap<object, unknown>(),\n  ancestors = new WeakSet<object>(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  // RegExp: seroval's SSR bootstrap emits regex literals with broken escape\n  // sequences (e.g. `/!\\\\[.../` instead of `/!\\[.../`), crashing the client\n  // script that populates `window.$_TSR` and preventing hydration. Rich-text\n  // feature transformer regexes aren't needed on the client (they drive\n  // server-side markdown import/export), so strip them here.\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      result[key] = v\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n\nexport function toSerializable<T>(value: T): T {\n  return stripUnserializable(value) as T\n}\n"],"names":["stripUnserializable","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","toSerializable"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,SAASA,oBACPC,KAAc,EACdC,QAAQ,IAAIC,SAA0B,EACtCC,YAAY,IAAIC,SAAiB;IAEjC,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,2DAA2D;IAC3D,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAF,UAAUU,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBb,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBpB,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,MAAMiB,MAAiB,EAAE;QACzBvB,MAAMe,GAAG,CAACT,KAAKiB;QACf,KAAK,MAAMC,QAAQlB,IAAK;YACtBiB,IAAIE,IAAI,CAAC3B,oBAAoB0B,MAAMxB,OAAOE;QAC5C;QACAA,UAAUiB,MAAM,CAACb;QACjB,OAAOiB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACrB,MAAM;QAC3BJ,UAAUiB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAMsB,SAAkC,CAAC;IACzC5B,MAAMe,GAAG,CAACT,KAAKsB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACzB,KAAM;QAClC,MAAMW,IAAInB,oBAAoBQ,GAAG,CAACuB,IAAI,EAAE7B,OAAOE;QAC/C,IAAIe,MAAMb,WAAW;YACnBwB,MAAM,CAACC,IAAI,GAAGZ;QAChB;IACF;IACAf,UAAUiB,MAAM,CAACb;IACjB,OAAOsB;AACT;AAEA,OAAO,SAASI,eAAkBjC,KAAQ;IACxC,OAAOD,oBAAoBC;AAC7B"}
+{"version":3,"sources":["../../src/utilities/toSerializable.ts"],"sourcesContent":["import type { Serializable, SerializableExtensions } from '@tanstack/react-router'\n\nimport { setOwnProperty } from 'payload/shared'\n\n/** A record sanitized for TanStack's server-function transport. */\nexport type SerializableRecord = Record<string, unknown> & SerializableExtensions['TsrSerializable']\n\n/**\n * Recursively strip values that seroval cannot serialize (React elements,\n * functions, Symbols) while preserving Maps, Sets, Dates, typed arrays, etc.\n *\n * TanStack Start uses seroval to transfer server function return values to\n * the client.  Payload's `getClientConfig` / `getLayoutData` may include\n * callback functions or RegExp instances that seroval chokes on.  Running\n * the data through this function before returning from a `createServerFn`\n * handler keeps the transfer safe.\n *\n * For server functions whose payloads contain React elements (e.g. the\n * shared `form-state` / `render-list` / `render-document` handlers), use\n * `serializeForRsc` instead — it converts elements into RSC handles rather\n * than stripping them.\n *\n * Uses a WeakMap cache so that shared object references (e.g. the same array\n * referenced by both `doc.hasMany` and `formState.hasMany.value`) are\n * returned correctly instead of being dropped as \"already seen\".\n *\n * A separate `ancestors` WeakSet tracks objects currently being recursed into.\n * If an object is encountered while it is still on the recursion stack, the\n * reference is circular and is replaced with `undefined` to keep the output\n * JSON-safe.  Once recursion completes the object is removed from `ancestors`,\n * so sibling/cousin references to the same (fully-processed) object still\n * resolve to the cached clone.\n */\nfunction stripUnserializable(\n  value: unknown,\n  cache = new WeakMap<object, unknown>(),\n  ancestors = new WeakSet<object>(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    return obj\n  }\n\n  // RegExp: seroval's SSR bootstrap emits regex literals with broken escape\n  // sequences (e.g. `/!\\\\[.../` instead of `/!\\[.../`), crashing the client\n  // script that populates `window.$_TSR` and preventing hydration. Rich-text\n  // feature transformer regexes aren't needed on the client (they drive\n  // server-side markdown import/export), so strip them here.\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      setOwnProperty({ key, target: result, value: v })\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n\n/**\n * Removes values unsupported by TanStack's serializer. Trusted serializable\n * additions are merged afterward so opaque handles such as RSC payloads are\n * preserved while the source record is sanitized.\n */\nexport function toSerializable<T>(value: T): T\nexport function toSerializable(\n  value: Record<string, unknown>,\n  additions: Record<string, Serializable>,\n): SerializableRecord\nexport function toSerializable(value: unknown, additions?: Record<string, Serializable>): unknown {\n  const serialized = stripUnserializable(value)\n\n  if (additions) {\n    if (typeof serialized !== 'object' || serialized === null || Array.isArray(serialized)) {\n      throw new TypeError('Serializable additions require an object source')\n    }\n\n    const result = { ...serialized, ...additions } satisfies Record<string, unknown>\n\n    return result as SerializableRecord\n  }\n\n  return serialized\n}\n"],"names":["setOwnProperty","stripUnserializable","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","target","toSerializable","additions","serialized","TypeError"],"mappings":"AAEA,SAASA,cAAc,QAAQ,iBAAgB;AAK/C;;;;;;;;;;;;;;;;;;;;;;;;;CAyBC,GACD,SAASC,oBACPC,KAAc,EACdC,QAAQ,IAAIC,SAA0B,EACtCC,YAAY,IAAIC,SAAiB;IAEjC,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,OAAOJ;IACT;IAEA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,sEAAsE;IACtE,2DAA2D;IAC3D,IAAIA,eAAeK,QAAQ;QACzB,OAAOP;IACT;IAEAF,UAAUU,GAAG,CAACN;IAEd,IAAIA,eAAeO,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBb,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIX,IAAK;YACxB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIR,eAAec,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBpB,MAAMe,GAAG,CAACT,KAAKQ;QACf,KAAK,MAAMG,KAAKX,IAAK;YACnB,MAAMY,KAAKpB,oBAAoBmB,GAAGjB,OAAOE;YACzC,IAAIgB,OAAOd,WAAW;gBACpBU,QAAQF,GAAG,CAACM;YACd;QACF;QACAhB,UAAUiB,MAAM,CAACb;QACjB,OAAOQ;IACT;IAEA,IAAIO,MAAMC,OAAO,CAAChB,MAAM;QACtB,MAAMiB,MAAiB,EAAE;QACzBvB,MAAMe,GAAG,CAACT,KAAKiB;QACf,KAAK,MAAMC,QAAQlB,IAAK;YACtBiB,IAAIE,IAAI,CAAC3B,oBAAoB0B,MAAMxB,OAAOE;QAC5C;QACAA,UAAUiB,MAAM,CAACb;QACjB,OAAOiB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACrB,MAAM;QAC3BJ,UAAUiB,MAAM,CAACb;QACjB,OAAOA;IACT;IAEA,MAAMsB,SAAkC,CAAC;IACzC5B,MAAMe,GAAG,CAACT,KAAKsB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAACzB,KAAM;QAClC,MAAMW,IAAInB,oBAAoBQ,GAAG,CAACuB,IAAI,EAAE7B,OAAOE;QAC/C,IAAIe,MAAMb,WAAW;YACnBP,eAAe;gBAAEgC;gBAAKG,QAAQJ;gBAAQ7B,OAAOkB;YAAE;QACjD;IACF;IACAf,UAAUiB,MAAM,CAACb;IACjB,OAAOsB;AACT;AAYA,OAAO,SAASK,eAAelC,KAAc,EAAEmC,SAAwC;IACrF,MAAMC,aAAarC,oBAAoBC;IAEvC,IAAImC,WAAW;QACb,IAAI,OAAOC,eAAe,YAAYA,eAAe,QAAQd,MAAMC,OAAO,CAACa,aAAa;YACtF,MAAM,IAAIC,UAAU;QACtB;QAEA,MAAMR,SAAS;YAAE,GAAGO,UAAU;YAAE,GAAGD,SAAS;QAAC;QAE7C,OAAON;IACT;IAEA,OAAOO;AACT"}

package/dist/withPayload/config/external.d.ts

@@ -0,0 +1,44 @@
+/**
+ * SSR/RSC externalization config used by `withPayload`. Kept separate from the
+ * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.
+ */
+/**
+ * Packages externalized during dev serve (`ssr.external`). Node's loader resolves
+ * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break
+ * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment
+ * throws when transformed rather than required).
+ *
+ * Safe here whoever declared the entry: Node resolves from the importing package,
+ * so pnpm's isolated layout never applies. The build is stricter — see
+ * {@link buildBundledPackages}.
+ */
+export declare const ssrExternalPackages: string[];
+/**
+ * Entries of {@link ssrExternalPackages} that must bundle in the production build.
+ *
+ * Externalizing only works for specifiers resolvable from the project root. These
+ * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare
+ * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at
+ * runtime, or a build-time resolve failure under Nitro's re-bundle pass.
+ *
+ * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the
+ * storage leaves don't, since their adapters are already `noExternal`.
+ */
+export declare const buildBundledPackages: string[];
+/**
+ * External packages for the production `vite build` only (not dev serve).
+ *
+ * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each
+ * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
+ * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
+ * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
+ * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
+ *
+ * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
+ * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
+ * transform can resolve — an externalized copy would hit Node's raw resolver and
+ * fail on the `.js`→`.ts` mismatch.
+ */
+export declare const buildExternalPackages: string[];
+export declare const payloadNoExternalPatterns: Array<RegExp | string>;
+//# sourceMappingURL=external.d.ts.map

package/dist/withPayload/config/external.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/external.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA+BvC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAOxC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAUzC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA"}

package/dist/{vite → withPayload}/config/external.js

@@ -2,10 +2,16 @@
  * SSR/RSC externalization config used by `withPayload`. Kept separate from the
  * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.
  */ /**
- * Server-only packages (Node-only or only ever used by the server bundle).
- * These are the Vite equivalent of Next.js's `serverExternalPackages`.
+ * Packages externalized during dev serve (`ssr.external`). Node's loader resolves
+ * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break
+ * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment
+ * throws when transformed rather than required).
+ *
+ * Safe here whoever declared the entry: Node resolves from the importing package,
+ * so pnpm's isolated layout never applies. The build is stricter — see
+ * {@link buildBundledPackages}.
  */ export const ssrExternalPackages = [
-    'ajv',
+    'zod',
     'fast-uri',
     'drizzle-kit',
     'drizzle-kit/api',
@@ -36,6 +42,24 @@
     'mongodb',
     'mongoose'
 ];
+/**
+ * Entries of {@link ssrExternalPackages} that must bundle in the production build.
+ *
+ * Externalizing only works for specifiers resolvable from the project root. These
+ * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare
+ * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at
+ * runtime, or a build-time resolve failure under Nitro's re-bundle pass.
+ *
+ * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the
+ * storage leaves don't, since their adapters are already `noExternal`.
+ */ export const buildBundledPackages = [
+    'pluralize',
+    // Leaf deps of the `@payloadcms/storage-*` adapters.
+    '@aws-sdk/client-s3',
+    '@aws-sdk/s3-request-presigner',
+    '@azure/storage-blob',
+    '@google-cloud/storage'
+];
 /**
  * External packages for the production `vite build` only (not dev serve).
  *
@@ -43,7 +67,7 @@
  * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
  * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
  * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
- * `dist/`, since pnpm does not hoist it.
+ * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
  *
  * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
  * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
@@ -58,7 +82,7 @@
     '@payloadcms/db-vercel-postgres',
     '@payloadcms/db-sqlite',
     '@payloadcms/db-d1-sqlite',
-    ...ssrExternalPackages
+    ...ssrExternalPackages.filter((pkg)=>!buildBundledPackages.includes(pkg))
 ];
 export const payloadNoExternalPatterns = [
     '@payloadcms/ui',

package/dist/withPayload/config/external.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/withPayload/config/external.ts"],"sourcesContent":["/**\n * SSR/RSC externalization config used by `withPayload`. Kept separate from the\n * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.\n */\n\n/**\n * Packages externalized during dev serve (`ssr.external`). Node's loader resolves\n * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break\n * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment\n * throws when transformed rather than required).\n *\n * Safe here whoever declared the entry: Node resolves from the importing package,\n * so pnpm's isolated layout never applies. The build is stricter — see\n * {@link buildBundledPackages}.\n */\nexport const ssrExternalPackages: string[] = [\n  'zod',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database drivers + their lazily-required companions, one group per adapter.\n  // Postgres (`@payloadcms/db-postgres`, `@payloadcms/db-vercel-postgres`)\n  'pg',\n  'pg-native',\n  'pg-cloudflare',\n  // SQLite (`@payloadcms/db-sqlite`)\n  'better-sqlite3',\n  'libsql',\n  // Mongo (`@payloadcms/db-mongodb`)\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Entries of {@link ssrExternalPackages} that must bundle in the production build.\n *\n * Externalizing only works for specifiers resolvable from the project root. These\n * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare\n * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at\n * runtime, or a build-time resolve failure under Nitro's re-bundle pass.\n *\n * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the\n * storage leaves don't, since their adapters are already `noExternal`.\n */\nexport const buildBundledPackages: string[] = [\n  'pluralize',\n  // Leaf deps of the `@payloadcms/storage-*` adapters.\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@azure/storage-blob',\n  '@google-cloud/storage',\n]\n\n/**\n * External packages for the production `vite build` only (not dev serve).\n *\n * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each\n * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from\n * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under\n * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from\n * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.\n *\n * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to\n * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's\n * transform can resolve — an externalized copy would hit Node's raw resolver and\n * fail on the `.js`→`.ts` mismatch.\n */\nexport const buildExternalPackages: string[] = [\n  'payload',\n  'payload/node',\n  '@payloadcms/drizzle',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-d1-sqlite',\n  ...ssrExternalPackages.filter((pkg) => !buildBundledPackages.includes(pkg)),\n]\n\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n"],"names":["ssrExternalPackages","buildBundledPackages","buildExternalPackages","filter","pkg","includes","payloadNoExternalPatterns"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,8EAA8E;IAC9E,yEAAyE;IACzE;IACA;IACA;IACA,mCAAmC;IACnC;IACA;IACA,mCAAmC;IACnC;IACA;CACD,CAAA;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,uBAAiC;IAC5C;IACA,qDAAqD;IACrD;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,wBAAkC;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;OACGF,oBAAoBG,MAAM,CAAC,CAACC,MAAQ,CAACH,qBAAqBI,QAAQ,CAACD;CACvE,CAAA;AAED,OAAO,MAAME,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/dist/withPayload/config/optimizeDeps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"optimizeDeps.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/optimizeDeps.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAyC/C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EA+E/C,CAAA"}

package/dist/{vite → withPayload}/config/optimizeDeps.js

@@ -25,9 +25,28 @@
     // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev
     // server with a `MISSING_EXPORT` error before any test runs.
     '@azure/storage-blob',
+    // Preserve RSC client boundaries on storage admin upload handlers.
+    '@payloadcms/storage-azure',
+    '@payloadcms/storage-vercel-blob',
     '@aws-sdk/client-s3',
     '@aws-sdk/s3-request-presigner',
-    '@google-cloud/storage'
+    '@google-cloud/storage',
+    // Database adapters and their drivers. The client scan reaches them through the
+    // Payload config (it follows server functions' `import('@payload-config')`
+    // without TanStack's server-fn stripping), so Vite would pre-bundle the whole
+    // driver for a browser that never loads it. Mongoose 9 has no browser build, so
+    // that bundles `mongodb`, whose optional `@aws-sdk/credential-providers` peer —
+    // when linked, as in the monorepo via `@payloadcms/payload-cloud` — fails the
+    // same `MISSING_EXPORT` way. Published installs reach the adapter packages;
+    // the monorepo, which resolves them to source, reaches the drivers.
+    '@payloadcms/db-d1-sqlite',
+    '@payloadcms/db-mongodb',
+    '@payloadcms/db-postgres',
+    '@payloadcms/db-sqlite',
+    '@payloadcms/db-vercel-postgres',
+    '@payloadcms/drizzle',
+    'mongodb',
+    'mongoose'
 ];
 /**
  * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be
@@ -91,16 +110,16 @@
     '@payloadcms/ui > react-select > prop-types > react-is',
     '@payloadcms/ui > date-fns/locale/en-US',
     // Further late discoveries observed re-optimizing mid-run in CI cold starts
-    // (see CI logs: "✨ new dependencies optimized: @dnd-kit/modifiers / ajv /
+    // (see CI logs: "✨ new dependencies optimized: @dnd-kit/modifiers / zod /
     // dequal/lite"). The modular dashboard pulls in `@dnd-kit/modifiers` on first
     // render; form-state diffing reaches `dequal/lite` (a distinct entry point
     // from the already-listed `dequal`); client-side field validation reaches
-    // `ajv` *through `payload`* — it is `ssrExternal` server-side but still
+    // `zod` *through `payload`* — it is `ssrExternal` server-side but still
     // bundled into the client, and must be pathed via `payload` so the optimizer
     // pre-bundles the exact copy the runtime loads.
     '@payloadcms/ui > @dnd-kit/modifiers',
     '@payloadcms/ui > dequal/lite',
-    'payload > ajv',
+    'payload > zod',
     // The storage client-upload suites (esp. vercel-blob) crawl part of the
     // `payload` server runtime into the client bundle and discover these late,
     // triggering several "optimized dependencies changed. reloading" waves that
@@ -113,11 +132,12 @@
     'payload > path-to-regexp',
     'payload > console-table-printer',
     'payload > ci-info',
-    'payload > image-size',
-    'payload > image-size/fromFile',
+    'payload > image-dimensions',
     'payload > ipaddr.js',
     'payload > range-parser',
-    'payload > sanitize-filename'
+    'payload > sanitize-filename',
+    // `@azure/storage-blob` is excluded, so pre-bundle its CommonJS browser dependency explicitly.
+    '@azure/storage-blob > events'
 ];
 
 //# sourceMappingURL=optimizeDeps.js.map

package/dist/withPayload/config/optimizeDeps.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/withPayload/config/optimizeDeps.ts"],"sourcesContent":["/**\n * Client dep-optimizer config used by `withPayload`. Kept separate from the\n * SSR/RSC externalization config (`./external.ts`) so each concern stays small.\n */\n\n/**\n * Packages we know contain Node-only code or top-level side effects requiring\n * Node APIs. Excluding them from the client optimizer prevents Vite from\n * walking into their main entries and trying to bundle server-only imports\n * for the browser.\n */\nexport const optimizeDepsExcludeDefaults: string[] = [\n  'sharp',\n  '@payloadcms/ui',\n  '@payloadcms/tanstack-start',\n  'payload',\n  'pino',\n  'pino-pretty',\n  'busboy',\n  'get-tsconfig',\n  'ws',\n  'croner',\n  'prompts',\n  'file-type',\n  // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite\n  // sometimes walks these from the main package entry while scanning\n  // workspace deps, and the browser sub-bundles do not expose the\n  // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev\n  // server with a `MISSING_EXPORT` error before any test runs.\n  '@azure/storage-blob',\n  // Preserve RSC client boundaries on storage admin upload handlers.\n  '@payloadcms/storage-azure',\n  '@payloadcms/storage-vercel-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database adapters and their drivers. The client scan reaches them through the\n  // Payload config (it follows server functions' `import('@payload-config')`\n  // without TanStack's server-fn stripping), so Vite would pre-bundle the whole\n  // driver for a browser that never loads it. Mongoose 9 has no browser build, so\n  // that bundles `mongodb`, whose optional `@aws-sdk/credential-providers` peer —\n  // when linked, as in the monorepo via `@payloadcms/payload-cloud` — fails the\n  // same `MISSING_EXPORT` way. Published installs reach the adapter packages;\n  // the monorepo, which resolves them to source, reaches the drivers.\n  '@payloadcms/db-d1-sqlite',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/drizzle',\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be\n * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick\n * these up because their parent packages are in `optimizeDeps.exclude`, so we\n * list them explicitly using the `parent > child` syntax.\n *\n * Each entry below fixes a specific late-discovery re-optimization: without it,\n * Vite discovers the dep *after* its initial crawl, forcing a full dep\n * re-optimization mid-session that 404s in-flight `.vite/deps/*` chunks and\n * remounts the admin (dropping client state). This is why the list can't simply\n * be deleted — it is the \"complete first pass\" for the admin's dep graph.\n */\nexport const optimizeDepsIncludeDefaults: string[] = [\n  '@payloadcms/ui > sonner',\n  '@payloadcms/ui > @faceless-ui/modal',\n  '@payloadcms/ui > @faceless-ui/window-info',\n  '@payloadcms/ui > @faceless-ui/scroll-info',\n  '@payloadcms/ui > @dnd-kit/core',\n  '@payloadcms/ui > @dnd-kit/sortable',\n  '@payloadcms/ui > @dnd-kit/utilities',\n  '@payloadcms/ui > react-datepicker',\n  '@payloadcms/ui > react-select',\n  '@payloadcms/ui > react-select/creatable',\n  '@payloadcms/ui > react-image-crop',\n  '@payloadcms/ui > @monaco-editor/react',\n  '@payloadcms/ui > date-fns',\n  '@payloadcms/ui > date-fns/transpose',\n  '@payloadcms/ui > @date-fns/tz/date/mini',\n  '@payloadcms/ui > uuid',\n  '@payloadcms/ui > use-context-selector',\n  '@payloadcms/ui > bson-objectid',\n  '@payloadcms/ui > dequal',\n  '@payloadcms/ui > object-to-formdata',\n  '@payloadcms/ui > md5',\n  'payload > deepmerge',\n  'payload > pluralize',\n  // `scheduler` is a transitive dep of `react-dom`, not a direct dependency of\n  // the app, so a bare `'scheduler'` specifier fails to resolve from an isolated\n  // install (`test/node_modules` built with `pnpm i --ignore-workspace`), where\n  // it isn't hoisted to the top level. Path it through `react-dom` so the\n  // optimizer resolves the exact copy the runtime loads.\n  'react-dom > scheduler',\n  // `@payloadcms/ui` (in `optimizeDeps.exclude`) ships compiled output that the\n  // React Compiler rewrote to `import { c } from 'react/compiler-runtime'`.\n  // Because its parent is excluded, the optimizer never crawls in to discover\n  // this entry, so Vite serves `react/compiler-runtime` raw. That file is\n  // CommonJS (`module.exports = require(...)`), so the named `c` export can't be\n  // statically extracted and every client component throws \"does not provide an\n  // export named 'c'\". Pre-bundling it lets esbuild synthesize the named export.\n  'react/compiler-runtime',\n  // Transitive deps that Vite otherwise discovers *after* the initial crawl\n  // (react-select pulls in @floating-ui at runtime; react-is is reached via\n  // react-transition-group/prop-types; the default date-fns locale is loaded\n  // through a dynamic `date-fns/locale/${key}` import). A late discovery forces\n  // a full dep re-optimization mid-session, which 404s every in-flight\n  // `.vite/deps/*` chunk (\"Pre-transform error: file does not exist in the\n  // optimize deps directory\") and breaks the admin UI in CI cold starts.\n  // Pre-bundling them keeps the first optimization pass complete.\n  '@payloadcms/ui > react-select > @floating-ui/dom',\n  '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',\n  '@payloadcms/ui > react-select > prop-types > react-is',\n  '@payloadcms/ui > date-fns/locale/en-US',\n  // Further late discoveries observed re-optimizing mid-run in CI cold starts\n  // (see CI logs: \"✨ new dependencies optimized: @dnd-kit/modifiers / zod /\n  // dequal/lite\"). The modular dashboard pulls in `@dnd-kit/modifiers` on first\n  // render; form-state diffing reaches `dequal/lite` (a distinct entry point\n  // from the already-listed `dequal`); client-side field validation reaches\n  // `zod` *through `payload`* — it is `ssrExternal` server-side but still\n  // bundled into the client, and must be pathed via `payload` so the optimizer\n  // pre-bundles the exact copy the runtime loads.\n  '@payloadcms/ui > @dnd-kit/modifiers',\n  '@payloadcms/ui > dequal/lite',\n  'payload > zod',\n  // The storage client-upload suites (esp. vercel-blob) crawl part of the\n  // `payload` server runtime into the client bundle and discover these late,\n  // triggering several \"optimized dependencies changed. reloading\" waves that\n  // reload the page mid-test (the bulk-upload drawer's Create New button /\n  // dropzone vanish and the direct-to-bucket PUT never fires). Pre-bundle the\n  // whole observed set so the first pass is complete.\n  'payload > undici',\n  'payload > jose',\n  'payload > dataloader',\n  'payload > path-to-regexp',\n  'payload > console-table-printer',\n  'payload > ci-info',\n  'payload > image-dimensions',\n  'payload > ipaddr.js',\n  'payload > range-parser',\n  'payload > sanitize-filename',\n  // `@azure/storage-blob` is excluded, so pre-bundle its CommonJS browser dependency explicitly.\n  '@azure/storage-blob > events',\n]\n"],"names":["optimizeDepsExcludeDefaults","optimizeDepsIncludeDefaults"],"mappings":"AAAA;;;CAGC,GAED;;;;;CAKC,GACD,OAAO,MAAMA,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,sEAAsE;IACtE,6DAA6D;IAC7D;IACA,mEAAmE;IACnE;IACA;IACA;IACA;IACA;IACA,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,oEAAoE;IACpE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,uDAAuD;IACvD;IACA,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E;IACA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD;IACA;IACA;IACA,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,oDAAoD;IACpD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,+FAA+F;IAC/F;CACD,CAAA"}

package/dist/withPayload/config/scss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scss.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/scss.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;qBAEZ,MAAM,GAAG,IAAI,GAAG,GAAG;GAWvC,CAAA"}

package/dist/withPayload/config/scss.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/withPayload/config/scss.ts"],"sourcesContent":["import { createRequire } from 'node:module'\nimport { pathToFileURL } from 'node:url'\n\nconst require = createRequire(import.meta.url)\n\n/**\n * SCSS `@import`/`@use` importers applied for every Payload consumer.\n *\n * Resolves webpack-style `~@payloadcms/...` tilde specifiers (emitted by\n * first-party Payload package styles, e.g. `@payloadcms/richtext-slate`) to the\n * installed package via Node resolution. Because it goes through the package's\n * `exports` map, it picks the workspace `src` scss in the monorepo and the\n * published `dist` scss in a consumer install automatically — no per-app\n * `findFileUrl` shim needed.\n */\nexport const payloadScssImporters = [\n  {\n    findFileUrl(url: string): null | URL {\n      if (!url.startsWith('~@payloadcms/')) {\n        return null\n      }\n      try {\n        return pathToFileURL(require.resolve(url.slice(1)))\n      } catch {\n        return null\n      }\n    },\n  },\n]\n"],"names":["createRequire","pathToFileURL","require","url","payloadScssImporters","findFileUrl","startsWith","resolve","slice"],"mappings":"AAAA,SAASA,aAAa,QAAQ,cAAa;AAC3C,SAASC,aAAa,QAAQ,WAAU;AAExC,MAAMC,UAAUF,cAAc,YAAYG,GAAG;AAE7C;;;;;;;;;CASC,GACD,OAAO,MAAMC,uBAAuB;IAClC;QACEC,aAAYF,GAAW;YACrB,IAAI,CAACA,IAAIG,UAAU,CAAC,kBAAkB;gBACpC,OAAO;YACT;YACA,IAAI;gBACF,OAAOL,cAAcC,QAAQK,OAAO,CAACJ,IAAIK,KAAK,CAAC;YACjD,EAAE,OAAM;gBACN,OAAO;YACT;QACF;IACF;CACD,CAAA"}

package/dist/withPayload/devConfigReload.d.ts

@@ -0,0 +1,14 @@
+import type { PluginOption } from 'vite';
+/**
+ * Reloads Payload when `payload.config.ts`, or anything it imports, changes.
+ *
+ * Vite re-evaluates the config module on its own, but `getPayload` keeps
+ * serving its cached instance until a `DevReloadStrategy` marks it stale. This
+ * plugin only broadcasts the change; `devConfigReload.server.ts` subscribes
+ * from inside the server runtime and marks the instance, which `getPayload`
+ * then reloads on its next call.
+ */
+export declare function payloadDevConfigReload({ payloadConfigPath, }: {
+    payloadConfigPath: string;
+}): PluginOption;
+//# sourceMappingURL=devConfigReload.d.ts.map

package/dist/withPayload/devConfigReload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devConfigReload.d.ts","sourceRoot":"","sources":["../../src/withPayload/devConfigReload.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,YAAY,EAAiB,MAAM,MAAM,CAAA;AAO9E;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,EACrC,iBAAiB,GAClB,EAAE;IACD,iBAAiB,EAAE,MAAM,CAAA;CAC1B,GAAG,YAAY,CA+Cf"}

package/dist/withPayload/devConfigReload.js

@@ -0,0 +1,84 @@
+import path from 'node:path';
+import { normalizePath } from 'vite';
+import { PAYLOAD_CONFIG_CHANGED_EVENT } from '../utilities/devConfigReloadEvent.js';
+/**
+ * Reloads Payload when `payload.config.ts`, or anything it imports, changes.
+ *
+ * Vite re-evaluates the config module on its own, but `getPayload` keeps
+ * serving its cached instance until a `DevReloadStrategy` marks it stale. This
+ * plugin only broadcasts the change; `devConfigReload.server.ts` subscribes
+ * from inside the server runtime and marks the instance, which `getPayload`
+ * then reloads on its next call.
+ */ export function payloadDevConfigReload({ payloadConfigPath }) {
+    const configFile = normalizePath(path.resolve(payloadConfigPath));
+    let server;
+    // Vite runs `hotUpdate` once per environment (client, ssr, rsc) per change,
+    // sharing one timestamp; without this the notice prints three times.
+    let lastHandled = '';
+    return {
+        name: 'payload:dev-config-reload',
+        apply: 'serve',
+        configureServer (devServer) {
+            server = devServer;
+        },
+        hotUpdate ({ file, modules, timestamp }) {
+            if (!server) {
+                return;
+            }
+            const changeKey = `${file}:${timestamp}`;
+            if (changeKey === lastHandled) {
+                return;
+            }
+            if (!affectsPayloadConfig({
+                configFile,
+                file,
+                modules
+            })) {
+                return;
+            }
+            lastHandled = changeKey;
+            server.config.logger.info(`payload config changed, reloading Payload (${path.basename(file)})`, {
+                timestamp: true
+            });
+            // Broadcast to every environment rather than just `this.environment`: the
+            // changed module may only be in the graph of the environment that saw it,
+            // while the Payload instance was built in another. Each environment's
+            // runtime subscribes with its own copy of `payload`, and environments with
+            // no subscriber (e.g. `client`) simply ignore the event.
+            for (const environment of Object.values(server.environments)){
+                environment.hot.send({
+                    type: 'custom',
+                    event: PAYLOAD_CONFIG_CHANGED_EVENT
+                });
+            }
+        }
+    };
+}
+/**
+ * Whether `file` is the Payload config or something it imports. Walks *up*
+ * through importers, since the config sits at the root of that subtree.
+ */ function affectsPayloadConfig({ configFile, file, modules }) {
+    if (normalizePath(file) === configFile) {
+        return true;
+    }
+    const seen = new Set();
+    const queue = [
+        ...modules
+    ];
+    while(queue.length > 0){
+        const mod = queue.pop();
+        if (seen.has(mod)) {
+            continue;
+        }
+        seen.add(mod);
+        if (mod.file && normalizePath(mod.file) === configFile) {
+            return true;
+        }
+        for (const importer of mod.importers){
+            queue.push(importer);
+        }
+    }
+    return false;
+}
+
+//# sourceMappingURL=devConfigReload.js.map

package/dist/withPayload/devConfigReload.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/withPayload/devConfigReload.ts"],"sourcesContent":["import type { EnvironmentModuleNode, PluginOption, ViteDevServer } from 'vite'\n\nimport path from 'node:path'\nimport { normalizePath } from 'vite'\n\nimport { PAYLOAD_CONFIG_CHANGED_EVENT } from '../utilities/devConfigReloadEvent.js'\n\n/**\n * Reloads Payload when `payload.config.ts`, or anything it imports, changes.\n *\n * Vite re-evaluates the config module on its own, but `getPayload` keeps\n * serving its cached instance until a `DevReloadStrategy` marks it stale. This\n * plugin only broadcasts the change; `devConfigReload.server.ts` subscribes\n * from inside the server runtime and marks the instance, which `getPayload`\n * then reloads on its next call.\n */\nexport function payloadDevConfigReload({\n  payloadConfigPath,\n}: {\n  payloadConfigPath: string\n}): PluginOption {\n  const configFile = normalizePath(path.resolve(payloadConfigPath))\n\n  let server: undefined | ViteDevServer\n\n  // Vite runs `hotUpdate` once per environment (client, ssr, rsc) per change,\n  // sharing one timestamp; without this the notice prints three times.\n  let lastHandled = ''\n\n  return {\n    name: 'payload:dev-config-reload',\n    apply: 'serve',\n    configureServer(devServer) {\n      server = devServer\n    },\n    hotUpdate({ file, modules, timestamp }) {\n      if (!server) {\n        return\n      }\n\n      const changeKey = `${file}:${timestamp}`\n\n      if (changeKey === lastHandled) {\n        return\n      }\n\n      if (!affectsPayloadConfig({ configFile, file, modules })) {\n        return\n      }\n\n      lastHandled = changeKey\n\n      server.config.logger.info(\n        `payload config changed, reloading Payload (${path.basename(file)})`,\n        { timestamp: true },\n      )\n\n      // Broadcast to every environment rather than just `this.environment`: the\n      // changed module may only be in the graph of the environment that saw it,\n      // while the Payload instance was built in another. Each environment's\n      // runtime subscribes with its own copy of `payload`, and environments with\n      // no subscriber (e.g. `client`) simply ignore the event.\n      for (const environment of Object.values(server.environments)) {\n        environment.hot.send({ type: 'custom', event: PAYLOAD_CONFIG_CHANGED_EVENT })\n      }\n    },\n  }\n}\n\n/**\n * Whether `file` is the Payload config or something it imports. Walks *up*\n * through importers, since the config sits at the root of that subtree.\n */\nfunction affectsPayloadConfig({\n  configFile,\n  file,\n  modules,\n}: {\n  configFile: string\n  file: string\n  modules: EnvironmentModuleNode[]\n}): boolean {\n  if (normalizePath(file) === configFile) {\n    return true\n  }\n\n  const seen = new Set<EnvironmentModuleNode>()\n  const queue = [...modules]\n\n  while (queue.length > 0) {\n    const mod = queue.pop()!\n\n    if (seen.has(mod)) {\n      continue\n    }\n    seen.add(mod)\n\n    if (mod.file && normalizePath(mod.file) === configFile) {\n      return true\n    }\n\n    for (const importer of mod.importers) {\n      queue.push(importer)\n    }\n  }\n\n  return false\n}\n"],"names":["path","normalizePath","PAYLOAD_CONFIG_CHANGED_EVENT","payloadDevConfigReload","payloadConfigPath","configFile","resolve","server","lastHandled","name","apply","configureServer","devServer","hotUpdate","file","modules","timestamp","changeKey","affectsPayloadConfig","config","logger","info","basename","environment","Object","values","environments","hot","send","type","event","seen","Set","queue","length","mod","pop","has","add","importer","importers","push"],"mappings":"AAEA,OAAOA,UAAU,YAAW;AAC5B,SAASC,aAAa,QAAQ,OAAM;AAEpC,SAASC,4BAA4B,QAAQ,uCAAsC;AAEnF;;;;;;;;CAQC,GACD,OAAO,SAASC,uBAAuB,EACrCC,iBAAiB,EAGlB;IACC,MAAMC,aAAaJ,cAAcD,KAAKM,OAAO,CAACF;IAE9C,IAAIG;IAEJ,4EAA4E;IAC5E,qEAAqE;IACrE,IAAIC,cAAc;IAElB,OAAO;QACLC,MAAM;QACNC,OAAO;QACPC,iBAAgBC,SAAS;YACvBL,SAASK;QACX;QACAC,WAAU,EAAEC,IAAI,EAAEC,OAAO,EAAEC,SAAS,EAAE;YACpC,IAAI,CAACT,QAAQ;gBACX;YACF;YAEA,MAAMU,YAAY,GAAGH,KAAK,CAAC,EAAEE,WAAW;YAExC,IAAIC,cAAcT,aAAa;gBAC7B;YACF;YAEA,IAAI,CAACU,qBAAqB;gBAAEb;gBAAYS;gBAAMC;YAAQ,IAAI;gBACxD;YACF;YAEAP,cAAcS;YAEdV,OAAOY,MAAM,CAACC,MAAM,CAACC,IAAI,CACvB,CAAC,2CAA2C,EAAErB,KAAKsB,QAAQ,CAACR,MAAM,CAAC,CAAC,EACpE;gBAAEE,WAAW;YAAK;YAGpB,0EAA0E;YAC1E,0EAA0E;YAC1E,sEAAsE;YACtE,2EAA2E;YAC3E,yDAAyD;YACzD,KAAK,MAAMO,eAAeC,OAAOC,MAAM,CAAClB,OAAOmB,YAAY,EAAG;gBAC5DH,YAAYI,GAAG,CAACC,IAAI,CAAC;oBAAEC,MAAM;oBAAUC,OAAO5B;gBAA6B;YAC7E;QACF;IACF;AACF;AAEA;;;CAGC,GACD,SAASgB,qBAAqB,EAC5Bb,UAAU,EACVS,IAAI,EACJC,OAAO,EAKR;IACC,IAAId,cAAca,UAAUT,YAAY;QACtC,OAAO;IACT;IAEA,MAAM0B,OAAO,IAAIC;IACjB,MAAMC,QAAQ;WAAIlB;KAAQ;IAE1B,MAAOkB,MAAMC,MAAM,GAAG,EAAG;QACvB,MAAMC,MAAMF,MAAMG,GAAG;QAErB,IAAIL,KAAKM,GAAG,CAACF,MAAM;YACjB;QACF;QACAJ,KAAKO,GAAG,CAACH;QAET,IAAIA,IAAIrB,IAAI,IAAIb,cAAckC,IAAIrB,IAAI,MAAMT,YAAY;YACtD,OAAO;QACT;QAEA,KAAK,MAAMkC,YAAYJ,IAAIK,SAAS,CAAE;YACpCP,MAAMQ,IAAI,CAACF;QACb;IACF;IAEA,OAAO;AACT"}

package/dist/withPayload/importProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"importProtection.d.ts","sourceRoot":"","sources":["../../src/withPayload/importProtection.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAoB7D,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,OAAO,GAAG,OAAO,GAAG,IAAI,CAmC9E;AAED,eAAO,MAAM,sCAAsC,EAAE,MAAM,EAAsC,CAAA"}

package/dist/{vite → withPayload}/importProtection.js

@@ -11,7 +11,7 @@ import { builtinModules } from 'node:module';
     /^@payloadcms\/richtext-lexical\/rsc/,
     /^@payloadcms\/richtext-slate\/rsc/,
     '@payloadcms/ui/server',
-    /^@payloadcms\/tanstack-start\/(layouts|rsc|server|views\/server)/,
+    /^@payloadcms\/tanstack-start\/(layouts|rsc|server)/,
     'sharp',
     'busboy',
     'croner',
@@ -30,7 +30,7 @@ import { builtinModules } from 'node:module';
  * to permit even when they appear to cross a server/client boundary.
  */ export function onImportProtectionViolation(violation) {
     const info = violation;
-    const allowedClientFileImporters = /\/richtext-lexical\/.*\/exports\/client\/|\/tanstack-start\/.*\/views\/AdminView|\/ui\//;
+    const allowedClientFileImporters = /\/richtext-lexical\/.*\/exports\/client\/|\/ui\//;
     if (info.envType === 'server' && info.resolved?.includes('.client.') && allowedClientFileImporters.test(info.importer)) {
         return false;
     }

package/dist/withPayload/importProtection.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/withPayload/importProtection.ts"],"sourcesContent":["import { builtinModules } from 'node:module'\n\n/**\n * Specifiers that must never appear in the client module graph. These are the\n * server-only Payload entry points plus Node.js built-ins and a handful of\n * Node-only npm packages that Payload pulls in transitively.\n */\nexport const serverOnlyClientSpecifiers: Array<RegExp | string> = [\n  /^node:/,\n  new RegExp(`^(${builtinModules.join('|')})(\\\\/|$)`),\n  '@payload-config',\n  /^@payloadcms\\/next\\/rsc/,\n  /^@payloadcms\\/richtext-lexical\\/rsc/,\n  /^@payloadcms\\/richtext-slate\\/rsc/,\n  '@payloadcms/ui/server',\n  /^@payloadcms\\/tanstack-start\\/(layouts|rsc|server)/,\n  'sharp',\n  'busboy',\n  'croner',\n  'pino',\n  'pino-pretty',\n  'prompts',\n  'ws',\n  'undici',\n  'get-tsconfig',\n  /^file-type/,\n  /^react-dom\\/server/,\n]\n\n/**\n * Allowlist callback for the `tanstackStart` plugin's import-protection. These\n * are the legitimate cross-environment imports in our monorepo that we want\n * to permit even when they appear to cross a server/client boundary.\n */\nexport function onImportProtectionViolation(violation: unknown): boolean | void {\n  const info = violation as {\n    envType: 'client' | 'server'\n    importer: string\n    resolved?: string\n  }\n\n  const allowedClientFileImporters = /\\/richtext-lexical\\/.*\\/exports\\/client\\/|\\/ui\\//\n\n  if (\n    info.envType === 'server' &&\n    info.resolved?.includes('.client.') &&\n    allowedClientFileImporters.test(info.importer)\n  ) {\n    return false\n  }\n\n  if (info.importer.includes('/richtext-lexical/') && info.importer.includes('/field/Diff/')) {\n    return false\n  }\n\n  if (info.importer.includes('/packages/payload/') || info.importer.includes('/payload/dist/')) {\n    return false\n  }\n\n  if (\n    info.importer.includes('@payloadcms/ui') &&\n    (info.importer.includes('/exports/rsc/') || info.importer.includes('/rsc/index'))\n  ) {\n    return false\n  }\n\n  if (info.envType === 'server' && info.importer.includes('vite-rsc/client-references')) {\n    return false\n  }\n}\n\nexport const defaultImportProtectionIgnoreImporters: RegExp[] = [/^src\\/importMap\\.js(?:\\?.*)?$/]\n"],"names":["builtinModules","serverOnlyClientSpecifiers","RegExp","join","onImportProtectionViolation","violation","info","allowedClientFileImporters","envType","resolved","includes","test","importer","defaultImportProtectionIgnoreImporters"],"mappings":"AAAA,SAASA,cAAc,QAAQ,cAAa;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,6BAAqD;IAChE;IACA,IAAIC,OAAO,CAAC,EAAE,EAAEF,eAAeG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,SAASC,4BAA4BC,SAAkB;IAC5D,MAAMC,OAAOD;IAMb,MAAME,6BAA6B;IAEnC,IACED,KAAKE,OAAO,KAAK,YACjBF,KAAKG,QAAQ,EAAEC,SAAS,eACxBH,2BAA2BI,IAAI,CAACL,KAAKM,QAAQ,GAC7C;QACA,OAAO;IACT;IAEA,IAAIN,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,iBAAiB;QAC1F,OAAO;IACT;IAEA,IAAIJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,mBAAmB;QAC5F,OAAO;IACT;IAEA,IACEJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,qBACtBJ,CAAAA,KAAKM,QAAQ,CAACF,QAAQ,CAAC,oBAAoBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,aAAY,GAC/E;QACA,OAAO;IACT;IAEA,IAAIJ,KAAKE,OAAO,KAAK,YAAYF,KAAKM,QAAQ,CAACF,QAAQ,CAAC,+BAA+B;QACrF,OAAO;IACT;AACF;AAEA,OAAO,MAAMG,yCAAmD;IAAC;CAAgC,CAAA"}