@payloadcms/tanstack-start 4.0.0-internal.d21c039 → 4.0.0-internal.d3909a9

package/dist/utilities/serverFunctionClient.d.ts

@@ -1,29 +1,8 @@
 import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload';
-/**
- * Builds the client-side `ServerFunctionClient` wired into
- * `RootProvider.serverFunction`, given the app's `createServerFn`-based
- * dispatcher (`runServerFn`).
- *
- * Strips functions / symbols / RegExps / React elements from the args before
- * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped
- * those, but TanStack Start's seroval-based wire format errors instead. We
- * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in
- * `ServerFunctionsProvider`) that may pass the live form state — which can
- * carry stray functions — keep working without each call site sanitising.
- *
- * Delegates to `runServerFn`, so the response (including any RSC handles for
- * server-rendered custom components) is decoded by TanStack Start back into
- * renderable React nodes on the client.
- */
+/** Builds the admin dispatcher with native Flight response decoding. */
 export declare function createServerFunctionClient({ runServerFn, }: {
     runServerFn: (input: {
         data: ServerFunctionClientArgs;
-    }) => Promise<unknown>;
+    }) => Promise<Response>;
 }): ServerFunctionClient;
-/**
- * Recursively removes values TanStack Start's seroval wire format cannot
- * serialize (functions, symbols, RegExps, React elements, cyclic refs) and
- * normalizes `Date` subclasses to plain `Date`.
- */
-export declare function stripUnserializable(value: unknown, cache?: WeakMap<object, unknown>, ancestors?: WeakSet<object>): unknown;
 //# sourceMappingURL=serverFunctionClient.d.ts.map

package/dist/utilities/serverFunctionClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAI7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7E,GAAG,oBAAoB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAiB,EAC/C,SAAS,GAAE,OAAO,CAAC,MAAM,CAAiB,GACzC,OAAO,CA4FT"}
+{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAE7E,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9E,GAAG,oBAAoB,CAoBvB"}

package/dist/utilities/serverFunctionClient.js

@@ -1,114 +1,20 @@
-import { setOwnProperty } from 'payload/shared';
-/**
- * Builds the client-side `ServerFunctionClient` wired into
- * `RootProvider.serverFunction`, given the app's `createServerFn`-based
- * dispatcher (`runServerFn`).
- *
- * Strips functions / symbols / RegExps / React elements from the args before
- * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped
- * those, but TanStack Start's seroval-based wire format errors instead. We
- * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in
- * `ServerFunctionsProvider`) that may pass the live form state — which can
- * carry stray functions — keep working without each call site sanitising.
- *
- * Delegates to `runServerFn`, so the response (including any RSC handles for
- * server-rendered custom components) is decoded by TanStack Start back into
- * renderable React nodes on the client.
- */ export function createServerFunctionClient({ runServerFn }) {
+/** Builds the admin dispatcher with native Flight response decoding. */ export function createServerFunctionClient({ runServerFn }) {
     return async (args)=>{
-        const safeArgs = stripUnserializable(args);
-        return await runServerFn({
-            data: safeArgs
+        const response = await runServerFn({
+            data: args
         });
-    };
-}
-/**
- * Recursively removes values TanStack Start's seroval wire format cannot
- * serialize (functions, symbols, RegExps, React elements, cyclic refs) and
- * normalizes `Date` subclasses to plain `Date`.
- */ export function stripUnserializable(value, cache = new WeakMap(), ancestors = new WeakSet()) {
-    if (value === null || value === undefined) {
-        return value;
-    }
-    const t = typeof value;
-    if (t === 'function' || t === 'symbol') {
-        return undefined;
-    }
-    if (t !== 'object') {
-        return value;
-    }
-    const obj = value;
-    if (typeof obj.$$typeof === 'symbol') {
-        return undefined;
-    }
-    if (ancestors.has(obj)) {
-        return undefined;
-    }
-    if (cache.has(obj)) {
-        return cache.get(obj);
-    }
-    if (obj instanceof Date) {
-        // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,
-        // used by the schedule-publish drawer) are `instanceof Date` but have a
-        // different `constructor`, which TanStack Start's seroval serializer
-        // rejects with "The value [object Date] ... cannot be parsed/serialized".
-        return new Date(obj.getTime());
-    }
-    if (obj instanceof RegExp) {
-        return undefined;
-    }
-    ancestors.add(obj);
-    if (obj instanceof Map) {
-        const cleaned = new Map();
-        cache.set(obj, cleaned);
-        for (const [k, v] of obj){
-            const cv = stripUnserializable(v, cache, ancestors);
-            if (cv !== undefined) {
-                cleaned.set(k, cv);
-            }
+        if (!response.ok) {
+            throw new Error(`Payload server function failed with status ${response.status}`);
         }
-        ancestors.delete(obj);
-        return cleaned;
-    }
-    if (obj instanceof Set) {
-        const cleaned = new Set();
-        cache.set(obj, cleaned);
-        for (const v of obj){
-            const cv = stripUnserializable(v, cache, ancestors);
-            if (cv !== undefined) {
-                cleaned.add(cv);
-            }
+        if (response.headers.get('content-type')?.split(';')[0]?.trim() !== 'text/x-component') {
+            throw new Error('Expected a React Flight response from the Payload server function');
         }
-        ancestors.delete(obj);
-        return cleaned;
-    }
-    if (Array.isArray(obj)) {
-        const arr = [];
-        cache.set(obj, arr);
-        for (const item of obj){
-            arr.push(stripUnserializable(item, cache, ancestors));
+        if (!response.body) {
+            throw new Error('The Payload server function returned an empty Flight response');
         }
-        ancestors.delete(obj);
-        return arr;
-    }
-    if (ArrayBuffer.isView(obj)) {
-        ancestors.delete(obj);
-        return obj;
-    }
-    const result = {};
-    cache.set(obj, result);
-    for (const key of Object.keys(obj)){
-        const v = stripUnserializable(obj[key], cache, ancestors);
-        if (v !== undefined) {
-            setOwnProperty({
-                key,
-                target: result,
-                value: v
-            });
-        }
-    }
-    ancestors.delete(obj);
-    return result;
+        const { createFromReadableStream } = await import('@tanstack/react-start/rsc');
+        return await createFromReadableStream(response.body);
+    };
 }
 
 //# sourceMappingURL=serverFunctionClient.js.map

package/dist/utilities/serverFunctionClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\nimport { setOwnProperty } from 'payload/shared'\n\n/**\n * Builds the client-side `ServerFunctionClient` wired into\n * `RootProvider.serverFunction`, given the app's `createServerFn`-based\n * dispatcher (`runServerFn`).\n *\n * Strips functions / symbols / RegExps / React elements from the args before\n * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped\n * those, but TanStack Start's seroval-based wire format errors instead. We\n * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in\n * `ServerFunctionsProvider`) that may pass the live form state — which can\n * carry stray functions — keep working without each call site sanitising.\n *\n * Delegates to `runServerFn`, so the response (including any RSC handles for\n * server-rendered custom components) is decoded by TanStack Start back into\n * renderable React nodes on the client.\n */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<unknown>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const safeArgs = stripUnserializable(args) as ServerFunctionClientArgs\n    return await runServerFn({ data: safeArgs })\n  }) as ServerFunctionClient\n}\n\n/**\n * Recursively removes values TanStack Start's seroval wire format cannot\n * serialize (functions, symbols, RegExps, React elements, cyclic refs) and\n * normalizes `Date` subclasses to plain `Date`.\n */\nexport function stripUnserializable(\n  value: unknown,\n  cache: WeakMap<object, unknown> = new WeakMap(),\n  ancestors: WeakSet<object> = new WeakSet(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,\n    // used by the schedule-publish drawer) are `instanceof Date` but have a\n    // different `constructor`, which TanStack Start's seroval serializer\n    // rejects with \"The value [object Date] ... cannot be parsed/serialized\".\n    return new Date(obj.getTime())\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      setOwnProperty({ key, target: result, value: v })\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["setOwnProperty","createServerFunctionClient","runServerFn","args","safeArgs","stripUnserializable","data","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","getTime","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","target"],"mappings":"AAEA,SAASA,cAAc,QAAQ,iBAAgB;AAE/C;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAWC,oBAAoBF;QACrC,OAAO,MAAMD,YAAY;YAAEI,MAAMF;QAAS;IAC5C;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASC,oBACdE,KAAc,EACdC,QAAkC,IAAIC,SAAS,EAC/CC,YAA6B,IAAIC,SAAS;IAE1C,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,IAAIA,KAAKJ,IAAIK,OAAO;IAC7B;IAEA,IAAIL,eAAeM,QAAQ;QACzB,OAAOR;IACT;IAEAF,UAAUW,GAAG,CAACP;IAEd,IAAIA,eAAeQ,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBd,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIZ,IAAK;YACxB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIT,eAAee,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBrB,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAMG,KAAKZ,IAAK;YACnB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQF,GAAG,CAACM;YACd;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIO,MAAMC,OAAO,CAACjB,MAAM;QACtB,MAAMkB,MAAiB,EAAE;QACzBxB,MAAMgB,GAAG,CAACV,KAAKkB;QACf,KAAK,MAAMC,QAAQnB,IAAK;YACtBkB,IAAIE,IAAI,CAAC7B,oBAAoB4B,MAAMzB,OAAOE;QAC5C;QACAA,UAAUkB,MAAM,CAACd;QACjB,OAAOkB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACtB,MAAM;QAC3BJ,UAAUkB,MAAM,CAACd;QACjB,OAAOA;IACT;IAEA,MAAMuB,SAAkC,CAAC;IACzC7B,MAAMgB,GAAG,CAACV,KAAKuB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC1B,KAAM;QAClC,MAAMY,IAAIrB,oBAAoBS,GAAG,CAACwB,IAAI,EAAE9B,OAAOE;QAC/C,IAAIgB,MAAMd,WAAW;YACnBZ,eAAe;gBAAEsC;gBAAKG,QAAQJ;gBAAQ9B,OAAOmB;YAAE;QACjD;IACF;IACAhB,UAAUkB,MAAM,CAACd;IACjB,OAAOuB;AACT"}
+{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\n/** Builds the admin dispatcher with native Flight response decoding. */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<Response>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const response = await runServerFn({ data: args })\n\n    if (!response.ok) {\n      throw new Error(`Payload server function failed with status ${response.status}`)\n    }\n\n    if (response.headers.get('content-type')?.split(';')[0]?.trim() !== 'text/x-component') {\n      throw new Error('Expected a React Flight response from the Payload server function')\n    }\n\n    if (!response.body) {\n      throw new Error('The Payload server function returned an empty Flight response')\n    }\n\n    const { createFromReadableStream } = await import('@tanstack/react-start/rsc')\n\n    return await createFromReadableStream(response.body)\n  }) as ServerFunctionClient\n}\n"],"names":["createServerFunctionClient","runServerFn","args","response","data","ok","Error","status","headers","get","split","trim","body","createFromReadableStream"],"mappings":"AAEA,sEAAsE,GACtE,OAAO,SAASA,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAW,MAAMF,YAAY;YAAEG,MAAMF;QAAK;QAEhD,IAAI,CAACC,SAASE,EAAE,EAAE;YAChB,MAAM,IAAIC,MAAM,CAAC,2CAA2C,EAAEH,SAASI,MAAM,EAAE;QACjF;QAEA,IAAIJ,SAASK,OAAO,CAACC,GAAG,CAAC,iBAAiBC,MAAM,IAAI,CAAC,EAAE,EAAEC,WAAW,oBAAoB;YACtF,MAAM,IAAIL,MAAM;QAClB;QAEA,IAAI,CAACH,SAASS,IAAI,EAAE;YAClB,MAAM,IAAIN,MAAM;QAClB;QAEA,MAAM,EAAEO,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC;QAElD,OAAO,MAAMA,yBAAyBV,SAASS,IAAI;IACrD;AACF"}

package/dist/withPayload/config/external.d.ts

@@ -25,19 +25,13 @@ export declare const ssrExternalPackages: string[];
  * storage leaves don't, since their adapters are already `noExternal`.
  */
 export declare const buildBundledPackages: string[];
+/** Server-only package boundaries loaded directly by Node in development and production. */
+export declare const serverExternalPackages: string[];
+/** Additional installed packages that can bypass Vite's development server transforms. */
+export declare const devExternalPackages: string[];
 /**
- * External packages for the production `vite build` only (not dev serve).
- *
- * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each
- * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
- * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
- * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
- * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
- *
- * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
- * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
- * transform can resolve — an externalized copy would hit Node's raw resolver and
- * fail on the `.js`→`.ts` mismatch.
+ * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.
+ * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.
  */
 export declare const buildExternalPackages: string[];
 export declare const payloadNoExternalPatterns: Array<RegExp | string>;

package/dist/withPayload/config/external.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/external.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA+BvC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAOxC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAUzC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA"}
+{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/external.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA+BvC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAOxC,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAS1C,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAKvC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAGzC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA"}

package/dist/withPayload/config/external.js

@@ -60,20 +60,7 @@
     '@azure/storage-blob',
     '@google-cloud/storage'
 ];
-/**
- * External packages for the production `vite build` only (not dev serve).
- *
- * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each
- * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
- * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
- * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
- * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
- *
- * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
- * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
- * transform can resolve — an externalized copy would hit Node's raw resolver and
- * fail on the `.js`→`.ts` mismatch.
- */ export const buildExternalPackages = [
+/** Server-only package boundaries loaded directly by Node in development and production. */ export const serverExternalPackages = [
     'payload',
     'payload/node',
     '@payloadcms/drizzle',
@@ -81,7 +68,19 @@
     '@payloadcms/db-postgres',
     '@payloadcms/db-vercel-postgres',
     '@payloadcms/db-sqlite',
-    '@payloadcms/db-d1-sqlite',
+    '@payloadcms/db-d1-sqlite'
+];
+/** Additional installed packages that can bypass Vite's development server transforms. */ export const devExternalPackages = [
+    ...serverExternalPackages,
+    '@payloadcms/plugin-mcp',
+    'date-fns',
+    'undici'
+];
+/**
+ * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.
+ * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.
+ */ export const buildExternalPackages = [
+    ...serverExternalPackages,
     ...ssrExternalPackages.filter((pkg)=>!buildBundledPackages.includes(pkg))
 ];
 export const payloadNoExternalPatterns = [

package/dist/withPayload/config/external.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/withPayload/config/external.ts"],"sourcesContent":["/**\n * SSR/RSC externalization config used by `withPayload`. Kept separate from the\n * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.\n */\n\n/**\n * Packages externalized during dev serve (`ssr.external`). Node's loader resolves\n * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break\n * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment\n * throws when transformed rather than required).\n *\n * Safe here whoever declared the entry: Node resolves from the importing package,\n * so pnpm's isolated layout never applies. The build is stricter — see\n * {@link buildBundledPackages}.\n */\nexport const ssrExternalPackages: string[] = [\n  'zod',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database drivers + their lazily-required companions, one group per adapter.\n  // Postgres (`@payloadcms/db-postgres`, `@payloadcms/db-vercel-postgres`)\n  'pg',\n  'pg-native',\n  'pg-cloudflare',\n  // SQLite (`@payloadcms/db-sqlite`)\n  'better-sqlite3',\n  'libsql',\n  // Mongo (`@payloadcms/db-mongodb`)\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Entries of {@link ssrExternalPackages} that must bundle in the production build.\n *\n * Externalizing only works for specifiers resolvable from the project root. These\n * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare\n * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at\n * runtime, or a build-time resolve failure under Nitro's re-bundle pass.\n *\n * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the\n * storage leaves don't, since their adapters are already `noExternal`.\n */\nexport const buildBundledPackages: string[] = [\n  'pluralize',\n  // Leaf deps of the `@payloadcms/storage-*` adapters.\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@azure/storage-blob',\n  '@google-cloud/storage',\n]\n\n/**\n * External packages for the production `vite build` only (not dev serve).\n *\n * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each\n * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from\n * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under\n * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from\n * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.\n *\n * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to\n * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's\n * transform can resolve — an externalized copy would hit Node's raw resolver and\n * fail on the `.js`→`.ts` mismatch.\n */\nexport const buildExternalPackages: string[] = [\n  'payload',\n  'payload/node',\n  '@payloadcms/drizzle',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-d1-sqlite',\n  ...ssrExternalPackages.filter((pkg) => !buildBundledPackages.includes(pkg)),\n]\n\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n"],"names":["ssrExternalPackages","buildBundledPackages","buildExternalPackages","filter","pkg","includes","payloadNoExternalPatterns"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,8EAA8E;IAC9E,yEAAyE;IACzE;IACA;IACA;IACA,mCAAmC;IACnC;IACA;IACA,mCAAmC;IACnC;IACA;CACD,CAAA;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,uBAAiC;IAC5C;IACA,qDAAqD;IACrD;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,wBAAkC;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;OACGF,oBAAoBG,MAAM,CAAC,CAACC,MAAQ,CAACH,qBAAqBI,QAAQ,CAACD;CACvE,CAAA;AAED,OAAO,MAAME,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}
+{"version":3,"sources":["../../../src/withPayload/config/external.ts"],"sourcesContent":["/**\n * SSR/RSC externalization config used by `withPayload`. Kept separate from the\n * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.\n */\n\n/**\n * Packages externalized during dev serve (`ssr.external`). Node's loader resolves\n * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break\n * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment\n * throws when transformed rather than required).\n *\n * Safe here whoever declared the entry: Node resolves from the importing package,\n * so pnpm's isolated layout never applies. The build is stricter — see\n * {@link buildBundledPackages}.\n */\nexport const ssrExternalPackages: string[] = [\n  'zod',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database drivers + their lazily-required companions, one group per adapter.\n  // Postgres (`@payloadcms/db-postgres`, `@payloadcms/db-vercel-postgres`)\n  'pg',\n  'pg-native',\n  'pg-cloudflare',\n  // SQLite (`@payloadcms/db-sqlite`)\n  'better-sqlite3',\n  'libsql',\n  // Mongo (`@payloadcms/db-mongodb`)\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Entries of {@link ssrExternalPackages} that must bundle in the production build.\n *\n * Externalizing only works for specifiers resolvable from the project root. These\n * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare\n * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at\n * runtime, or a build-time resolve failure under Nitro's re-bundle pass.\n *\n * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the\n * storage leaves don't, since their adapters are already `noExternal`.\n */\nexport const buildBundledPackages: string[] = [\n  'pluralize',\n  // Leaf deps of the `@payloadcms/storage-*` adapters.\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@azure/storage-blob',\n  '@google-cloud/storage',\n]\n\n/** Server-only package boundaries loaded directly by Node in development and production. */\nexport const serverExternalPackages: string[] = [\n  'payload',\n  'payload/node',\n  '@payloadcms/drizzle',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-d1-sqlite',\n]\n\n/** Additional installed packages that can bypass Vite's development server transforms. */\nexport const devExternalPackages: string[] = [\n  ...serverExternalPackages,\n  '@payloadcms/plugin-mcp',\n  'date-fns',\n  'undici',\n]\n\n/**\n * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.\n * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.\n */\nexport const buildExternalPackages: string[] = [\n  ...serverExternalPackages,\n  ...ssrExternalPackages.filter((pkg) => !buildBundledPackages.includes(pkg)),\n]\n\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n"],"names":["ssrExternalPackages","buildBundledPackages","serverExternalPackages","devExternalPackages","buildExternalPackages","filter","pkg","includes","payloadNoExternalPatterns"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,8EAA8E;IAC9E,yEAAyE;IACzE;IACA;IACA;IACA,mCAAmC;IACnC;IACA;IACA,mCAAmC;IACnC;IACA;CACD,CAAA;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,uBAAiC;IAC5C;IACA,qDAAqD;IACrD;IACA;IACA;IACA;CACD,CAAA;AAED,0FAA0F,GAC1F,OAAO,MAAMC,yBAAmC;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,wFAAwF,GACxF,OAAO,MAAMC,sBAAgC;OACxCD;IACH;IACA;IACA;CACD,CAAA;AAED;;;CAGC,GACD,OAAO,MAAME,wBAAkC;OAC1CF;OACAF,oBAAoBK,MAAM,CAAC,CAACC,MAAQ,CAACL,qBAAqBM,QAAQ,CAACD;CACvE,CAAA;AAED,OAAO,MAAME,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/dist/withPayload/config/optimizeDeps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"optimizeDeps.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/optimizeDeps.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EAyB/C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EA+E/C,CAAA"}
+{"version":3,"file":"optimizeDeps.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/optimizeDeps.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EA0D/C,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,2BAA2B,EAAE,MAAM,EA+E/C,CAAA"}

package/dist/withPayload/config/optimizeDeps.js

@@ -27,10 +27,43 @@
     '@azure/storage-blob',
     // Preserve RSC client boundaries on storage admin upload handlers.
     '@payloadcms/storage-azure',
+    '@payloadcms/storage-r2',
     '@payloadcms/storage-vercel-blob',
     '@aws-sdk/client-s3',
     '@aws-sdk/s3-request-presigner',
-    '@google-cloud/storage'
+    '@google-cloud/storage',
+    // Packages whose admin component barrel re-exports `'use client'` modules
+    // without carrying the directive itself. Pre-bundling one puts those modules
+    // in the optimized dep chunk *and* in the `rsc` environment as client
+    // references, which `@vitejs/plugin-rsc` warns about ("client component
+    // dependency is inconsistently optimized") once per component. Barrels that
+    // start with `'use client'` (e.g. `richtext-lexical`, `plugin-stripe`) don't
+    // warn and stay pre-bundled. Only shows up in published installs; workspace
+    // source is never pre-bundled.
+    '@payloadcms/plugin-cloud-storage',
+    '@payloadcms/plugin-ecommerce',
+    '@payloadcms/plugin-form-builder',
+    '@payloadcms/plugin-import-export',
+    '@payloadcms/plugin-multi-tenant',
+    '@payloadcms/plugin-search',
+    '@payloadcms/plugin-sentry',
+    '@payloadcms/plugin-seo',
+    // Database adapters and their drivers. The client scan reaches them through the
+    // Payload config (it follows server functions' `import('@payload-config')`
+    // without TanStack's server-fn stripping), so Vite would pre-bundle the whole
+    // driver for a browser that never loads it. Mongoose 9 has no browser build, so
+    // that bundles `mongodb`, whose optional `@aws-sdk/credential-providers` peer —
+    // when linked, as in the monorepo via `@payloadcms/payload-cloud` — fails the
+    // same `MISSING_EXPORT` way. Published installs reach the adapter packages;
+    // the monorepo, which resolves them to source, reaches the drivers.
+    '@payloadcms/db-d1-sqlite',
+    '@payloadcms/db-mongodb',
+    '@payloadcms/db-postgres',
+    '@payloadcms/db-sqlite',
+    '@payloadcms/db-vercel-postgres',
+    '@payloadcms/drizzle',
+    'mongodb',
+    'mongoose'
 ];
 /**
  * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be

package/dist/withPayload/config/optimizeDeps.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/withPayload/config/optimizeDeps.ts"],"sourcesContent":["/**\n * Client dep-optimizer config used by `withPayload`. Kept separate from the\n * SSR/RSC externalization config (`./external.ts`) so each concern stays small.\n */\n\n/**\n * Packages we know contain Node-only code or top-level side effects requiring\n * Node APIs. Excluding them from the client optimizer prevents Vite from\n * walking into their main entries and trying to bundle server-only imports\n * for the browser.\n */\nexport const optimizeDepsExcludeDefaults: string[] = [\n  'sharp',\n  '@payloadcms/ui',\n  '@payloadcms/tanstack-start',\n  'payload',\n  'pino',\n  'pino-pretty',\n  'busboy',\n  'get-tsconfig',\n  'ws',\n  'croner',\n  'prompts',\n  'file-type',\n  // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite\n  // sometimes walks these from the main package entry while scanning\n  // workspace deps, and the browser sub-bundles do not expose the\n  // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev\n  // server with a `MISSING_EXPORT` error before any test runs.\n  '@azure/storage-blob',\n  // Preserve RSC client boundaries on storage admin upload handlers.\n  '@payloadcms/storage-azure',\n  '@payloadcms/storage-vercel-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n]\n\n/**\n * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be\n * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick\n * these up because their parent packages are in `optimizeDeps.exclude`, so we\n * list them explicitly using the `parent > child` syntax.\n *\n * Each entry below fixes a specific late-discovery re-optimization: without it,\n * Vite discovers the dep *after* its initial crawl, forcing a full dep\n * re-optimization mid-session that 404s in-flight `.vite/deps/*` chunks and\n * remounts the admin (dropping client state). This is why the list can't simply\n * be deleted — it is the \"complete first pass\" for the admin's dep graph.\n */\nexport const optimizeDepsIncludeDefaults: string[] = [\n  '@payloadcms/ui > sonner',\n  '@payloadcms/ui > @faceless-ui/modal',\n  '@payloadcms/ui > @faceless-ui/window-info',\n  '@payloadcms/ui > @faceless-ui/scroll-info',\n  '@payloadcms/ui > @dnd-kit/core',\n  '@payloadcms/ui > @dnd-kit/sortable',\n  '@payloadcms/ui > @dnd-kit/utilities',\n  '@payloadcms/ui > react-datepicker',\n  '@payloadcms/ui > react-select',\n  '@payloadcms/ui > react-select/creatable',\n  '@payloadcms/ui > react-image-crop',\n  '@payloadcms/ui > @monaco-editor/react',\n  '@payloadcms/ui > date-fns',\n  '@payloadcms/ui > date-fns/transpose',\n  '@payloadcms/ui > @date-fns/tz/date/mini',\n  '@payloadcms/ui > uuid',\n  '@payloadcms/ui > use-context-selector',\n  '@payloadcms/ui > bson-objectid',\n  '@payloadcms/ui > dequal',\n  '@payloadcms/ui > object-to-formdata',\n  '@payloadcms/ui > md5',\n  'payload > deepmerge',\n  'payload > pluralize',\n  // `scheduler` is a transitive dep of `react-dom`, not a direct dependency of\n  // the app, so a bare `'scheduler'` specifier fails to resolve from an isolated\n  // install (`test/node_modules` built with `pnpm i --ignore-workspace`), where\n  // it isn't hoisted to the top level. Path it through `react-dom` so the\n  // optimizer resolves the exact copy the runtime loads.\n  'react-dom > scheduler',\n  // `@payloadcms/ui` (in `optimizeDeps.exclude`) ships compiled output that the\n  // React Compiler rewrote to `import { c } from 'react/compiler-runtime'`.\n  // Because its parent is excluded, the optimizer never crawls in to discover\n  // this entry, so Vite serves `react/compiler-runtime` raw. That file is\n  // CommonJS (`module.exports = require(...)`), so the named `c` export can't be\n  // statically extracted and every client component throws \"does not provide an\n  // export named 'c'\". Pre-bundling it lets esbuild synthesize the named export.\n  'react/compiler-runtime',\n  // Transitive deps that Vite otherwise discovers *after* the initial crawl\n  // (react-select pulls in @floating-ui at runtime; react-is is reached via\n  // react-transition-group/prop-types; the default date-fns locale is loaded\n  // through a dynamic `date-fns/locale/${key}` import). A late discovery forces\n  // a full dep re-optimization mid-session, which 404s every in-flight\n  // `.vite/deps/*` chunk (\"Pre-transform error: file does not exist in the\n  // optimize deps directory\") and breaks the admin UI in CI cold starts.\n  // Pre-bundling them keeps the first optimization pass complete.\n  '@payloadcms/ui > react-select > @floating-ui/dom',\n  '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',\n  '@payloadcms/ui > react-select > prop-types > react-is',\n  '@payloadcms/ui > date-fns/locale/en-US',\n  // Further late discoveries observed re-optimizing mid-run in CI cold starts\n  // (see CI logs: \"✨ new dependencies optimized: @dnd-kit/modifiers / zod /\n  // dequal/lite\"). The modular dashboard pulls in `@dnd-kit/modifiers` on first\n  // render; form-state diffing reaches `dequal/lite` (a distinct entry point\n  // from the already-listed `dequal`); client-side field validation reaches\n  // `zod` *through `payload`* — it is `ssrExternal` server-side but still\n  // bundled into the client, and must be pathed via `payload` so the optimizer\n  // pre-bundles the exact copy the runtime loads.\n  '@payloadcms/ui > @dnd-kit/modifiers',\n  '@payloadcms/ui > dequal/lite',\n  'payload > zod',\n  // The storage client-upload suites (esp. vercel-blob) crawl part of the\n  // `payload` server runtime into the client bundle and discover these late,\n  // triggering several \"optimized dependencies changed. reloading\" waves that\n  // reload the page mid-test (the bulk-upload drawer's Create New button /\n  // dropzone vanish and the direct-to-bucket PUT never fires). Pre-bundle the\n  // whole observed set so the first pass is complete.\n  'payload > undici',\n  'payload > jose',\n  'payload > dataloader',\n  'payload > path-to-regexp',\n  'payload > console-table-printer',\n  'payload > ci-info',\n  'payload > image-dimensions',\n  'payload > ipaddr.js',\n  'payload > range-parser',\n  'payload > sanitize-filename',\n  // `@azure/storage-blob` is excluded, so pre-bundle its CommonJS browser dependency explicitly.\n  '@azure/storage-blob > events',\n]\n"],"names":["optimizeDepsExcludeDefaults","optimizeDepsIncludeDefaults"],"mappings":"AAAA;;;CAGC,GAED;;;;;CAKC,GACD,OAAO,MAAMA,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,sEAAsE;IACtE,6DAA6D;IAC7D;IACA,mEAAmE;IACnE;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,uDAAuD;IACvD;IACA,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E;IACA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD;IACA;IACA;IACA,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,oDAAoD;IACpD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,+FAA+F;IAC/F;CACD,CAAA"}
+{"version":3,"sources":["../../../src/withPayload/config/optimizeDeps.ts"],"sourcesContent":["/**\n * Client dep-optimizer config used by `withPayload`. Kept separate from the\n * SSR/RSC externalization config (`./external.ts`) so each concern stays small.\n */\n\n/**\n * Packages we know contain Node-only code or top-level side effects requiring\n * Node APIs. Excluding them from the client optimizer prevents Vite from\n * walking into their main entries and trying to bundle server-only imports\n * for the browser.\n */\nexport const optimizeDepsExcludeDefaults: string[] = [\n  'sharp',\n  '@payloadcms/ui',\n  '@payloadcms/tanstack-start',\n  'payload',\n  'pino',\n  'pino-pretty',\n  'busboy',\n  'get-tsconfig',\n  'ws',\n  'croner',\n  'prompts',\n  'file-type',\n  // Server-only SDKs used by `@payloadcms/storage-*` adapters. Vite\n  // sometimes walks these from the main package entry while scanning\n  // workspace deps, and the browser sub-bundles do not expose the\n  // server-only APIs (e.g. `BlobSASPermissions`), which crashes the dev\n  // server with a `MISSING_EXPORT` error before any test runs.\n  '@azure/storage-blob',\n  // Preserve RSC client boundaries on storage admin upload handlers.\n  '@payloadcms/storage-azure',\n  '@payloadcms/storage-r2',\n  '@payloadcms/storage-vercel-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Packages whose admin component barrel re-exports `'use client'` modules\n  // without carrying the directive itself. Pre-bundling one puts those modules\n  // in the optimized dep chunk *and* in the `rsc` environment as client\n  // references, which `@vitejs/plugin-rsc` warns about (\"client component\n  // dependency is inconsistently optimized\") once per component. Barrels that\n  // start with `'use client'` (e.g. `richtext-lexical`, `plugin-stripe`) don't\n  // warn and stay pre-bundled. Only shows up in published installs; workspace\n  // source is never pre-bundled.\n  '@payloadcms/plugin-cloud-storage',\n  '@payloadcms/plugin-ecommerce',\n  '@payloadcms/plugin-form-builder',\n  '@payloadcms/plugin-import-export',\n  '@payloadcms/plugin-multi-tenant',\n  '@payloadcms/plugin-search',\n  '@payloadcms/plugin-sentry',\n  '@payloadcms/plugin-seo',\n  // Database adapters and their drivers. The client scan reaches them through the\n  // Payload config (it follows server functions' `import('@payload-config')`\n  // without TanStack's server-fn stripping), so Vite would pre-bundle the whole\n  // driver for a browser that never loads it. Mongoose 9 has no browser build, so\n  // that bundles `mongodb`, whose optional `@aws-sdk/credential-providers` peer —\n  // when linked, as in the monorepo via `@payloadcms/payload-cloud` — fails the\n  // same `MISSING_EXPORT` way. Published installs reach the adapter packages;\n  // the monorepo, which resolves them to source, reaches the drivers.\n  '@payloadcms/db-d1-sqlite',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/drizzle',\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Transitive dependencies of `@payloadcms/ui` and `payload` that need to be\n * pre-bundled for the client. Vite's auto-discovery doesn't reliably pick\n * these up because their parent packages are in `optimizeDeps.exclude`, so we\n * list them explicitly using the `parent > child` syntax.\n *\n * Each entry below fixes a specific late-discovery re-optimization: without it,\n * Vite discovers the dep *after* its initial crawl, forcing a full dep\n * re-optimization mid-session that 404s in-flight `.vite/deps/*` chunks and\n * remounts the admin (dropping client state). This is why the list can't simply\n * be deleted — it is the \"complete first pass\" for the admin's dep graph.\n */\nexport const optimizeDepsIncludeDefaults: string[] = [\n  '@payloadcms/ui > sonner',\n  '@payloadcms/ui > @faceless-ui/modal',\n  '@payloadcms/ui > @faceless-ui/window-info',\n  '@payloadcms/ui > @faceless-ui/scroll-info',\n  '@payloadcms/ui > @dnd-kit/core',\n  '@payloadcms/ui > @dnd-kit/sortable',\n  '@payloadcms/ui > @dnd-kit/utilities',\n  '@payloadcms/ui > react-datepicker',\n  '@payloadcms/ui > react-select',\n  '@payloadcms/ui > react-select/creatable',\n  '@payloadcms/ui > react-image-crop',\n  '@payloadcms/ui > @monaco-editor/react',\n  '@payloadcms/ui > date-fns',\n  '@payloadcms/ui > date-fns/transpose',\n  '@payloadcms/ui > @date-fns/tz/date/mini',\n  '@payloadcms/ui > uuid',\n  '@payloadcms/ui > use-context-selector',\n  '@payloadcms/ui > bson-objectid',\n  '@payloadcms/ui > dequal',\n  '@payloadcms/ui > object-to-formdata',\n  '@payloadcms/ui > md5',\n  'payload > deepmerge',\n  'payload > pluralize',\n  // `scheduler` is a transitive dep of `react-dom`, not a direct dependency of\n  // the app, so a bare `'scheduler'` specifier fails to resolve from an isolated\n  // install (`test/node_modules` built with `pnpm i --ignore-workspace`), where\n  // it isn't hoisted to the top level. Path it through `react-dom` so the\n  // optimizer resolves the exact copy the runtime loads.\n  'react-dom > scheduler',\n  // `@payloadcms/ui` (in `optimizeDeps.exclude`) ships compiled output that the\n  // React Compiler rewrote to `import { c } from 'react/compiler-runtime'`.\n  // Because its parent is excluded, the optimizer never crawls in to discover\n  // this entry, so Vite serves `react/compiler-runtime` raw. That file is\n  // CommonJS (`module.exports = require(...)`), so the named `c` export can't be\n  // statically extracted and every client component throws \"does not provide an\n  // export named 'c'\". Pre-bundling it lets esbuild synthesize the named export.\n  'react/compiler-runtime',\n  // Transitive deps that Vite otherwise discovers *after* the initial crawl\n  // (react-select pulls in @floating-ui at runtime; react-is is reached via\n  // react-transition-group/prop-types; the default date-fns locale is loaded\n  // through a dynamic `date-fns/locale/${key}` import). A late discovery forces\n  // a full dep re-optimization mid-session, which 404s every in-flight\n  // `.vite/deps/*` chunk (\"Pre-transform error: file does not exist in the\n  // optimize deps directory\") and breaks the admin UI in CI cold starts.\n  // Pre-bundling them keeps the first optimization pass complete.\n  '@payloadcms/ui > react-select > @floating-ui/dom',\n  '@payloadcms/ui > react-select > @floating-ui/dom > @floating-ui/core',\n  '@payloadcms/ui > react-select > prop-types > react-is',\n  '@payloadcms/ui > date-fns/locale/en-US',\n  // Further late discoveries observed re-optimizing mid-run in CI cold starts\n  // (see CI logs: \"✨ new dependencies optimized: @dnd-kit/modifiers / zod /\n  // dequal/lite\"). The modular dashboard pulls in `@dnd-kit/modifiers` on first\n  // render; form-state diffing reaches `dequal/lite` (a distinct entry point\n  // from the already-listed `dequal`); client-side field validation reaches\n  // `zod` *through `payload`* — it is `ssrExternal` server-side but still\n  // bundled into the client, and must be pathed via `payload` so the optimizer\n  // pre-bundles the exact copy the runtime loads.\n  '@payloadcms/ui > @dnd-kit/modifiers',\n  '@payloadcms/ui > dequal/lite',\n  'payload > zod',\n  // The storage client-upload suites (esp. vercel-blob) crawl part of the\n  // `payload` server runtime into the client bundle and discover these late,\n  // triggering several \"optimized dependencies changed. reloading\" waves that\n  // reload the page mid-test (the bulk-upload drawer's Create New button /\n  // dropzone vanish and the direct-to-bucket PUT never fires). Pre-bundle the\n  // whole observed set so the first pass is complete.\n  'payload > undici',\n  'payload > jose',\n  'payload > dataloader',\n  'payload > path-to-regexp',\n  'payload > console-table-printer',\n  'payload > ci-info',\n  'payload > image-dimensions',\n  'payload > ipaddr.js',\n  'payload > range-parser',\n  'payload > sanitize-filename',\n  // `@azure/storage-blob` is excluded, so pre-bundle its CommonJS browser dependency explicitly.\n  '@azure/storage-blob > events',\n]\n"],"names":["optimizeDepsExcludeDefaults","optimizeDepsIncludeDefaults"],"mappings":"AAAA;;;CAGC,GAED;;;;;CAKC,GACD,OAAO,MAAMA,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,kEAAkE;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,sEAAsE;IACtE,6DAA6D;IAC7D;IACA,mEAAmE;IACnE;IACA;IACA;IACA;IACA;IACA;IACA,0EAA0E;IAC1E,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,+BAA+B;IAC/B;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,gFAAgF;IAChF,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,oEAAoE;IACpE;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;CAWC,GACD,OAAO,MAAMC,8BAAwC;IACnD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,6EAA6E;IAC7E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,uDAAuD;IACvD;IACA,8EAA8E;IAC9E,0EAA0E;IAC1E,4EAA4E;IAC5E,wEAAwE;IACxE,+EAA+E;IAC/E,8EAA8E;IAC9E,+EAA+E;IAC/E;IACA,0EAA0E;IAC1E,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,qEAAqE;IACrE,yEAAyE;IACzE,uEAAuE;IACvE,gEAAgE;IAChE;IACA;IACA;IACA;IACA,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,gDAAgD;IAChD;IACA;IACA;IACA,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,4EAA4E;IAC5E,oDAAoD;IACpD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,+FAA+F;IAC/F;CACD,CAAA"}

package/dist/withPayload/importProtection.js

@@ -11,7 +11,7 @@ import { builtinModules } from 'node:module';
     /^@payloadcms\/richtext-lexical\/rsc/,
     /^@payloadcms\/richtext-slate\/rsc/,
     '@payloadcms/ui/server',
-    /^@payloadcms\/tanstack-start\/(layouts|rsc|server)/,
+    /^@payloadcms\/tanstack-start\/(layouts|rest|rsc|server)/,
     'sharp',
     'busboy',
     'croner',

package/dist/withPayload/importProtection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/withPayload/importProtection.ts"],"sourcesContent":["import { builtinModules } from 'node:module'\n\n/**\n * Specifiers that must never appear in the client module graph. These are the\n * server-only Payload entry points plus Node.js built-ins and a handful of\n * Node-only npm packages that Payload pulls in transitively.\n */\nexport const serverOnlyClientSpecifiers: Array<RegExp | string> = [\n  /^node:/,\n  new RegExp(`^(${builtinModules.join('|')})(\\\\/|$)`),\n  '@payload-config',\n  /^@payloadcms\\/next\\/rsc/,\n  /^@payloadcms\\/richtext-lexical\\/rsc/,\n  /^@payloadcms\\/richtext-slate\\/rsc/,\n  '@payloadcms/ui/server',\n  /^@payloadcms\\/tanstack-start\\/(layouts|rsc|server)/,\n  'sharp',\n  'busboy',\n  'croner',\n  'pino',\n  'pino-pretty',\n  'prompts',\n  'ws',\n  'undici',\n  'get-tsconfig',\n  /^file-type/,\n  /^react-dom\\/server/,\n]\n\n/**\n * Allowlist callback for the `tanstackStart` plugin's import-protection. These\n * are the legitimate cross-environment imports in our monorepo that we want\n * to permit even when they appear to cross a server/client boundary.\n */\nexport function onImportProtectionViolation(violation: unknown): boolean | void {\n  const info = violation as {\n    envType: 'client' | 'server'\n    importer: string\n    resolved?: string\n  }\n\n  const allowedClientFileImporters = /\\/richtext-lexical\\/.*\\/exports\\/client\\/|\\/ui\\//\n\n  if (\n    info.envType === 'server' &&\n    info.resolved?.includes('.client.') &&\n    allowedClientFileImporters.test(info.importer)\n  ) {\n    return false\n  }\n\n  if (info.importer.includes('/richtext-lexical/') && info.importer.includes('/field/Diff/')) {\n    return false\n  }\n\n  if (info.importer.includes('/packages/payload/') || info.importer.includes('/payload/dist/')) {\n    return false\n  }\n\n  if (\n    info.importer.includes('@payloadcms/ui') &&\n    (info.importer.includes('/exports/rsc/') || info.importer.includes('/rsc/index'))\n  ) {\n    return false\n  }\n\n  if (info.envType === 'server' && info.importer.includes('vite-rsc/client-references')) {\n    return false\n  }\n}\n\nexport const defaultImportProtectionIgnoreImporters: RegExp[] = [/^src\\/importMap\\.js(?:\\?.*)?$/]\n"],"names":["builtinModules","serverOnlyClientSpecifiers","RegExp","join","onImportProtectionViolation","violation","info","allowedClientFileImporters","envType","resolved","includes","test","importer","defaultImportProtectionIgnoreImporters"],"mappings":"AAAA,SAASA,cAAc,QAAQ,cAAa;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,6BAAqD;IAChE;IACA,IAAIC,OAAO,CAAC,EAAE,EAAEF,eAAeG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,SAASC,4BAA4BC,SAAkB;IAC5D,MAAMC,OAAOD;IAMb,MAAME,6BAA6B;IAEnC,IACED,KAAKE,OAAO,KAAK,YACjBF,KAAKG,QAAQ,EAAEC,SAAS,eACxBH,2BAA2BI,IAAI,CAACL,KAAKM,QAAQ,GAC7C;QACA,OAAO;IACT;IAEA,IAAIN,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,iBAAiB;QAC1F,OAAO;IACT;IAEA,IAAIJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,mBAAmB;QAC5F,OAAO;IACT;IAEA,IACEJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,qBACtBJ,CAAAA,KAAKM,QAAQ,CAACF,QAAQ,CAAC,oBAAoBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,aAAY,GAC/E;QACA,OAAO;IACT;IAEA,IAAIJ,KAAKE,OAAO,KAAK,YAAYF,KAAKM,QAAQ,CAACF,QAAQ,CAAC,+BAA+B;QACrF,OAAO;IACT;AACF;AAEA,OAAO,MAAMG,yCAAmD;IAAC;CAAgC,CAAA"}
+{"version":3,"sources":["../../src/withPayload/importProtection.ts"],"sourcesContent":["import { builtinModules } from 'node:module'\n\n/**\n * Specifiers that must never appear in the client module graph. These are the\n * server-only Payload entry points plus Node.js built-ins and a handful of\n * Node-only npm packages that Payload pulls in transitively.\n */\nexport const serverOnlyClientSpecifiers: Array<RegExp | string> = [\n  /^node:/,\n  new RegExp(`^(${builtinModules.join('|')})(\\\\/|$)`),\n  '@payload-config',\n  /^@payloadcms\\/next\\/rsc/,\n  /^@payloadcms\\/richtext-lexical\\/rsc/,\n  /^@payloadcms\\/richtext-slate\\/rsc/,\n  '@payloadcms/ui/server',\n  /^@payloadcms\\/tanstack-start\\/(layouts|rest|rsc|server)/,\n  'sharp',\n  'busboy',\n  'croner',\n  'pino',\n  'pino-pretty',\n  'prompts',\n  'ws',\n  'undici',\n  'get-tsconfig',\n  /^file-type/,\n  /^react-dom\\/server/,\n]\n\n/**\n * Allowlist callback for the `tanstackStart` plugin's import-protection. These\n * are the legitimate cross-environment imports in our monorepo that we want\n * to permit even when they appear to cross a server/client boundary.\n */\nexport function onImportProtectionViolation(violation: unknown): boolean | void {\n  const info = violation as {\n    envType: 'client' | 'server'\n    importer: string\n    resolved?: string\n  }\n\n  const allowedClientFileImporters = /\\/richtext-lexical\\/.*\\/exports\\/client\\/|\\/ui\\//\n\n  if (\n    info.envType === 'server' &&\n    info.resolved?.includes('.client.') &&\n    allowedClientFileImporters.test(info.importer)\n  ) {\n    return false\n  }\n\n  if (info.importer.includes('/richtext-lexical/') && info.importer.includes('/field/Diff/')) {\n    return false\n  }\n\n  if (info.importer.includes('/packages/payload/') || info.importer.includes('/payload/dist/')) {\n    return false\n  }\n\n  if (\n    info.importer.includes('@payloadcms/ui') &&\n    (info.importer.includes('/exports/rsc/') || info.importer.includes('/rsc/index'))\n  ) {\n    return false\n  }\n\n  if (info.envType === 'server' && info.importer.includes('vite-rsc/client-references')) {\n    return false\n  }\n}\n\nexport const defaultImportProtectionIgnoreImporters: RegExp[] = [/^src\\/importMap\\.js(?:\\?.*)?$/]\n"],"names":["builtinModules","serverOnlyClientSpecifiers","RegExp","join","onImportProtectionViolation","violation","info","allowedClientFileImporters","envType","resolved","includes","test","importer","defaultImportProtectionIgnoreImporters"],"mappings":"AAAA,SAASA,cAAc,QAAQ,cAAa;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,6BAAqD;IAChE;IACA,IAAIC,OAAO,CAAC,EAAE,EAAEF,eAAeG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,SAASC,4BAA4BC,SAAkB;IAC5D,MAAMC,OAAOD;IAMb,MAAME,6BAA6B;IAEnC,IACED,KAAKE,OAAO,KAAK,YACjBF,KAAKG,QAAQ,EAAEC,SAAS,eACxBH,2BAA2BI,IAAI,CAACL,KAAKM,QAAQ,GAC7C;QACA,OAAO;IACT;IAEA,IAAIN,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,iBAAiB;QAC1F,OAAO;IACT;IAEA,IAAIJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,mBAAmB;QAC5F,OAAO;IACT;IAEA,IACEJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,qBACtBJ,CAAAA,KAAKM,QAAQ,CAACF,QAAQ,CAAC,oBAAoBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,aAAY,GAC/E;QACA,OAAO;IACT;IAEA,IAAIJ,KAAKE,OAAO,KAAK,YAAYF,KAAKM,QAAQ,CAACF,QAAQ,CAAC,+BAA+B;QACrF,OAAO;IACT;AACF;AAEA,OAAO,MAAMG,yCAAmD;IAAC;CAAgC,CAAA"}

package/dist/withPayload/index.d.ts

@@ -5,10 +5,16 @@ import rsc from '@vitejs/plugin-rsc';
 export type WithPayloadOptions = {
     /** Extra import-protection `ignoreImporters` patterns for the TanStack Start plugin. */
     additionalIgnoreImporters?: RegExp[];
-    /** Route id of Payload's admin layout, eager-loaded instead of code-split. Defaults to `'/_payload'`. */
-    adminRouteId?: string;
     /** Extra globs exempted from the `.client.*` SSR denial (beyond the default node_modules exemption). */
     clientDenialExcludeFiles?: string[];
+    /** Transform server packages in development. Enable when linking Payload source. Defaults to `false`. */
+    devBundleServerPackages?: boolean;
+    /**
+     * Packages added to `ssr.external` on dev serve only (the build bundles them).
+     * List CommonJS deps that 500 with `__cjs_module_runner_transform` — the RSC
+     * plugin's CJS-to-ESM rewrite breaks on their circular `require`s.
+     */
+    devServerExternalPackages?: string[];
     /** Path to the user's `payload.config.ts` (required) */
     payloadConfigPath: string;
     /** TanStack router routes directory relative to `srcDirectory`. Defaults to `'app'` */
@@ -81,17 +87,11 @@ export declare function payloadRscOptions(): NonNullable<Parameters<typeof rsc>[
  * with `ERR_MODULE_NOT_FOUND` on the first request.
  */
 export declare function payloadNitroOptions(): PayloadNitroOptions;
-/** `@vitejs/plugin-react` options for Payload: transform every `.[jt]sx?` file. */
+/** Transforms application and workspace source without refreshing installed dependencies. */
 export declare function payloadReactOptions(): NonNullable<Parameters<typeof viteReact>[0]>;
 export type PayloadTanstackStartOptionsArgs = {
     /** Additional import-protection `ignoreImporters` patterns. */
     additionalIgnoreImporters?: RegExp[];
-    /**
-     * Route id of Payload's admin layout route, eager-loaded (not code-split) so it
-     * hydrates on first paint. It and its children skip splitting; host routes keep
-     * TanStack's default. Defaults to `'/_payload'` (the `_payload.tsx` convention).
-     */
-    adminRouteId?: string;
     /**
      * Extra globs exempted from TanStack's `.client.*` SSR denial, on top of the
      * default node_modules exemption. Needed only when Payload's own `.client.*`
@@ -104,8 +104,8 @@ export type PayloadTanstackStartOptionsArgs = {
     srcDirectory?: string;
 };
 /**
- * The `tanstackStart` options Payload's admin requires (import-protection and
- * code-splitting). TanStack Start is one-per-app, so a host that already runs it
+ * The `tanstackStart` options Payload's admin requires (import protection and
+ * route discovery). TanStack Start is one-per-app, so a host that already runs it
  * should merge these into its single `tanstackStart` call.
  */
 export declare function payloadTanstackStartOptions(args?: PayloadTanstackStartOptionsArgs): NonNullable<Parameters<typeof tanstackStart>[0]>;

package/dist/withPayload/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/withPayload/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAwB,UAAU,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAA;AAI3F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,SAAS,MAAM,sBAAsB,CAAA;AAC5C,OAAO,GAAG,MAAM,oBAAoB,CAAA;AAyEpC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,wFAAwF;IACxF,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,yGAAyG;IACzG,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wGAAwG;IACxG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAA;IACzB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wFAAwF;IACxF,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED,mIAAmI;AACnI,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,SAAS,CAAA;IACd,qFAAqF;IACrF,aAAa,EAAE,oBAAoB,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,UAAU,CAAA;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GAAG,kBAAkB,EACrC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CA0HpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAElF;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,+DAA+D;IAC/D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,+BAAoC,GACzC,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAwClD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/withPayload/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAwB,UAAU,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAA;AAI3F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,SAAS,MAAM,sBAAsB,CAAA;AAC5C,OAAO,GAAG,MAAM,oBAAoB,CAAA;AA0EpC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,wFAAwF;IACxF,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wGAAwG;IACxG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,yGAAyG;IACzG,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAA;IACzB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wFAAwF;IACxF,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED,mIAAmI;AACnI,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,SAAS,CAAA;IACd,qFAAqF;IACrF,aAAa,EAAE,oBAAoB,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,UAAU,CAAA;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GAAG,kBAAkB,EACrC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CA2IpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAElF;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,+DAA+D;IAC/D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,+BAAoC,GACzC,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAgClD"}

package/dist/withPayload/index.js

@@ -5,7 +5,7 @@ import viteReact from '@vitejs/plugin-react';
 import rsc from '@vitejs/plugin-rsc';
 import path from 'node:path';
 import { createLogger, mergeConfig } from 'vite';
-import { buildExternalPackages, payloadNoExternalPatterns, ssrExternalPackages } from './config/external.js';
+import { buildExternalPackages, devExternalPackages, payloadNoExternalPatterns, ssrExternalPackages } from './config/external.js';
 import { optimizeDepsExcludeDefaults, optimizeDepsIncludeDefaults } from './config/optimizeDeps.js';
 import { payloadScssImporters } from './config/scss.js';
 import { payloadDevConfigReload } from './devConfigReload.js';
@@ -86,7 +86,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
  * )
  * ```
  */ export function withPayload(build, options) {
-    const { additionalIgnoreImporters = [], adminRouteId, clientDenialExcludeFiles = [], payloadConfigPath, routesDirectory = 'app', silenceDependencyWarnings = true, srcDirectory = 'src', vite } = options;
+    const { additionalIgnoreImporters = [], clientDenialExcludeFiles = [], devBundleServerPackages = false, devServerExternalPackages = [], payloadConfigPath, routesDirectory = 'app', silenceDependencyWarnings = true, srcDirectory = 'src', vite } = options;
     return (env)=>{
         // `pluralize` ships a UMD wrapper that throws when run through Vite's dev SSR
         // transform, so dev serve keeps it external and lets Node require it.
@@ -106,7 +106,16 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
         // externalizes the package boundaries (`buildExternalPackages`) and drops
         // `pluralize` so it bundles — leaving it in `ssr.external` here would win over
         // `noExternal` and re-emit the bare specifier.
-        const ssrExternal = isBuild ? buildExternalPackages : ssrExternalPackages;
+        // Dev serve also honors `devServerExternalPackages`, the app's own CJS
+        // dependencies that break under the RSC plugin's CJS-to-ESM rewrite; the build
+        // needs none of it, since Rollup bundles CJS correctly.
+        const ssrExternal = isBuild ? buildExternalPackages : [
+            ...new Set([
+                ...devBundleServerPackages ? [] : devExternalPackages,
+                ...devServerExternalPackages,
+                ...ssrExternalPackages
+            ])
+        ];
         const base = {
             build: {
                 cssMinify: 'esbuild'
@@ -133,6 +142,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
                         }
                     },
                     resolve: {
+                        external: isBuild ? undefined : ssrExternal,
                         noExternal: noExternalPatterns
                     }
                 },
@@ -143,6 +153,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
                         }
                     },
                     resolve: {
+                        external: isBuild ? undefined : ssrExternal,
                         noExternal: noExternalPatterns
                     }
                 }
@@ -201,7 +212,6 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
             rsc: payloadRscOptions(),
             tanstackStart: payloadTanstackStartOptions({
                 additionalIgnoreImporters,
-                adminRouteId,
                 clientDenialExcludeFiles,
                 routesDirectory,
                 srcDirectory
@@ -240,24 +250,27 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
         ]
     };
 }
-/** `@vitejs/plugin-react` options for Payload: transform every `.[jt]sx?` file. */ export function payloadReactOptions() {
+/** Transforms application and workspace source without refreshing installed dependencies. */ export function payloadReactOptions() {
     return {
-        exclude: [],
+        exclude: /node_modules/,
         include: /\.[jt]sx?$/
     };
 }
 /**
- * The `tanstackStart` options Payload's admin requires (import-protection and
- * code-splitting). TanStack Start is one-per-app, so a host that already runs it
+ * The `tanstackStart` options Payload's admin requires (import protection and
+ * route discovery). TanStack Start is one-per-app, so a host that already runs it
  * should merge these into its single `tanstackStart` call.
  */ export function payloadTanstackStartOptions(args = {}) {
-    const { additionalIgnoreImporters = [], adminRouteId = '/_payload', clientDenialExcludeFiles = [], routesDirectory = 'app', srcDirectory = 'src' } = args;
+    const { additionalIgnoreImporters = [], clientDenialExcludeFiles = [], routesDirectory = 'app', srcDirectory = 'src' } = args;
     return {
         importProtection: {
             client: {
                 excludeFiles: [],
                 specifiers: serverOnlyClientSpecifiers
             },
+            exclude: [
+                '**/node_modules/**'
+            ],
             ignoreImporters: [
                 ...defaultImportProtectionIgnoreImporters,
                 ...additionalIgnoreImporters
@@ -280,13 +293,6 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
             }
         },
         router: {
-            codeSplittingOptions: {
-                // Eager-load only Payload's admin routes so they hydrate on first paint —
-                // a split admin renders but isn't interactive until its lazy `?tsr-split=`
-                // chunk lands. Returning `[]` disables splitting for a route; `undefined`
-                // lets host routes keep TanStack's default per-route splitting.
-                splitBehavior: ({ routeId })=>routeId === adminRouteId || routeId.startsWith(`${adminRouteId}/`) ? [] : undefined
-            },
             // Ignore generated importMap files and colocated `*.functions.ts` modules
             // (they define `createServerFn`s, not routes).
             routeFileIgnorePattern: 'importMap\\.(?:d\\.ts|js|server\\.ts)$|\\.functions\\.',