@payloadcms/tanstack-start 4.0.0-internal.ea6e8f8 → 4.0.0-internal.ec73d44

package/dist/routes/rest/index.js

@@ -1,16 +1,17 @@
+import '../../utilities/devConfigReload.server.js';
 /**
  * Builds the method handlers for the Payload REST/GraphQL catch-all
  * (`/_payload/api/$`). The app supplies `getConfig` (an `@payload-config`
  * import) since the package cannot resolve the consumer's config.
  *
- * Imported from `@payloadcms/tanstack-start/server` (not the root barrel) so
- * the server-only `handleAPIRoute` graph never reaches the client bundle.
+ * Imported from `@payloadcms/tanstack-start/routes` so API routes do not load
+ * the admin rendering graph from the shared server entrypoint.
  *
  * Spread the result into a literal `server.handlers` key so TanStack Start's
  * client compiler can statically see — and prune — the server-only route:
  *
  * ```ts
- * import { payloadApiHandlers } from '@payloadcms/tanstack-start/server'
+ * import { payloadApiHandlers } from '@payloadcms/tanstack-start/routes'
  *
  * export const Route = createFileRoute('/_payload/api/$')({
  *   server: {

package/dist/routes/rest/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/routes/rest/index.ts"],"sourcesContent":["import type { SanitizedConfig } from 'payload'\n\ntype ApiRouteHandler = (ctx: { request: Request }) => Promise<Response>\n\n/**\n * Builds the method handlers for the Payload REST/GraphQL catch-all\n * (`/_payload/api/$`). The app supplies `getConfig` (an `@payload-config`\n * import) since the package cannot resolve the consumer's config.\n *\n * Imported from `@payloadcms/tanstack-start/server` (not the root barrel) so\n * the server-only `handleAPIRoute` graph never reaches the client bundle.\n *\n * Spread the result into a literal `server.handlers` key so TanStack Start's\n * client compiler can statically see — and prune — the server-only route:\n *\n * ```ts\n * import { payloadApiHandlers } from '@payloadcms/tanstack-start/server'\n *\n * export const Route = createFileRoute('/_payload/api/$')({\n *   server: {\n *     handlers: payloadApiHandlers({ getConfig: async () => (await import('@payload-config')).default }),\n *   },\n * })\n * ```\n *\n * The compiler only strips a literal `server:` key from a route-options object\n * expression; wrapping the whole options object in a factory call hides the\n * key, leaking the config graph into the client bundle.\n */\nexport function payloadApiHandlers({\n  getConfig,\n}: {\n  getConfig: () => Promise<SanitizedConfig>\n}): Record<'DELETE' | 'GET' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT', ApiRouteHandler> {\n  const handler: ApiRouteHandler = async ({ request }) => {\n    const { handleAPIRoute } = await import('./handler.server.js')\n    return handleAPIRoute({ config: await getConfig(), request })\n  }\n\n  return {\n    DELETE: handler,\n    GET: handler,\n    OPTIONS: handler,\n    PATCH: handler,\n    POST: handler,\n    PUT: handler,\n  }\n}\n"],"names":["payloadApiHandlers","getConfig","handler","request","handleAPIRoute","config","DELETE","GET","OPTIONS","PATCH","POST","PUT"],"mappings":"AAIA;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,SAASA,mBAAmB,EACjCC,SAAS,EAGV;IACC,MAAMC,UAA2B,OAAO,EAAEC,OAAO,EAAE;QACjD,MAAM,EAAEC,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC;QACxC,OAAOA,eAAe;YAAEC,QAAQ,MAAMJ;YAAaE;QAAQ;IAC7D;IAEA,OAAO;QACLG,QAAQJ;QACRK,KAAKL;QACLM,SAASN;QACTO,OAAOP;QACPQ,MAAMR;QACNS,KAAKT;IACP;AACF"}
+{"version":3,"sources":["../../../src/routes/rest/index.ts"],"sourcesContent":["import type { SanitizedConfig } from 'payload'\n\nimport '../../utilities/devConfigReload.server.js'\n\ntype ApiRouteHandler = (ctx: { request: Request }) => Promise<Response>\n\n/**\n * Builds the method handlers for the Payload REST/GraphQL catch-all\n * (`/_payload/api/$`). The app supplies `getConfig` (an `@payload-config`\n * import) since the package cannot resolve the consumer's config.\n *\n * Imported from `@payloadcms/tanstack-start/routes` so API routes do not load\n * the admin rendering graph from the shared server entrypoint.\n *\n * Spread the result into a literal `server.handlers` key so TanStack Start's\n * client compiler can statically see — and prune — the server-only route:\n *\n * ```ts\n * import { payloadApiHandlers } from '@payloadcms/tanstack-start/routes'\n *\n * export const Route = createFileRoute('/_payload/api/$')({\n *   server: {\n *     handlers: payloadApiHandlers({ getConfig: async () => (await import('@payload-config')).default }),\n *   },\n * })\n * ```\n *\n * The compiler only strips a literal `server:` key from a route-options object\n * expression; wrapping the whole options object in a factory call hides the\n * key, leaking the config graph into the client bundle.\n */\nexport function payloadApiHandlers({\n  getConfig,\n}: {\n  getConfig: () => Promise<SanitizedConfig>\n}): Record<'DELETE' | 'GET' | 'OPTIONS' | 'PATCH' | 'POST' | 'PUT', ApiRouteHandler> {\n  const handler: ApiRouteHandler = async ({ request }) => {\n    const { handleAPIRoute } = await import('./handler.server.js')\n    return handleAPIRoute({ config: await getConfig(), request })\n  }\n\n  return {\n    DELETE: handler,\n    GET: handler,\n    OPTIONS: handler,\n    PATCH: handler,\n    POST: handler,\n    PUT: handler,\n  }\n}\n"],"names":["payloadApiHandlers","getConfig","handler","request","handleAPIRoute","config","DELETE","GET","OPTIONS","PATCH","POST","PUT"],"mappings":"AAEA,OAAO,4CAA2C;AAIlD;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GACD,OAAO,SAASA,mBAAmB,EACjCC,SAAS,EAGV;IACC,MAAMC,UAA2B,OAAO,EAAEC,OAAO,EAAE;QACjD,MAAM,EAAEC,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC;QACxC,OAAOA,eAAe;YAAEC,QAAQ,MAAMJ;YAAaE;QAAQ;IAC7D;IAEA,OAAO;QACLG,QAAQJ;QACRK,KAAKL;QACLM,SAASN;QACTO,OAAOP;QACPQ,MAAMR;QACNS,KAAKT;IACP;AACF"}

package/dist/utilities/devConfigReload.server.js

@@ -4,10 +4,8 @@ import { PAYLOAD_CONFIG_CHANGED_EVENT } from './devConfigReloadEvent.js';
  * Subscribes the Payload instance to the config-changed event that the
  * `payload:dev-config-reload` Vite plugin broadcasts.
  *
- * Imported for its side effect by `initAdminContext.server.ts`, the adapter's only
- * `getPayload` call site, so the strategy is registered before an instance can
- * be built. Registration is module-scoped on both ends: this runs inside the
- * app's server graph and so resolves the same copy of `payload` that
+ * Imported by the admin context and REST route module, so the strategy is registered before an instance can be built or a config-change event can arrive after a program reload.
+ * Registration is module-scoped on both ends: this runs inside the app's server graph and so resolves the same copy of `payload` that
  * `getPayload` is called on, and each Vite environment (`ssr`, `rsc`) registers
  * its own listener against its own copy.
  *

package/dist/utilities/devConfigReload.server.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/devConfigReload.server.ts"],"sourcesContent":["import { registerDevReloadStrategy } from 'payload'\n\nimport { PAYLOAD_CONFIG_CHANGED_EVENT } from './devConfigReloadEvent.js'\n\n/**\n * Subscribes the Payload instance to the config-changed event that the\n * `payload:dev-config-reload` Vite plugin broadcasts.\n *\n * Imported for its side effect by `initAdminContext.server.ts`, the adapter's only\n * `getPayload` call site, so the strategy is registered before an instance can\n * be built. Registration is module-scoped on both ends: this runs inside the\n * app's server graph and so resolves the same copy of `payload` that\n * `getPayload` is called on, and each Vite environment (`ssr`, `rsc`) registers\n * its own listener against its own copy.\n *\n * Vite re-evaluates this module on a program reload, which drops the listeners\n * the previous instance had collected. `getPayload` reconnects on its next call\n * because the registered strategy is a new object - see `connectDevReload`.\n *\n * `import.meta.hot` is only defined during dev serve, so this is inert in a\n * production build.\n */\nconst hot = (import.meta as unknown as { hot?: ViteHotContext }).hot\n\nif (hot) {\n  registerDevReloadStrategy(createConfigChangedStrategy({ hot }))\n}\n\n/**\n * Builds a dev reload strategy that forwards the config-changed event to every\n * connected instance.\n *\n * After a program reload, the first request to re-import this module replaces\n * the old listener with a new one, but the cached Payload instance only connects\n * to it on its next `getPayload` call - and a request such as a frontend page\n * render may never make one. An event that lands in that gap has no one to\n * notify, so it is held and replayed to the next connection instead of being\n * dropped - which would otherwise leave the instance serving the old config\n * indefinitely.\n */\nfunction createConfigChangedStrategy({ hot }: { hot: ViteHotContext }): {\n  connect: (onReload: () => void) => () => void\n} {\n  const listeners = new Set<() => void>()\n  let hasPendingReload = false\n\n  hot.on(PAYLOAD_CONFIG_CHANGED_EVENT, () => {\n    if (listeners.size === 0) {\n      hasPendingReload = true\n      return\n    }\n\n    for (const onReload of listeners) {\n      onReload()\n    }\n  })\n\n  return {\n    connect: (onReload) => {\n      listeners.add(onReload)\n\n      if (hasPendingReload) {\n        hasPendingReload = false\n        onReload()\n      }\n\n      return () => {\n        listeners.delete(onReload)\n      }\n    },\n  }\n}\n\ntype ViteHotContext = {\n  on: (event: string, cb: () => void) => void\n}\n"],"names":["registerDevReloadStrategy","PAYLOAD_CONFIG_CHANGED_EVENT","hot","createConfigChangedStrategy","listeners","Set","hasPendingReload","on","size","onReload","connect","add","delete"],"mappings":"AAAA,SAASA,yBAAyB,QAAQ,UAAS;AAEnD,SAASC,4BAA4B,QAAQ,4BAA2B;AAExE;;;;;;;;;;;;;;;;;CAiBC,GACD,MAAMC,MAAM,AAAC,YAAoDA,GAAG;AAEpE,IAAIA,KAAK;IACPF,0BAA0BG,4BAA4B;QAAED;IAAI;AAC9D;AAEA;;;;;;;;;;;CAWC,GACD,SAASC,4BAA4B,EAAED,GAAG,EAA2B;IAGnE,MAAME,YAAY,IAAIC;IACtB,IAAIC,mBAAmB;IAEvBJ,IAAIK,EAAE,CAACN,8BAA8B;QACnC,IAAIG,UAAUI,IAAI,KAAK,GAAG;YACxBF,mBAAmB;YACnB;QACF;QAEA,KAAK,MAAMG,YAAYL,UAAW;YAChCK;QACF;IACF;IAEA,OAAO;QACLC,SAAS,CAACD;YACRL,UAAUO,GAAG,CAACF;YAEd,IAAIH,kBAAkB;gBACpBA,mBAAmB;gBACnBG;YACF;YAEA,OAAO;gBACLL,UAAUQ,MAAM,CAACH;YACnB;QACF;IACF;AACF"}
+{"version":3,"sources":["../../src/utilities/devConfigReload.server.ts"],"sourcesContent":["import { registerDevReloadStrategy } from 'payload'\n\nimport { PAYLOAD_CONFIG_CHANGED_EVENT } from './devConfigReloadEvent.js'\n\n/**\n * Subscribes the Payload instance to the config-changed event that the\n * `payload:dev-config-reload` Vite plugin broadcasts.\n *\n * Imported by the admin context and REST route module, so the strategy is registered before an instance can be built or a config-change event can arrive after a program reload.\n * Registration is module-scoped on both ends: this runs inside the app's server graph and so resolves the same copy of `payload` that\n * `getPayload` is called on, and each Vite environment (`ssr`, `rsc`) registers\n * its own listener against its own copy.\n *\n * Vite re-evaluates this module on a program reload, which drops the listeners\n * the previous instance had collected. `getPayload` reconnects on its next call\n * because the registered strategy is a new object - see `connectDevReload`.\n *\n * `import.meta.hot` is only defined during dev serve, so this is inert in a\n * production build.\n */\nconst hot = (import.meta as unknown as { hot?: ViteHotContext }).hot\n\nif (hot) {\n  registerDevReloadStrategy(createConfigChangedStrategy({ hot }))\n}\n\n/**\n * Builds a dev reload strategy that forwards the config-changed event to every\n * connected instance.\n *\n * After a program reload, the first request to re-import this module replaces\n * the old listener with a new one, but the cached Payload instance only connects\n * to it on its next `getPayload` call - and a request such as a frontend page\n * render may never make one. An event that lands in that gap has no one to\n * notify, so it is held and replayed to the next connection instead of being\n * dropped - which would otherwise leave the instance serving the old config\n * indefinitely.\n */\nfunction createConfigChangedStrategy({ hot }: { hot: ViteHotContext }): {\n  connect: (onReload: () => void) => () => void\n} {\n  const listeners = new Set<() => void>()\n  let hasPendingReload = false\n\n  hot.on(PAYLOAD_CONFIG_CHANGED_EVENT, () => {\n    if (listeners.size === 0) {\n      hasPendingReload = true\n      return\n    }\n\n    for (const onReload of listeners) {\n      onReload()\n    }\n  })\n\n  return {\n    connect: (onReload) => {\n      listeners.add(onReload)\n\n      if (hasPendingReload) {\n        hasPendingReload = false\n        onReload()\n      }\n\n      return () => {\n        listeners.delete(onReload)\n      }\n    },\n  }\n}\n\ntype ViteHotContext = {\n  on: (event: string, cb: () => void) => void\n}\n"],"names":["registerDevReloadStrategy","PAYLOAD_CONFIG_CHANGED_EVENT","hot","createConfigChangedStrategy","listeners","Set","hasPendingReload","on","size","onReload","connect","add","delete"],"mappings":"AAAA,SAASA,yBAAyB,QAAQ,UAAS;AAEnD,SAASC,4BAA4B,QAAQ,4BAA2B;AAExE;;;;;;;;;;;;;;;CAeC,GACD,MAAMC,MAAM,AAAC,YAAoDA,GAAG;AAEpE,IAAIA,KAAK;IACPF,0BAA0BG,4BAA4B;QAAED;IAAI;AAC9D;AAEA;;;;;;;;;;;CAWC,GACD,SAASC,4BAA4B,EAAED,GAAG,EAA2B;IAGnE,MAAME,YAAY,IAAIC;IACtB,IAAIC,mBAAmB;IAEvBJ,IAAIK,EAAE,CAACN,8BAA8B;QACnC,IAAIG,UAAUI,IAAI,KAAK,GAAG;YACxBF,mBAAmB;YACnB;QACF;QAEA,KAAK,MAAMG,YAAYL,UAAW;YAChCK;QACF;IACF;IAEA,OAAO;QACLC,SAAS,CAACD;YACRL,UAAUO,GAAG,CAACF;YAEd,IAAIH,kBAAkB;gBACpBA,mBAAmB;gBACnBG;YACF;YAEA,OAAO;gBACLL,UAAUQ,MAAM,CAACH;YACnB;QACF;IACF;AACF"}

package/dist/utilities/serverFunctionClient.d.ts

@@ -1,29 +1,8 @@
 import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload';
-/**
- * Builds the client-side `ServerFunctionClient` wired into
- * `RootProvider.serverFunction`, given the app's `createServerFn`-based
- * dispatcher (`runServerFn`).
- *
- * Strips functions / symbols / RegExps / React elements from the args before
- * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped
- * those, but TanStack Start's seroval-based wire format errors instead. We
- * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in
- * `ServerFunctionsProvider`) that may pass the live form state — which can
- * carry stray functions — keep working without each call site sanitising.
- *
- * Delegates to `runServerFn`, so the response (including any RSC handles for
- * server-rendered custom components) is decoded by TanStack Start back into
- * renderable React nodes on the client.
- */
+/** Builds the admin dispatcher with native Flight response decoding. */
 export declare function createServerFunctionClient({ runServerFn, }: {
     runServerFn: (input: {
         data: ServerFunctionClientArgs;
-    }) => Promise<unknown>;
+    }) => Promise<Response>;
 }): ServerFunctionClient;
-/**
- * Recursively removes values TanStack Start's seroval wire format cannot
- * serialize (functions, symbols, RegExps, React elements, cyclic refs) and
- * normalizes `Date` subclasses to plain `Date`.
- */
-export declare function stripUnserializable(value: unknown, cache?: WeakMap<object, unknown>, ancestors?: WeakSet<object>): unknown;
 //# sourceMappingURL=serverFunctionClient.d.ts.map

package/dist/utilities/serverFunctionClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAI7E;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAC7E,GAAG,oBAAoB,CAKvB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAiB,EAC/C,SAAS,GAAE,OAAO,CAAC,MAAM,CAAiB,GACzC,OAAO,CA4FT"}
+{"version":3,"file":"serverFunctionClient.d.ts","sourceRoot":"","sources":["../../src/utilities/serverFunctionClient.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AAE7E,wEAAwE;AACxE,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,GACZ,EAAE;IACD,WAAW,EAAE,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,wBAAwB,CAAA;KAAE,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9E,GAAG,oBAAoB,CAoBvB"}

package/dist/utilities/serverFunctionClient.js

@@ -1,114 +1,20 @@
-import { setOwnProperty } from 'payload/shared';
-/**
- * Builds the client-side `ServerFunctionClient` wired into
- * `RootProvider.serverFunction`, given the app's `createServerFn`-based
- * dispatcher (`runServerFn`).
- *
- * Strips functions / symbols / RegExps / React elements from the args before
- * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped
- * those, but TanStack Start's seroval-based wire format errors instead. We
- * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in
- * `ServerFunctionsProvider`) that may pass the live form state — which can
- * carry stray functions — keep working without each call site sanitising.
- *
- * Delegates to `runServerFn`, so the response (including any RSC handles for
- * server-rendered custom components) is decoded by TanStack Start back into
- * renderable React nodes on the client.
- */ export function createServerFunctionClient({ runServerFn }) {
+/** Builds the admin dispatcher with native Flight response decoding. */ export function createServerFunctionClient({ runServerFn }) {
     return async (args)=>{
-        const safeArgs = stripUnserializable(args);
-        return await runServerFn({
-            data: safeArgs
+        const response = await runServerFn({
+            data: args
         });
-    };
-}
-/**
- * Recursively removes values TanStack Start's seroval wire format cannot
- * serialize (functions, symbols, RegExps, React elements, cyclic refs) and
- * normalizes `Date` subclasses to plain `Date`.
- */ export function stripUnserializable(value, cache = new WeakMap(), ancestors = new WeakSet()) {
-    if (value === null || value === undefined) {
-        return value;
-    }
-    const t = typeof value;
-    if (t === 'function' || t === 'symbol') {
-        return undefined;
-    }
-    if (t !== 'object') {
-        return value;
-    }
-    const obj = value;
-    if (typeof obj.$$typeof === 'symbol') {
-        return undefined;
-    }
-    if (ancestors.has(obj)) {
-        return undefined;
-    }
-    if (cache.has(obj)) {
-        return cache.get(obj);
-    }
-    if (obj instanceof Date) {
-        // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,
-        // used by the schedule-publish drawer) are `instanceof Date` but have a
-        // different `constructor`, which TanStack Start's seroval serializer
-        // rejects with "The value [object Date] ... cannot be parsed/serialized".
-        return new Date(obj.getTime());
-    }
-    if (obj instanceof RegExp) {
-        return undefined;
-    }
-    ancestors.add(obj);
-    if (obj instanceof Map) {
-        const cleaned = new Map();
-        cache.set(obj, cleaned);
-        for (const [k, v] of obj){
-            const cv = stripUnserializable(v, cache, ancestors);
-            if (cv !== undefined) {
-                cleaned.set(k, cv);
-            }
+        if (!response.ok) {
+            throw new Error(`Payload server function failed with status ${response.status}`);
         }
-        ancestors.delete(obj);
-        return cleaned;
-    }
-    if (obj instanceof Set) {
-        const cleaned = new Set();
-        cache.set(obj, cleaned);
-        for (const v of obj){
-            const cv = stripUnserializable(v, cache, ancestors);
-            if (cv !== undefined) {
-                cleaned.add(cv);
-            }
+        if (response.headers.get('content-type')?.split(';')[0]?.trim() !== 'text/x-component') {
+            throw new Error('Expected a React Flight response from the Payload server function');
         }
-        ancestors.delete(obj);
-        return cleaned;
-    }
-    if (Array.isArray(obj)) {
-        const arr = [];
-        cache.set(obj, arr);
-        for (const item of obj){
-            arr.push(stripUnserializable(item, cache, ancestors));
+        if (!response.body) {
+            throw new Error('The Payload server function returned an empty Flight response');
         }
-        ancestors.delete(obj);
-        return arr;
-    }
-    if (ArrayBuffer.isView(obj)) {
-        ancestors.delete(obj);
-        return obj;
-    }
-    const result = {};
-    cache.set(obj, result);
-    for (const key of Object.keys(obj)){
-        const v = stripUnserializable(obj[key], cache, ancestors);
-        if (v !== undefined) {
-            setOwnProperty({
-                key,
-                target: result,
-                value: v
-            });
-        }
-    }
-    ancestors.delete(obj);
-    return result;
+        const { createFromReadableStream } = await import('@tanstack/react-start/rsc');
+        return await createFromReadableStream(response.body);
+    };
 }
 
 //# sourceMappingURL=serverFunctionClient.js.map

package/dist/utilities/serverFunctionClient.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\nimport { setOwnProperty } from 'payload/shared'\n\n/**\n * Builds the client-side `ServerFunctionClient` wired into\n * `RootProvider.serverFunction`, given the app's `createServerFn`-based\n * dispatcher (`runServerFn`).\n *\n * Strips functions / symbols / RegExps / React elements from the args before\n * dispatching: the previous `fetch + JSON.stringify` pipeline silently dropped\n * those, but TanStack Start's seroval-based wire format errors instead. We\n * mirror the relaxed behaviour so existing callers (e.g. `getFormState` in\n * `ServerFunctionsProvider`) that may pass the live form state — which can\n * carry stray functions — keep working without each call site sanitising.\n *\n * Delegates to `runServerFn`, so the response (including any RSC handles for\n * server-rendered custom components) is decoded by TanStack Start back into\n * renderable React nodes on the client.\n */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<unknown>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const safeArgs = stripUnserializable(args) as ServerFunctionClientArgs\n    return await runServerFn({ data: safeArgs })\n  }) as ServerFunctionClient\n}\n\n/**\n * Recursively removes values TanStack Start's seroval wire format cannot\n * serialize (functions, symbols, RegExps, React elements, cyclic refs) and\n * normalizes `Date` subclasses to plain `Date`.\n */\nexport function stripUnserializable(\n  value: unknown,\n  cache: WeakMap<object, unknown> = new WeakMap(),\n  ancestors: WeakSet<object> = new WeakSet(),\n): unknown {\n  if (value === null || value === undefined) {\n    return value\n  }\n\n  const t = typeof value\n  if (t === 'function' || t === 'symbol') {\n    return undefined\n  }\n  if (t !== 'object') {\n    return value\n  }\n\n  const obj = value as Record<string, unknown>\n\n  if (typeof obj.$$typeof === 'symbol') {\n    return undefined\n  }\n\n  if (ancestors.has(obj)) {\n    return undefined\n  }\n\n  if (cache.has(obj)) {\n    return cache.get(obj)\n  }\n\n  if (obj instanceof Date) {\n    // Normalize to a plain `Date`. Subclasses (e.g. `@date-fns/tz`'s `TZDate`,\n    // used by the schedule-publish drawer) are `instanceof Date` but have a\n    // different `constructor`, which TanStack Start's seroval serializer\n    // rejects with \"The value [object Date] ... cannot be parsed/serialized\".\n    return new Date(obj.getTime())\n  }\n\n  if (obj instanceof RegExp) {\n    return undefined\n  }\n\n  ancestors.add(obj)\n\n  if (obj instanceof Map) {\n    const cleaned = new Map()\n    cache.set(obj, cleaned)\n    for (const [k, v] of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.set(k, cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (obj instanceof Set) {\n    const cleaned = new Set()\n    cache.set(obj, cleaned)\n    for (const v of obj) {\n      const cv = stripUnserializable(v, cache, ancestors)\n      if (cv !== undefined) {\n        cleaned.add(cv)\n      }\n    }\n    ancestors.delete(obj)\n    return cleaned\n  }\n\n  if (Array.isArray(obj)) {\n    const arr: unknown[] = []\n    cache.set(obj, arr)\n    for (const item of obj) {\n      arr.push(stripUnserializable(item, cache, ancestors))\n    }\n    ancestors.delete(obj)\n    return arr\n  }\n\n  if (ArrayBuffer.isView(obj)) {\n    ancestors.delete(obj)\n    return obj\n  }\n\n  const result: Record<string, unknown> = {}\n  cache.set(obj, result)\n  for (const key of Object.keys(obj)) {\n    const v = stripUnserializable(obj[key], cache, ancestors)\n    if (v !== undefined) {\n      setOwnProperty({ key, target: result, value: v })\n    }\n  }\n  ancestors.delete(obj)\n  return result\n}\n"],"names":["setOwnProperty","createServerFunctionClient","runServerFn","args","safeArgs","stripUnserializable","data","value","cache","WeakMap","ancestors","WeakSet","undefined","t","obj","$$typeof","has","get","Date","getTime","RegExp","add","Map","cleaned","set","k","v","cv","delete","Set","Array","isArray","arr","item","push","ArrayBuffer","isView","result","key","Object","keys","target"],"mappings":"AAEA,SAASA,cAAc,QAAQ,iBAAgB;AAE/C;;;;;;;;;;;;;;;CAeC,GACD,OAAO,SAASC,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAWC,oBAAoBF;QACrC,OAAO,MAAMD,YAAY;YAAEI,MAAMF;QAAS;IAC5C;AACF;AAEA;;;;CAIC,GACD,OAAO,SAASC,oBACdE,KAAc,EACdC,QAAkC,IAAIC,SAAS,EAC/CC,YAA6B,IAAIC,SAAS;IAE1C,IAAIJ,UAAU,QAAQA,UAAUK,WAAW;QACzC,OAAOL;IACT;IAEA,MAAMM,IAAI,OAAON;IACjB,IAAIM,MAAM,cAAcA,MAAM,UAAU;QACtC,OAAOD;IACT;IACA,IAAIC,MAAM,UAAU;QAClB,OAAON;IACT;IAEA,MAAMO,MAAMP;IAEZ,IAAI,OAAOO,IAAIC,QAAQ,KAAK,UAAU;QACpC,OAAOH;IACT;IAEA,IAAIF,UAAUM,GAAG,CAACF,MAAM;QACtB,OAAOF;IACT;IAEA,IAAIJ,MAAMQ,GAAG,CAACF,MAAM;QAClB,OAAON,MAAMS,GAAG,CAACH;IACnB;IAEA,IAAIA,eAAeI,MAAM;QACvB,2EAA2E;QAC3E,wEAAwE;QACxE,qEAAqE;QACrE,0EAA0E;QAC1E,OAAO,IAAIA,KAAKJ,IAAIK,OAAO;IAC7B;IAEA,IAAIL,eAAeM,QAAQ;QACzB,OAAOR;IACT;IAEAF,UAAUW,GAAG,CAACP;IAEd,IAAIA,eAAeQ,KAAK;QACtB,MAAMC,UAAU,IAAID;QACpBd,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAM,CAACE,GAAGC,EAAE,IAAIZ,IAAK;YACxB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQC,GAAG,CAACC,GAAGE;YACjB;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIT,eAAee,KAAK;QACtB,MAAMN,UAAU,IAAIM;QACpBrB,MAAMgB,GAAG,CAACV,KAAKS;QACf,KAAK,MAAMG,KAAKZ,IAAK;YACnB,MAAMa,KAAKtB,oBAAoBqB,GAAGlB,OAAOE;YACzC,IAAIiB,OAAOf,WAAW;gBACpBW,QAAQF,GAAG,CAACM;YACd;QACF;QACAjB,UAAUkB,MAAM,CAACd;QACjB,OAAOS;IACT;IAEA,IAAIO,MAAMC,OAAO,CAACjB,MAAM;QACtB,MAAMkB,MAAiB,EAAE;QACzBxB,MAAMgB,GAAG,CAACV,KAAKkB;QACf,KAAK,MAAMC,QAAQnB,IAAK;YACtBkB,IAAIE,IAAI,CAAC7B,oBAAoB4B,MAAMzB,OAAOE;QAC5C;QACAA,UAAUkB,MAAM,CAACd;QACjB,OAAOkB;IACT;IAEA,IAAIG,YAAYC,MAAM,CAACtB,MAAM;QAC3BJ,UAAUkB,MAAM,CAACd;QACjB,OAAOA;IACT;IAEA,MAAMuB,SAAkC,CAAC;IACzC7B,MAAMgB,GAAG,CAACV,KAAKuB;IACf,KAAK,MAAMC,OAAOC,OAAOC,IAAI,CAAC1B,KAAM;QAClC,MAAMY,IAAIrB,oBAAoBS,GAAG,CAACwB,IAAI,EAAE9B,OAAOE;QAC/C,IAAIgB,MAAMd,WAAW;YACnBZ,eAAe;gBAAEsC;gBAAKG,QAAQJ;gBAAQ9B,OAAOmB;YAAE;QACjD;IACF;IACAhB,UAAUkB,MAAM,CAACd;IACjB,OAAOuB;AACT"}
+{"version":3,"sources":["../../src/utilities/serverFunctionClient.ts"],"sourcesContent":["import type { ServerFunctionClient, ServerFunctionClientArgs } from 'payload'\n\n/** Builds the admin dispatcher with native Flight response decoding. */\nexport function createServerFunctionClient({\n  runServerFn,\n}: {\n  runServerFn: (input: { data: ServerFunctionClientArgs }) => Promise<Response>\n}): ServerFunctionClient {\n  return (async (args: ServerFunctionClientArgs) => {\n    const response = await runServerFn({ data: args })\n\n    if (!response.ok) {\n      throw new Error(`Payload server function failed with status ${response.status}`)\n    }\n\n    if (response.headers.get('content-type')?.split(';')[0]?.trim() !== 'text/x-component') {\n      throw new Error('Expected a React Flight response from the Payload server function')\n    }\n\n    if (!response.body) {\n      throw new Error('The Payload server function returned an empty Flight response')\n    }\n\n    const { createFromReadableStream } = await import('@tanstack/react-start/rsc')\n\n    return await createFromReadableStream(response.body)\n  }) as ServerFunctionClient\n}\n"],"names":["createServerFunctionClient","runServerFn","args","response","data","ok","Error","status","headers","get","split","trim","body","createFromReadableStream"],"mappings":"AAEA,sEAAsE,GACtE,OAAO,SAASA,2BAA2B,EACzCC,WAAW,EAGZ;IACC,OAAQ,OAAOC;QACb,MAAMC,WAAW,MAAMF,YAAY;YAAEG,MAAMF;QAAK;QAEhD,IAAI,CAACC,SAASE,EAAE,EAAE;YAChB,MAAM,IAAIC,MAAM,CAAC,2CAA2C,EAAEH,SAASI,MAAM,EAAE;QACjF;QAEA,IAAIJ,SAASK,OAAO,CAACC,GAAG,CAAC,iBAAiBC,MAAM,IAAI,CAAC,EAAE,EAAEC,WAAW,oBAAoB;YACtF,MAAM,IAAIL,MAAM;QAClB;QAEA,IAAI,CAACH,SAASS,IAAI,EAAE;YAClB,MAAM,IAAIN,MAAM;QAClB;QAEA,MAAM,EAAEO,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC;QAElD,OAAO,MAAMA,yBAAyBV,SAASS,IAAI;IACrD;AACF"}

package/dist/withPayload/config/external.d.ts

@@ -1,7 +1,3 @@
-/**
- * SSR/RSC externalization config used by `withPayload`. Kept separate from the
- * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.
- */
 /**
  * Packages externalized during dev serve (`ssr.external`). Node's loader resolves
  * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break
@@ -25,19 +21,13 @@ export declare const ssrExternalPackages: string[];
  * storage leaves don't, since their adapters are already `noExternal`.
  */
 export declare const buildBundledPackages: string[];
+/** Server-only package boundaries loaded directly by Node in development and production. */
+export declare const serverExternalPackages: string[];
+/** Additional installed packages that can bypass Vite's development server transforms. */
+export declare const devExternalPackages: string[];
 /**
- * External packages for the production `vite build` only (not dev serve).
- *
- * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each
- * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
- * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
- * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
- * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
- *
- * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
- * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
- * transform can resolve — an externalized copy would hit Node's raw resolver and
- * fail on the `.js`→`.ts` mismatch.
+ * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.
+ * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.
  */
 export declare const buildExternalPackages: string[];
 export declare const payloadNoExternalPatterns: Array<RegExp | string>;

package/dist/withPayload/config/external.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/external.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EA+BvC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAOxC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAUzC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA"}
+{"version":3,"file":"external.d.ts","sourceRoot":"","sources":["../../../src/withPayload/config/external.ts"],"names":[],"mappings":"AAKA;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAwBvC,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAOxC,CAAA;AAED,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,EAAE,MAAM,EAS1C,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,mBAAmB,EAAE,MAAM,EAOvC,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAGzC,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAO5D,CAAA"}

package/dist/withPayload/config/external.js

@@ -1,7 +1,5 @@
+import { devServerExternalPackages as devServerExternalPayloadPackages, serverExternalPackages as serverExternalPayloadPackages } from 'payload/build-config';
 /**
- * SSR/RSC externalization config used by `withPayload`. Kept separate from the
- * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.
- */ /**
  * Packages externalized during dev serve (`ssr.external`). Node's loader resolves
  * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break
  * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment
@@ -13,15 +11,9 @@
  */ export const ssrExternalPackages = [
     'zod',
     'fast-uri',
-    'drizzle-kit',
-    'drizzle-kit/api',
+    ...serverExternalPayloadPackages,
     'drizzle-orm',
-    'sharp',
-    'require-in-the-middle',
-    'json-schema-to-typescript',
-    'pino',
     'pino-pretty',
-    'graphql',
     'nodemailer',
     'aws4',
     'pluralize',
@@ -37,7 +29,6 @@
     'pg-cloudflare',
     // SQLite (`@payloadcms/db-sqlite`)
     'better-sqlite3',
-    'libsql',
     // Mongo (`@payloadcms/db-mongodb`)
     'mongodb',
     'mongoose'
@@ -60,20 +51,7 @@
     '@azure/storage-blob',
     '@google-cloud/storage'
 ];
-/**
- * External packages for the production `vite build` only (not dev serve).
- *
- * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each
- * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from
- * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under
- * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from
- * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.
- *
- * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to
- * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's
- * transform can resolve — an externalized copy would hit Node's raw resolver and
- * fail on the `.js`→`.ts` mismatch.
- */ export const buildExternalPackages = [
+/** Server-only package boundaries loaded directly by Node in development and production. */ export const serverExternalPackages = [
     'payload',
     'payload/node',
     '@payloadcms/drizzle',
@@ -81,7 +59,21 @@
     '@payloadcms/db-postgres',
     '@payloadcms/db-vercel-postgres',
     '@payloadcms/db-sqlite',
-    '@payloadcms/db-d1-sqlite',
+    '@payloadcms/db-d1-sqlite'
+];
+/** Additional installed packages that can bypass Vite's development server transforms. */ export const devExternalPackages = [
+    ...new Set([
+        // Vite otherwise transforms date-fns' full module graph during SSR.
+        'date-fns',
+        ...devServerExternalPayloadPackages,
+        ...serverExternalPackages
+    ])
+];
+/**
+ * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.
+ * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.
+ */ export const buildExternalPackages = [
+    ...serverExternalPackages,
     ...ssrExternalPackages.filter((pkg)=>!buildBundledPackages.includes(pkg))
 ];
 export const payloadNoExternalPatterns = [

package/dist/withPayload/config/external.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/withPayload/config/external.ts"],"sourcesContent":["/**\n * SSR/RSC externalization config used by `withPayload`. Kept separate from the\n * client optimizer config (`./optimizeDeps.ts`) so each concern stays small.\n */\n\n/**\n * Packages externalized during dev serve (`ssr.external`). Node's loader resolves\n * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break\n * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment\n * throws when transformed rather than required).\n *\n * Safe here whoever declared the entry: Node resolves from the importing package,\n * so pnpm's isolated layout never applies. The build is stricter — see\n * {@link buildBundledPackages}.\n */\nexport const ssrExternalPackages: string[] = [\n  'zod',\n  'fast-uri',\n  'drizzle-kit',\n  'drizzle-kit/api',\n  'drizzle-orm',\n  'sharp',\n  'require-in-the-middle',\n  'json-schema-to-typescript',\n  'pino',\n  'pino-pretty',\n  'graphql',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database drivers + their lazily-required companions, one group per adapter.\n  // Postgres (`@payloadcms/db-postgres`, `@payloadcms/db-vercel-postgres`)\n  'pg',\n  'pg-native',\n  'pg-cloudflare',\n  // SQLite (`@payloadcms/db-sqlite`)\n  'better-sqlite3',\n  'libsql',\n  // Mongo (`@payloadcms/db-mongodb`)\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Entries of {@link ssrExternalPackages} that must bundle in the production build.\n *\n * Externalizing only works for specifiers resolvable from the project root. These\n * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare\n * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at\n * runtime, or a build-time resolve failure under Nitro's re-bundle pass.\n *\n * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the\n * storage leaves don't, since their adapters are already `noExternal`.\n */\nexport const buildBundledPackages: string[] = [\n  'pluralize',\n  // Leaf deps of the `@payloadcms/storage-*` adapters.\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@azure/storage-blob',\n  '@google-cloud/storage',\n]\n\n/**\n * External packages for the production `vite build` only (not dev serve).\n *\n * Externalizes the `@payloadcms/*` package boundaries — plus `payload` — so each\n * resolves its own transitive Node deps (`pino`, `drizzle-orm`, `libsql`, …) from\n * its own `node_modules` at runtime. Externalizing only the leaf deps breaks under\n * pnpm: a leaf imported by bundled code becomes an unresolvable bare specifier from\n * `dist/`, since pnpm does not hoist it; see {@link buildBundledPackages}.\n *\n * Kept out of dev's `ssr.external` on purpose: the monorepo resolves these to\n * TypeScript source (`.ts` imported via `.js` specifiers), which only Vite's\n * transform can resolve — an externalized copy would hit Node's raw resolver and\n * fail on the `.js`→`.ts` mismatch.\n */\nexport const buildExternalPackages: string[] = [\n  'payload',\n  'payload/node',\n  '@payloadcms/drizzle',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-d1-sqlite',\n  ...ssrExternalPackages.filter((pkg) => !buildBundledPackages.includes(pkg)),\n]\n\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n"],"names":["ssrExternalPackages","buildBundledPackages","buildExternalPackages","filter","pkg","includes","payloadNoExternalPatterns"],"mappings":"AAAA;;;CAGC,GAED;;;;;;;;;CASC,GACD,OAAO,MAAMA,sBAAgC;IAC3C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,8EAA8E;IAC9E,yEAAyE;IACzE;IACA;IACA;IACA,mCAAmC;IACnC;IACA;IACA,mCAAmC;IACnC;IACA;CACD,CAAA;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,uBAAiC;IAC5C;IACA,qDAAqD;IACrD;IACA;IACA;IACA;CACD,CAAA;AAED;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMC,wBAAkC;IAC7C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;OACGF,oBAAoBG,MAAM,CAAC,CAACC,MAAQ,CAACH,qBAAqBI,QAAQ,CAACD;CACvE,CAAA;AAED,OAAO,MAAME,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}
+{"version":3,"sources":["../../../src/withPayload/config/external.ts"],"sourcesContent":["import {\n  devServerExternalPackages as devServerExternalPayloadPackages,\n  serverExternalPackages as serverExternalPayloadPackages,\n} from 'payload/build-config'\n\n/**\n * Packages externalized during dev serve (`ssr.external`). Node's loader resolves\n * their CJS/UMD directly; letting Vite's dev SSR transform touch them can break\n * fragile UMD wrappers (e.g. `pluralize`, whose `this`-based global assignment\n * throws when transformed rather than required).\n *\n * Safe here whoever declared the entry: Node resolves from the importing package,\n * so pnpm's isolated layout never applies. The build is stricter — see\n * {@link buildBundledPackages}.\n */\nexport const ssrExternalPackages: string[] = [\n  'zod',\n  'fast-uri',\n  ...serverExternalPayloadPackages,\n  'drizzle-orm',\n  'pino-pretty',\n  'nodemailer',\n  'aws4',\n  'pluralize',\n  'console-table-printer',\n  '@azure/storage-blob',\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@google-cloud/storage',\n  // Database drivers + their lazily-required companions, one group per adapter.\n  // Postgres (`@payloadcms/db-postgres`, `@payloadcms/db-vercel-postgres`)\n  'pg',\n  'pg-native',\n  'pg-cloudflare',\n  // SQLite (`@payloadcms/db-sqlite`)\n  'better-sqlite3',\n  // Mongo (`@payloadcms/db-mongodb`)\n  'mongodb',\n  'mongoose',\n]\n\n/**\n * Entries of {@link ssrExternalPackages} that must bundle in the production build.\n *\n * Externalizing only works for specifiers resolvable from the project root. These\n * are leaf deps of Payload packages, so under pnpm they live in `.pnpm/…` and a bare\n * specifier in a root-resolved chunk is invisible — `ERR_MODULE_NOT_FOUND` at\n * runtime, or a build-time resolve failure under Nitro's re-bundle pass.\n *\n * `pluralize` also needs forcing back via `noExternal` (see `withPayload`); the\n * storage leaves don't, since their adapters are already `noExternal`.\n */\nexport const buildBundledPackages: string[] = [\n  'pluralize',\n  // Leaf deps of the `@payloadcms/storage-*` adapters.\n  '@aws-sdk/client-s3',\n  '@aws-sdk/s3-request-presigner',\n  '@azure/storage-blob',\n  '@google-cloud/storage',\n]\n\n/** Server-only package boundaries loaded directly by Node in development and production. */\nexport const serverExternalPackages: string[] = [\n  'payload',\n  'payload/node',\n  '@payloadcms/drizzle',\n  '@payloadcms/db-mongodb',\n  '@payloadcms/db-postgres',\n  '@payloadcms/db-vercel-postgres',\n  '@payloadcms/db-sqlite',\n  '@payloadcms/db-d1-sqlite',\n]\n\n/** Additional installed packages that can bypass Vite's development server transforms. */\nexport const devExternalPackages: string[] = [\n  ...new Set([\n    // Vite otherwise transforms date-fns' full module graph during SSR.\n    'date-fns',\n    ...devServerExternalPayloadPackages,\n    ...serverExternalPackages,\n  ]),\n]\n\n/**\n * Externalizes package boundaries so packages resolve their own transitive dependencies under pnpm.\n * Leaves that must bundle in production are excluded; see {@link buildBundledPackages}.\n */\nexport const buildExternalPackages: string[] = [\n  ...serverExternalPackages,\n  ...ssrExternalPackages.filter((pkg) => !buildBundledPackages.includes(pkg)),\n]\n\nexport const payloadNoExternalPatterns: Array<RegExp | string> = [\n  '@payloadcms/ui',\n  '@payloadcms/translations',\n  '@payloadcms/tanstack-start',\n  /^@payloadcms\\/richtext-lexical/,\n  /^@payloadcms\\/plugin-/,\n  /^@payloadcms\\/storage-/,\n]\n"],"names":["devServerExternalPackages","devServerExternalPayloadPackages","serverExternalPackages","serverExternalPayloadPackages","ssrExternalPackages","buildBundledPackages","devExternalPackages","Set","buildExternalPackages","filter","pkg","includes","payloadNoExternalPatterns"],"mappings":"AAAA,SACEA,6BAA6BC,gCAAgC,EAC7DC,0BAA0BC,6BAA6B,QAClD,uBAAsB;AAE7B;;;;;;;;;CASC,GACD,OAAO,MAAMC,sBAAgC;IAC3C;IACA;OACGD;IACH;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA,8EAA8E;IAC9E,yEAAyE;IACzE;IACA;IACA;IACA,mCAAmC;IACnC;IACA,mCAAmC;IACnC;IACA;CACD,CAAA;AAED;;;;;;;;;;CAUC,GACD,OAAO,MAAME,uBAAiC;IAC5C;IACA,qDAAqD;IACrD;IACA;IACA;IACA;CACD,CAAA;AAED,0FAA0F,GAC1F,OAAO,MAAMH,yBAAmC;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED,wFAAwF,GACxF,OAAO,MAAMI,sBAAgC;OACxC,IAAIC,IAAI;QACT,oEAAoE;QACpE;WACGN;WACAC;KACJ;CACF,CAAA;AAED;;;CAGC,GACD,OAAO,MAAMM,wBAAkC;OAC1CN;OACAE,oBAAoBK,MAAM,CAAC,CAACC,MAAQ,CAACL,qBAAqBM,QAAQ,CAACD;CACvE,CAAA;AAED,OAAO,MAAME,4BAAoD;IAC/D;IACA;IACA;IACA;IACA;IACA;CACD,CAAA"}

package/dist/withPayload/importProtection.js

@@ -11,7 +11,7 @@ import { builtinModules } from 'node:module';
     /^@payloadcms\/richtext-lexical\/rsc/,
     /^@payloadcms\/richtext-slate\/rsc/,
     '@payloadcms/ui/server',
-    /^@payloadcms\/tanstack-start\/(layouts|rsc|server)/,
+    /^@payloadcms\/tanstack-start\/(layouts|routes|rsc|server)/,
     'sharp',
     'busboy',
     'croner',

package/dist/withPayload/importProtection.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/withPayload/importProtection.ts"],"sourcesContent":["import { builtinModules } from 'node:module'\n\n/**\n * Specifiers that must never appear in the client module graph. These are the\n * server-only Payload entry points plus Node.js built-ins and a handful of\n * Node-only npm packages that Payload pulls in transitively.\n */\nexport const serverOnlyClientSpecifiers: Array<RegExp | string> = [\n  /^node:/,\n  new RegExp(`^(${builtinModules.join('|')})(\\\\/|$)`),\n  '@payload-config',\n  /^@payloadcms\\/next\\/rsc/,\n  /^@payloadcms\\/richtext-lexical\\/rsc/,\n  /^@payloadcms\\/richtext-slate\\/rsc/,\n  '@payloadcms/ui/server',\n  /^@payloadcms\\/tanstack-start\\/(layouts|rsc|server)/,\n  'sharp',\n  'busboy',\n  'croner',\n  'pino',\n  'pino-pretty',\n  'prompts',\n  'ws',\n  'undici',\n  'get-tsconfig',\n  /^file-type/,\n  /^react-dom\\/server/,\n]\n\n/**\n * Allowlist callback for the `tanstackStart` plugin's import-protection. These\n * are the legitimate cross-environment imports in our monorepo that we want\n * to permit even when they appear to cross a server/client boundary.\n */\nexport function onImportProtectionViolation(violation: unknown): boolean | void {\n  const info = violation as {\n    envType: 'client' | 'server'\n    importer: string\n    resolved?: string\n  }\n\n  const allowedClientFileImporters = /\\/richtext-lexical\\/.*\\/exports\\/client\\/|\\/ui\\//\n\n  if (\n    info.envType === 'server' &&\n    info.resolved?.includes('.client.') &&\n    allowedClientFileImporters.test(info.importer)\n  ) {\n    return false\n  }\n\n  if (info.importer.includes('/richtext-lexical/') && info.importer.includes('/field/Diff/')) {\n    return false\n  }\n\n  if (info.importer.includes('/packages/payload/') || info.importer.includes('/payload/dist/')) {\n    return false\n  }\n\n  if (\n    info.importer.includes('@payloadcms/ui') &&\n    (info.importer.includes('/exports/rsc/') || info.importer.includes('/rsc/index'))\n  ) {\n    return false\n  }\n\n  if (info.envType === 'server' && info.importer.includes('vite-rsc/client-references')) {\n    return false\n  }\n}\n\nexport const defaultImportProtectionIgnoreImporters: RegExp[] = [/^src\\/importMap\\.js(?:\\?.*)?$/]\n"],"names":["builtinModules","serverOnlyClientSpecifiers","RegExp","join","onImportProtectionViolation","violation","info","allowedClientFileImporters","envType","resolved","includes","test","importer","defaultImportProtectionIgnoreImporters"],"mappings":"AAAA,SAASA,cAAc,QAAQ,cAAa;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,6BAAqD;IAChE;IACA,IAAIC,OAAO,CAAC,EAAE,EAAEF,eAAeG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,SAASC,4BAA4BC,SAAkB;IAC5D,MAAMC,OAAOD;IAMb,MAAME,6BAA6B;IAEnC,IACED,KAAKE,OAAO,KAAK,YACjBF,KAAKG,QAAQ,EAAEC,SAAS,eACxBH,2BAA2BI,IAAI,CAACL,KAAKM,QAAQ,GAC7C;QACA,OAAO;IACT;IAEA,IAAIN,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,iBAAiB;QAC1F,OAAO;IACT;IAEA,IAAIJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,mBAAmB;QAC5F,OAAO;IACT;IAEA,IACEJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,qBACtBJ,CAAAA,KAAKM,QAAQ,CAACF,QAAQ,CAAC,oBAAoBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,aAAY,GAC/E;QACA,OAAO;IACT;IAEA,IAAIJ,KAAKE,OAAO,KAAK,YAAYF,KAAKM,QAAQ,CAACF,QAAQ,CAAC,+BAA+B;QACrF,OAAO;IACT;AACF;AAEA,OAAO,MAAMG,yCAAmD;IAAC;CAAgC,CAAA"}
+{"version":3,"sources":["../../src/withPayload/importProtection.ts"],"sourcesContent":["import { builtinModules } from 'node:module'\n\n/**\n * Specifiers that must never appear in the client module graph. These are the\n * server-only Payload entry points plus Node.js built-ins and a handful of\n * Node-only npm packages that Payload pulls in transitively.\n */\nexport const serverOnlyClientSpecifiers: Array<RegExp | string> = [\n  /^node:/,\n  new RegExp(`^(${builtinModules.join('|')})(\\\\/|$)`),\n  '@payload-config',\n  /^@payloadcms\\/next\\/rsc/,\n  /^@payloadcms\\/richtext-lexical\\/rsc/,\n  /^@payloadcms\\/richtext-slate\\/rsc/,\n  '@payloadcms/ui/server',\n  /^@payloadcms\\/tanstack-start\\/(layouts|routes|rsc|server)/,\n  'sharp',\n  'busboy',\n  'croner',\n  'pino',\n  'pino-pretty',\n  'prompts',\n  'ws',\n  'undici',\n  'get-tsconfig',\n  /^file-type/,\n  /^react-dom\\/server/,\n]\n\n/**\n * Allowlist callback for the `tanstackStart` plugin's import-protection. These\n * are the legitimate cross-environment imports in our monorepo that we want\n * to permit even when they appear to cross a server/client boundary.\n */\nexport function onImportProtectionViolation(violation: unknown): boolean | void {\n  const info = violation as {\n    envType: 'client' | 'server'\n    importer: string\n    resolved?: string\n  }\n\n  const allowedClientFileImporters = /\\/richtext-lexical\\/.*\\/exports\\/client\\/|\\/ui\\//\n\n  if (\n    info.envType === 'server' &&\n    info.resolved?.includes('.client.') &&\n    allowedClientFileImporters.test(info.importer)\n  ) {\n    return false\n  }\n\n  if (info.importer.includes('/richtext-lexical/') && info.importer.includes('/field/Diff/')) {\n    return false\n  }\n\n  if (info.importer.includes('/packages/payload/') || info.importer.includes('/payload/dist/')) {\n    return false\n  }\n\n  if (\n    info.importer.includes('@payloadcms/ui') &&\n    (info.importer.includes('/exports/rsc/') || info.importer.includes('/rsc/index'))\n  ) {\n    return false\n  }\n\n  if (info.envType === 'server' && info.importer.includes('vite-rsc/client-references')) {\n    return false\n  }\n}\n\nexport const defaultImportProtectionIgnoreImporters: RegExp[] = [/^src\\/importMap\\.js(?:\\?.*)?$/]\n"],"names":["builtinModules","serverOnlyClientSpecifiers","RegExp","join","onImportProtectionViolation","violation","info","allowedClientFileImporters","envType","resolved","includes","test","importer","defaultImportProtectionIgnoreImporters"],"mappings":"AAAA,SAASA,cAAc,QAAQ,cAAa;AAE5C;;;;CAIC,GACD,OAAO,MAAMC,6BAAqD;IAChE;IACA,IAAIC,OAAO,CAAC,EAAE,EAAEF,eAAeG,IAAI,CAAC,KAAK,QAAQ,CAAC;IAClD;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAA;AAED;;;;CAIC,GACD,OAAO,SAASC,4BAA4BC,SAAkB;IAC5D,MAAMC,OAAOD;IAMb,MAAME,6BAA6B;IAEnC,IACED,KAAKE,OAAO,KAAK,YACjBF,KAAKG,QAAQ,EAAEC,SAAS,eACxBH,2BAA2BI,IAAI,CAACL,KAAKM,QAAQ,GAC7C;QACA,OAAO;IACT;IAEA,IAAIN,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,iBAAiB;QAC1F,OAAO;IACT;IAEA,IAAIJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,yBAAyBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,mBAAmB;QAC5F,OAAO;IACT;IAEA,IACEJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,qBACtBJ,CAAAA,KAAKM,QAAQ,CAACF,QAAQ,CAAC,oBAAoBJ,KAAKM,QAAQ,CAACF,QAAQ,CAAC,aAAY,GAC/E;QACA,OAAO;IACT;IAEA,IAAIJ,KAAKE,OAAO,KAAK,YAAYF,KAAKM,QAAQ,CAACF,QAAQ,CAAC,+BAA+B;QACrF,OAAO;IACT;AACF;AAEA,OAAO,MAAMG,yCAAmD;IAAC;CAAgC,CAAA"}

package/dist/withPayload/index.d.ts

@@ -7,6 +7,8 @@ export type WithPayloadOptions = {
     additionalIgnoreImporters?: RegExp[];
     /** Extra globs exempted from the `.client.*` SSR denial (beyond the default node_modules exemption). */
     clientDenialExcludeFiles?: string[];
+    /** Transform server packages in development. Enable when linking Payload source. Defaults to `false`. */
+    devBundleServerPackages?: boolean;
     /**
      * Packages added to `ssr.external` on dev serve only (the build bundles them).
      * List CommonJS deps that 500 with `__cjs_module_runner_transform` — the RSC
@@ -85,7 +87,7 @@ export declare function payloadRscOptions(): NonNullable<Parameters<typeof rsc>[
  * with `ERR_MODULE_NOT_FOUND` on the first request.
  */
 export declare function payloadNitroOptions(): PayloadNitroOptions;
-/** `@vitejs/plugin-react` options for Payload: transform every `.[jt]sx?` file. */
+/** Transforms application and workspace source without refreshing installed dependencies. */
 export declare function payloadReactOptions(): NonNullable<Parameters<typeof viteReact>[0]>;
 export type PayloadTanstackStartOptionsArgs = {
     /** Additional import-protection `ignoreImporters` patterns. */

package/dist/withPayload/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/withPayload/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAwB,UAAU,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAA;AAI3F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,SAAS,MAAM,sBAAsB,CAAA;AAC5C,OAAO,GAAG,MAAM,oBAAoB,CAAA;AAyEpC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,wFAAwF;IACxF,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wGAAwG;IACxG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAA;IACzB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wFAAwF;IACxF,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED,mIAAmI;AACnI,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,SAAS,CAAA;IACd,qFAAqF;IACrF,aAAa,EAAE,oBAAoB,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,UAAU,CAAA;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GAAG,kBAAkB,EACrC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CA8HpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED,mFAAmF;AACnF,wBAAgB,mBAAmB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAElF;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,+DAA+D;IAC/D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,+BAAoC,GACzC,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CA+BlD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/withPayload/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAwB,UAAU,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAA;AAI3F,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAA;AACjE,OAAO,SAAS,MAAM,sBAAsB,CAAA;AAC5C,OAAO,GAAG,MAAM,oBAAoB,CAAA;AA0EpC,MAAM,MAAM,kBAAkB,GAAG;IAC/B,wFAAwF;IACxF,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wGAAwG;IACxG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,yGAAyG;IACzG,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC,wDAAwD;IACxD,iBAAiB,EAAE,MAAM,CAAA;IACzB,uFAAuF;IACvF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,yFAAyF;IACzF,yBAAyB,CAAC,EAAE,OAAO,CAAA;IACnC,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,wFAAwF;IACxF,IAAI,CAAC,EAAE,UAAU,CAAA;CAClB,CAAA;AAED,mIAAmI;AACnI,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,wEAAwE;AACxE,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,mBAAmB,CAAA;IAC1B,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnD,GAAG,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3C,aAAa,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CAChE,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,SAAS,CAAA;IACd,qFAAqF;IACrF,aAAa,EAAE,oBAAoB,CAAA;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,yBAAyB,KAAK,UAAU,CAAA;AAEnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GAAG,kBAAkB,EACrC,OAAO,EAAE,kBAAkB,GAC1B,kBAAkB,CA2IpB;AAED,oGAAoG;AACpG,wBAAgB,iBAAiB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAE1E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,mBAAmB,CAEzD;AAED,6FAA6F;AAC7F,wBAAgB,mBAAmB,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAElF;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,+DAA+D;IAC/D,yBAAyB,CAAC,EAAE,MAAM,EAAE,CAAA;IACpC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,wFAAwF;IACxF,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,sDAAsD;IACtD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,+BAAoC,GACzC,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAgClD"}

package/dist/withPayload/index.js

@@ -5,7 +5,7 @@ import viteReact from '@vitejs/plugin-react';
 import rsc from '@vitejs/plugin-rsc';
 import path from 'node:path';
 import { createLogger, mergeConfig } from 'vite';
-import { buildExternalPackages, payloadNoExternalPatterns, ssrExternalPackages } from './config/external.js';
+import { buildExternalPackages, devExternalPackages, payloadNoExternalPatterns, ssrExternalPackages } from './config/external.js';
 import { optimizeDepsExcludeDefaults, optimizeDepsIncludeDefaults } from './config/optimizeDeps.js';
 import { payloadScssImporters } from './config/scss.js';
 import { payloadDevConfigReload } from './devConfigReload.js';
@@ -86,7 +86,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
  * )
  * ```
  */ export function withPayload(build, options) {
-    const { additionalIgnoreImporters = [], clientDenialExcludeFiles = [], devServerExternalPackages = [], payloadConfigPath, routesDirectory = 'app', silenceDependencyWarnings = true, srcDirectory = 'src', vite } = options;
+    const { additionalIgnoreImporters = [], clientDenialExcludeFiles = [], devBundleServerPackages = false, devServerExternalPackages = [], payloadConfigPath, routesDirectory = 'app', silenceDependencyWarnings = true, srcDirectory = 'src', vite } = options;
     return (env)=>{
         // `pluralize` ships a UMD wrapper that throws when run through Vite's dev SSR
         // transform, so dev serve keeps it external and lets Node require it.
@@ -110,8 +110,11 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
         // dependencies that break under the RSC plugin's CJS-to-ESM rewrite; the build
         // needs none of it, since Rollup bundles CJS correctly.
         const ssrExternal = isBuild ? buildExternalPackages : [
-            ...ssrExternalPackages,
-            ...devServerExternalPackages
+            ...new Set([
+                ...devBundleServerPackages ? [] : devExternalPackages,
+                ...devServerExternalPackages,
+                ...ssrExternalPackages
+            ])
         ];
         const base = {
             build: {
@@ -139,6 +142,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
                         }
                     },
                     resolve: {
+                        external: isBuild ? undefined : ssrExternal,
                         noExternal: noExternalPatterns
                     }
                 },
@@ -149,6 +153,7 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
                         }
                     },
                     resolve: {
+                        external: isBuild ? undefined : ssrExternal,
                         noExternal: noExternalPatterns
                     }
                 }
@@ -245,9 +250,9 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
         ]
     };
 }
-/** `@vitejs/plugin-react` options for Payload: transform every `.[jt]sx?` file. */ export function payloadReactOptions() {
+/** Transforms application and workspace source without refreshing installed dependencies. */ export function payloadReactOptions() {
     return {
-        exclude: [],
+        exclude: /node_modules/,
         include: /\.[jt]sx?$/
     };
 }
@@ -263,6 +268,9 @@ import { wrapCjsForClient } from './workarounds/wrapCjsForClient.js';
                 excludeFiles: [],
                 specifiers: serverOnlyClientSpecifiers
             },
+            exclude: [
+                '**/node_modules/**'
+            ],
             ignoreImporters: [
                 ...defaultImportProtectionIgnoreImporters,
                 ...additionalIgnoreImporters