@seshuk/payload-plugin-openapi 1.0.0-beta.1 → 1.0.0-beta.2

package/dist/server/spec/plugins/shared.d.ts

@@ -0,0 +1,35 @@
+import { BuildContext } from "../../../shared/types/index.js";
+import { Translate } from "../../../shared/translations/types.js";
+import { Endpoint, SanitizedCollectionConfig, SanitizedConfig } from "payload";
+import { OperationObject, PathsObject, ResponsesObject, SchemaObject } from "@scalar/openapi-types/3.2";
+export interface PluginBuildArgs {
+  config: SanitizedConfig;
+  collections: SanitizedCollectionConfig[];
+  ctx: BuildContext;
+  options: Record<string, unknown> | undefined;
+  schemas: Record<string, SchemaObject>;
+  t: Translate;
+}
+export interface PluginGroup {
+  paths: PathsObject;
+  slug?: string;
+}
+export interface OfficialPlugin {
+  slug: string;
+  tag: string;
+  installed?: (config: SanitizedConfig) => boolean;
+  build: (args: PluginBuildArgs) => PluginGroup[];
+}
+export declare const mountEndpoints: (endpoints: Endpoint[] | false | undefined, prefix: string, operation: (endpoint: Endpoint) => OperationObject | undefined) => PathsObject;
+export declare const collectionGroups: (collections: SanitizedCollectionConfig[], ctx: BuildContext, operation: (endpoint: Endpoint, collection: SanitizedCollectionConfig) => OperationObject | undefined) => PluginGroup[];
+export declare const idSchema: (ctx: BuildContext) => SchemaObject;
+export declare const messageSchema: SchemaObject;
+declare const MESSAGE_ERROR_KEYS: {
+  readonly '400': 'errorPlugin400';
+  readonly '401': 'errorPlugin401';
+  readonly '403': 'errorPlugin403';
+  readonly '404': 'errorPlugin404';
+  readonly '500': 'errorPlugin500';
+};
+export declare const messageErrors: (codes: Array<keyof typeof MESSAGE_ERROR_KEYS>, t: Translate, schema?: SchemaObject) => ResponsesObject;
+//# sourceMappingURL=shared.d.ts.map

package/dist/server/spec/plugins/shared.js

@@ -0,0 +1,37 @@
+import { jsonResponse } from "../components.js";
+import { getOpenapiMeta, normalizePath } from "../paths/custom.js";
+const mountEndpoints = (endpoints, prefix, operation) => {
+	const out = {};
+	for (const endpoint of endpoints || []) {
+		if (getOpenapiMeta(endpoint)) continue;
+		const op = operation(endpoint);
+		if (!op) continue;
+		const path = normalizePath(prefix, endpoint.path);
+		out[path] = {
+			...out[path],
+			[endpoint.method]: op
+		};
+	}
+	return out;
+};
+const collectionGroups = (collections, ctx, operation) => collections.map((collection) => ({
+	slug: collection.slug,
+	paths: mountEndpoints(collection.endpoints, `${ctx.apiRoute}/${collection.slug}`, (endpoint) => operation(endpoint, collection))
+})).filter((group) => Object.keys(group.paths).length > 0);
+const idSchema = (ctx) => ({ type: ctx.defaultIDType === "number" ? "integer" : "string" });
+const messageSchema = {
+	type: "object",
+	properties: { message: { type: "string" } },
+	required: ["message"]
+};
+const MESSAGE_ERROR_KEYS = {
+	"400": "errorPlugin400",
+	"401": "errorPlugin401",
+	"403": "errorPlugin403",
+	"404": "errorPlugin404",
+	"500": "errorPlugin500"
+};
+const messageErrors = (codes, t, schema = messageSchema) => Object.fromEntries(codes.map((code) => [code, jsonResponse(t(MESSAGE_ERROR_KEYS[code]), schema)]));
+export { collectionGroups, idSchema, messageErrors, messageSchema, mountEndpoints };
+
+//# sourceMappingURL=shared.js.map

package/dist/server/spec/plugins/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","names":[],"sources":["../../../../src/server/spec/plugins/shared.ts"],"sourcesContent":["import type { OperationObject, PathsObject, ResponsesObject, SchemaObject } from '@scalar/openapi-types/3.2'\nimport type { Endpoint, SanitizedCollectionConfig, SanitizedConfig } from 'payload'\n\nimport { jsonResponse } from '@/server/spec/components.js'\nimport { getOpenapiMeta, normalizePath } from '@/server/spec/paths/custom.js'\nimport type { Translate } from '@/shared/translations/types.js'\nimport type { BuildContext } from '@/shared/types/index.js'\n\nexport interface PluginBuildArgs {\n  config: SanitizedConfig\n  collections: SanitizedCollectionConfig[]\n  ctx: BuildContext\n  options: Record<string, unknown> | undefined\n  schemas: Record<string, SchemaObject>\n  t: Translate\n}\n\nexport interface PluginGroup {\n  paths: PathsObject\n  slug?: string\n}\n\nexport interface OfficialPlugin {\n  slug: string\n  tag: string\n  installed?: (config: SanitizedConfig) => boolean\n  build: (args: PluginBuildArgs) => PluginGroup[]\n}\n\nexport const mountEndpoints = (\n  endpoints: Endpoint[] | false | undefined,\n  prefix: string,\n  operation: (endpoint: Endpoint) => OperationObject | undefined,\n): PathsObject => {\n  const out: PathsObject = {}\n  for (const endpoint of endpoints || []) {\n    if (getOpenapiMeta(endpoint)) continue\n    const op = operation(endpoint)\n    if (!op) continue\n    const path = normalizePath(prefix, endpoint.path)\n    out[path] = { ...out[path], [endpoint.method]: op }\n  }\n  return out\n}\n\nexport const collectionGroups = (\n  collections: SanitizedCollectionConfig[],\n  ctx: BuildContext,\n  operation: (endpoint: Endpoint, collection: SanitizedCollectionConfig) => OperationObject | undefined,\n): PluginGroup[] =>\n  collections\n    .map((collection) => ({\n      slug: collection.slug,\n      paths: mountEndpoints(collection.endpoints, `${ctx.apiRoute}/${collection.slug}`, (endpoint) =>\n        operation(endpoint, collection),\n      ),\n    }))\n    .filter((group) => Object.keys(group.paths).length > 0)\n\nexport const idSchema = (ctx: BuildContext): SchemaObject => ({\n  type: ctx.defaultIDType === 'number' ? 'integer' : 'string',\n})\n\nexport const messageSchema: SchemaObject = {\n  type: 'object',\n  properties: { message: { type: 'string' } },\n  required: ['message'],\n}\n\nconst MESSAGE_ERROR_KEYS = {\n  '400': 'errorPlugin400',\n  '401': 'errorPlugin401',\n  '403': 'errorPlugin403',\n  '404': 'errorPlugin404',\n  '500': 'errorPlugin500',\n} as const\n\nexport const messageErrors = (\n  codes: Array<keyof typeof MESSAGE_ERROR_KEYS>,\n  t: Translate,\n  schema: SchemaObject = messageSchema,\n): ResponsesObject => Object.fromEntries(codes.map((code) => [code, jsonResponse(t(MESSAGE_ERROR_KEYS[code]), schema)]))\n"],"mappings":";;AA6BA,MAAa,kBACX,WACA,QACA,cACgB;CAChB,MAAM,MAAmB,CAAC;CAC1B,KAAK,MAAM,YAAY,aAAa,CAAC,GAAG;EACtC,IAAI,eAAe,QAAQ,GAAG;EAC9B,MAAM,KAAK,UAAU,QAAQ;EAC7B,IAAI,CAAC,IAAI;EACT,MAAM,OAAO,cAAc,QAAQ,SAAS,IAAI;EAChD,IAAI,QAAQ;GAAE,GAAG,IAAI;IAAQ,SAAS,SAAS;EAAG;CACpD;CACA,OAAO;AACT;AAEA,MAAa,oBACX,aACA,KACA,cAEA,YACG,KAAK,gBAAgB;CACpB,MAAM,WAAW;CACjB,OAAO,eAAe,WAAW,WAAW,GAAG,IAAI,SAAS,GAAG,WAAW,SAAS,aACjF,UAAU,UAAU,UAAU,CAChC;AACF,EAAE,CAAC,CACF,QAAQ,UAAU,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,SAAS,CAAC;AAE1D,MAAa,YAAY,SAAqC,EAC5D,MAAM,IAAI,kBAAkB,WAAW,YAAY,SACrD;AAEA,MAAa,gBAA8B;CACzC,MAAM;CACN,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,EAAE;CAC1C,UAAU,CAAC,SAAS;AACtB;AAEA,MAAM,qBAAqB;CACzB,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;AACT;AAEA,MAAa,iBACX,OACA,GACA,SAAuB,kBACH,OAAO,YAAY,MAAM,KAAK,SAAS,CAAC,MAAM,aAAa,EAAE,mBAAmB,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC"}

package/dist/server/spec/plugins/storageR2.d.ts

@@ -0,0 +1,3 @@
+import { OfficialPlugin } from "./shared.js";
+export declare const storageR2: OfficialPlugin;
+//# sourceMappingURL=storageR2.d.ts.map

package/dist/server/spec/plugins/storageR2.js

@@ -0,0 +1,91 @@
+import { errorResponses } from "../components.js";
+import { securedRequirement } from "../security.js";
+import { mountEndpoints } from "./shared.js";
+const TAG = "Storage R2";
+const UPLOAD_PATH = /^\/storage-r2-multi-part-upload(?:-(\d+))?$/;
+const query = (name, required, type = "string") => ({
+	name,
+	in: "query",
+	required,
+	schema: { type }
+});
+const storageR2 = {
+	slug: "@payloadcms/storage-r2",
+	tag: TAG,
+	installed: (config) => (config.storage ?? []).some((adapter) => adapter?.name === "r2"),
+	build: ({ config, ctx, t }) => {
+		const upload = (suffix) => ({
+			tags: [TAG],
+			operationId: `r2MultipartUpload${suffix}`,
+			summary: t("r2Upload"),
+			description: t("r2UploadDesc"),
+			parameters: [
+				query("collection", true),
+				query("fileName", true),
+				query("fileType", true),
+				query("docPrefix", false),
+				query("multipartId", false),
+				query("multipartKey", false),
+				query("multipartNumber", false, "integer"),
+				query("signedReceipt", false)
+			],
+			requestBody: { content: {
+				"application/octet-stream": { schema: {
+					type: "string",
+					format: "binary"
+				} },
+				"application/json": { schema: {
+					type: "array",
+					items: {
+						type: "object",
+						properties: {
+							partNumber: { type: "integer" },
+							etag: { type: "string" }
+						},
+						required: ["partNumber", "etag"]
+					}
+				} }
+			} },
+			responses: {
+				"200": {
+					description: t("r2UploadResult"),
+					content: {
+						"application/json": { schema: {
+							type: "object",
+							additionalProperties: true,
+							properties: {
+								filename: { type: "string" },
+								key: { type: "string" },
+								uploadId: { type: "string" },
+								uploadReference: {
+									type: "object",
+									additionalProperties: true
+								},
+								partNumber: { type: "integer" },
+								etag: { type: "string" }
+							}
+						} },
+						"text/plain": { schema: { type: "string" } }
+					}
+				},
+				...errorResponses([
+					"400",
+					"403",
+					"500"
+				], t),
+				"412": {
+					description: t("errorStorageR2412"),
+					content: { "text/plain": { schema: { type: "string" } } }
+				}
+			},
+			security: securedRequirement()
+		});
+		return [{ paths: mountEndpoints(config.endpoints, ctx.apiRoute, ({ method, path }) => {
+			const match = UPLOAD_PATH.exec(path);
+			return method === "post" && match ? upload(match[1] ?? "") : void 0;
+		}) }];
+	}
+};
+export { storageR2 };
+
+//# sourceMappingURL=storageR2.js.map

package/dist/server/spec/plugins/storageR2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storageR2.js","names":[],"sources":["../../../../src/server/spec/plugins/storageR2.ts"],"sourcesContent":["import type { OperationObject, ParameterObject } from '@scalar/openapi-types/3.2'\n\nimport { errorResponses } from '@/server/spec/components.js'\nimport { securedRequirement } from '@/server/spec/security.js'\n\nimport { type OfficialPlugin, mountEndpoints } from './shared.js'\n\nconst TAG = 'Storage R2'\n\nconst UPLOAD_PATH = /^\\/storage-r2-multi-part-upload(?:-(\\d+))?$/\n\nconst query = (name: string, required: boolean, type: 'string' | 'integer' = 'string'): ParameterObject => ({\n  name,\n  in: 'query',\n  required,\n  schema: { type },\n})\n\nexport const storageR2: OfficialPlugin = {\n  slug: '@payloadcms/storage-r2',\n  tag: TAG,\n  installed: (config) => (config.storage ?? []).some((adapter) => adapter?.name === 'r2'),\n  build: ({ config, ctx, t }) => {\n    const upload = (suffix: string): OperationObject => ({\n      tags: [TAG],\n      operationId: `r2MultipartUpload${suffix}`,\n      summary: t('r2Upload'),\n      description: t('r2UploadDesc'),\n      parameters: [\n        query('collection', true),\n        query('fileName', true),\n        query('fileType', true),\n        query('docPrefix', false),\n        query('multipartId', false),\n        query('multipartKey', false),\n        query('multipartNumber', false, 'integer'),\n        query('signedReceipt', false),\n      ],\n      requestBody: {\n        content: {\n          'application/octet-stream': { schema: { type: 'string', format: 'binary' } },\n          'application/json': {\n            schema: {\n              type: 'array',\n              items: {\n                type: 'object',\n                properties: { partNumber: { type: 'integer' }, etag: { type: 'string' } },\n                required: ['partNumber', 'etag'],\n              },\n            },\n          },\n        },\n      },\n      responses: {\n        '200': {\n          description: t('r2UploadResult'),\n          content: {\n            'application/json': {\n              schema: {\n                type: 'object',\n                additionalProperties: true,\n                properties: {\n                  filename: { type: 'string' },\n                  key: { type: 'string' },\n                  uploadId: { type: 'string' },\n                  uploadReference: { type: 'object', additionalProperties: true },\n                  partNumber: { type: 'integer' },\n                  etag: { type: 'string' },\n                },\n              },\n            },\n            'text/plain': { schema: { type: 'string' } },\n          },\n        },\n        ...errorResponses(['400', '403', '500'], t),\n        '412': { description: t('errorStorageR2412'), content: { 'text/plain': { schema: { type: 'string' } } } },\n      },\n      security: securedRequirement(),\n    })\n    return [\n      {\n        paths: mountEndpoints(config.endpoints, ctx.apiRoute, ({ method, path }) => {\n          const match = UPLOAD_PATH.exec(path)\n          return method === 'post' && match ? upload(match[1] ?? '') : undefined\n        }),\n      },\n    ]\n  },\n}\n"],"mappings":";;;AAOA,MAAM,MAAM;AAEZ,MAAM,cAAc;AAEpB,MAAM,SAAS,MAAc,UAAmB,OAA6B,cAA+B;CAC1G;CACA,IAAI;CACJ;CACA,QAAQ,EAAE,KAAK;AACjB;AAEA,MAAa,YAA4B;CACvC,MAAM;CACN,KAAK;CACL,YAAY,YAAY,OAAO,WAAW,CAAC,EAAA,CAAG,MAAM,YAAY,SAAS,SAAS,IAAI;CACtF,QAAQ,EAAE,QAAQ,KAAK,QAAQ;EAC7B,MAAM,UAAU,YAAqC;GACnD,MAAM,CAAC,GAAG;GACV,aAAa,oBAAoB;GACjC,SAAS,EAAE,UAAU;GACrB,aAAa,EAAE,cAAc;GAC7B,YAAY;IACV,MAAM,cAAc,IAAI;IACxB,MAAM,YAAY,IAAI;IACtB,MAAM,YAAY,IAAI;IACtB,MAAM,aAAa,KAAK;IACxB,MAAM,eAAe,KAAK;IAC1B,MAAM,gBAAgB,KAAK;IAC3B,MAAM,mBAAmB,OAAO,SAAS;IACzC,MAAM,iBAAiB,KAAK;GAC9B;GACA,aAAa,EACX,SAAS;IACP,4BAA4B,EAAE,QAAQ;KAAE,MAAM;KAAU,QAAQ;IAAS,EAAE;IAC3E,oBAAoB,EAClB,QAAQ;KACN,MAAM;KACN,OAAO;MACL,MAAM;MACN,YAAY;OAAE,YAAY,EAAE,MAAM,UAAU;OAAG,MAAM,EAAE,MAAM,SAAS;MAAE;MACxE,UAAU,CAAC,cAAc,MAAM;KACjC;IACF,EACF;GACF,EACF;GACA,WAAW;IACT,OAAO;KACL,aAAa,EAAE,gBAAgB;KAC/B,SAAS;MACP,oBAAoB,EAClB,QAAQ;OACN,MAAM;OACN,sBAAsB;OACtB,YAAY;QACV,UAAU,EAAE,MAAM,SAAS;QAC3B,KAAK,EAAE,MAAM,SAAS;QACtB,UAAU,EAAE,MAAM,SAAS;QAC3B,iBAAiB;SAAE,MAAM;SAAU,sBAAsB;QAAK;QAC9D,YAAY,EAAE,MAAM,UAAU;QAC9B,MAAM,EAAE,MAAM,SAAS;OACzB;MACF,EACF;MACA,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE;KAC7C;IACF;IACA,GAAG,eAAe;KAAC;KAAO;KAAO;IAAK,GAAG,CAAC;IAC1C,OAAO;KAAE,aAAa,EAAE,mBAAmB;KAAG,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,SAAS,EAAE,EAAE;IAAE;GAC1G;GACA,UAAU,mBAAmB;EAC/B;EACA,OAAO,CACL,EACE,OAAO,eAAe,OAAO,WAAW,IAAI,WAAW,EAAE,QAAQ,WAAW;GAC1E,MAAM,QAAQ,YAAY,KAAK,IAAI;GACnC,OAAO,WAAW,UAAU,QAAQ,OAAO,MAAM,MAAM,EAAE,IAAI,KAAA;EAC/D,CAAC,EACH,CACF;CACF;AACF"}

package/dist/server/spec/plugins/stripe.d.ts

@@ -0,0 +1,10 @@
+import { Translate } from "../../../shared/translations/types.js";
+import { OfficialPlugin } from "./shared.js";
+import { OperationObject } from "@scalar/openapi-types/3.2";
+export declare const stripeWebhookOperation: ({ tag, operationId, t }: {
+  tag: string;
+  operationId: string;
+  t: Translate;
+}) => OperationObject;
+export declare const stripe: OfficialPlugin;
+//# sourceMappingURL=stripe.d.ts.map

package/dist/server/spec/plugins/stripe.js

@@ -0,0 +1,102 @@
+import { jsonBody, jsonResponse } from "../components.js";
+import { securedRequirement } from "../security.js";
+import { messageErrors, mountEndpoints } from "./shared.js";
+const TAG = "Stripe";
+const stripeWebhookOperation = ({ tag, operationId, t }) => {
+	const received = {
+		type: "object",
+		properties: { received: { type: "boolean" } },
+		required: ["received"]
+	};
+	return {
+		tags: [tag],
+		operationId,
+		summary: t("stripeWebhook"),
+		parameters: [{
+			name: "stripe-signature",
+			in: "header",
+			schema: { type: "string" }
+		}],
+		requestBody: {
+			...jsonBody({
+				type: "object",
+				additionalProperties: true
+			}),
+			description: t("stripeWebhookBody")
+		},
+		responses: {
+			"200": jsonResponse(t("stripeWebhookResult"), received),
+			"400": jsonResponse(t("errorPluginStripeWebhook400"), received)
+		}
+	};
+};
+const stripe = {
+	slug: "@payloadcms/plugin-stripe",
+	tag: TAG,
+	build: ({ config, ctx, options, t }) => {
+		const rest = options?.rest;
+		const allowed = Array.isArray(rest?.allowedMethods) ? rest.allowedMethods : void 0;
+		const restOperation = {
+			tags: [TAG],
+			operationId: "stripeRest",
+			summary: t("stripeRest"),
+			requestBody: jsonBody({
+				type: "object",
+				properties: {
+					stripeMethod: {
+						type: "string",
+						...allowed ? { enum: [...new Set(allowed)] } : {}
+					},
+					stripeArgs: {
+						type: "array",
+						items: {}
+					}
+				},
+				required: ["stripeMethod", "stripeArgs"]
+			}),
+			responses: {
+				"200": jsonResponse(t("stripeRestResult"), {
+					type: "object",
+					properties: {
+						data: {},
+						status: {
+							type: "integer",
+							enum: [200]
+						}
+					},
+					required: ["data", "status"]
+				}),
+				...messageErrors([
+					"400",
+					"401",
+					"403"
+				], t),
+				"404": jsonResponse(t("errorPluginStripeRest404"), {
+					type: "object",
+					properties: {
+						message: { type: "string" },
+						status: {
+							type: "integer",
+							enum: [404]
+						}
+					},
+					required: ["message", "status"]
+				}),
+				...messageErrors(["500"], t)
+			},
+			security: securedRequirement()
+		};
+		return [{ paths: mountEndpoints(config.endpoints, ctx.apiRoute, ({ method, path }) => {
+			if (method !== "post") return void 0;
+			if (path === "/stripe/webhooks") return stripeWebhookOperation({
+				tag: TAG,
+				operationId: "stripeWebhooks",
+				t
+			});
+			return path === "/stripe/rest" ? restOperation : void 0;
+		}) }];
+	}
+};
+export { stripe, stripeWebhookOperation };
+
+//# sourceMappingURL=stripe.js.map

package/dist/server/spec/plugins/stripe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe.js","names":[],"sources":["../../../../src/server/spec/plugins/stripe.ts"],"sourcesContent":["import type { OperationObject, SchemaObject } from '@scalar/openapi-types/3.2'\n\nimport { jsonBody, jsonResponse } from '@/server/spec/components.js'\nimport { securedRequirement } from '@/server/spec/security.js'\nimport type { Translate } from '@/shared/translations/types.js'\n\nimport { type OfficialPlugin, messageErrors, mountEndpoints } from './shared.js'\n\nconst TAG = 'Stripe'\n\nexport const stripeWebhookOperation = ({\n  tag,\n  operationId,\n  t,\n}: {\n  tag: string\n  operationId: string\n  t: Translate\n}): OperationObject => {\n  const received: SchemaObject = {\n    type: 'object',\n    properties: { received: { type: 'boolean' } },\n    required: ['received'],\n  }\n  return {\n    tags: [tag],\n    operationId,\n    summary: t('stripeWebhook'),\n    parameters: [{ name: 'stripe-signature', in: 'header', schema: { type: 'string' } }],\n    requestBody: {\n      ...jsonBody({ type: 'object', additionalProperties: true }),\n      description: t('stripeWebhookBody'),\n    },\n    responses: {\n      '200': jsonResponse(t('stripeWebhookResult'), received),\n      '400': jsonResponse(t('errorPluginStripeWebhook400'), received),\n    },\n  }\n}\n\nexport const stripe: OfficialPlugin = {\n  slug: '@payloadcms/plugin-stripe',\n  tag: TAG,\n  build: ({ config, ctx, options, t }) => {\n    const rest = options?.rest as { allowedMethods?: unknown } | undefined\n    const allowed = Array.isArray(rest?.allowedMethods) ? (rest.allowedMethods as string[]) : undefined\n    const restOperation: OperationObject = {\n      tags: [TAG],\n      operationId: 'stripeRest',\n      summary: t('stripeRest'),\n      requestBody: jsonBody({\n        type: 'object',\n        properties: {\n          stripeMethod: { type: 'string', ...(allowed ? { enum: [...new Set(allowed)] } : {}) },\n          stripeArgs: { type: 'array', items: {} },\n        },\n        required: ['stripeMethod', 'stripeArgs'],\n      }),\n      responses: {\n        '200': jsonResponse(t('stripeRestResult'), {\n          type: 'object',\n          properties: { data: {}, status: { type: 'integer', enum: [200] } },\n          required: ['data', 'status'],\n        }),\n        ...messageErrors(['400', '401', '403'], t),\n        '404': jsonResponse(t('errorPluginStripeRest404'), {\n          type: 'object',\n          properties: { message: { type: 'string' }, status: { type: 'integer', enum: [404] } },\n          required: ['message', 'status'],\n        }),\n        ...messageErrors(['500'], t),\n      },\n      security: securedRequirement(),\n    }\n    return [\n      {\n        paths: mountEndpoints(config.endpoints, ctx.apiRoute, ({ method, path }) => {\n          if (method !== 'post') return undefined\n          if (path === '/stripe/webhooks') return stripeWebhookOperation({ tag: TAG, operationId: 'stripeWebhooks', t })\n          return path === '/stripe/rest' ? restOperation : undefined\n        }),\n      },\n    ]\n  },\n}\n"],"mappings":";;;AAQA,MAAM,MAAM;AAEZ,MAAa,0BAA0B,EACrC,KACA,aACA,QAKqB;CACrB,MAAM,WAAyB;EAC7B,MAAM;EACN,YAAY,EAAE,UAAU,EAAE,MAAM,UAAU,EAAE;EAC5C,UAAU,CAAC,UAAU;CACvB;CACA,OAAO;EACL,MAAM,CAAC,GAAG;EACV;EACA,SAAS,EAAE,eAAe;EAC1B,YAAY,CAAC;GAAE,MAAM;GAAoB,IAAI;GAAU,QAAQ,EAAE,MAAM,SAAS;EAAE,CAAC;EACnF,aAAa;GACX,GAAG,SAAS;IAAE,MAAM;IAAU,sBAAsB;GAAK,CAAC;GAC1D,aAAa,EAAE,mBAAmB;EACpC;EACA,WAAW;GACT,OAAO,aAAa,EAAE,qBAAqB,GAAG,QAAQ;GACtD,OAAO,aAAa,EAAE,6BAA6B,GAAG,QAAQ;EAChE;CACF;AACF;AAEA,MAAa,SAAyB;CACpC,MAAM;CACN,KAAK;CACL,QAAQ,EAAE,QAAQ,KAAK,SAAS,QAAQ;EACtC,MAAM,OAAO,SAAS;EACtB,MAAM,UAAU,MAAM,QAAQ,MAAM,cAAc,IAAK,KAAK,iBAA8B,KAAA;EAC1F,MAAM,gBAAiC;GACrC,MAAM,CAAC,GAAG;GACV,aAAa;GACb,SAAS,EAAE,YAAY;GACvB,aAAa,SAAS;IACpB,MAAM;IACN,YAAY;KACV,cAAc;MAAE,MAAM;MAAU,GAAI,UAAU,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC;KAAG;KACpF,YAAY;MAAE,MAAM;MAAS,OAAO,CAAC;KAAE;IACzC;IACA,UAAU,CAAC,gBAAgB,YAAY;GACzC,CAAC;GACD,WAAW;IACT,OAAO,aAAa,EAAE,kBAAkB,GAAG;KACzC,MAAM;KACN,YAAY;MAAE,MAAM,CAAC;MAAG,QAAQ;OAAE,MAAM;OAAW,MAAM,CAAC,GAAG;MAAE;KAAE;KACjE,UAAU,CAAC,QAAQ,QAAQ;IAC7B,CAAC;IACD,GAAG,cAAc;KAAC;KAAO;KAAO;IAAK,GAAG,CAAC;IACzC,OAAO,aAAa,EAAE,0BAA0B,GAAG;KACjD,MAAM;KACN,YAAY;MAAE,SAAS,EAAE,MAAM,SAAS;MAAG,QAAQ;OAAE,MAAM;OAAW,MAAM,CAAC,GAAG;MAAE;KAAE;KACpF,UAAU,CAAC,WAAW,QAAQ;IAChC,CAAC;IACD,GAAG,cAAc,CAAC,KAAK,GAAG,CAAC;GAC7B;GACA,UAAU,mBAAmB;EAC/B;EACA,OAAO,CACL,EACE,OAAO,eAAe,OAAO,WAAW,IAAI,WAAW,EAAE,QAAQ,WAAW;GAC1E,IAAI,WAAW,QAAQ,OAAO,KAAA;GAC9B,IAAI,SAAS,oBAAoB,OAAO,uBAAuB;IAAE,KAAK;IAAK,aAAa;IAAkB;GAAE,CAAC;GAC7G,OAAO,SAAS,iBAAiB,gBAAgB,KAAA;EACnD,CAAC,EACH,CACF;CACF;AACF"}

package/dist/server/spec/security.d.ts

@@ -23,10 +23,11 @@ export declare const resolveEntitySecurity: ({ entity, operations, locale, baseA
   locale?: string;
   baseAccess?: SanitizedConfig['baseAccess'];
 }) => Promise<EntitySecurity>;
-export declare const applySecurity: ({ paths, slug, kind, security, login }: {
+export declare const applySecurity: ({ paths, slug, kind, plugin, security, login }: {
   paths: PathsObject;
   slug?: string;
   kind: OperationKind;
+  plugin?: string;
   security?: SecurityOption;
   login?: boolean;
 }) => Promise<PathsObject>;

package/dist/server/spec/security.js

@@ -1,6 +1,7 @@
 import { isPlainObject } from "../../shared/utils.js";
 import { INTERACTIVE_SCHEME_NAME, SECURITY_SCHEME_NAME } from "./components.js";
 import { PLUGIN_NAME } from "../../shared/constants.js";
+import { operationPlugin } from "./filters.js";
 const HTTP_METHODS = [
 	"get",
 	"post",
@@ -68,7 +69,7 @@ const resolveEntitySecurity = async ({ entity, operations, locale, baseAccess })
 	return out;
 };
 const withLogin = (security) => security.some((r) => "PayloadToken" in r) && !security.some((r) => "PayloadLogin" in r) ? [...security, { [INTERACTIVE_SCHEME_NAME]: [] }] : security;
-const applySecurity = async ({ paths, slug, kind, security, login = false }) => {
+const applySecurity = async ({ paths, slug, kind, plugin, security, login = false }) => {
 	if (!security && !login) return paths;
 	for (const [path, item] of Object.entries(paths)) {
 		if (!item) continue;
@@ -78,12 +79,14 @@ const applySecurity = async ({ paths, slug, kind, security, login = false }) =>
 			if (!op) continue;
 			if (login && op.security) op.security = withLogin(op.security);
 			if (!security) continue;
+			const detected = op.security?.length ? "secured" : "public";
 			const decision = await security({
 				method,
 				path,
 				slug,
 				kind,
-				detected: op.security?.length ? "secured" : "public"
+				plugin: operationPlugin(op, plugin),
+				detected
 			});
 			if (decision === "public") delete op.security;
 			else if (decision === "secured") op.security = securedRequirement(login);

package/dist/server/spec/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","names":[],"sources":["../../../src/server/spec/security.ts"],"sourcesContent":["import type { PathsObject, SecurityRequirementObject } from '@scalar/openapi-types/3.2'\nimport type { Access, SanitizedConfig } from 'payload'\n\nimport { PLUGIN_NAME } from '@/shared/constants.js'\nimport type {\n  Entity,\n  EntityOperation,\n  EntitySecurityOverride,\n  HttpMethod,\n  OperationKind,\n  SecurityOption,\n} from '@/shared/types/index.js'\nimport { isPlainObject } from '@/shared/utils.js'\n\nimport { INTERACTIVE_SCHEME_NAME, SECURITY_SCHEME_NAME } from './components.js'\n\nconst HTTP_METHODS: HttpMethod[] = ['get', 'post', 'patch', 'put', 'delete']\n\nexport const securedRequirement = (login = false): SecurityRequirementObject[] =>\n  login ? [{ [SECURITY_SCHEME_NAME]: [] }, { [INTERACTIVE_SCHEME_NAME]: [] }] : [{ [SECURITY_SCHEME_NAME]: [] }]\n\ntype ProbedOperation = EntityOperation | 'readVersions'\n\nconst OVERRIDE_FALLBACK: Partial<Record<ProbedOperation, EntityOperation>> = {\n  readVersions: 'read',\n  validate: 'update',\n}\n\nexport type EntitySecurity = Partial<Record<ProbedOperation, SecurityRequirementObject[] | undefined>>\n\nconst withTimeout = async (promise: Promise<unknown>, timeoutMs: number): Promise<boolean> => {\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const guard = new Promise<false>((resolve) => {\n    timer = setTimeout(() => resolve(false), timeoutMs)\n  })\n  try {\n    return await Promise.race([\n      promise.then(\n        (value) => value === true,\n        () => false,\n      ),\n      guard,\n    ])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\nexport const evaluateAccess = async (\n  access: Access | undefined,\n  opts: { locale?: string; timeoutMs?: number; baseAccess?: SanitizedConfig['baseAccess'] } = {},\n): Promise<boolean> => {\n  if (!access) return false\n  const { locale, timeoutMs = 250, baseAccess } = opts\n  const trap = <T extends object>(allowed: PropertyKey, value: unknown): T =>\n    new Proxy({} as T, {\n      get(_target, key) {\n        if (key === allowed) return value\n        throw new Error('req.payload accessed during build')\n      },\n    })\n  const payloadTrap = trap('config', trap('baseAccess', baseAccess))\n  const req = { user: null, headers: new Headers(), context: {}, locale, payload: payloadTrap }\n  try {\n    const result = access({ req } as never)\n    if (result && typeof (result as Promise<unknown>).then === 'function') {\n      return await withTimeout(result as Promise<unknown>, timeoutMs)\n    }\n    return result === true\n  } catch {\n    return false\n  }\n}\n\nexport const readSecurityOverride = (entity: {\n  slug: string\n  custom?: { openapi?: { security?: unknown } }\n}): EntitySecurityOverride | undefined => {\n  const meta = entity.custom?.openapi?.security\n  const values = isPlainObject(meta) ? Object.values(meta) : [meta]\n  if (values.some((value) => typeof value === 'boolean')) {\n    throw new Error(\n      `[${PLUGIN_NAME}] custom.openapi.security true/false on \"${entity.slug}\" was removed, use 'public' or 'secured'`,\n    )\n  }\n  return meta === undefined ? undefined : (meta as EntitySecurityOverride)\n}\n\nconst overrideFor = (override: EntitySecurityOverride | undefined, op: ProbedOperation): boolean | undefined => {\n  const fallback = OVERRIDE_FALLBACK[op]\n  const marking =\n    typeof override === 'string'\n      ? override\n      : (override?.[op as EntityOperation] ?? (fallback ? override?.[fallback] : undefined))\n  return marking === undefined ? undefined : marking === 'public'\n}\n\nexport const resolveEntitySecurity = async ({\n  entity,\n  operations,\n  locale,\n  baseAccess,\n}: {\n  entity: Entity\n  operations: ProbedOperation[]\n  locale?: string\n  baseAccess?: SanitizedConfig['baseAccess']\n}): Promise<EntitySecurity> => {\n  const override = readSecurityOverride(entity)\n  const access = entity.access as Partial<Record<ProbedOperation, Access>> | undefined\n  const out: EntitySecurity = {}\n  for (const op of operations) {\n    const declared = overrideFor(override, op)\n    const isPublic = declared ?? (await evaluateAccess(access?.[op], { locale, baseAccess }))\n    out[op] = isPublic ? undefined : securedRequirement()\n  }\n  return out\n}\n\nconst withLogin = (security: SecurityRequirementObject[]): SecurityRequirementObject[] =>\n  security.some((r) => SECURITY_SCHEME_NAME in r) && !security.some((r) => INTERACTIVE_SCHEME_NAME in r)\n    ? [...security, { [INTERACTIVE_SCHEME_NAME]: [] }]\n    : security\n\nexport const applySecurity = async ({\n  paths,\n  slug,\n  kind,\n  security,\n  login = false,\n}: {\n  paths: PathsObject\n  slug?: string\n  kind: OperationKind\n  security?: SecurityOption\n  login?: boolean\n}): Promise<PathsObject> => {\n  if (!security && !login) return paths\n  for (const [path, item] of Object.entries(paths)) {\n    if (!item) continue\n    const ops = item as Record<HttpMethod, { security?: SecurityRequirementObject[] } | undefined>\n    for (const method of HTTP_METHODS) {\n      const op = ops[method]\n      if (!op) continue\n      if (login && op.security) op.security = withLogin(op.security)\n      if (!security) continue\n      const detected = op.security?.length ? 'secured' : 'public'\n      const decision = await security({ method, path, slug, kind, detected })\n      if (decision === 'public') delete op.security\n      else if (decision === 'secured') op.security = securedRequirement(login)\n      else if (Array.isArray(decision)) op.security = decision\n    }\n  }\n  return paths\n}\n"],"mappings":";;;AAgBA,MAAM,eAA6B;CAAC;CAAO;CAAQ;CAAS;CAAO;AAAQ;AAE3E,MAAa,sBAAsB,QAAQ,UACzC,QAAQ,CAAC,GAAG,uBAAuB,CAAC,EAAE,GAAG,GAAG,0BAA0B,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,EAAE,CAAC;AAI/G,MAAM,oBAAuE;CAC3E,cAAc;CACd,UAAU;AACZ;AAIA,MAAM,cAAc,OAAO,SAA2B,cAAwC;CAC5F,IAAI;CACJ,MAAM,QAAQ,IAAI,SAAgB,YAAY;EAC5C,QAAQ,iBAAiB,QAAQ,KAAK,GAAG,SAAS;CACpD,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QAAQ,MACL,UAAU,UAAU,YACf,KACR,GACA,KACF,CAAC;CACH,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,MAAa,iBAAiB,OAC5B,QACA,OAA4F,CAAC,MACxE;CACrB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,EAAE,QAAQ,YAAY,KAAK,eAAe;CAChD,MAAM,QAA0B,SAAsB,UACpD,IAAI,MAAM,CAAC,GAAQ,EACjB,IAAI,SAAS,KAAK;EAChB,IAAI,QAAQ,SAAS,OAAO;EAC5B,MAAM,IAAI,MAAM,mCAAmC;CACrD,EACF,CAAC;CACH,MAAM,cAAc,KAAK,UAAU,KAAK,cAAc,UAAU,CAAC;CACjE,MAAM,MAAM;EAAE,MAAM;EAAM,SAAS,IAAI,QAAQ;EAAG,SAAS,CAAC;EAAG;EAAQ,SAAS;CAAY;CAC5F,IAAI;EACF,MAAM,SAAS,OAAO,EAAE,IAAI,CAAU;EACtC,IAAI,UAAU,OAAQ,OAA4B,SAAS,YACzD,OAAO,MAAM,YAAY,QAA4B,SAAS;EAEhE,OAAO,WAAW;CACpB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,wBAAwB,WAGK;CACxC,MAAM,OAAO,OAAO,QAAQ,SAAS;CAErC,KADe,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,EAAA,CACrD,MAAM,UAAU,OAAO,UAAU,SAAS,GACnD,MAAM,IAAI,MACR,IAAI,YAAY,2CAA2C,OAAO,KAAK,yCACzE;CAEF,OAAO,SAAS,KAAA,IAAY,KAAA,IAAa;AAC3C;AAEA,MAAM,eAAe,UAA8C,OAA6C;CAC9G,MAAM,WAAW,kBAAkB;CACnC,MAAM,UACJ,OAAO,aAAa,WAChB,WACC,WAAW,QAA2B,WAAW,WAAW,YAAY,KAAA;CAC/E,OAAO,YAAY,KAAA,IAAY,KAAA,IAAY,YAAY;AACzD;AAEA,MAAa,wBAAwB,OAAO,EAC1C,QACA,YACA,QACA,iBAM6B;CAC7B,MAAM,WAAW,qBAAqB,MAAM;CAC5C,MAAM,SAAS,OAAO;CACtB,MAAM,MAAsB,CAAC;CAC7B,KAAK,MAAM,MAAM,YAGf,IAAI,MAFa,YAAY,UAAU,EACf,KAAM,MAAM,eAAe,SAAS,KAAK;EAAE;EAAQ;CAAW,CAAC,IAClE,KAAA,IAAY,mBAAmB;CAEtD,OAAO;AACT;AAEA,MAAM,aAAa,aACjB,SAAS,MAAM,MAAA,kBAA8B,CAAC,KAAK,CAAC,SAAS,MAAM,MAAA,kBAAiC,CAAC,IACjG,CAAC,GAAG,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,IAC/C;AAEN,MAAa,gBAAgB,OAAO,EAClC,OACA,MACA,MACA,UACA,QAAQ,YAOkB;CAC1B,IAAI,CAAC,YAAY,CAAC,OAAO,OAAO;CAChC,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,CAAC,MAAM;EACX,MAAM,MAAM;EACZ,KAAK,MAAM,UAAU,cAAc;GACjC,MAAM,KAAK,IAAI;GACf,IAAI,CAAC,IAAI;GACT,IAAI,SAAS,GAAG,UAAU,GAAG,WAAW,UAAU,GAAG,QAAQ;GAC7D,IAAI,CAAC,UAAU;GAEf,MAAM,WAAW,MAAM,SAAS;IAAE;IAAQ;IAAM;IAAM;IAAM,UAD3C,GAAG,UAAU,SAAS,YAAY;GACkB,CAAC;GACtE,IAAI,aAAa,UAAU,OAAO,GAAG;QAChC,IAAI,aAAa,WAAW,GAAG,WAAW,mBAAmB,KAAK;QAClE,IAAI,MAAM,QAAQ,QAAQ,GAAG,GAAG,WAAW;EAClD;CACF;CACA,OAAO;AACT"}
+{"version":3,"file":"security.js","names":[],"sources":["../../../src/server/spec/security.ts"],"sourcesContent":["import type { PathsObject, SecurityRequirementObject } from '@scalar/openapi-types/3.2'\nimport type { Access, SanitizedConfig } from 'payload'\n\nimport { PLUGIN_NAME } from '@/shared/constants.js'\nimport type {\n  Entity,\n  EntityOperation,\n  EntitySecurityOverride,\n  HttpMethod,\n  OperationKind,\n  SecurityOption,\n} from '@/shared/types/index.js'\nimport { isPlainObject } from '@/shared/utils.js'\n\nimport { INTERACTIVE_SCHEME_NAME, SECURITY_SCHEME_NAME } from './components.js'\nimport { operationPlugin } from './filters.js'\n\nconst HTTP_METHODS: HttpMethod[] = ['get', 'post', 'patch', 'put', 'delete']\n\nexport const securedRequirement = (login = false): SecurityRequirementObject[] =>\n  login ? [{ [SECURITY_SCHEME_NAME]: [] }, { [INTERACTIVE_SCHEME_NAME]: [] }] : [{ [SECURITY_SCHEME_NAME]: [] }]\n\ntype ProbedOperation = EntityOperation | 'readVersions'\n\nconst OVERRIDE_FALLBACK: Partial<Record<ProbedOperation, EntityOperation>> = {\n  readVersions: 'read',\n  validate: 'update',\n}\n\nexport type EntitySecurity = Partial<Record<ProbedOperation, SecurityRequirementObject[] | undefined>>\n\nconst withTimeout = async (promise: Promise<unknown>, timeoutMs: number): Promise<boolean> => {\n  let timer: ReturnType<typeof setTimeout> | undefined\n  const guard = new Promise<false>((resolve) => {\n    timer = setTimeout(() => resolve(false), timeoutMs)\n  })\n  try {\n    return await Promise.race([\n      promise.then(\n        (value) => value === true,\n        () => false,\n      ),\n      guard,\n    ])\n  } finally {\n    if (timer) clearTimeout(timer)\n  }\n}\n\nexport const evaluateAccess = async (\n  access: Access | undefined,\n  opts: { locale?: string; timeoutMs?: number; baseAccess?: SanitizedConfig['baseAccess'] } = {},\n): Promise<boolean> => {\n  if (!access) return false\n  const { locale, timeoutMs = 250, baseAccess } = opts\n  const trap = <T extends object>(allowed: PropertyKey, value: unknown): T =>\n    new Proxy({} as T, {\n      get(_target, key) {\n        if (key === allowed) return value\n        throw new Error('req.payload accessed during build')\n      },\n    })\n  const payloadTrap = trap('config', trap('baseAccess', baseAccess))\n  const req = { user: null, headers: new Headers(), context: {}, locale, payload: payloadTrap }\n  try {\n    const result = access({ req } as never)\n    if (result && typeof (result as Promise<unknown>).then === 'function') {\n      return await withTimeout(result as Promise<unknown>, timeoutMs)\n    }\n    return result === true\n  } catch {\n    return false\n  }\n}\n\nexport const readSecurityOverride = (entity: {\n  slug: string\n  custom?: { openapi?: { security?: unknown } }\n}): EntitySecurityOverride | undefined => {\n  const meta = entity.custom?.openapi?.security\n  const values = isPlainObject(meta) ? Object.values(meta) : [meta]\n  if (values.some((value) => typeof value === 'boolean')) {\n    throw new Error(\n      `[${PLUGIN_NAME}] custom.openapi.security true/false on \"${entity.slug}\" was removed, use 'public' or 'secured'`,\n    )\n  }\n  return meta === undefined ? undefined : (meta as EntitySecurityOverride)\n}\n\nconst overrideFor = (override: EntitySecurityOverride | undefined, op: ProbedOperation): boolean | undefined => {\n  const fallback = OVERRIDE_FALLBACK[op]\n  const marking =\n    typeof override === 'string'\n      ? override\n      : (override?.[op as EntityOperation] ?? (fallback ? override?.[fallback] : undefined))\n  return marking === undefined ? undefined : marking === 'public'\n}\n\nexport const resolveEntitySecurity = async ({\n  entity,\n  operations,\n  locale,\n  baseAccess,\n}: {\n  entity: Entity\n  operations: ProbedOperation[]\n  locale?: string\n  baseAccess?: SanitizedConfig['baseAccess']\n}): Promise<EntitySecurity> => {\n  const override = readSecurityOverride(entity)\n  const access = entity.access as Partial<Record<ProbedOperation, Access>> | undefined\n  const out: EntitySecurity = {}\n  for (const op of operations) {\n    const declared = overrideFor(override, op)\n    const isPublic = declared ?? (await evaluateAccess(access?.[op], { locale, baseAccess }))\n    out[op] = isPublic ? undefined : securedRequirement()\n  }\n  return out\n}\n\nconst withLogin = (security: SecurityRequirementObject[]): SecurityRequirementObject[] =>\n  security.some((r) => SECURITY_SCHEME_NAME in r) && !security.some((r) => INTERACTIVE_SCHEME_NAME in r)\n    ? [...security, { [INTERACTIVE_SCHEME_NAME]: [] }]\n    : security\n\nexport const applySecurity = async ({\n  paths,\n  slug,\n  kind,\n  plugin,\n  security,\n  login = false,\n}: {\n  paths: PathsObject\n  slug?: string\n  kind: OperationKind\n  plugin?: string\n  security?: SecurityOption\n  login?: boolean\n}): Promise<PathsObject> => {\n  if (!security && !login) return paths\n  for (const [path, item] of Object.entries(paths)) {\n    if (!item) continue\n    const ops = item as Record<HttpMethod, { security?: SecurityRequirementObject[] } | undefined>\n    for (const method of HTTP_METHODS) {\n      const op = ops[method]\n      if (!op) continue\n      if (login && op.security) op.security = withLogin(op.security)\n      if (!security) continue\n      const detected = op.security?.length ? 'secured' : 'public'\n      const decision = await security({ method, path, slug, kind, plugin: operationPlugin(op, plugin), detected })\n      if (decision === 'public') delete op.security\n      else if (decision === 'secured') op.security = securedRequirement(login)\n      else if (Array.isArray(decision)) op.security = decision\n    }\n  }\n  return paths\n}\n"],"mappings":";;;;AAiBA,MAAM,eAA6B;CAAC;CAAO;CAAQ;CAAS;CAAO;AAAQ;AAE3E,MAAa,sBAAsB,QAAQ,UACzC,QAAQ,CAAC,GAAG,uBAAuB,CAAC,EAAE,GAAG,GAAG,0BAA0B,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,EAAE,CAAC;AAI/G,MAAM,oBAAuE;CAC3E,cAAc;CACd,UAAU;AACZ;AAIA,MAAM,cAAc,OAAO,SAA2B,cAAwC;CAC5F,IAAI;CACJ,MAAM,QAAQ,IAAI,SAAgB,YAAY;EAC5C,QAAQ,iBAAiB,QAAQ,KAAK,GAAG,SAAS;CACpD,CAAC;CACD,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,QAAQ,MACL,UAAU,UAAU,YACf,KACR,GACA,KACF,CAAC;CACH,UAAU;EACR,IAAI,OAAO,aAAa,KAAK;CAC/B;AACF;AAEA,MAAa,iBAAiB,OAC5B,QACA,OAA4F,CAAC,MACxE;CACrB,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,EAAE,QAAQ,YAAY,KAAK,eAAe;CAChD,MAAM,QAA0B,SAAsB,UACpD,IAAI,MAAM,CAAC,GAAQ,EACjB,IAAI,SAAS,KAAK;EAChB,IAAI,QAAQ,SAAS,OAAO;EAC5B,MAAM,IAAI,MAAM,mCAAmC;CACrD,EACF,CAAC;CACH,MAAM,cAAc,KAAK,UAAU,KAAK,cAAc,UAAU,CAAC;CACjE,MAAM,MAAM;EAAE,MAAM;EAAM,SAAS,IAAI,QAAQ;EAAG,SAAS,CAAC;EAAG;EAAQ,SAAS;CAAY;CAC5F,IAAI;EACF,MAAM,SAAS,OAAO,EAAE,IAAI,CAAU;EACtC,IAAI,UAAU,OAAQ,OAA4B,SAAS,YACzD,OAAO,MAAM,YAAY,QAA4B,SAAS;EAEhE,OAAO,WAAW;CACpB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAa,wBAAwB,WAGK;CACxC,MAAM,OAAO,OAAO,QAAQ,SAAS;CAErC,KADe,cAAc,IAAI,IAAI,OAAO,OAAO,IAAI,IAAI,CAAC,IAAI,EAAA,CACrD,MAAM,UAAU,OAAO,UAAU,SAAS,GACnD,MAAM,IAAI,MACR,IAAI,YAAY,2CAA2C,OAAO,KAAK,yCACzE;CAEF,OAAO,SAAS,KAAA,IAAY,KAAA,IAAa;AAC3C;AAEA,MAAM,eAAe,UAA8C,OAA6C;CAC9G,MAAM,WAAW,kBAAkB;CACnC,MAAM,UACJ,OAAO,aAAa,WAChB,WACC,WAAW,QAA2B,WAAW,WAAW,YAAY,KAAA;CAC/E,OAAO,YAAY,KAAA,IAAY,KAAA,IAAY,YAAY;AACzD;AAEA,MAAa,wBAAwB,OAAO,EAC1C,QACA,YACA,QACA,iBAM6B;CAC7B,MAAM,WAAW,qBAAqB,MAAM;CAC5C,MAAM,SAAS,OAAO;CACtB,MAAM,MAAsB,CAAC;CAC7B,KAAK,MAAM,MAAM,YAGf,IAAI,MAFa,YAAY,UAAU,EACf,KAAM,MAAM,eAAe,SAAS,KAAK;EAAE;EAAQ;CAAW,CAAC,IAClE,KAAA,IAAY,mBAAmB;CAEtD,OAAO;AACT;AAEA,MAAM,aAAa,aACjB,SAAS,MAAM,MAAA,kBAA8B,CAAC,KAAK,CAAC,SAAS,MAAM,MAAA,kBAAiC,CAAC,IACjG,CAAC,GAAG,UAAU,GAAG,0BAA0B,CAAC,EAAE,CAAC,IAC/C;AAEN,MAAa,gBAAgB,OAAO,EAClC,OACA,MACA,MACA,QACA,UACA,QAAQ,YAQkB;CAC1B,IAAI,CAAC,YAAY,CAAC,OAAO,OAAO;CAChC,KAAK,MAAM,CAAC,MAAM,SAAS,OAAO,QAAQ,KAAK,GAAG;EAChD,IAAI,CAAC,MAAM;EACX,MAAM,MAAM;EACZ,KAAK,MAAM,UAAU,cAAc;GACjC,MAAM,KAAK,IAAI;GACf,IAAI,CAAC,IAAI;GACT,IAAI,SAAS,GAAG,UAAU,GAAG,WAAW,UAAU,GAAG,QAAQ;GAC7D,IAAI,CAAC,UAAU;GACf,MAAM,WAAW,GAAG,UAAU,SAAS,YAAY;GACnD,MAAM,WAAW,MAAM,SAAS;IAAE;IAAQ;IAAM;IAAM;IAAM,QAAQ,gBAAgB,IAAI,MAAM;IAAG;GAAS,CAAC;GAC3G,IAAI,aAAa,UAAU,OAAO,GAAG;QAChC,IAAI,aAAa,WAAW,GAAG,WAAW,mBAAmB,KAAK;QAClE,IAAI,MAAM,QAAQ,QAAQ,GAAG,GAAG,WAAW;EAClD;CACF;CACA,OAAO;AACT"}

package/dist/server/spec/tags.d.ts

@@ -3,12 +3,14 @@ import { TagObject } from "@scalar/openapi-types/3.2";
 export declare const NAV_COLLECTIONS = "Collections";
 export declare const NAV_GLOBALS = "Globals";
 export declare const NAV_SYSTEM = "System";
+export declare const NAV_PLUGINS = "Plugins";
 export declare const entityTagName: (base: string) => string;
 export declare const authTagName: (base: string) => string;
 export declare const versionsTagName: (base: string) => string;
 declare const SYSTEM_TAG_SUMMARIES: {
   readonly Jobs: 'tagJobs';
   readonly Uploads: 'tagUploads';
+  readonly Reorder: 'tagReorder';
   readonly Access: 'tagAccess';
 };
 export type SystemTag = keyof typeof SYSTEM_TAG_SUMMARIES;
@@ -27,8 +29,9 @@ export interface TagHierarchyInput {
   collections: CollectionTagInfo[];
   globals: GlobalTagInfo[];
   systemTags: SystemTag[];
+  pluginTags?: string[];
   t: Translate;
   nested: boolean;
 }
-export declare const buildTagHierarchy: ({ collections, globals, systemTags, t, nested }: TagHierarchyInput) => TagObject[];
+export declare const buildTagHierarchy: ({ collections, globals, systemTags, pluginTags, t, nested }: TagHierarchyInput) => TagObject[];
 //# sourceMappingURL=tags.d.ts.map

package/dist/server/spec/tags.js

@@ -1,15 +1,17 @@
 const NAV_COLLECTIONS = "Collections";
 const NAV_GLOBALS = "Globals";
 const NAV_SYSTEM = "System";
+const NAV_PLUGINS = "Plugins";
 const entityTagName = (base) => base;
 const authTagName = (base) => `${base} Auth`;
 const versionsTagName = (base) => `${base} Versions`;
 const SYSTEM_TAG_SUMMARIES = {
 	Jobs: "tagJobs",
 	Uploads: "tagUploads",
+	Reorder: "tagReorder",
 	Access: "tagAccess"
 };
-const buildTagHierarchy = ({ collections, globals, systemTags, t, nested }) => {
+const buildTagHierarchy = ({ collections, globals, systemTags, pluginTags = [], t, nested }) => {
 	if (!nested) return [...collections.map((c) => ({
 		name: entityTagName(c.base),
 		description: c.description
@@ -76,8 +78,22 @@ const buildTagHierarchy = ({ collections, globals, systemTags, t, nested }) => {
 			summary: t(SYSTEM_TAG_SUMMARIES[name])
 		});
 	}
+	const taken = new Set(tags.map((tag) => tag.name));
+	const freePluginTags = pluginTags.filter((name) => !taken.has(name));
+	if (freePluginTags.length > 0) {
+		tags.push({
+			name: NAV_PLUGINS,
+			summary: t("tagPlugins"),
+			description: t("tagPluginsDesc"),
+			kind: "nav"
+		});
+		for (const name of freePluginTags) tags.push({
+			name,
+			parent: NAV_PLUGINS
+		});
+	}
 	return tags;
 };
-export { NAV_COLLECTIONS, NAV_GLOBALS, NAV_SYSTEM, authTagName, buildTagHierarchy, entityTagName, versionsTagName };
+export { NAV_COLLECTIONS, NAV_GLOBALS, NAV_PLUGINS, NAV_SYSTEM, authTagName, buildTagHierarchy, entityTagName, versionsTagName };
 
 //# sourceMappingURL=tags.js.map

package/dist/server/spec/tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"tags.js","names":[],"sources":["../../../src/server/spec/tags.ts"],"sourcesContent":["import type { TagObject } from '@scalar/openapi-types/3.2'\n\nimport type { Translate } from '@/shared/translations/types.js'\n\nexport const NAV_COLLECTIONS = 'Collections'\nexport const NAV_GLOBALS = 'Globals'\nexport const NAV_SYSTEM = 'System'\n\nexport const entityTagName = (base: string): string => base\nexport const authTagName = (base: string): string => `${base} Auth`\nexport const versionsTagName = (base: string): string => `${base} Versions`\n\nconst SYSTEM_TAG_SUMMARIES = { Jobs: 'tagJobs', Uploads: 'tagUploads', Access: 'tagAccess' } as const\n\nexport type SystemTag = keyof typeof SYSTEM_TAG_SUMMARIES\n\nexport interface CollectionTagInfo {\n  base: string\n  hasAuth: boolean\n  hasVersions: boolean\n  description?: string\n}\n\nexport interface GlobalTagInfo {\n  base: string\n  hasVersions: boolean\n  description?: string\n}\n\nexport interface TagHierarchyInput {\n  collections: CollectionTagInfo[]\n  globals: GlobalTagInfo[]\n  systemTags: SystemTag[]\n  t: Translate\n  nested: boolean\n}\n\nexport const buildTagHierarchy = ({ collections, globals, systemTags, t, nested }: TagHierarchyInput): TagObject[] => {\n  if (!nested) {\n    return [\n      ...collections.map((c) => ({ name: entityTagName(c.base), description: c.description })),\n      ...globals.map((g) => ({ name: entityTagName(g.base), description: g.description })),\n    ]\n  }\n\n  const tags: TagObject[] = []\n\n  if (collections.length > 0) {\n    tags.push({\n      name: NAV_COLLECTIONS,\n      summary: t('tagCollections'),\n      description: t('tagCollectionsDesc'),\n      kind: 'nav',\n    })\n    for (const c of collections) {\n      tags.push({ name: entityTagName(c.base), parent: NAV_COLLECTIONS, description: c.description })\n      if (c.hasAuth) tags.push({ name: authTagName(c.base), parent: c.base, summary: t('tagAuth') })\n      if (c.hasVersions) tags.push({ name: versionsTagName(c.base), parent: c.base, summary: t('tagVersions') })\n    }\n  }\n\n  if (globals.length > 0) {\n    tags.push({ name: NAV_GLOBALS, summary: t('tagGlobals'), description: t('tagGlobalsDesc'), kind: 'nav' })\n    for (const g of globals) {\n      tags.push({ name: entityTagName(g.base), parent: NAV_GLOBALS, description: g.description })\n      if (g.hasVersions) tags.push({ name: versionsTagName(g.base), parent: g.base, summary: t('tagVersions') })\n    }\n  }\n\n  if (systemTags.length > 0) {\n    tags.push({ name: NAV_SYSTEM, summary: t('tagSystem'), description: t('tagSystemDesc'), kind: 'nav' })\n    for (const name of systemTags) tags.push({ name, parent: NAV_SYSTEM, summary: t(SYSTEM_TAG_SUMMARIES[name]) })\n  }\n\n  return tags\n}\n"],"mappings":"AAIA,MAAa,kBAAkB;AAC/B,MAAa,cAAc;AAC3B,MAAa,aAAa;AAE1B,MAAa,iBAAiB,SAAyB;AACvD,MAAa,eAAe,SAAyB,GAAG,KAAK;AAC7D,MAAa,mBAAmB,SAAyB,GAAG,KAAK;AAEjE,MAAM,uBAAuB;CAAE,MAAM;CAAW,SAAS;CAAc,QAAQ;AAAY;AAyB3F,MAAa,qBAAqB,EAAE,aAAa,SAAS,YAAY,GAAG,aAA6C;CACpH,IAAI,CAAC,QACH,OAAO,CACL,GAAG,YAAY,KAAK,OAAO;EAAE,MAAM,cAAc,EAAE,IAAI;EAAG,aAAa,EAAE;CAAY,EAAE,GACvF,GAAG,QAAQ,KAAK,OAAO;EAAE,MAAM,cAAc,EAAE,IAAI;EAAG,aAAa,EAAE;CAAY,EAAE,CACrF;CAGF,MAAM,OAAoB,CAAC;CAE3B,IAAI,YAAY,SAAS,GAAG;EAC1B,KAAK,KAAK;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB;GAC3B,aAAa,EAAE,oBAAoB;GACnC,MAAM;EACR,CAAC;EACD,KAAK,MAAM,KAAK,aAAa;GAC3B,KAAK,KAAK;IAAE,MAAM,cAAc,EAAE,IAAI;IAAG,QAAQ;IAAiB,aAAa,EAAE;GAAY,CAAC;GAC9F,IAAI,EAAE,SAAS,KAAK,KAAK;IAAE,MAAM,YAAY,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GAC7F,IAAI,EAAE,aAAa,KAAK,KAAK;IAAE,MAAM,gBAAgB,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,aAAa;GAAE,CAAC;EAC3G;CACF;CAEA,IAAI,QAAQ,SAAS,GAAG;EACtB,KAAK,KAAK;GAAE,MAAM;GAAa,SAAS,EAAE,YAAY;GAAG,aAAa,EAAE,gBAAgB;GAAG,MAAM;EAAM,CAAC;EACxG,KAAK,MAAM,KAAK,SAAS;GACvB,KAAK,KAAK;IAAE,MAAM,cAAc,EAAE,IAAI;IAAG,QAAQ;IAAa,aAAa,EAAE;GAAY,CAAC;GAC1F,IAAI,EAAE,aAAa,KAAK,KAAK;IAAE,MAAM,gBAAgB,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,aAAa;GAAE,CAAC;EAC3G;CACF;CAEA,IAAI,WAAW,SAAS,GAAG;EACzB,KAAK,KAAK;GAAE,MAAM;GAAY,SAAS,EAAE,WAAW;GAAG,aAAa,EAAE,eAAe;GAAG,MAAM;EAAM,CAAC;EACrG,KAAK,MAAM,QAAQ,YAAY,KAAK,KAAK;GAAE;GAAM,QAAQ;GAAY,SAAS,EAAE,qBAAqB,KAAK;EAAE,CAAC;CAC/G;CAEA,OAAO;AACT"}
+{"version":3,"file":"tags.js","names":[],"sources":["../../../src/server/spec/tags.ts"],"sourcesContent":["import type { TagObject } from '@scalar/openapi-types/3.2'\n\nimport type { Translate } from '@/shared/translations/types.js'\n\nexport const NAV_COLLECTIONS = 'Collections'\nexport const NAV_GLOBALS = 'Globals'\nexport const NAV_SYSTEM = 'System'\nexport const NAV_PLUGINS = 'Plugins'\n\nexport const entityTagName = (base: string): string => base\nexport const authTagName = (base: string): string => `${base} Auth`\nexport const versionsTagName = (base: string): string => `${base} Versions`\n\nconst SYSTEM_TAG_SUMMARIES = {\n  Jobs: 'tagJobs',\n  Uploads: 'tagUploads',\n  Reorder: 'tagReorder',\n  Access: 'tagAccess',\n} as const\n\nexport type SystemTag = keyof typeof SYSTEM_TAG_SUMMARIES\n\nexport interface CollectionTagInfo {\n  base: string\n  hasAuth: boolean\n  hasVersions: boolean\n  description?: string\n}\n\nexport interface GlobalTagInfo {\n  base: string\n  hasVersions: boolean\n  description?: string\n}\n\nexport interface TagHierarchyInput {\n  collections: CollectionTagInfo[]\n  globals: GlobalTagInfo[]\n  systemTags: SystemTag[]\n  pluginTags?: string[]\n  t: Translate\n  nested: boolean\n}\n\nexport const buildTagHierarchy = ({\n  collections,\n  globals,\n  systemTags,\n  pluginTags = [],\n  t,\n  nested,\n}: TagHierarchyInput): TagObject[] => {\n  if (!nested) {\n    return [\n      ...collections.map((c) => ({ name: entityTagName(c.base), description: c.description })),\n      ...globals.map((g) => ({ name: entityTagName(g.base), description: g.description })),\n    ]\n  }\n\n  const tags: TagObject[] = []\n\n  if (collections.length > 0) {\n    tags.push({\n      name: NAV_COLLECTIONS,\n      summary: t('tagCollections'),\n      description: t('tagCollectionsDesc'),\n      kind: 'nav',\n    })\n    for (const c of collections) {\n      tags.push({ name: entityTagName(c.base), parent: NAV_COLLECTIONS, description: c.description })\n      if (c.hasAuth) tags.push({ name: authTagName(c.base), parent: c.base, summary: t('tagAuth') })\n      if (c.hasVersions) tags.push({ name: versionsTagName(c.base), parent: c.base, summary: t('tagVersions') })\n    }\n  }\n\n  if (globals.length > 0) {\n    tags.push({ name: NAV_GLOBALS, summary: t('tagGlobals'), description: t('tagGlobalsDesc'), kind: 'nav' })\n    for (const g of globals) {\n      tags.push({ name: entityTagName(g.base), parent: NAV_GLOBALS, description: g.description })\n      if (g.hasVersions) tags.push({ name: versionsTagName(g.base), parent: g.base, summary: t('tagVersions') })\n    }\n  }\n\n  if (systemTags.length > 0) {\n    tags.push({ name: NAV_SYSTEM, summary: t('tagSystem'), description: t('tagSystemDesc'), kind: 'nav' })\n    for (const name of systemTags) tags.push({ name, parent: NAV_SYSTEM, summary: t(SYSTEM_TAG_SUMMARIES[name]) })\n  }\n\n  const taken = new Set(tags.map((tag) => tag.name))\n  const freePluginTags = pluginTags.filter((name) => !taken.has(name))\n  if (freePluginTags.length > 0) {\n    tags.push({ name: NAV_PLUGINS, summary: t('tagPlugins'), description: t('tagPluginsDesc'), kind: 'nav' })\n    for (const name of freePluginTags) tags.push({ name, parent: NAV_PLUGINS })\n  }\n\n  return tags\n}\n"],"mappings":"AAIA,MAAa,kBAAkB;AAC/B,MAAa,cAAc;AAC3B,MAAa,aAAa;AAC1B,MAAa,cAAc;AAE3B,MAAa,iBAAiB,SAAyB;AACvD,MAAa,eAAe,SAAyB,GAAG,KAAK;AAC7D,MAAa,mBAAmB,SAAyB,GAAG,KAAK;AAEjE,MAAM,uBAAuB;CAC3B,MAAM;CACN,SAAS;CACT,SAAS;CACT,QAAQ;AACV;AA0BA,MAAa,qBAAqB,EAChC,aACA,SACA,YACA,aAAa,CAAC,GACd,GACA,aACoC;CACpC,IAAI,CAAC,QACH,OAAO,CACL,GAAG,YAAY,KAAK,OAAO;EAAE,MAAM,cAAc,EAAE,IAAI;EAAG,aAAa,EAAE;CAAY,EAAE,GACvF,GAAG,QAAQ,KAAK,OAAO;EAAE,MAAM,cAAc,EAAE,IAAI;EAAG,aAAa,EAAE;CAAY,EAAE,CACrF;CAGF,MAAM,OAAoB,CAAC;CAE3B,IAAI,YAAY,SAAS,GAAG;EAC1B,KAAK,KAAK;GACR,MAAM;GACN,SAAS,EAAE,gBAAgB;GAC3B,aAAa,EAAE,oBAAoB;GACnC,MAAM;EACR,CAAC;EACD,KAAK,MAAM,KAAK,aAAa;GAC3B,KAAK,KAAK;IAAE,MAAM,cAAc,EAAE,IAAI;IAAG,QAAQ;IAAiB,aAAa,EAAE;GAAY,CAAC;GAC9F,IAAI,EAAE,SAAS,KAAK,KAAK;IAAE,MAAM,YAAY,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,SAAS;GAAE,CAAC;GAC7F,IAAI,EAAE,aAAa,KAAK,KAAK;IAAE,MAAM,gBAAgB,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,aAAa;GAAE,CAAC;EAC3G;CACF;CAEA,IAAI,QAAQ,SAAS,GAAG;EACtB,KAAK,KAAK;GAAE,MAAM;GAAa,SAAS,EAAE,YAAY;GAAG,aAAa,EAAE,gBAAgB;GAAG,MAAM;EAAM,CAAC;EACxG,KAAK,MAAM,KAAK,SAAS;GACvB,KAAK,KAAK;IAAE,MAAM,cAAc,EAAE,IAAI;IAAG,QAAQ;IAAa,aAAa,EAAE;GAAY,CAAC;GAC1F,IAAI,EAAE,aAAa,KAAK,KAAK;IAAE,MAAM,gBAAgB,EAAE,IAAI;IAAG,QAAQ,EAAE;IAAM,SAAS,EAAE,aAAa;GAAE,CAAC;EAC3G;CACF;CAEA,IAAI,WAAW,SAAS,GAAG;EACzB,KAAK,KAAK;GAAE,MAAM;GAAY,SAAS,EAAE,WAAW;GAAG,aAAa,EAAE,eAAe;GAAG,MAAM;EAAM,CAAC;EACrG,KAAK,MAAM,QAAQ,YAAY,KAAK,KAAK;GAAE;GAAM,QAAQ;GAAY,SAAS,EAAE,qBAAqB,KAAK;EAAE,CAAC;CAC/G;CAEA,MAAM,QAAQ,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC;CACjD,MAAM,iBAAiB,WAAW,QAAQ,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC;CACnE,IAAI,eAAe,SAAS,GAAG;EAC7B,KAAK,KAAK;GAAE,MAAM;GAAa,SAAS,EAAE,YAAY;GAAG,aAAa,EAAE,gBAAgB;GAAG,MAAM;EAAM,CAAC;EACxG,KAAK,MAAM,QAAQ,gBAAgB,KAAK,KAAK;GAAE;GAAM,QAAQ;EAAY,CAAC;CAC5E;CAEA,OAAO;AACT"}

package/dist/server/ui/html.js

@@ -1,8 +1,8 @@
 const escapeHtml = (value) => value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
-const jsonForScript = (value) => JSON.stringify(value ?? {}).replace(/</g, "\\u003c");
+const jsonForScript = (value) => JSON.stringify(value ?? {}).replace(/[<>&\u2028\u2029]/g, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
 const htmlPage = ({ title, head, body }) => `<!doctype html><html><head><meta charset="utf-8"/><title>${escapeHtml(title)}</title><meta name="viewport" content="width=device-width, initial-scale=1"/>${head}</head><body>${body}</body></html>`;
 const specUrlExpr = (specUrl) => {
-	const u = JSON.stringify(specUrl);
+	const u = jsonForScript(specUrl);
 	return `(function(){var l=new URLSearchParams(location.search).get('lang');return ${u}+(l?((${u}.indexOf('?')>-1?'&':'?')+'lang='+encodeURIComponent(l)):'')})()`;
 };
 const integrityAttrs = (pinned, integrity) => pinned ? ` integrity="${integrity}" crossorigin="anonymous"` : "";

package/dist/server/ui/html.js.map

@@ -1 +1 @@
-{"version":3,"file":"html.js","names":[],"sources":["../../../src/server/ui/html.ts"],"sourcesContent":["export const escapeHtml = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;')\n\nexport const jsonForScript = (value: unknown): string => JSON.stringify(value ?? {}).replace(/</g, '\\\\u003c')\n\nexport const htmlPage = ({ title, head, body }: { title: string; head: string; body: string }): string =>\n  `<!doctype html><html><head><meta charset=\"utf-8\"/><title>${escapeHtml(title)}</title>` +\n  `<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/>${head}</head>` +\n  `<body>${body}</body></html>`\n\nexport const specUrlExpr = (specUrl: string): string => {\n  const u = JSON.stringify(specUrl)\n  return `(function(){var l=new URLSearchParams(location.search).get('lang');return ${u}+(l?((${u}.indexOf('?')>-1?'&':'?')+'lang='+encodeURIComponent(l)):'')})()`\n}\n\nexport const integrityAttrs = (pinned: boolean, integrity: string): string =>\n  pinned ? ` integrity=\"${integrity}\" crossorigin=\"anonymous\"` : ''\n"],"mappings":"AAAA,MAAa,cAAc,UACzB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,QAAQ;AAEjG,MAAa,iBAAiB,UAA2B,KAAK,UAAU,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,SAAS;AAE5G,MAAa,YAAY,EAAE,OAAO,MAAM,WACtC,4DAA4D,WAAW,KAAK,EAAE,+EACN,KAAK,eACpE,KAAK;AAEhB,MAAa,eAAe,YAA4B;CACtD,MAAM,IAAI,KAAK,UAAU,OAAO;CAChC,OAAO,6EAA6E,EAAE,QAAQ,EAAE;AAClG;AAEA,MAAa,kBAAkB,QAAiB,cAC9C,SAAS,eAAe,UAAU,6BAA6B"}
+{"version":3,"file":"html.js","names":[],"sources":["../../../src/server/ui/html.ts"],"sourcesContent":["export const escapeHtml = (value: string): string =>\n  value.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;')\n\nexport const jsonForScript = (value: unknown): string =>\n  JSON.stringify(value ?? {}).replace(\n    /[<>&\\u2028\\u2029]/g,\n    (char) => `\\\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`,\n  )\n\nexport const htmlPage = ({ title, head, body }: { title: string; head: string; body: string }): string =>\n  `<!doctype html><html><head><meta charset=\"utf-8\"/><title>${escapeHtml(title)}</title>` +\n  `<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\"/>${head}</head>` +\n  `<body>${body}</body></html>`\n\nexport const specUrlExpr = (specUrl: string): string => {\n  const u = jsonForScript(specUrl)\n  return `(function(){var l=new URLSearchParams(location.search).get('lang');return ${u}+(l?((${u}.indexOf('?')>-1?'&':'?')+'lang='+encodeURIComponent(l)):'')})()`\n}\n\nexport const integrityAttrs = (pinned: boolean, integrity: string): string =>\n  pinned ? ` integrity=\"${integrity}\" crossorigin=\"anonymous\"` : ''\n"],"mappings":"AAAA,MAAa,cAAc,UACzB,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,QAAQ;AAEjG,MAAa,iBAAiB,UAC5B,KAAK,UAAU,SAAS,CAAC,CAAC,CAAC,CAAC,QAC1B,uBACC,SAAS,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,GAAG,GAAG,GACjE;AAEF,MAAa,YAAY,EAAE,OAAO,MAAM,WACtC,4DAA4D,WAAW,KAAK,EAAE,+EACN,KAAK,eACpE,KAAK;AAEhB,MAAa,eAAe,YAA4B;CACtD,MAAM,IAAI,cAAc,OAAO;CAC/B,OAAO,6EAA6E,EAAE,QAAQ,EAAE;AAClG;AAEA,MAAa,kBAAkB,QAAiB,cAC9C,SAAS,eAAe,UAAU,6BAA6B"}

package/dist/shared/translations/locales/ar.js

@@ -67,11 +67,24 @@ const ar = { "@seshuk/payload-plugin-openapi": {
 	uploadPayloadField: "حقول {{schema}} بصيغة JSON. مثال: `{\"alt\":\"A caption\"}`.",
 	fileServe: "الملف",
 	filePartial: "جزء من الملف، لطلب `Range`",
+	paramFileVersion: "يعرض الملف المحفوظ مع معرّف الإصدار هذا.",
 	uploadInstructionsSummary: "الحصول على تعليمات رفع ملف قبل حفظ المستند",
 	uploadInstructionsResult: "مكان إرسال بايتات الملف، وقيمة `file` التي تُرسل مع طلب الإنشاء أو التحديث",
 	uploadStagePutSummary: "إرسال بايتات الملف لرفع مؤقت",
 	uploadStageDeleteSummary: "حذف رفع مؤقت",
 	uploadStageResult: "تم، بدون محتوى",
+	paramPreferenceKey: "مفتاح التفضيل، مثل `nav`.",
+	preferenceGet: "الحصول على تفضيل للمستخدم الحالي",
+	preferenceGetResult: "التفضيل المحفوظ، أو `value: null` إذا لم يكن موجودًا",
+	preferenceSet: "حفظ تفضيل للمستخدم الحالي",
+	preferenceSetBody: "أرسل القيمة في `value`. يُحفظ الجسم الذي لا يحتوي على `value` كاملًا كقيمة.",
+	preferenceSetResult: "التفضيل المحفوظ",
+	preferenceDelete: "حذف تفضيل للمستخدم الحالي",
+	preferenceDeleteResult: "التفضيل المحذوف",
+	reorder: "نقل المستندات في قائمة قابلة للترتيب",
+	reorderBody: "ينقل `docsToMove` بعد `target` مع `newKeyWillBe: \"greater\"`، أو قبله مع `\"less\"`. قيمة `orderableFieldName` هي `_order` لمجموعة قابلة للترتيب، أو حقل الترتيب لـ join قابل للترتيب. بدون `target.key` يمنح Payload مفاتيح الترتيب فقط للمستندات التي لا تملكها.",
+	reorderResult: "مفاتيح الترتيب الجديدة، أو `message: \"initial migration\"` عندما عيّن Payload مفاتيح الترتيب لأول مرة",
+	errorReorder400: "جسم الطلب غير صالح؛ السبب في `error`",
 	error400: "خطأ في التحقق أو الاستعلام (ValidationError، QueryError)",
 	error401: "غير مُصادَق عليه (AuthenticationError)",
 	error403: "محظور بواسطة التحكم في الوصول (Forbidden، UnverifiedEmail)",
@@ -90,6 +103,67 @@ const ar = { "@seshuk/payload-plugin-openapi": {
 	tagJobs: "المهام",
 	tagUploads: "الرفع",
 	tagAccess: "الوصول",
+	tagReorder: "إعادة الترتيب",
+	tagPlugins: "الإضافات",
+	tagPluginsDesc: "نقاط نهاية تضيفها إضافات Payload الرسمية.",
+	errorPlugin400: "طلب غير صالح",
+	errorPlugin401: "غير مصادق",
+	errorPlugin403: "محظور",
+	errorPlugin404: "غير موجود",
+	errorPlugin500: "خطأ داخلي في الخادم",
+	ecommerceAddItem: "إضافة منتج إلى السلة",
+	ecommerceRemoveItem: "إزالة منتج من السلة",
+	ecommerceUpdateItem: "تغيير كمية منتج في السلة",
+	ecommerceClearCart: "إزالة كل المنتجات من السلة",
+	ecommerceMergeCart: "دمج سلة ضيف في هذه السلة",
+	ecommerceCartAccess: "مسموح لمالك السلة، أو لسلة ضيف مع `secret` الخاص بها في جسم الطلب.",
+	ecommerceCartResult: "السلة المحدّثة",
+	errorPluginEcommerce404: "السلة غير موجودة أو لا يمكن الوصول إليها",
+	ecommerceQuantity: "الكمية الجديدة، أو `{ \"$inc\": n }` لتغييرها بمقدار n.",
+	ecommerceInitiatePayment: "بدء دفعة عبر `{{method}}`",
+	ecommerceConfirmOrder: "تأكيد الدفع عبر `{{method}}` وإنشاء الطلب",
+	ecommercePaymentBody: "يستخدم `cartID` (مع `secret` لسلة ضيف) أو سلة المستخدم. بدون مستخدم يكون `customerEmail` مطلوبًا. قد يحتاج محوّل الدفع إلى حقول إضافية.",
+	ecommerceInitiateResult: "بدأت عملية الدفع. يضيف المحوّل حقوله الخاصة، مثل client secret.",
+	ecommerceConfirmResult: "تم إنشاء الطلب",
+	stripeWebhook: "استقبال أحداث webhook من Stripe",
+	stripeWebhookBody: "حدث Stripe الخام، موقّع في الترويسة `Stripe-Signature`. يستدعيه Stripe وليس عملاء API.",
+	stripeWebhookResult: "تم استلام الحدث",
+	errorPluginStripeWebhook400: "فشل التحقق من التوقيع",
+	stripeRest: "استدعاء دالة مسموح بها من Stripe API",
+	stripeRestResult: "نتيجة Stripe API",
+	errorPluginStripeRest404: "أعادت Stripe API خطأ",
+	mcp: "إرسال رسالة MCP JSON-RPC",
+	mcpDesc: "Model Context Protocol عبر Streamable HTTP مع ردود JSON. الطلبات المجهولة تعمل؛ الأدوات المعروضة تعتمد على صلاحيات المستخدم. يجب على العملاء الذين يستخدمون إصدار بروتوكول من 2025 إرسال `Accept: application/json, text/event-stream`.",
+	mcpResult: "رد JSON-RPC",
+	mcpOverrideAccess: "تجاوز فحوص الوصول. للتطوير فقط.",
+	mcpGet: "غير مدعوم: الخادم لا يفتح أي تدفق أحداث",
+	errorPluginMcpGet405: "الطريقة غير مسموح بها، استخدم POST",
+	mcpProtocolVersion: "إصدار بروتوكول MCP المتفق عليه، مثل `2025-06-18`.",
+	mcpResult202: "مقبول: احتوى الجسم على إشعارات أو ردود فقط",
+	errorPluginMcp404: "دالة MCP غير معروفة",
+	errorPluginMcp406: "الترويسة `Accept` لا تتضمن `application/json` أو `text/event-stream`",
+	errorPluginMcp413: "جسم الطلب كبير جدًا",
+	errorPluginMcp415: "يجب أن يكون `Content-Type` هو `application/json`",
+	seoTitle: "توليد عنوان الميتا",
+	seoDescription: "توليد وصف الميتا",
+	seoUrl: "توليد رابط المعاينة",
+	seoImage: "توليد صورة الميتا",
+	seoBody: "المستند قيد التحرير: `collectionSlug` أو `globalSlug`، و`id` الخاص به، وبيانات `doc` الحالية. يُمرَّر إلى دالة التوليد لديك.",
+	seoResult: "القيمة المولَّدة. سلسلة فارغة عند عدم تعيين دالة توليد.",
+	searchReindex: "إعادة بناء فهرس البحث لبعض المجموعات",
+	searchReindexResult: "ملخص إعادة الفهرسة",
+	tenantOptions: "عرض المستأجرين الذين يمكن للمستخدم اختيارهم",
+	tenantOptionsResult: "خيارات المستأجرين",
+	exportDownload: "تصدير المستندات إلى ملف",
+	exportDownloadResult: "ملف التصدير",
+	exportPreview: "معاينة تصدير",
+	importPreview: "معاينة ملف استيراد",
+	previewResult: "صفحة من مستندات المعاينة",
+	importFileData: "محتوى الملف بترميز base64.",
+	r2Upload: "رفع ملف إلى R2 على أجزاء",
+	r2UploadDesc: "ثلاث خطوات على مسار واحد. البدء: أرسل `collection` و`fileName` و`fileType`. كل جزء: أضف `multipartId` و`multipartKey` و`multipartNumber` و`signedReceipt` وأرسل البايتات. الإنهاء: الشيء نفسه بدون `multipartNumber`، مع قائمة JSON بالأجزاء.",
+	r2UploadResult: "بدأ الرفع، أو رُفع جزء، أو اكتمل الرفع (مفتاح الكائن كنص)",
+	errorStorageR2412: "يوجد ملف بالفعل عند هذا المفتاح",
 	localizationHeading: "الترجمة",
 	localizationNote: "اللغات المتاحة: {{locales}}. مرّر `?locale=<code>` إلى نقطة نهاية قراءة لاختيار لغة واحدة. مرّر `?locale=all` لتلقّي كل اللغات دفعة واحدة — عندئذٍ يُرجَع كل حقل مترجم ككائن مفهرس بحسب رمز اللغة (مثل `{ \"en\": \"Hello\", \"de\": \"Hallo\" }`) بدلاً من قيمة واحدة. اضبط `?flattenLocales=false` مع `locale=all` للإبقاء على شكل الكائن لكل لغة. تعرض مخططات الحقول شكل اللغة الواحدة.",
 	docLanguagesNote: "يتوفر هذا التوثيق باللغات التالية: {{languages}}. أضِف `?lang=<code>` إلى عنوان URL لهذه المواصفة للتبديل."