payload 4.0.0-internal.4cbdd50 → 4.0.0-internal.4e1f822

package/dist/utilities/getFieldPermissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,uEAMjC;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA6Dd,CAAA"}
+{"version":3,"file":"getFieldPermissions.d.ts","sourceRoot":"","sources":["../../src/utilities/getFieldPermissions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,4BAA4B,EAC5B,yBAAyB,EACzB,0BAA0B,EAC3B,MAAM,kBAAkB,CAAA;AACzB,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAElD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,0EAM7B;IACD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAA;IAC7D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,KAAK,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;CAC7E,KAAG;IACF,SAAS,EAAE,OAAO,CAAA;IAClB;;;OAGG;IACH,WAAW,EAAE,yBAAyB,GAAG,0BAA0B,CAAA;IACnE,IAAI,EAAE,OAAO,CAAA;CA6Dd,CAAA"}

package/dist/utilities/getNextVersion.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */
+export declare const getNextVersion: () => string | undefined;
+//# sourceMappingURL=getNextVersion.d.ts.map

package/dist/utilities/getNextVersion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getNextVersion.d.ts","sourceRoot":"","sources":["../../src/utilities/getNextVersion.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,MAAM,GAAG,SAc1C,CAAA"}

package/dist/utilities/getNextVersion.js

@@ -0,0 +1,20 @@
+import { readFileSync } from 'fs';
+import { resolveFrom } from './dependencies/resolveFrom.js';
+/**
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */ export const getNextVersion = ()=>{
+    try {
+        const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true);
+        if (!packageJSONPath) {
+            return undefined;
+        }
+        const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'));
+        return typeof version === 'string' ? version : undefined;
+    } catch (_) {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=getNextVersion.js.map

package/dist/utilities/getNextVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getNextVersion.ts"],"sourcesContent":["import { readFileSync } from 'fs'\n\nimport { resolveFrom } from './dependencies/resolveFrom.js'\n\n/**\n * Reads the version of the Next.js installed alongside the running app.\n * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs\n * outside of Next.js or from a directory the app's dependencies are not visible from.\n */\nexport const getNextVersion = (): string | undefined => {\n  try {\n    const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true)\n\n    if (!packageJSONPath) {\n      return undefined\n    }\n\n    const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'))\n\n    return typeof version === 'string' ? version : undefined\n  } catch (_) {\n    return undefined\n  }\n}\n"],"names":["readFileSync","resolveFrom","getNextVersion","packageJSONPath","process","cwd","undefined","version","JSON","parse","_"],"mappings":"AAAA,SAASA,YAAY,QAAQ,KAAI;AAEjC,SAASC,WAAW,QAAQ,gCAA+B;AAE3D;;;;CAIC,GACD,OAAO,MAAMC,iBAAiB;IAC5B,IAAI;QACF,MAAMC,kBAAkBF,YAAYG,QAAQC,GAAG,IAAI,qBAAqB;QAExE,IAAI,CAACF,iBAAiB;YACpB,OAAOG;QACT;QAEA,MAAM,EAAEC,OAAO,EAAE,GAAGC,KAAKC,KAAK,CAACT,aAAaG,iBAAiB;QAE7D,OAAO,OAAOI,YAAY,WAAWA,UAAUD;IACjD,EAAE,OAAOI,GAAG;QACV,OAAOJ;IACT;AACF,EAAC"}

package/dist/utilities/getNextVersion.spec.js

@@ -0,0 +1,16 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+import { getNextVersion } from './getNextVersion.js';
+describe('getNextVersion', ()=>{
+    afterEach(()=>{
+        vi.restoreAllMocks();
+    });
+    it('should read the version of the installed Next.js', ()=>{
+        expect(getNextVersion()).toMatch(/^\d+\.\d+\.\d+/);
+    });
+    it('should return undefined when Next.js cannot be resolved', ()=>{
+        vi.spyOn(process, 'cwd').mockReturnValue('/');
+        expect(getNextVersion()).toBeUndefined();
+    });
+});
+
+//# sourceMappingURL=getNextVersion.spec.js.map

package/dist/utilities/getNextVersion.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getNextVersion.spec.ts"],"sourcesContent":["import { afterEach, describe, expect, it, vi } from 'vitest'\n\nimport { getNextVersion } from './getNextVersion.js'\n\ndescribe('getNextVersion', () => {\n  afterEach(() => {\n    vi.restoreAllMocks()\n  })\n\n  it('should read the version of the installed Next.js', () => {\n    expect(getNextVersion()).toMatch(/^\\d+\\.\\d+\\.\\d+/)\n  })\n\n  it('should return undefined when Next.js cannot be resolved', () => {\n    vi.spyOn(process, 'cwd').mockReturnValue('/')\n\n    expect(getNextVersion()).toBeUndefined()\n  })\n})\n"],"names":["afterEach","describe","expect","it","vi","getNextVersion","restoreAllMocks","toMatch","spyOn","process","mockReturnValue","toBeUndefined"],"mappings":"AAAA,SAASA,SAAS,EAAEC,QAAQ,EAAEC,MAAM,EAAEC,EAAE,EAAEC,EAAE,QAAQ,SAAQ;AAE5D,SAASC,cAAc,QAAQ,sBAAqB;AAEpDJ,SAAS,kBAAkB;IACzBD,UAAU;QACRI,GAAGE,eAAe;IACpB;IAEAH,GAAG,oDAAoD;QACrDD,OAAOG,kBAAkBE,OAAO,CAAC;IACnC;IAEAJ,GAAG,2DAA2D;QAC5DC,GAAGI,KAAK,CAACC,SAAS,OAAOC,eAAe,CAAC;QAEzCR,OAAOG,kBAAkBM,aAAa;IACxC;AACF"}

package/dist/utilities/getObjectDotNotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,EACpC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,MAAM,MAAM,EACZ,eAAe,CAAC,KACf,CAMF,CAAA"}
+{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAMF,CAAA"}

package/dist/utilities/getRequestEntity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRequestEntity.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestEntity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,eAAO,MAAM,oBAAoB,GAAI,KAAK,cAAc,KAAG,UAc1D,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,OAAO,EAC1D,KAAK,cAAc,EACnB,mCAGG;IACD,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CAChB,KACL;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CA2C9C,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAI,KAAK,cAAc,KAAG,qBActD,CAAA"}
+{"version":3,"file":"getRequestEntity.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestEntity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,eAAO,MAAM,oBAAoB,QAAS,cAAc,KAAG,UAc1D,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,CAAC,SAAS,OAAO,OACrD,cAAc,qCAIhB;IACD,eAAe,CAAC,EAAE,CAAC,CAAA;IACnB,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,KACA;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,EAAE,EAAE,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAA;CA2C9C,CAAA;AAED,eAAO,MAAM,gBAAgB,QAAS,cAAc,KAAG,qBActD,CAAA"}

package/dist/utilities/getRequestLanguage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRequestLanguage.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestLanguage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAIjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,eAAe,CAAC,EAAE,iBAAiB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC5B,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,+BAIhC,sBAAsB,KAAG,iBAqB3B,CAAA"}
+{"version":3,"file":"getRequestLanguage.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestLanguage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAIjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAEzD,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,eAAe,CAAA;IACvB,OAAO,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC1C,eAAe,CAAC,EAAE,iBAAiB,CAAA;IACnC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;CAC5B,CAAA;AAED,eAAO,MAAM,kBAAkB,kCAI5B,sBAAsB,KAAG,iBAqB3B,CAAA"}

package/dist/utilities/getRequestOrigin.d.ts

@@ -4,7 +4,7 @@ import type { PayloadRequest } from '../types/index.js';
  * Returns a trusted request origin
  */
 export declare const getRequestOrigin: ({ config, req, }: {
-    config: Pick<SanitizedConfig, "cors" | "csrf" | "serverURL">;
-    req: Pick<PayloadRequest, "headers" | "payload" | "url">;
+    config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>;
+    req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>;
 }) => string;
 //# sourceMappingURL=getRequestOrigin.d.ts.map

package/dist/utilities/getRequestOrigin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,kBAG9B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}
+{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}

package/dist/utilities/getRequestOrigin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { CORSConfig, SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = (cors as CORSConfig).origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAc,AAACP,KAAoBF,OAAO;QAChD,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = cors.origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAcP,KAAKF,OAAO;QAChC,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}

package/dist/utilities/getSafeRedirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,GAAI,gDAI7B;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAmCH,CAAA"}
+{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAgDH,CAAA"}

package/dist/utilities/getSafeRedirect.js

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };
 

package/dist/utilities/getSafeRedirect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  const redirectPath = redirectTo.trim()\n\n  const hasControlCharacters = [...redirectPath].some((character) => {\n    const code = character.charCodeAt(0)\n    return code <= 31 || code === 127\n  })\n  const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath)\n\n  let parsedRedirect: URL\n  try {\n    parsedRedirect = new URL(redirectPath, 'http://localhost')\n  } catch {\n    return fallbackTo\n  }\n\n  const isSafeRedirect =\n    !hasControlCharacters &&\n    !hasAmbiguousPathPrefix &&\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Must resolve to the same origin after URL parser normalization\n    parsedRedirect.origin === 'http://localhost' &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    !hasControlCharacters &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n    (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:')\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getSafeRedirect.spec.js

@@ -2,6 +2,12 @@ import { describe, it, expect } from 'vitest';
 import { getSafeRedirect } from './getSafeRedirect';
 const fallback = '/admin' // default fallback if the input is unsafe or invalid
 ;
+const parseRedirect = (redirect)=>{
+    const searchParams = new URLSearchParams({
+        redirect
+    });
+    return new URLSearchParams(searchParams.toString()).get('redirect') ?? '';
+};
 describe('getSafeRedirect', ()=>{
     // Valid - safe redirect paths
     it.each([
@@ -39,6 +45,42 @@ describe('getSafeRedirect', ()=>{
             fallbackTo: fallback
         })).toBe(fallback);
     });
+    it.each([
+        [
+            'TAB',
+            '/\t/example.invalid'
+        ],
+        [
+            'CR',
+            '/\r/example.invalid'
+        ],
+        [
+            'LF',
+            '/\n/example.invalid'
+        ]
+    ])('should use the fallback after parsing a %s separator', (_label, input)=>{
+        expect(getSafeRedirect({
+            redirectTo: parseRedirect(input),
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
+    it.each([
+        '/%09/example.invalid',
+        '/%0D/example.invalid',
+        '/%0A/example.invalid',
+        '/%5Cexample.invalid',
+        '/%2fexample.invalid',
+        '/%2509/example.invalid',
+        '/%25250D/example.invalid',
+        '/%2525250A/example.invalid',
+        '/%2525255Cexample.invalid',
+        '/%2525252fexample.invalid'
+    ])('should use the fallback for ambiguous encoded path prefixes: %s', (input)=>{
+        expect(getSafeRedirect({
+            redirectTo: parseRedirect(input),
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
     // Unsafe redirect patterns
     it.each([
         '//example.com',
@@ -72,13 +114,65 @@ describe('getSafeRedirect', ()=>{
             fallbackTo: fallback
         })).toBe(fallback);
     });
-    // If decoding the input fails (e.g., invalid percent encoding), it should not crash
-    it('should return fallback on invalid encoding', ()=>{
+    // A value that is neither a path nor an absolute URL should use the fallback
+    it('should return fallback when input is not a path or URL', ()=>{
         expect(getSafeRedirect({
             redirectTo: '%E0%A4%A',
             fallbackTo: fallback
         })).toBe(fallback);
     });
+    it('should preserve an accepted local redirect', ()=>{
+        const redirectTo = '/dashboard?tab=overview#details';
+        expect(getSafeRedirect({
+            redirectTo,
+            fallbackTo: fallback
+        })).toBe(redirectTo);
+    });
+    it('should preserve a parsed local redirect byte-for-byte', ()=>{
+        const redirectTo = '/oauth/callback?code=A%2FB&state=opaque%3D#done';
+        const parsedRedirect = parseRedirect(redirectTo);
+        expect(parsedRedirect).toBe(redirectTo);
+        expect(getSafeRedirect({
+            redirectTo: parsedRedirect,
+            fallbackTo: fallback
+        })).toBe(redirectTo);
+    });
+    it.each([
+        [
+            'https://example.invalid/path?code=A%2FB#done',
+            'https://example.invalid/path?code=A%2FB#done'
+        ],
+        [
+            'http://example.invalid/dashboard',
+            'http://example.invalid/dashboard'
+        ]
+    ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected)=>{
+        expect(getSafeRedirect({
+            allowAbsoluteUrls: true,
+            redirectTo: input,
+            fallbackTo: fallback
+        })).toBe(expected);
+    });
+    it.each([
+        [
+            'https://example.invalid/path',
+            false
+        ],
+        [
+            'mailto:user@example.invalid',
+            true
+        ],
+        [
+            '//example.invalid/path',
+            true
+        ]
+    ])('should use the fallback without an explicitly enabled HTTP(S) URL: %s', (input, allowAbsoluteUrls)=>{
+        expect(getSafeRedirect({
+            allowAbsoluteUrls,
+            redirectTo: input,
+            fallbackTo: fallback
+        })).toBe(fallback);
+    });
 });
 
 //# sourceMappingURL=getSafeRedirect.spec.js.map

package/dist/utilities/getSafeRedirect.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  // If decoding the input fails (e.g., invalid percent encoding), it should not crash\n  it('should return fallback on invalid encoding', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","each","input","redirectTo","fallbackTo","toBe","undefined"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/EJ,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGI,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCL,GAAGI,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAcE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACnF;IAGF,2BAA2B;IAC3BH,GAAGI,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEJ,OAAOC,gBAAgB;YAAEI,YAAYD;YAAOE,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEI,YAAY;YAAoBC,YAAYJ;QAAS,IAAIK,IAAI,CACpF;QAGF,sDAAsD;QACtDP,OAAOC,gBAAgB;YAAEI,YAAY;YAAuBC,YAAYJ;QAAS,IAAIK,IAAI,CACvFL;IAEJ;IAEA,oFAAoF;IACpFH,GAAG,8CAA8C;QAC/CC,OAAOC,gBAAgB;YAAEI,YAAY;YAAYC,YAAYJ;QAAS,IAAIK,IAAI,CAACL;IACjF;AACF"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.spec.ts"],"sourcesContent":["import { describe, it, expect } from 'vitest'\nimport { getSafeRedirect } from './getSafeRedirect'\n\nconst fallback = '/admin' // default fallback if the input is unsafe or invalid\n\nconst parseRedirect = (redirect: string): string => {\n  const searchParams = new URLSearchParams({ redirect })\n  return new URLSearchParams(searchParams.toString()).get('redirect') ?? ''\n}\n\ndescribe('getSafeRedirect', () => {\n  // Valid - safe redirect paths\n  it.each([['/dashboard'], ['/admin/settings'], ['/projects?id=123'], ['/hello-world']])(\n    'should allow safe relative path: %s',\n    (input) => {\n      // If the input is a clean relative path, it should be returned as-is\n      expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(input)\n    },\n  )\n\n  // Invalid types or empty inputs\n  it.each(['', null, undefined, 123, {}, []])(\n    'should fallback on invalid or non-string input: %s',\n    (input) => {\n      // If the input is not a valid string, it should return the fallback\n      expect(getSafeRedirect({ redirectTo: input as any, fallbackTo: fallback })).toBe(fallback)\n    },\n  )\n\n  it.each([\n    ['TAB', '/\\t/example.invalid'],\n    ['CR', '/\\r/example.invalid'],\n    ['LF', '/\\n/example.invalid'],\n  ])('should use the fallback after parsing a %s separator', (_label, input) => {\n    expect(getSafeRedirect({ redirectTo: parseRedirect(input), fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  it.each([\n    '/%09/example.invalid',\n    '/%0D/example.invalid',\n    '/%0A/example.invalid',\n    '/%5Cexample.invalid',\n    '/%2fexample.invalid',\n    '/%2509/example.invalid',\n    '/%25250D/example.invalid',\n    '/%2525250A/example.invalid',\n    '/%2525255Cexample.invalid',\n    '/%2525252fexample.invalid',\n  ])('should use the fallback for ambiguous encoded path prefixes: %s', (input) => {\n    expect(getSafeRedirect({ redirectTo: parseRedirect(input), fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  // Unsafe redirect patterns\n  it.each([\n    '//example.com', // protocol-relative URL\n    '/javascript:alert(1)', // JavaScript scheme\n    '/JavaScript:alert(1)', // case-insensitive JavaScript\n    '/http://unknown.com', // disguised external redirect\n    '/https://unknown.com', // disguised external redirect\n    '/%2Funknown.com', // encoded slash — could resolve to //\n    '/\\\\/unknown.com', // escaped slash\n    '/\\\\\\\\unknown.com', // double escaped slashes\n    '/\\\\unknown.com', // single escaped slash\n    '%2F%2Funknown.com', // fully encoded protocol-relative path\n    '%2Fjavascript:alert(1)', // encoded JavaScript scheme\n  ])('should block unsafe redirect: %s', (input) => {\n    // All of these should return the fallback because they’re unsafe\n    expect(getSafeRedirect({ redirectTo: input, fallbackTo: fallback })).toBe(fallback)\n  })\n\n  // Input with extra spaces should still be properly handled\n  it('should trim whitespace before evaluating', () => {\n    // A valid path with surrounding spaces should still be accepted\n    expect(getSafeRedirect({ redirectTo: '   /dashboard   ', fallbackTo: fallback })).toBe(\n      '/dashboard',\n    )\n\n    // An unsafe path with spaces should still be rejected\n    expect(getSafeRedirect({ redirectTo: '   //example.com   ', fallbackTo: fallback })).toBe(\n      fallback,\n    )\n  })\n\n  // A value that is neither a path nor an absolute URL should use the fallback\n  it('should return fallback when input is not a path or URL', () => {\n    expect(getSafeRedirect({ redirectTo: '%E0%A4%A', fallbackTo: fallback })).toBe(fallback)\n  })\n\n  it('should preserve an accepted local redirect', () => {\n    const redirectTo = '/dashboard?tab=overview#details'\n    expect(getSafeRedirect({ redirectTo, fallbackTo: fallback })).toBe(redirectTo)\n  })\n\n  it('should preserve a parsed local redirect byte-for-byte', () => {\n    const redirectTo = '/oauth/callback?code=A%2FB&state=opaque%3D#done'\n    const parsedRedirect = parseRedirect(redirectTo)\n\n    expect(parsedRedirect).toBe(redirectTo)\n    expect(getSafeRedirect({ redirectTo: parsedRedirect, fallbackTo: fallback })).toBe(redirectTo)\n  })\n\n  it.each([\n    [\n      'https://example.invalid/path?code=A%2FB#done',\n      'https://example.invalid/path?code=A%2FB#done',\n    ],\n    ['http://example.invalid/dashboard', 'http://example.invalid/dashboard'],\n  ])('should preserve an HTTP absolute redirect when enabled: %s', (input, expected) => {\n    expect(\n      getSafeRedirect({\n        allowAbsoluteUrls: true,\n        redirectTo: input,\n        fallbackTo: fallback,\n      }),\n    ).toBe(expected)\n  })\n\n  it.each([\n    ['https://example.invalid/path', false],\n    ['mailto:user@example.invalid', true],\n    ['//example.invalid/path', true],\n  ])(\n    'should use the fallback without an explicitly enabled HTTP(S) URL: %s',\n    (input, allowAbsoluteUrls) => {\n      expect(getSafeRedirect({ allowAbsoluteUrls, redirectTo: input, fallbackTo: fallback })).toBe(\n        fallback,\n      )\n    },\n  )\n})\n"],"names":["describe","it","expect","getSafeRedirect","fallback","parseRedirect","redirect","searchParams","URLSearchParams","toString","get","each","input","redirectTo","fallbackTo","toBe","undefined","_label","parsedRedirect","expected","allowAbsoluteUrls"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,EAAE,EAAEC,MAAM,QAAQ,SAAQ;AAC7C,SAASC,eAAe,QAAQ,oBAAmB;AAEnD,MAAMC,WAAW,SAAS,qDAAqD;;AAE/E,MAAMC,gBAAgB,CAACC;IACrB,MAAMC,eAAe,IAAIC,gBAAgB;QAAEF;IAAS;IACpD,OAAO,IAAIE,gBAAgBD,aAAaE,QAAQ,IAAIC,GAAG,CAAC,eAAe;AACzE;AAEAV,SAAS,mBAAmB;IAC1B,8BAA8B;IAC9BC,GAAGU,IAAI,CAAC;QAAC;YAAC;SAAa;QAAE;YAAC;SAAkB;QAAE;YAAC;SAAmB;QAAE;YAAC;SAAe;KAAC,EACnF,uCACA,CAACC;QACC,qEAAqE;QACrEV,OAAOC,gBAAgB;YAAEU,YAAYD;YAAOE,YAAYV;QAAS,IAAIW,IAAI,CAACH;IAC5E;IAGF,gCAAgC;IAChCX,GAAGU,IAAI,CAAC;QAAC;QAAI;QAAMK;QAAW;QAAK,CAAC;QAAG,EAAE;KAAC,EACxC,sDACA,CAACJ;QACC,oEAAoE;QACpEV,OAAOC,gBAAgB;YAAEU,YAAYD;YAAcE,YAAYV;QAAS,IAAIW,IAAI,CAACX;IACnF;IAGFH,GAAGU,IAAI,CAAC;QACN;YAAC;YAAO;SAAsB;QAC9B;YAAC;YAAM;SAAsB;QAC7B;YAAC;YAAM;SAAsB;KAC9B,EAAE,wDAAwD,CAACM,QAAQL;QAClEV,OAAOC,gBAAgB;YAAEU,YAAYR,cAAcO;YAAQE,YAAYV;QAAS,IAAIW,IAAI,CACtFX;IAEJ;IAEAH,GAAGU,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,mEAAmE,CAACC;QACrEV,OAAOC,gBAAgB;YAAEU,YAAYR,cAAcO;YAAQE,YAAYV;QAAS,IAAIW,IAAI,CACtFX;IAEJ;IAEA,2BAA2B;IAC3BH,GAAGU,IAAI,CAAC;QACN;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;QACA;KACD,EAAE,oCAAoC,CAACC;QACtC,iEAAiE;QACjEV,OAAOC,gBAAgB;YAAEU,YAAYD;YAAOE,YAAYV;QAAS,IAAIW,IAAI,CAACX;IAC5E;IAEA,2DAA2D;IAC3DH,GAAG,4CAA4C;QAC7C,gEAAgE;QAChEC,OAAOC,gBAAgB;YAAEU,YAAY;YAAoBC,YAAYV;QAAS,IAAIW,IAAI,CACpF;QAGF,sDAAsD;QACtDb,OAAOC,gBAAgB;YAAEU,YAAY;YAAuBC,YAAYV;QAAS,IAAIW,IAAI,CACvFX;IAEJ;IAEA,6EAA6E;IAC7EH,GAAG,0DAA0D;QAC3DC,OAAOC,gBAAgB;YAAEU,YAAY;YAAYC,YAAYV;QAAS,IAAIW,IAAI,CAACX;IACjF;IAEAH,GAAG,8CAA8C;QAC/C,MAAMY,aAAa;QACnBX,OAAOC,gBAAgB;YAAEU;YAAYC,YAAYV;QAAS,IAAIW,IAAI,CAACF;IACrE;IAEAZ,GAAG,yDAAyD;QAC1D,MAAMY,aAAa;QACnB,MAAMK,iBAAiBb,cAAcQ;QAErCX,OAAOgB,gBAAgBH,IAAI,CAACF;QAC5BX,OAAOC,gBAAgB;YAAEU,YAAYK;YAAgBJ,YAAYV;QAAS,IAAIW,IAAI,CAACF;IACrF;IAEAZ,GAAGU,IAAI,CAAC;QACN;YACE;YACA;SACD;QACD;YAAC;YAAoC;SAAmC;KACzE,EAAE,8DAA8D,CAACC,OAAOO;QACvEjB,OACEC,gBAAgB;YACdiB,mBAAmB;YACnBP,YAAYD;YACZE,YAAYV;QACd,IACAW,IAAI,CAACI;IACT;IAEAlB,GAAGU,IAAI,CAAC;QACN;YAAC;YAAgC;SAAM;QACvC;YAAC;YAA+B;SAAK;QACrC;YAAC;YAA0B;SAAK;KACjC,EACC,yEACA,CAACC,OAAOQ;QACNlB,OAAOC,gBAAgB;YAAEiB;YAAmBP,YAAYD;YAAOE,YAAYV;QAAS,IAAIW,IAAI,CAC1FX;IAEJ;AAEJ"}

package/dist/utilities/getSelectMode.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSelectMode.d.ts","sourceRoot":"","sources":["../../src/utilities/getSelectMode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE/D,eAAO,MAAM,aAAa,GAAI,QAAQ,UAAU,KAAG,UAalD,CAAA"}
+{"version":3,"file":"getSelectMode.d.ts","sourceRoot":"","sources":["../../src/utilities/getSelectMode.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE/D,eAAO,MAAM,aAAa,WAAY,UAAU,KAAG,UAalD,CAAA"}

package/dist/utilities/getSiblingData.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSiblingData.d.ts","sourceRoot":"","sources":["../../src/utilities/getSiblingData.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAKxD,eAAO,MAAM,cAAc,GAAI,QAAQ,SAAS,EAAE,MAAM,MAAM,KAAG,IAqChE,CAAA"}
+{"version":3,"file":"getSiblingData.d.ts","sourceRoot":"","sources":["../../src/utilities/getSiblingData.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAKxD,eAAO,MAAM,cAAc,WAAY,SAAS,QAAQ,MAAM,KAAG,IAqChE,CAAA"}

package/dist/utilities/getTranslatedLabel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getTranslatedLabel.d.ts","sourceRoot":"","sources":["../../src/utilities/getTranslatedLabel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEpE,eAAO,MAAM,kBAAkB,GAC7B,OAAO,aAAa,GAAG,WAAW,GAAG,SAAS,EAC9C,OAAO,IAAI,KACV,MAAM,GAAG,SAUX,CAAA"}
+{"version":3,"file":"getTranslatedLabel.d.ts","sourceRoot":"","sources":["../../src/utilities/getTranslatedLabel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,IAAI,EAAE,MAAM,0BAA0B,CAAA;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAEpE,eAAO,MAAM,kBAAkB,UACtB,aAAa,GAAG,WAAW,GAAG,SAAS,SACvC,IAAI,KACV,MAAM,GAAG,SAUX,CAAA"}

package/dist/utilities/getUniqueFieldValue.d.ts

@@ -0,0 +1,28 @@
+import type { DefaultDocumentIDType, Locale } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collection: string;
+    /** Also treat a value taken by a draft-only version as unavailable. */
+    draftsEnabled?: boolean;
+    /** Field name to check for uniqueness. */
+    field: string;
+    /** Exclude this doc from the check when updating; omit for a new doc. */
+    id?: DefaultDocumentIDType;
+    /** Locale to scope the check to, for localized fields. */
+    locale?: Locale['code'];
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /**
+     * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …
+     * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.
+     */
+    startIndex?: number;
+    value: string;
+};
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */
+export declare const getUniqueFieldValue: ({ id, collection, draftsEnabled, field, locale, overrideAccess, req, startIndex, value, }: Args) => Promise<string>;
+export {};
+//# sourceMappingURL=getUniqueFieldValue.d.ts.map

package/dist/utilities/getUniqueFieldValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUniqueFieldValue.d.ts","sourceRoot":"","sources":["../../src/utilities/getUniqueFieldValue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8FAU7B,IAAI,KAAG,OAAO,CAAC,MAAM,CAqBvB,CAAA"}

package/dist/utilities/getUniqueFieldValue.js

@@ -0,0 +1,27 @@
+import { fieldValueExists } from './fieldValueExists.js';
+// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.
+const MAX_SUFFIX_ATTEMPTS = 50;
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */ export const getUniqueFieldValue = async ({ id, collection, draftsEnabled, field, locale, overrideAccess = false, req, startIndex = 0, value })=>{
+    for(let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++){
+        const candidate = index === 0 ? value : `${value}-${index}`;
+        const taken = await fieldValueExists({
+            id,
+            collection,
+            draftsEnabled,
+            field,
+            locale,
+            overrideAccess,
+            req,
+            value: candidate
+        });
+        if (!taken) {
+            return candidate;
+        }
+    }
+    return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`;
+};
+
+//# sourceMappingURL=getUniqueFieldValue.js.map

package/dist/utilities/getUniqueFieldValue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getUniqueFieldValue.ts"],"sourcesContent":["import type { DefaultDocumentIDType, Locale } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldValueExists } from './fieldValueExists.js'\n\ntype Args = {\n  collection: string\n  /** Also treat a value taken by a draft-only version as unavailable. */\n  draftsEnabled?: boolean\n  /** Field name to check for uniqueness. */\n  field: string\n  /** Exclude this doc from the check when updating; omit for a new doc. */\n  id?: DefaultDocumentIDType\n  /** Locale to scope the check to, for localized fields. */\n  locale?: Locale['code']\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /**\n   * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …\n   * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.\n   */\n  startIndex?: number\n  value: string\n}\n\n// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.\nconst MAX_SUFFIX_ATTEMPTS = 50\n\n/**\n * Returns the first available value for `field` in `collection` — either the bare `value` or a\n * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.\n */\nexport const getUniqueFieldValue = async ({\n  id,\n  collection,\n  draftsEnabled,\n  field,\n  locale,\n  overrideAccess = false,\n  req,\n  startIndex = 0,\n  value,\n}: Args): Promise<string> => {\n  for (let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++) {\n    const candidate = index === 0 ? value : `${value}-${index}`\n\n    const taken = await fieldValueExists({\n      id,\n      collection,\n      draftsEnabled,\n      field,\n      locale,\n      overrideAccess,\n      req,\n      value: candidate,\n    })\n\n    if (!taken) {\n      return candidate\n    }\n  }\n\n  return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`\n}\n"],"names":["fieldValueExists","MAX_SUFFIX_ATTEMPTS","getUniqueFieldValue","id","collection","draftsEnabled","field","locale","overrideAccess","req","startIndex","value","index","candidate","taken"],"mappings":"AAGA,SAASA,gBAAgB,QAAQ,wBAAuB;AAsBxD,oGAAoG;AACpG,MAAMC,sBAAsB;AAE5B;;;CAGC,GACD,OAAO,MAAMC,sBAAsB,OAAO,EACxCC,EAAE,EACFC,UAAU,EACVC,aAAa,EACbC,KAAK,EACLC,MAAM,EACNC,iBAAiB,KAAK,EACtBC,GAAG,EACHC,aAAa,CAAC,EACdC,KAAK,EACA;IACL,IAAK,IAAIC,QAAQF,YAAYE,SAASF,aAAaT,qBAAqBW,QAAS;QAC/E,MAAMC,YAAYD,UAAU,IAAID,QAAQ,GAAGA,MAAM,CAAC,EAAEC,OAAO;QAE3D,MAAME,QAAQ,MAAMd,iBAAiB;YACnCG;YACAC;YACAC;YACAC;YACAC;YACAC;YACAC;YACAE,OAAOE;QACT;QAEA,IAAI,CAACC,OAAO;YACV,OAAOD;QACT;IACF;IAEA,OAAO,GAAGF,MAAM,CAAC,EAAED,aAAaT,qBAAqB;AACvD,EAAC"}

package/dist/utilities/getVersionsConfig.d.ts

@@ -27,7 +27,7 @@ export declare const hasDraftValidationEnabled: (config: EntityConfig) => boolea
 export declare const hasScheduledPublishEnabled: (config: EntityConfig) => config is {
     versions: {
         drafts: {
-            schedulePublish: SanitizedDrafts["schedulePublish"];
+            schedulePublish: SanitizedDrafts['schedulePublish'];
         };
     };
 } & EntityConfig;

package/dist/utilities/getVersionsConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,GAAI,QAAQ,YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,GAAI,QAAQ,YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,GACrC,QAAQ,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAI,QAAQ,YAAY,KAAG,MAa1D,CAAA"}
+{"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,gBAAgB,WAAY,YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,WAAY,YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,WACrB,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAY,YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,WAC7B,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,YAAY,KAAG,MAa1D,CAAA"}

package/dist/utilities/getVirtualFieldNames.d.ts

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from '../config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export declare function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export declare function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export declare function stripVirtualFields(data: Record<string, unknown>, virtualFieldNames: string[]): Record<string, unknown>;
+//# sourceMappingURL=getVirtualFieldNames.d.ts.map

package/dist/utilities/getVirtualFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getVirtualFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getVirtualFieldNames.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/utilities/getVirtualFieldNames.js

@@ -0,0 +1,35 @@
+import { fieldIsVirtual } from '../fields/config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */ export function getCollectionVirtualFieldNames(config, slug) {
+    const collection = config.collections.find((c)=>c.slug === slug);
+    if (!collection) {
+        return [];
+    }
+    return collection.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */ export function getGlobalVirtualFieldNames(config, slug) {
+    const global = config.globals.find((g)=>g.slug === slug);
+    if (!global) {
+        return [];
+    }
+    return global.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */ export function stripVirtualFields(data, virtualFieldNames) {
+    if (virtualFieldNames.length === 0) {
+        return data;
+    }
+    const stripped = {
+        ...data
+    };
+    for (const name of virtualFieldNames){
+        delete stripped[name];
+    }
+    return stripped;
+}
+
+//# sourceMappingURL=getVirtualFieldNames.js.map

package/dist/utilities/getVirtualFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getVirtualFieldNames.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { fieldIsVirtual } from '../fields/config/types.js'\n\n/**\n * Returns the names of all top-level virtual fields for a given collection slug.\n */\nexport function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const collection = config.collections.find((c) => c.slug === slug)\n\n  if (!collection) {\n    return []\n  }\n\n  return collection.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Returns the names of all top-level virtual fields for a given global slug.\n */\nexport function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const global = config.globals.find((g) => g.slug === slug)\n\n  if (!global) {\n    return []\n  }\n\n  return global.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Strips virtual field values from a data object given a list of virtual field names.\n */\nexport function stripVirtualFields(\n  data: Record<string, unknown>,\n  virtualFieldNames: string[],\n): Record<string, unknown> {\n  if (virtualFieldNames.length === 0) {\n    return data\n  }\n\n  const stripped = { ...data }\n\n  for (const name of virtualFieldNames) {\n    delete stripped[name]\n  }\n\n  return stripped\n}\n"],"names":["fieldIsVirtual","getCollectionVirtualFieldNames","config","slug","collection","collections","find","c","flattenedFields","filter","field","map","name","getGlobalVirtualFieldNames","global","globals","g","stripVirtualFields","data","virtualFieldNames","length","stripped"],"mappings":"AAEA,SAASA,cAAc,QAAQ,4BAA2B;AAE1D;;CAEC,GACD,OAAO,SAASC,+BAA+BC,MAAuB,EAAEC,IAAY;IAClF,MAAMC,aAAaF,OAAOG,WAAW,CAACC,IAAI,CAAC,CAACC,IAAMA,EAAEJ,IAAI,KAAKA;IAE7D,IAAI,CAACC,YAAY;QACf,OAAO,EAAE;IACX;IAEA,OAAOA,WAAWI,eAAe,CAC9BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASC,2BAA2BX,MAAuB,EAAEC,IAAY;IAC9E,MAAMW,SAASZ,OAAOa,OAAO,CAACT,IAAI,CAAC,CAACU,IAAMA,EAAEb,IAAI,KAAKA;IAErD,IAAI,CAACW,QAAQ;QACX,OAAO,EAAE;IACX;IAEA,OAAOA,OAAON,eAAe,CAC1BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASK,mBACdC,IAA6B,EAC7BC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,MAAMG,WAAW;QAAE,GAAGH,IAAI;IAAC;IAE3B,KAAK,MAAMN,QAAQO,kBAAmB;QACpC,OAAOE,QAAQ,CAACT,KAAK;IACvB;IAEA,OAAOS;AACT"}

package/dist/utilities/handleEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,GAAU,+EAMnC;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAmNnB,CAAA"}
+{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAmNnB,CAAA"}

package/dist/utilities/headersWithCors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"headersWithCors.d.ts","sourceRoot":"","sources":["../../src/utilities/headersWithCors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,KAAK,QAAQ,GAAG;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CAC7B,CAAA;AACD,eAAO,MAAM,eAAe,GAAI,kBAAkB,QAAQ,KAAG,OAiD5D,CAAA"}
+{"version":3,"file":"headersWithCors.d.ts","sourceRoot":"","sources":["../../src/utilities/headersWithCors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,KAAK,QAAQ,GAAG;IACd,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC,CAAA;CAC7B,CAAA;AACD,eAAO,MAAM,eAAe,qBAAsB,QAAQ,KAAG,OAiD5D,CAAA"}

package/dist/utilities/headersWithCors.js

@@ -20,7 +20,7 @@ export const headersWithCors = ({ headers, req })=>{
             if (typeof cors === 'object' && 'headers' in cors) {
                 headers.set('Access-Control-Allow-Headers', [
                     ...defaultAllowedHeaders,
-                    ...cors.headers
+                    ...cors.headers ?? []
                 ].filter(Boolean).join(', '));
             } else {
                 headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '));

package/dist/utilities/headersWithCors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...cors.headers].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA0BL,KAAKF,OAAO;iBAAC,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAErE,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...(cors.headers ?? [])].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA2BL,KAAKF,OAAO,IAAI,EAAE;iBAAE,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAE7E,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}

package/dist/utilities/isEntityHidden.d.ts

@@ -2,7 +2,7 @@ import type { SanitizedCollectionConfig } from '../collections/config/types.js';
 import type { SanitizedGlobalConfig } from '../globals/config/types.js';
 import type { PayloadRequest } from '../types/index.js';
 export declare const isEntityHidden: ({ hidden, user, }: {
-    hidden: SanitizedCollectionConfig["admin"]["hidden"] | SanitizedGlobalConfig["admin"]["hidden"];
-    user: PayloadRequest["user"];
+    hidden: SanitizedCollectionConfig['admin']['hidden'] | SanitizedGlobalConfig['admin']['hidden'];
+    user: PayloadRequest['user'];
 }) => boolean;
 //# sourceMappingURL=isEntityHidden.d.ts.map

package/dist/utilities/isEntityHidden.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isEntityHidden.d.ts","sourceRoot":"","sources":["../../src/utilities/isEntityHidden.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,cAAc,GAAI,mBAG5B;IACD,MAAM,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC/F,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,YAEA,CAAA"}
+{"version":3,"file":"isEntityHidden.d.ts","sourceRoot":"","sources":["../../src/utilities/isEntityHidden.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AACvE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,eAAO,MAAM,cAAc,sBAGxB;IACD,MAAM,EAAE,yBAAyB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAA;IAC/F,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAA;CAC7B,YAEA,CAAA"}

package/dist/utilities/isURLAllowed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isURLAllowed.d.ts","sourceRoot":"","sources":["../../src/utilities/isURLAllowed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,EAAE,WAAW,SAAS,KAAG,OAgChE,CAAA"}
+{"version":3,"file":"isURLAllowed.d.ts","sourceRoot":"","sources":["../../src/utilities/isURLAllowed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAIpD,eAAO,MAAM,YAAY,QAAS,MAAM,aAAa,SAAS,KAAG,OAqChE,CAAA"}