payload 4.0.0-internal.cd69eef → 4.0.0-internal.ce66a41

package/dist/utilities/getSafeRedirect.js

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };
 

package/dist/utilities/getSafeRedirect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  const redirectPath = redirectTo.trim()\n\n  const hasControlCharacters = [...redirectPath].some((character) => {\n    const code = character.charCodeAt(0)\n    return code <= 31 || code === 127\n  })\n  const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath)\n\n  let parsedRedirect: URL\n  try {\n    parsedRedirect = new URL(redirectPath, 'http://localhost')\n  } catch {\n    return fallbackTo\n  }\n\n  const isSafeRedirect =\n    !hasControlCharacters &&\n    !hasAmbiguousPathPrefix &&\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Must resolve to the same origin after URL parser normalization\n    parsedRedirect.origin === 'http://localhost' &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    !hasControlCharacters &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n    (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:')\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getTopLevelFieldNames.d.ts

@@ -0,0 +1,2 @@
+export declare const getTopLevelFieldNames: (data: object) => Set<string>;
+//# sourceMappingURL=getTopLevelFieldNames.d.ts.map

package/dist/utilities/getTopLevelFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTopLevelFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getTopLevelFieldNames.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,CACa,CAAA"}

package/dist/utilities/getTopLevelFieldNames.js

@@ -0,0 +1,3 @@
+export const getTopLevelFieldNames = (data)=>new Set(Object.keys(data).map((fieldPath)=>fieldPath.split('.', 1)[0]));
+
+//# sourceMappingURL=getTopLevelFieldNames.js.map

package/dist/utilities/getTopLevelFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.ts"],"sourcesContent":["export const getTopLevelFieldNames = (data: object): Set<string> =>\n  new Set(Object.keys(data).map((fieldPath) => fieldPath.split('.', 1)[0]!))\n"],"names":["getTopLevelFieldNames","data","Set","Object","keys","map","fieldPath","split"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,OACpC,IAAIC,IAAIC,OAAOC,IAAI,CAACH,MAAMI,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG"}

package/dist/utilities/getUniqueFieldValue.d.ts

@@ -0,0 +1,28 @@
+import type { DefaultDocumentIDType, Locale } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collection: string;
+    /** Also treat a value taken by a draft-only version as unavailable. */
+    draftsEnabled?: boolean;
+    /** Field name to check for uniqueness. */
+    field: string;
+    /** Exclude this doc from the check when updating; omit for a new doc. */
+    id?: DefaultDocumentIDType;
+    /** Locale to scope the check to, for localized fields. */
+    locale?: Locale['code'];
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /**
+     * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …
+     * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.
+     */
+    startIndex?: number;
+    value: string;
+};
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */
+export declare const getUniqueFieldValue: ({ id, collection, draftsEnabled, field, locale, overrideAccess, req, startIndex, value, }: Args) => Promise<string>;
+export {};
+//# sourceMappingURL=getUniqueFieldValue.d.ts.map

package/dist/utilities/getUniqueFieldValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUniqueFieldValue.d.ts","sourceRoot":"","sources":["../../src/utilities/getUniqueFieldValue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8FAU7B,IAAI,KAAG,OAAO,CAAC,MAAM,CAqBvB,CAAA"}

package/dist/utilities/getUniqueFieldValue.js

@@ -0,0 +1,27 @@
+import { fieldValueExists } from './fieldValueExists.js';
+// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.
+const MAX_SUFFIX_ATTEMPTS = 50;
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */ export const getUniqueFieldValue = async ({ id, collection, draftsEnabled, field, locale, overrideAccess = false, req, startIndex = 0, value })=>{
+    for(let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++){
+        const candidate = index === 0 ? value : `${value}-${index}`;
+        const taken = await fieldValueExists({
+            id,
+            collection,
+            draftsEnabled,
+            field,
+            locale,
+            overrideAccess,
+            req,
+            value: candidate
+        });
+        if (!taken) {
+            return candidate;
+        }
+    }
+    return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`;
+};
+
+//# sourceMappingURL=getUniqueFieldValue.js.map

package/dist/utilities/getUniqueFieldValue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getUniqueFieldValue.ts"],"sourcesContent":["import type { DefaultDocumentIDType, Locale } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldValueExists } from './fieldValueExists.js'\n\ntype Args = {\n  collection: string\n  /** Also treat a value taken by a draft-only version as unavailable. */\n  draftsEnabled?: boolean\n  /** Field name to check for uniqueness. */\n  field: string\n  /** Exclude this doc from the check when updating; omit for a new doc. */\n  id?: DefaultDocumentIDType\n  /** Locale to scope the check to, for localized fields. */\n  locale?: Locale['code']\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /**\n   * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …\n   * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.\n   */\n  startIndex?: number\n  value: string\n}\n\n// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.\nconst MAX_SUFFIX_ATTEMPTS = 50\n\n/**\n * Returns the first available value for `field` in `collection` — either the bare `value` or a\n * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.\n */\nexport const getUniqueFieldValue = async ({\n  id,\n  collection,\n  draftsEnabled,\n  field,\n  locale,\n  overrideAccess = false,\n  req,\n  startIndex = 0,\n  value,\n}: Args): Promise<string> => {\n  for (let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++) {\n    const candidate = index === 0 ? value : `${value}-${index}`\n\n    const taken = await fieldValueExists({\n      id,\n      collection,\n      draftsEnabled,\n      field,\n      locale,\n      overrideAccess,\n      req,\n      value: candidate,\n    })\n\n    if (!taken) {\n      return candidate\n    }\n  }\n\n  return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`\n}\n"],"names":["fieldValueExists","MAX_SUFFIX_ATTEMPTS","getUniqueFieldValue","id","collection","draftsEnabled","field","locale","overrideAccess","req","startIndex","value","index","candidate","taken"],"mappings":"AAGA,SAASA,gBAAgB,QAAQ,wBAAuB;AAsBxD,oGAAoG;AACpG,MAAMC,sBAAsB;AAE5B;;;CAGC,GACD,OAAO,MAAMC,sBAAsB,OAAO,EACxCC,EAAE,EACFC,UAAU,EACVC,aAAa,EACbC,KAAK,EACLC,MAAM,EACNC,iBAAiB,KAAK,EACtBC,GAAG,EACHC,aAAa,CAAC,EACdC,KAAK,EACA;IACL,IAAK,IAAIC,QAAQF,YAAYE,SAASF,aAAaT,qBAAqBW,QAAS;QAC/E,MAAMC,YAAYD,UAAU,IAAID,QAAQ,GAAGA,MAAM,CAAC,EAAEC,OAAO;QAE3D,MAAME,QAAQ,MAAMd,iBAAiB;YACnCG;YACAC;YACAC;YACAC;YACAC;YACAC;YACAC;YACAE,OAAOE;QACT;QAEA,IAAI,CAACC,OAAO;YACV,OAAOD;QACT;IACF;IAEA,OAAO,GAAGF,MAAM,CAAC,EAAED,aAAaT,qBAAqB;AACvD,EAAC"}

package/dist/utilities/getVirtualFieldNames.d.ts

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from '../config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export declare function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export declare function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export declare function stripVirtualFields(data: Record<string, unknown>, virtualFieldNames: string[]): Record<string, unknown>;
+//# sourceMappingURL=getVirtualFieldNames.d.ts.map

package/dist/utilities/getVirtualFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getVirtualFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getVirtualFieldNames.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/utilities/getVirtualFieldNames.js

@@ -0,0 +1,35 @@
+import { fieldIsVirtual } from '../fields/config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */ export function getCollectionVirtualFieldNames(config, slug) {
+    const collection = config.collections.find((c)=>c.slug === slug);
+    if (!collection) {
+        return [];
+    }
+    return collection.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */ export function getGlobalVirtualFieldNames(config, slug) {
+    const global = config.globals.find((g)=>g.slug === slug);
+    if (!global) {
+        return [];
+    }
+    return global.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */ export function stripVirtualFields(data, virtualFieldNames) {
+    if (virtualFieldNames.length === 0) {
+        return data;
+    }
+    const stripped = {
+        ...data
+    };
+    for (const name of virtualFieldNames){
+        delete stripped[name];
+    }
+    return stripped;
+}
+
+//# sourceMappingURL=getVirtualFieldNames.js.map

package/dist/utilities/getVirtualFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getVirtualFieldNames.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { fieldIsVirtual } from '../fields/config/types.js'\n\n/**\n * Returns the names of all top-level virtual fields for a given collection slug.\n */\nexport function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const collection = config.collections.find((c) => c.slug === slug)\n\n  if (!collection) {\n    return []\n  }\n\n  return collection.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Returns the names of all top-level virtual fields for a given global slug.\n */\nexport function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const global = config.globals.find((g) => g.slug === slug)\n\n  if (!global) {\n    return []\n  }\n\n  return global.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Strips virtual field values from a data object given a list of virtual field names.\n */\nexport function stripVirtualFields(\n  data: Record<string, unknown>,\n  virtualFieldNames: string[],\n): Record<string, unknown> {\n  if (virtualFieldNames.length === 0) {\n    return data\n  }\n\n  const stripped = { ...data }\n\n  for (const name of virtualFieldNames) {\n    delete stripped[name]\n  }\n\n  return stripped\n}\n"],"names":["fieldIsVirtual","getCollectionVirtualFieldNames","config","slug","collection","collections","find","c","flattenedFields","filter","field","map","name","getGlobalVirtualFieldNames","global","globals","g","stripVirtualFields","data","virtualFieldNames","length","stripped"],"mappings":"AAEA,SAASA,cAAc,QAAQ,4BAA2B;AAE1D;;CAEC,GACD,OAAO,SAASC,+BAA+BC,MAAuB,EAAEC,IAAY;IAClF,MAAMC,aAAaF,OAAOG,WAAW,CAACC,IAAI,CAAC,CAACC,IAAMA,EAAEJ,IAAI,KAAKA;IAE7D,IAAI,CAACC,YAAY;QACf,OAAO,EAAE;IACX;IAEA,OAAOA,WAAWI,eAAe,CAC9BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASC,2BAA2BX,MAAuB,EAAEC,IAAY;IAC9E,MAAMW,SAASZ,OAAOa,OAAO,CAACT,IAAI,CAAC,CAACU,IAAMA,EAAEb,IAAI,KAAKA;IAErD,IAAI,CAACW,QAAQ;QACX,OAAO,EAAE;IACX;IAEA,OAAOA,OAAON,eAAe,CAC1BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASK,mBACdC,IAA6B,EAC7BC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,MAAMG,WAAW;QAAE,GAAGH,IAAI;IAAC;IAE3B,KAAK,MAAMN,QAAQO,kBAAmB;QACpC,OAAOE,QAAQ,CAACT,KAAK;IACvB;IAEA,OAAOS;AACT"}

package/dist/utilities/handleEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAmNnB,CAAA"}
+{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAoNnB,CAAA"}

package/dist/utilities/handleEndpoints.js

@@ -1,7 +1,7 @@
 import { status as httpStatus } from 'http-status';
 import { match } from 'path-to-regexp';
-import { createPayloadRequest } from './createPayloadRequest.js';
-import { formatAdminURL } from './formatAdminURL.js';
+import { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js';
+import { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js';
 import { headersWithCors } from './headersWithCors.js';
 import { mergeHeaders } from './mergeHeaders.js';
 import { routeError } from './routeError.js';
@@ -69,8 +69,7 @@ const notFoundResponse = (req, pathname)=>{
         } else if (request.headers.get('Content-Type') === 'application/json') {
             // May not be supported by every endpoint
             data = await request.json();
-            // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale
-            // => add to searchParams
+            // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.
             if (data?.locale) {
                 url += `?locale=${data.locale}`;
             }
@@ -97,7 +96,7 @@ const notFoundResponse = (req, pathname)=>{
         return response;
     }
     try {
-        req = await createPayloadRequest({
+        req = await createPayloadRequestFromWebRequest({
             canSetHeaders: true,
             config: incomingConfig,
             payloadInstanceCacheKey,
@@ -105,11 +104,13 @@ const notFoundResponse = (req, pathname)=>{
         });
         const { payload } = req;
         const { config } = payload;
-        const pathname = path ?? new URL(req.url).pathname;
-        const baseAPIPath = formatAdminURL({
+        const rawPathname = path ?? new URL(req.url).pathname;
+        const pathname = stripTrailingSlash(rawPathname);
+        const rawBaseAPIPath = formatAdminURL({
             apiRoute: config.routes.api,
             path: ''
         });
+        const baseAPIPath = stripTrailingSlash(rawBaseAPIPath);
         if (!pathname.startsWith(baseAPIPath)) {
             return notFoundResponse(req, pathname);
         }

package/dist/utilities/handleEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequest } from './createPayloadRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale\n      // => add to searchParams\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const pathname = path ?? new URL(req.url!).pathname\n    const baseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequest","formatAdminURL","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","baseAPIPath","apiRoute","routes","api","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAT,QAAQC,WAAWiB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQT,OAAO;QACtC,MAAMgB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAIlB,MAAMU,QAAQV,GAAG;QACrB,IAAImB,OAAYC;QAEhB,IAAIV,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCtB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEqB,QAAQ;QAClC,OAAO,IAAIX,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQb,IAAI;YAEzB,0GAA0G;YAC1G,yBAAyB;YACzB,IAAIsB,MAAMI,QAAQ;gBAChBvB,OAAO,CAAC,QAAQ,EAAEmB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBxB,OAAO,CAAC,gBAAgB,EAAEmB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM/B,MAAM,IAAIgC,QAAQ1B,KAAK;YAC3BC,SAASe;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChFzB,IAAIyB,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMN,qBAAqB;YAC/BwC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMlC,WAAWa,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACnD,MAAMmC,cAAczC,eAAe;YACjC0C,UAAUzB,OAAO0B,MAAM,CAACC,GAAG;YAC3BzB,MAAM;QACR;QAEA,IAAI,CAACb,SAASuC,UAAU,CAACJ,cAAc;YACrC,OAAOrC,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAIwC,mBAAmBxC,SAASyC,OAAO,CAACN,aAAa;QAErD,IAAIO,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAeb,QAAQc,OAAO,CAACrC,MAAM,CAACsC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAIZ,QAAQkB,WAAW,CAACN,WAAW,EAAE;gBAC1C7B,aAAaiB,QAAQkB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC1C,OAAO0C,SAAS;QAEpD,IAAIpC,YAAY;YACdoC,YAAYpC,WAAWN,MAAM,CAAC0C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAExB,WAAWN,MAAM,CAACwC,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOpD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEoC,cAAc,CAAC,EAAEvD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAT,QAAQC,WAAWgE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAAStC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMsC,cAAcjE,MAAMgE,SAAS3C,IAAI,EAAE;gBAAE6C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA7D,IAAI8D,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI7C,YAAY;gBACdlB,IAAI8D,WAAW,CAAC5C,UAAU,GAAGA,WAAWN,MAAM,CAACwC,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBhD,IAAI8D,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZxC,UAAUwC,SAASxC,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAT,QAAQ;gBACV;YAEJ;YAEA,OAAOQ,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASgC,IAAI,EAAE;YACjC1D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIkE,eAAe,IAAI,IAAI1D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAT,QAAQ0C,SAAS1C,MAAM;YACvB4E,YAAYlC,SAASkC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOtE,WAAW;YAChBoB;YACAN,QAAQC;YACRwD;YACArE,KAAKA;QACP;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js'\nimport { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequestFromWebRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const rawPathname = path ?? new URL(req.url!).pathname\n    const pathname = stripTrailingSlash(rawPathname)\n    const rawBaseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n    const baseAPIPath = stripTrailingSlash(rawBaseAPIPath)\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequestFromWebRequest","formatAdminURL","stripTrailingSlash","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","rawPathname","rawBaseAPIPath","apiRoute","routes","api","baseAPIPath","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,kCAAkC,QAAQ,0CAAyC;AAC5F,SAASC,cAAc,EAAEC,kBAAkB,QAAQ,sBAAqB;AACxE,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAV,QAAQC,WAAWkB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQT,OAAO;QACtC,MAAMgB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAIlB,MAAMU,QAAQV,GAAG;QACrB,IAAImB,OAAYC;QAEhB,IAAIV,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCtB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEqB,QAAQ;QAClC,OAAO,IAAIX,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQb,IAAI;YAEzB,wFAAwF;YACxF,IAAIsB,MAAMI,QAAQ;gBAChBvB,OAAO,CAAC,QAAQ,EAAEmB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBxB,OAAO,CAAC,gBAAgB,EAAEmB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM/B,MAAM,IAAIgC,QAAQ1B,KAAK;YAC3BC,SAASe;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChFzB,IAAIyB,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMP,mCAAmC;YAC7CyC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMC,cAActB,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACtD,MAAMA,WAAWN,mBAAmByC;QACpC,MAAMC,iBAAiB3C,eAAe;YACpC4C,UAAU1B,OAAO2B,MAAM,CAACC,GAAG;YAC3B1B,MAAM;QACR;QACA,MAAM2B,cAAc9C,mBAAmB0C;QAEvC,IAAI,CAACpC,SAASyC,UAAU,CAACD,cAAc;YACrC,OAAO1C,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAI0C,mBAAmB1C,SAAS2C,OAAO,CAACH,aAAa;QAErD,IAAII,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAef,QAAQgB,OAAO,CAACvC,MAAM,CAACwC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAId,QAAQoB,WAAW,CAACN,WAAW,EAAE;gBAC1C/B,aAAaiB,QAAQoB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC5C,OAAO4C,SAAS;QAEpD,IAAItC,YAAY;YACdsC,YAAYtC,WAAWN,MAAM,CAAC4C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAE1B,WAAWN,MAAM,CAAC0C,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOtD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEsC,cAAc,CAAC,EAAEzD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAV,QAAQC,WAAWmE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAASxC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMwC,cAAcpE,MAAMmE,SAAS7C,IAAI,EAAE;gBAAE+C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA/D,IAAIgE,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI/C,YAAY;gBACdlB,IAAIgE,WAAW,CAAC9C,UAAU,GAAGA,WAAWN,MAAM,CAAC0C,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBlD,IAAIgE,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZ1C,UAAU0C,SAAS1C,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAV,QAAQ;gBACV;YAEJ;YAEA,OAAOS,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASkC,IAAI,EAAE;YACjC5D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIoE,eAAe,IAAI,IAAI5D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAV,QAAQ2C,SAAS3C,MAAM;YACvB+E,YAAYpC,SAASoC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOxE,WAAW;YAChBoB;YACAN,QAAQC;YACR0D;YACAvE,KAAKA;QACP;IACF;AACF,EAAC"}

package/dist/utilities/headersWithCors.js

@@ -20,7 +20,7 @@ export const headersWithCors = ({ headers, req })=>{
             if (typeof cors === 'object' && 'headers' in cors) {
                 headers.set('Access-Control-Allow-Headers', [
                     ...defaultAllowedHeaders,
-                    ...cors.headers
+                    ...cors.headers ?? []
                 ].filter(Boolean).join(', '));
             } else {
                 headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '));

package/dist/utilities/headersWithCors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...cors.headers].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA0BL,KAAKF,OAAO;iBAAC,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAErE,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...(cors.headers ?? [])].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA2BL,KAAKF,OAAO,IAAI,EAAE;iBAAE,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAE7E,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}

package/dist/utilities/killTransaction.d.ts

@@ -2,6 +2,13 @@ import type { MarkRequired } from 'ts-essentials';
 import type { PayloadRequest } from '../types/index.js';
 /**
  * Rollback the transaction from the req using the db adapter and removes it from the req
+ *
+ * Only call this from an operation that owns the transaction, i.e. one whose own
+ * `initTransaction` call returned `true`. Operations that never open a transaction —
+ * every read operation — must not call this: `req` is shared with the caller, so rolling
+ * back here discards the caller's in-flight writes. If that caller catches the error
+ * (a hook tolerating a missing doc, for example) it goes on to commit a transaction that
+ * no longer exists, and the write is lost with no error surfaced.
  */
 export declare function killTransaction(req: MarkRequired<Partial<PayloadRequest>, 'payload'>): Promise<void>;
 //# sourceMappingURL=killTransaction.d.ts.map

package/dist/utilities/killTransaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"killTransaction.d.ts","sourceRoot":"","sources":["../../src/utilities/killTransaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;GAEG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,CAUf"}
+{"version":3,"file":"killTransaction.d.ts","sourceRoot":"","sources":["../../src/utilities/killTransaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,GACpD,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/utilities/killTransaction.js

@@ -1,5 +1,12 @@
 /**
  * Rollback the transaction from the req using the db adapter and removes it from the req
+ *
+ * Only call this from an operation that owns the transaction, i.e. one whose own
+ * `initTransaction` call returned `true`. Operations that never open a transaction —
+ * every read operation — must not call this: `req` is shared with the caller, so rolling
+ * back here discards the caller's in-flight writes. If that caller catches the error
+ * (a hook tolerating a missing doc, for example) it goes on to commit a transaction that
+ * no longer exists, and the write is lost with no error surfaced.
  */ export async function killTransaction(req) {
     const { payload, transactionID } = req;
     if (transactionID && !(transactionID instanceof Promise)) {

package/dist/utilities/killTransaction.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/killTransaction.ts"],"sourcesContent":["import type { MarkRequired } from 'ts-essentials'\n\nimport type { PayloadRequest } from '../types/index.js'\n\n/**\n * Rollback the transaction from the req using the db adapter and removes it from the req\n */\nexport async function killTransaction(\n  req: MarkRequired<Partial<PayloadRequest>, 'payload'>,\n): Promise<void> {\n  const { payload, transactionID } = req\n  if (transactionID && !(transactionID instanceof Promise)) {\n    try {\n      await payload.db.rollbackTransaction(req.transactionID!)\n    } catch (ignore) {\n      // swallow any errors while attempting to rollback\n    }\n    delete req.transactionID\n  }\n}\n"],"names":["killTransaction","req","payload","transactionID","Promise","db","rollbackTransaction","ignore"],"mappings":"AAIA;;CAEC,GACD,OAAO,eAAeA,gBACpBC,GAAqD;IAErD,MAAM,EAAEC,OAAO,EAAEC,aAAa,EAAE,GAAGF;IACnC,IAAIE,iBAAiB,CAAEA,CAAAA,yBAAyBC,OAAM,GAAI;QACxD,IAAI;YACF,MAAMF,QAAQG,EAAE,CAACC,mBAAmB,CAACL,IAAIE,aAAa;QACxD,EAAE,OAAOI,QAAQ;QACf,kDAAkD;QACpD;QACA,OAAON,IAAIE,aAAa;IAC1B;AACF"}
+{"version":3,"sources":["../../src/utilities/killTransaction.ts"],"sourcesContent":["import type { MarkRequired } from 'ts-essentials'\n\nimport type { PayloadRequest } from '../types/index.js'\n\n/**\n * Rollback the transaction from the req using the db adapter and removes it from the req\n *\n * Only call this from an operation that owns the transaction, i.e. one whose own\n * `initTransaction` call returned `true`. Operations that never open a transaction —\n * every read operation — must not call this: `req` is shared with the caller, so rolling\n * back here discards the caller's in-flight writes. If that caller catches the error\n * (a hook tolerating a missing doc, for example) it goes on to commit a transaction that\n * no longer exists, and the write is lost with no error surfaced.\n */\nexport async function killTransaction(\n  req: MarkRequired<Partial<PayloadRequest>, 'payload'>,\n): Promise<void> {\n  const { payload, transactionID } = req\n  if (transactionID && !(transactionID instanceof Promise)) {\n    try {\n      await payload.db.rollbackTransaction(req.transactionID!)\n    } catch (ignore) {\n      // swallow any errors while attempting to rollback\n    }\n    delete req.transactionID\n  }\n}\n"],"names":["killTransaction","req","payload","transactionID","Promise","db","rollbackTransaction","ignore"],"mappings":"AAIA;;;;;;;;;CASC,GACD,OAAO,eAAeA,gBACpBC,GAAqD;IAErD,MAAM,EAAEC,OAAO,EAAEC,aAAa,EAAE,GAAGF;IACnC,IAAIE,iBAAiB,CAAEA,CAAAA,yBAAyBC,OAAM,GAAI;QACxD,IAAI;YACF,MAAMF,QAAQG,EAAE,CAACC,mBAAmB,CAACL,IAAIE,aAAa;QACxD,EAAE,OAAOI,QAAQ;QACf,kDAAkD;QACpD;QACA,OAAON,IAAIE,aAAa;IAC1B;AACF"}

package/dist/utilities/logError.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logError.d.ts","sourceRoot":"","sources":["../../src/utilities/logError.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEhD,eAAO,MAAM,QAAQ,qBAAsB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAAG,IAyB/E,CAAA"}
+{"version":3,"file":"logError.d.ts","sourceRoot":"","sources":["../../src/utilities/logError.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEhD,eAAO,MAAM,QAAQ,qBAAsB;IAAE,GAAG,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,KAAG,IAuB/E,CAAA"}

package/dist/utilities/logError.js

@@ -1,7 +1,10 @@
 export const logError = ({ err, payload })=>{
     let level = 'error';
-    if (err && typeof err === 'object' && 'name' in err && typeof err.name === 'string' && typeof payload.config.loggingLevels[err.name] !== 'undefined') {
-        level = payload.config.loggingLevels[err.name];
+    if (err && typeof err === 'object' && 'name' in err && typeof err.name === 'string') {
+        const configuredLevel = payload.config.loggingLevels[err.name];
+        if (configuredLevel !== undefined) {
+            level = configuredLevel;
+        }
     }
     if (level) {
         const logObject = {};

package/dist/utilities/logError.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/logError.ts"],"sourcesContent":["import type pino from 'pino'\n\nimport type { Payload } from '../types/index.js'\n\nexport const logError = ({ err, payload }: { err: unknown; payload: Payload }): void => {\n  let level: false | pino.Level = 'error'\n\n  if (\n    err &&\n    typeof err === 'object' &&\n    'name' in err &&\n    typeof err.name === 'string' &&\n    typeof payload.config.loggingLevels[err.name as keyof typeof payload.config.loggingLevels] !==\n      'undefined'\n  ) {\n    level = payload.config.loggingLevels[err.name as keyof typeof payload.config.loggingLevels]\n  }\n\n  if (level) {\n    const logObject: { err?: unknown; msg?: unknown } = {}\n\n    if (level === 'info') {\n      logObject.msg = typeof err === 'object' && 'message' in err! ? err.message : 'Error'\n    } else {\n      logObject.err = err\n    }\n\n    payload.logger[level](logObject)\n  }\n}\n"],"names":["logError","err","payload","level","name","config","loggingLevels","logObject","msg","message","logger"],"mappings":"AAIA,OAAO,MAAMA,WAAW,CAAC,EAAEC,GAAG,EAAEC,OAAO,EAAsC;IAC3E,IAAIC,QAA4B;IAEhC,IACEF,OACA,OAAOA,QAAQ,YACf,UAAUA,OACV,OAAOA,IAAIG,IAAI,KAAK,YACpB,OAAOF,QAAQG,MAAM,CAACC,aAAa,CAACL,IAAIG,IAAI,CAA8C,KACxF,aACF;QACAD,QAAQD,QAAQG,MAAM,CAACC,aAAa,CAACL,IAAIG,IAAI,CAA8C;IAC7F;IAEA,IAAID,OAAO;QACT,MAAMI,YAA8C,CAAC;QAErD,IAAIJ,UAAU,QAAQ;YACpBI,UAAUC,GAAG,GAAG,OAAOP,QAAQ,YAAY,aAAaA,MAAOA,IAAIQ,OAAO,GAAG;QAC/E,OAAO;YACLF,UAAUN,GAAG,GAAGA;QAClB;QAEAC,QAAQQ,MAAM,CAACP,MAAM,CAACI;IACxB;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/logError.ts"],"sourcesContent":["import type pino from 'pino'\n\nimport type { Payload } from '../types/index.js'\n\nexport const logError = ({ err, payload }: { err: unknown; payload: Payload }): void => {\n  let level: false | pino.Level = 'error'\n\n  if (err && typeof err === 'object' && 'name' in err && typeof err.name === 'string') {\n    const configuredLevel =\n      payload.config.loggingLevels[err.name as keyof typeof payload.config.loggingLevels]\n\n    if (configuredLevel !== undefined) {\n      level = configuredLevel\n    }\n  }\n\n  if (level) {\n    const logObject: { err?: unknown; msg?: unknown } = {}\n\n    if (level === 'info') {\n      logObject.msg = typeof err === 'object' && 'message' in err! ? err.message : 'Error'\n    } else {\n      logObject.err = err\n    }\n\n    payload.logger[level](logObject)\n  }\n}\n"],"names":["logError","err","payload","level","name","configuredLevel","config","loggingLevels","undefined","logObject","msg","message","logger"],"mappings":"AAIA,OAAO,MAAMA,WAAW,CAAC,EAAEC,GAAG,EAAEC,OAAO,EAAsC;IAC3E,IAAIC,QAA4B;IAEhC,IAAIF,OAAO,OAAOA,QAAQ,YAAY,UAAUA,OAAO,OAAOA,IAAIG,IAAI,KAAK,UAAU;QACnF,MAAMC,kBACJH,QAAQI,MAAM,CAACC,aAAa,CAACN,IAAIG,IAAI,CAA8C;QAErF,IAAIC,oBAAoBG,WAAW;YACjCL,QAAQE;QACV;IACF;IAEA,IAAIF,OAAO;QACT,MAAMM,YAA8C,CAAC;QAErD,IAAIN,UAAU,QAAQ;YACpBM,UAAUC,GAAG,GAAG,OAAOT,QAAQ,YAAY,aAAaA,MAAOA,IAAIU,OAAO,GAAG;QAC/E,OAAO;YACLF,UAAUR,GAAG,GAAGA;QAClB;QAEAC,QAAQU,MAAM,CAACT,MAAM,CAACM;IACxB;AACF,EAAC"}

package/dist/utilities/nextJsDevReloadStrategy.d.ts

@@ -0,0 +1,7 @@
+import type { DevReloadStrategy } from '../admin/adapters/devReload.js';
+/**
+ * Default HMR reload strategy using the Next.js dev HMR WebSocket.
+ * Used as fallback when no custom devReloadStrategy is provided.
+ */
+export declare const defaultNextJsDevReloadStrategy: () => DevReloadStrategy | null;
+//# sourceMappingURL=nextJsDevReloadStrategy.d.ts.map

package/dist/utilities/nextJsDevReloadStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextJsDevReloadStrategy.d.ts","sourceRoot":"","sources":["../../src/utilities/nextJsDevReloadStrategy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAA;AAavE;;;GAGG;AACH,eAAO,MAAM,8BAA8B,QAAO,iBAAiB,GAAG,IAgCrE,CAAA"}

package/dist/utilities/nextJsDevReloadStrategy.js

@@ -0,0 +1,62 @@
+import WebSocket from 'ws';
+import { compareVersions, parseVersion } from './dependencies/versionUtils.js';
+import { getNextVersion } from './getNextVersion.js';
+/** Next.js serves the dev HMR WebSocket on this path from 16.3 onwards. */ const modernHMRPath = '/_next/hmr';
+/** Next.js served the dev HMR WebSocket on this path before 16.3. */ const legacyHMRPath = '/_next/webpack-hmr';
+const firstModernHMRPathVersion = '16.3.0';
+/**
+ * Default HMR reload strategy using the Next.js dev HMR WebSocket.
+ * Used as fallback when no custom devReloadStrategy is provided.
+ */ export const defaultNextJsDevReloadStrategy = ()=>{
+    try {
+        const url = getHMRURL();
+        return {
+            connect (onReload) {
+                const ws = new WebSocket(url);
+                ws.onmessage = (event)=>{
+                    if (typeof event.data === 'string') {
+                        const data = JSON.parse(event.data);
+                        if (data.type === 'serverComponentChanges' || data.action === 'serverComponentChanges') {
+                            onReload();
+                        }
+                    }
+                };
+                ws.onerror = ()=>{
+                // swallow any websocket connection error
+                };
+                return ()=>{
+                    ws.close();
+                };
+            }
+        };
+    } catch (_) {
+        return null;
+    }
+};
+const getHMRURL = ()=>{
+    if (process.env.PAYLOAD_HMR_URL_OVERRIDE) {
+        return process.env.PAYLOAD_HMR_URL_OVERRIDE;
+    }
+    const port = process.env.PORT || '3000';
+    const hasHTTPS = process.env.USE_HTTPS === 'true' || process.argv.includes('--experimental-https');
+    const protocol = hasHTTPS ? 'wss' : 'ws';
+    /**
+   * Next.js only inlines __NEXT_ASSET_PREFIX into bundled code. In dev, withPayload keeps `payload`
+   * external, so fall back to NEXT_BASE_PATH, which withPayload sets on process.env at runtime.
+   */ const prefix = process.env.__NEXT_ASSET_PREFIX || process.env.NEXT_BASE_PATH || '';
+    return `${protocol}://localhost:${port}${prefix}${getHMRPath()}`;
+};
+/**
+ * Pre-release identifiers are ignored, so that a `16.3.0-canary` build maps to the 16.3 path.
+ * An unreadable version uses the current path, as Payload being unable to resolve Next.js
+ * normally means it is not running under Next.js, where this strategy does not apply.
+ */ const getHMRPath = ()=>{
+    const nextVersion = getNextVersion();
+    if (!nextVersion) {
+        return modernHMRPath;
+    }
+    const mainVersion = parseVersion(nextVersion).parts.join('.');
+    return compareVersions(mainVersion, firstModernHMRPathVersion) === 'lower' ? legacyHMRPath : modernHMRPath;
+};
+
+//# sourceMappingURL=nextJsDevReloadStrategy.js.map

package/dist/utilities/nextJsDevReloadStrategy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/nextJsDevReloadStrategy.ts"],"sourcesContent":["import WebSocket from 'ws'\n\nimport type { DevReloadStrategy } from '../admin/adapters/devReload.js'\n\nimport { compareVersions, parseVersion } from './dependencies/versionUtils.js'\nimport { getNextVersion } from './getNextVersion.js'\n\n/** Next.js serves the dev HMR WebSocket on this path from 16.3 onwards. */\nconst modernHMRPath = '/_next/hmr'\n\n/** Next.js served the dev HMR WebSocket on this path before 16.3. */\nconst legacyHMRPath = '/_next/webpack-hmr'\n\nconst firstModernHMRPathVersion = '16.3.0'\n\n/**\n * Default HMR reload strategy using the Next.js dev HMR WebSocket.\n * Used as fallback when no custom devReloadStrategy is provided.\n */\nexport const defaultNextJsDevReloadStrategy = (): DevReloadStrategy | null => {\n  try {\n    const url = getHMRURL()\n\n    return {\n      connect(onReload) {\n        const ws = new WebSocket(url)\n\n        ws.onmessage = (event) => {\n          if (typeof event.data === 'string') {\n            const data = JSON.parse(event.data)\n            if (\n              data.type === 'serverComponentChanges' ||\n              data.action === 'serverComponentChanges'\n            ) {\n              onReload()\n            }\n          }\n        }\n\n        ws.onerror = () => {\n          // swallow any websocket connection error\n        }\n\n        return () => {\n          ws.close()\n        }\n      },\n    }\n  } catch (_) {\n    return null\n  }\n}\n\nconst getHMRURL = (): string => {\n  if (process.env.PAYLOAD_HMR_URL_OVERRIDE) {\n    return process.env.PAYLOAD_HMR_URL_OVERRIDE\n  }\n\n  const port = process.env.PORT || '3000'\n  const hasHTTPS = process.env.USE_HTTPS === 'true' || process.argv.includes('--experimental-https')\n  const protocol = hasHTTPS ? 'wss' : 'ws'\n  /**\n   * Next.js only inlines __NEXT_ASSET_PREFIX into bundled code. In dev, withPayload keeps `payload`\n   * external, so fall back to NEXT_BASE_PATH, which withPayload sets on process.env at runtime.\n   */\n  const prefix = process.env.__NEXT_ASSET_PREFIX || process.env.NEXT_BASE_PATH || ''\n\n  return `${protocol}://localhost:${port}${prefix}${getHMRPath()}`\n}\n\n/**\n * Pre-release identifiers are ignored, so that a `16.3.0-canary` build maps to the 16.3 path.\n * An unreadable version uses the current path, as Payload being unable to resolve Next.js\n * normally means it is not running under Next.js, where this strategy does not apply.\n */\nconst getHMRPath = (): string => {\n  const nextVersion = getNextVersion()\n\n  if (!nextVersion) {\n    return modernHMRPath\n  }\n\n  const mainVersion = parseVersion(nextVersion).parts.join('.')\n\n  return compareVersions(mainVersion, firstModernHMRPathVersion) === 'lower'\n    ? legacyHMRPath\n    : modernHMRPath\n}\n"],"names":["WebSocket","compareVersions","parseVersion","getNextVersion","modernHMRPath","legacyHMRPath","firstModernHMRPathVersion","defaultNextJsDevReloadStrategy","url","getHMRURL","connect","onReload","ws","onmessage","event","data","JSON","parse","type","action","onerror","close","_","process","env","PAYLOAD_HMR_URL_OVERRIDE","port","PORT","hasHTTPS","USE_HTTPS","argv","includes","protocol","prefix","__NEXT_ASSET_PREFIX","NEXT_BASE_PATH","getHMRPath","nextVersion","mainVersion","parts","join"],"mappings":"AAAA,OAAOA,eAAe,KAAI;AAI1B,SAASC,eAAe,EAAEC,YAAY,QAAQ,iCAAgC;AAC9E,SAASC,cAAc,QAAQ,sBAAqB;AAEpD,yEAAyE,GACzE,MAAMC,gBAAgB;AAEtB,mEAAmE,GACnE,MAAMC,gBAAgB;AAEtB,MAAMC,4BAA4B;AAElC;;;CAGC,GACD,OAAO,MAAMC,iCAAiC;IAC5C,IAAI;QACF,MAAMC,MAAMC;QAEZ,OAAO;YACLC,SAAQC,QAAQ;gBACd,MAAMC,KAAK,IAAIZ,UAAUQ;gBAEzBI,GAAGC,SAAS,GAAG,CAACC;oBACd,IAAI,OAAOA,MAAMC,IAAI,KAAK,UAAU;wBAClC,MAAMA,OAAOC,KAAKC,KAAK,CAACH,MAAMC,IAAI;wBAClC,IACEA,KAAKG,IAAI,KAAK,4BACdH,KAAKI,MAAM,KAAK,0BAChB;4BACAR;wBACF;oBACF;gBACF;gBAEAC,GAAGQ,OAAO,GAAG;gBACX,yCAAyC;gBAC3C;gBAEA,OAAO;oBACLR,GAAGS,KAAK;gBACV;YACF;QACF;IACF,EAAE,OAAOC,GAAG;QACV,OAAO;IACT;AACF,EAAC;AAED,MAAMb,YAAY;IAChB,IAAIc,QAAQC,GAAG,CAACC,wBAAwB,EAAE;QACxC,OAAOF,QAAQC,GAAG,CAACC,wBAAwB;IAC7C;IAEA,MAAMC,OAAOH,QAAQC,GAAG,CAACG,IAAI,IAAI;IACjC,MAAMC,WAAWL,QAAQC,GAAG,CAACK,SAAS,KAAK,UAAUN,QAAQO,IAAI,CAACC,QAAQ,CAAC;IAC3E,MAAMC,WAAWJ,WAAW,QAAQ;IACpC;;;GAGC,GACD,MAAMK,SAASV,QAAQC,GAAG,CAACU,mBAAmB,IAAIX,QAAQC,GAAG,CAACW,cAAc,IAAI;IAEhF,OAAO,GAAGH,SAAS,aAAa,EAAEN,OAAOO,SAASG,cAAc;AAClE;AAEA;;;;CAIC,GACD,MAAMA,aAAa;IACjB,MAAMC,cAAclC;IAEpB,IAAI,CAACkC,aAAa;QAChB,OAAOjC;IACT;IAEA,MAAMkC,cAAcpC,aAAamC,aAAaE,KAAK,CAACC,IAAI,CAAC;IAEzD,OAAOvC,gBAAgBqC,aAAahC,+BAA+B,UAC/DD,gBACAD;AACN"}

package/dist/utilities/parseDocumentID.d.ts

@@ -4,6 +4,9 @@ type ParseDocumentIDArgs = {
     id?: number | string;
     payload: Payload;
 };
-export declare function parseDocumentID({ id, collectionSlug, payload }: ParseDocumentIDArgs): string | number | undefined;
+export declare function parseDocumentID(args: {
+    id: number | string;
+} & ParseDocumentIDArgs): number | string;
+export declare function parseDocumentID(args: ParseDocumentIDArgs): number | string | undefined;
 export {};
 //# sourceMappingURL=parseDocumentID.d.ts.map

package/dist/utilities/parseDocumentID.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parseDocumentID.d.ts","sourceRoot":"","sources":["../../src/utilities/parseDocumentID.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAI1D,KAAK,mBAAmB,GAAG;IACzB,cAAc,EAAE,cAAc,CAAA;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,mBAAmB,+BAInF"}
+{"version":3,"file":"parseDocumentID.d.ts","sourceRoot":"","sources":["../../src/utilities/parseDocumentID.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAI1D,KAAK,mBAAmB,GAAG;IACzB,cAAc,EAAE,cAAc,CAAA;IAC9B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;IACpB,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,wBAAgB,eAAe,CAC7B,IAAI,EAAE;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,mBAAmB,GAClD,MAAM,GAAG,MAAM,CAAA;AAClB,wBAAgB,eAAe,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA"}

package/dist/utilities/parseDocumentID.js

@@ -1,7 +1,13 @@
 import { isNumber } from './isNumber.js';
 export function parseDocumentID({ id, collectionSlug, payload }) {
+    if (id === undefined) {
+        return undefined;
+    }
     const idType = payload.collections[collectionSlug]?.customIDType ?? payload.db.defaultIDType;
-    return id ? idType === 'number' && isNumber(id) ? parseFloat(String(id)) : id : undefined;
+    if (idType === 'number') {
+        return isNumber(id) ? parseFloat(String(id)) : id;
+    }
+    return String(id);
 }
 
 //# sourceMappingURL=parseDocumentID.js.map

package/dist/utilities/parseDocumentID.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/parseDocumentID.ts"],"sourcesContent":["import type { CollectionSlug, Payload } from '../index.js'\n\nimport { isNumber } from './isNumber.js'\n\ntype ParseDocumentIDArgs = {\n  collectionSlug: CollectionSlug\n  id?: number | string\n  payload: Payload\n}\n\nexport function parseDocumentID({ id, collectionSlug, payload }: ParseDocumentIDArgs) {\n  const idType = payload.collections[collectionSlug]?.customIDType ?? payload.db.defaultIDType\n\n  return id ? (idType === 'number' && isNumber(id) ? parseFloat(String(id)) : id) : undefined\n}\n"],"names":["isNumber","parseDocumentID","id","collectionSlug","payload","idType","collections","customIDType","db","defaultIDType","parseFloat","String","undefined"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,gBAAe;AAQxC,OAAO,SAASC,gBAAgB,EAAEC,EAAE,EAAEC,cAAc,EAAEC,OAAO,EAAuB;IAClF,MAAMC,SAASD,QAAQE,WAAW,CAACH,eAAe,EAAEI,gBAAgBH,QAAQI,EAAE,CAACC,aAAa;IAE5F,OAAOP,KAAMG,WAAW,YAAYL,SAASE,MAAMQ,WAAWC,OAAOT,OAAOA,KAAMU;AACpF"}
+{"version":3,"sources":["../../src/utilities/parseDocumentID.ts"],"sourcesContent":["import type { CollectionSlug, Payload } from '../index.js'\n\nimport { isNumber } from './isNumber.js'\n\ntype ParseDocumentIDArgs = {\n  collectionSlug: CollectionSlug\n  id?: number | string\n  payload: Payload\n}\n\nexport function parseDocumentID(\n  args: { id: number | string } & ParseDocumentIDArgs,\n): number | string\nexport function parseDocumentID(args: ParseDocumentIDArgs): number | string | undefined\nexport function parseDocumentID({ id, collectionSlug, payload }: ParseDocumentIDArgs) {\n  if (id === undefined) {\n    return undefined\n  }\n\n  const idType = payload.collections[collectionSlug]?.customIDType ?? payload.db.defaultIDType\n\n  if (idType === 'number') {\n    return isNumber(id) ? parseFloat(String(id)) : id\n  }\n\n  return String(id)\n}\n"],"names":["isNumber","parseDocumentID","id","collectionSlug","payload","undefined","idType","collections","customIDType","db","defaultIDType","parseFloat","String"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,gBAAe;AAYxC,OAAO,SAASC,gBAAgB,EAAEC,EAAE,EAAEC,cAAc,EAAEC,OAAO,EAAuB;IAClF,IAAIF,OAAOG,WAAW;QACpB,OAAOA;IACT;IAEA,MAAMC,SAASF,QAAQG,WAAW,CAACJ,eAAe,EAAEK,gBAAgBJ,QAAQK,EAAE,CAACC,aAAa;IAE5F,IAAIJ,WAAW,UAAU;QACvB,OAAON,SAASE,MAAMS,WAAWC,OAAOV,OAAOA;IACjD;IAEA,OAAOU,OAAOV;AAChB"}

package/dist/utilities/parseParams/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/parseParams/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,eAAO,MAAM,aAAa,UAOzB,CAAA;AAED,eAAO,MAAM,YAAY,UAA6B,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WAAY,SAAS,KAAG,YA2C/C,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/utilities/parseParams/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAA;AACtF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAS1D,MAAM,MAAM,SAAS,GAAG;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,KAAK,CAAC,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,eAAO,MAAM,aAAa,UASzB,CAAA;AAED,eAAO,MAAM,YAAY,UAA6B,CAAA;AAEtD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,WAAY,SAAS,KAAG,YA2C/C,CAAA"}