payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ea6e8f8

package/dist/utilities/getObjectDotNotation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n  const result = path.split('.').reduce((o, i) => o?.[i] as Record<string, unknown>, obj)\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","split","reduce","o","i","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IACA,MAAMC,SAASF,KAAKG,KAAK,CAAC,KAAKC,MAAM,CAAC,CAACC,GAAGC,IAAMD,GAAG,CAACC,EAAE,EAA6BP;IACnF,OAAOG,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}
+{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n\n  let result: unknown = obj\n\n  for (const segment of path.split('.')) {\n    if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {\n      return defaultValue!\n    }\n\n    result = (result as Record<string, unknown>)[segment]\n  }\n\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","segment","split","Object","hasOwn","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IAEA,IAAIC,SAAkBH;IAEtB,KAAK,MAAMI,WAAWH,KAAKI,KAAK,CAAC,KAAM;QACrC,IAAIF,WAAW,QAAQ,OAAOA,WAAW,YAAY,CAACG,OAAOC,MAAM,CAACJ,QAAQC,UAAU;YACpF,OAAOF;QACT;QAEAC,SAAS,AAACA,MAAkC,CAACC,QAAQ;IACvD;IAEA,OAAOD,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}

package/dist/utilities/getRequestOrigin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}
+{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}

package/dist/utilities/getRequestOrigin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { CORSConfig, SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = (cors as CORSConfig).origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAc,AAACP,KAAoBF,OAAO;QAChD,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = cors.origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAcP,KAAKF,OAAO;QAChC,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}

package/dist/utilities/getSafeRedirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAmCH,CAAA"}
+{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAgDH,CAAA"}

package/dist/utilities/getSafeRedirect.js

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };
 

package/dist/utilities/getSafeRedirect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  const redirectPath = redirectTo.trim()\n\n  const hasControlCharacters = [...redirectPath].some((character) => {\n    const code = character.charCodeAt(0)\n    return code <= 31 || code === 127\n  })\n  const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath)\n\n  let parsedRedirect: URL\n  try {\n    parsedRedirect = new URL(redirectPath, 'http://localhost')\n  } catch {\n    return fallbackTo\n  }\n\n  const isSafeRedirect =\n    !hasControlCharacters &&\n    !hasAmbiguousPathPrefix &&\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Must resolve to the same origin after URL parser normalization\n    parsedRedirect.origin === 'http://localhost' &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    !hasControlCharacters &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n    (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:')\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getTopLevelFieldNames.d.ts

@@ -0,0 +1,2 @@
+export declare const getTopLevelFieldNames: (data: object) => Set<string>;
+//# sourceMappingURL=getTopLevelFieldNames.d.ts.map

package/dist/utilities/getTopLevelFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTopLevelFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getTopLevelFieldNames.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,CACa,CAAA"}

package/dist/utilities/getTopLevelFieldNames.js

@@ -0,0 +1,3 @@
+export const getTopLevelFieldNames = (data)=>new Set(Object.keys(data).map((fieldPath)=>fieldPath.split('.', 1)[0]));
+
+//# sourceMappingURL=getTopLevelFieldNames.js.map

package/dist/utilities/getTopLevelFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.ts"],"sourcesContent":["export const getTopLevelFieldNames = (data: object): Set<string> =>\n  new Set(Object.keys(data).map((fieldPath) => fieldPath.split('.', 1)[0]!))\n"],"names":["getTopLevelFieldNames","data","Set","Object","keys","map","fieldPath","split"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,OACpC,IAAIC,IAAIC,OAAOC,IAAI,CAACH,MAAMI,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG"}

package/dist/utilities/getUniqueFieldValue.d.ts

@@ -0,0 +1,28 @@
+import type { DefaultDocumentIDType, Locale } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collection: string;
+    /** Also treat a value taken by a draft-only version as unavailable. */
+    draftsEnabled?: boolean;
+    /** Field name to check for uniqueness. */
+    field: string;
+    /** Exclude this doc from the check when updating; omit for a new doc. */
+    id?: DefaultDocumentIDType;
+    /** Locale to scope the check to, for localized fields. */
+    locale?: Locale['code'];
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /**
+     * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …
+     * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.
+     */
+    startIndex?: number;
+    value: string;
+};
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */
+export declare const getUniqueFieldValue: ({ id, collection, draftsEnabled, field, locale, overrideAccess, req, startIndex, value, }: Args) => Promise<string>;
+export {};
+//# sourceMappingURL=getUniqueFieldValue.d.ts.map

package/dist/utilities/getUniqueFieldValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUniqueFieldValue.d.ts","sourceRoot":"","sources":["../../src/utilities/getUniqueFieldValue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8FAU7B,IAAI,KAAG,OAAO,CAAC,MAAM,CAqBvB,CAAA"}

package/dist/utilities/getUniqueFieldValue.js

@@ -0,0 +1,27 @@
+import { fieldValueExists } from './fieldValueExists.js';
+// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.
+const MAX_SUFFIX_ATTEMPTS = 50;
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */ export const getUniqueFieldValue = async ({ id, collection, draftsEnabled, field, locale, overrideAccess = false, req, startIndex = 0, value })=>{
+    for(let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++){
+        const candidate = index === 0 ? value : `${value}-${index}`;
+        const taken = await fieldValueExists({
+            id,
+            collection,
+            draftsEnabled,
+            field,
+            locale,
+            overrideAccess,
+            req,
+            value: candidate
+        });
+        if (!taken) {
+            return candidate;
+        }
+    }
+    return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`;
+};
+
+//# sourceMappingURL=getUniqueFieldValue.js.map

package/dist/utilities/getUniqueFieldValue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getUniqueFieldValue.ts"],"sourcesContent":["import type { DefaultDocumentIDType, Locale } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldValueExists } from './fieldValueExists.js'\n\ntype Args = {\n  collection: string\n  /** Also treat a value taken by a draft-only version as unavailable. */\n  draftsEnabled?: boolean\n  /** Field name to check for uniqueness. */\n  field: string\n  /** Exclude this doc from the check when updating; omit for a new doc. */\n  id?: DefaultDocumentIDType\n  /** Locale to scope the check to, for localized fields. */\n  locale?: Locale['code']\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /**\n   * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …\n   * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.\n   */\n  startIndex?: number\n  value: string\n}\n\n// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.\nconst MAX_SUFFIX_ATTEMPTS = 50\n\n/**\n * Returns the first available value for `field` in `collection` — either the bare `value` or a\n * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.\n */\nexport const getUniqueFieldValue = async ({\n  id,\n  collection,\n  draftsEnabled,\n  field,\n  locale,\n  overrideAccess = false,\n  req,\n  startIndex = 0,\n  value,\n}: Args): Promise<string> => {\n  for (let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++) {\n    const candidate = index === 0 ? value : `${value}-${index}`\n\n    const taken = await fieldValueExists({\n      id,\n      collection,\n      draftsEnabled,\n      field,\n      locale,\n      overrideAccess,\n      req,\n      value: candidate,\n    })\n\n    if (!taken) {\n      return candidate\n    }\n  }\n\n  return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`\n}\n"],"names":["fieldValueExists","MAX_SUFFIX_ATTEMPTS","getUniqueFieldValue","id","collection","draftsEnabled","field","locale","overrideAccess","req","startIndex","value","index","candidate","taken"],"mappings":"AAGA,SAASA,gBAAgB,QAAQ,wBAAuB;AAsBxD,oGAAoG;AACpG,MAAMC,sBAAsB;AAE5B;;;CAGC,GACD,OAAO,MAAMC,sBAAsB,OAAO,EACxCC,EAAE,EACFC,UAAU,EACVC,aAAa,EACbC,KAAK,EACLC,MAAM,EACNC,iBAAiB,KAAK,EACtBC,GAAG,EACHC,aAAa,CAAC,EACdC,KAAK,EACA;IACL,IAAK,IAAIC,QAAQF,YAAYE,SAASF,aAAaT,qBAAqBW,QAAS;QAC/E,MAAMC,YAAYD,UAAU,IAAID,QAAQ,GAAGA,MAAM,CAAC,EAAEC,OAAO;QAE3D,MAAME,QAAQ,MAAMd,iBAAiB;YACnCG;YACAC;YACAC;YACAC;YACAC;YACAC;YACAC;YACAE,OAAOE;QACT;QAEA,IAAI,CAACC,OAAO;YACV,OAAOD;QACT;IACF;IAEA,OAAO,GAAGF,MAAM,CAAC,EAAED,aAAaT,qBAAqB;AACvD,EAAC"}

package/dist/utilities/getVirtualFieldNames.d.ts

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from '../config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export declare function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export declare function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export declare function stripVirtualFields(data: Record<string, unknown>, virtualFieldNames: string[]): Record<string, unknown>;
+//# sourceMappingURL=getVirtualFieldNames.d.ts.map

package/dist/utilities/getVirtualFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getVirtualFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getVirtualFieldNames.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/utilities/getVirtualFieldNames.js

@@ -0,0 +1,35 @@
+import { fieldIsVirtual } from '../fields/config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */ export function getCollectionVirtualFieldNames(config, slug) {
+    const collection = config.collections.find((c)=>c.slug === slug);
+    if (!collection) {
+        return [];
+    }
+    return collection.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */ export function getGlobalVirtualFieldNames(config, slug) {
+    const global = config.globals.find((g)=>g.slug === slug);
+    if (!global) {
+        return [];
+    }
+    return global.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */ export function stripVirtualFields(data, virtualFieldNames) {
+    if (virtualFieldNames.length === 0) {
+        return data;
+    }
+    const stripped = {
+        ...data
+    };
+    for (const name of virtualFieldNames){
+        delete stripped[name];
+    }
+    return stripped;
+}
+
+//# sourceMappingURL=getVirtualFieldNames.js.map

package/dist/utilities/getVirtualFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getVirtualFieldNames.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { fieldIsVirtual } from '../fields/config/types.js'\n\n/**\n * Returns the names of all top-level virtual fields for a given collection slug.\n */\nexport function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const collection = config.collections.find((c) => c.slug === slug)\n\n  if (!collection) {\n    return []\n  }\n\n  return collection.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Returns the names of all top-level virtual fields for a given global slug.\n */\nexport function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const global = config.globals.find((g) => g.slug === slug)\n\n  if (!global) {\n    return []\n  }\n\n  return global.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Strips virtual field values from a data object given a list of virtual field names.\n */\nexport function stripVirtualFields(\n  data: Record<string, unknown>,\n  virtualFieldNames: string[],\n): Record<string, unknown> {\n  if (virtualFieldNames.length === 0) {\n    return data\n  }\n\n  const stripped = { ...data }\n\n  for (const name of virtualFieldNames) {\n    delete stripped[name]\n  }\n\n  return stripped\n}\n"],"names":["fieldIsVirtual","getCollectionVirtualFieldNames","config","slug","collection","collections","find","c","flattenedFields","filter","field","map","name","getGlobalVirtualFieldNames","global","globals","g","stripVirtualFields","data","virtualFieldNames","length","stripped"],"mappings":"AAEA,SAASA,cAAc,QAAQ,4BAA2B;AAE1D;;CAEC,GACD,OAAO,SAASC,+BAA+BC,MAAuB,EAAEC,IAAY;IAClF,MAAMC,aAAaF,OAAOG,WAAW,CAACC,IAAI,CAAC,CAACC,IAAMA,EAAEJ,IAAI,KAAKA;IAE7D,IAAI,CAACC,YAAY;QACf,OAAO,EAAE;IACX;IAEA,OAAOA,WAAWI,eAAe,CAC9BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASC,2BAA2BX,MAAuB,EAAEC,IAAY;IAC9E,MAAMW,SAASZ,OAAOa,OAAO,CAACT,IAAI,CAAC,CAACU,IAAMA,EAAEb,IAAI,KAAKA;IAErD,IAAI,CAACW,QAAQ;QACX,OAAO,EAAE;IACX;IAEA,OAAOA,OAAON,eAAe,CAC1BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASK,mBACdC,IAA6B,EAC7BC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,MAAMG,WAAW;QAAE,GAAGH,IAAI;IAAC;IAE3B,KAAK,MAAMN,QAAQO,kBAAmB;QACpC,OAAOE,QAAQ,CAACT,KAAK;IACvB;IAEA,OAAOS;AACT"}

package/dist/utilities/handleEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAmNnB,CAAA"}
+{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA4BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAyNnB,CAAA"}

package/dist/utilities/handleEndpoints.js

@@ -1,8 +1,9 @@
-import { status as httpStatus } from 'http-status';
 import { match } from 'path-to-regexp';
-import { createPayloadRequest } from './createPayloadRequest.js';
-import { formatAdminURL } from './formatAdminURL.js';
+import { assertBranchReadable } from '../branching/assertBranchReadable.js';
+import { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js';
+import { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js';
 import { headersWithCors } from './headersWithCors.js';
+import { httpStatus } from './httpStatus.js';
 import { mergeHeaders } from './mergeHeaders.js';
 import { routeError } from './routeError.js';
 const notFoundResponse = (req, pathname)=>{
@@ -69,8 +70,7 @@ const notFoundResponse = (req, pathname)=>{
         } else if (request.headers.get('Content-Type') === 'application/json') {
             // May not be supported by every endpoint
             data = await request.json();
-            // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale
-            // => add to searchParams
+            // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.
             if (data?.locale) {
                 url += `?locale=${data.locale}`;
             }
@@ -97,19 +97,27 @@ const notFoundResponse = (req, pathname)=>{
         return response;
     }
     try {
-        req = await createPayloadRequest({
+        req = await createPayloadRequestFromWebRequest({
             canSetHeaders: true,
             config: incomingConfig,
             payloadInstanceCacheKey,
             request
         });
+        // Here rather than inside `createPayloadRequest`: the check needs the resolved user,
+        // and it has to be able to fail as a formatted response, which means the request has
+        // to exist first. §12.5 — a caller may not read through a branch they cannot see.
+        await assertBranchReadable({
+            req
+        });
         const { payload } = req;
         const { config } = payload;
-        const pathname = path ?? new URL(req.url).pathname;
-        const baseAPIPath = formatAdminURL({
+        const rawPathname = path ?? new URL(req.url).pathname;
+        const pathname = stripTrailingSlash(rawPathname);
+        const rawBaseAPIPath = formatAdminURL({
             apiRoute: config.routes.api,
             path: ''
         });
+        const baseAPIPath = stripTrailingSlash(rawBaseAPIPath);
         if (!pathname.startsWith(baseAPIPath)) {
             return notFoundResponse(req, pathname);
         }

package/dist/utilities/handleEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequest } from './createPayloadRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale\n      // => add to searchParams\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const pathname = path ?? new URL(req.url!).pathname\n    const baseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequest","formatAdminURL","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","baseAPIPath","apiRoute","routes","api","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAT,QAAQC,WAAWiB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQT,OAAO;QACtC,MAAMgB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAIlB,MAAMU,QAAQV,GAAG;QACrB,IAAImB,OAAYC;QAEhB,IAAIV,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCtB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEqB,QAAQ;QAClC,OAAO,IAAIX,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQb,IAAI;YAEzB,0GAA0G;YAC1G,yBAAyB;YACzB,IAAIsB,MAAMI,QAAQ;gBAChBvB,OAAO,CAAC,QAAQ,EAAEmB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBxB,OAAO,CAAC,gBAAgB,EAAEmB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM/B,MAAM,IAAIgC,QAAQ1B,KAAK;YAC3BC,SAASe;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChFzB,IAAIyB,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMN,qBAAqB;YAC/BwC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMlC,WAAWa,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACnD,MAAMmC,cAAczC,eAAe;YACjC0C,UAAUzB,OAAO0B,MAAM,CAACC,GAAG;YAC3BzB,MAAM;QACR;QAEA,IAAI,CAACb,SAASuC,UAAU,CAACJ,cAAc;YACrC,OAAOrC,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAIwC,mBAAmBxC,SAASyC,OAAO,CAACN,aAAa;QAErD,IAAIO,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAeb,QAAQc,OAAO,CAACrC,MAAM,CAACsC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAIZ,QAAQkB,WAAW,CAACN,WAAW,EAAE;gBAC1C7B,aAAaiB,QAAQkB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC1C,OAAO0C,SAAS;QAEpD,IAAIpC,YAAY;YACdoC,YAAYpC,WAAWN,MAAM,CAAC0C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAExB,WAAWN,MAAM,CAACwC,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOpD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEoC,cAAc,CAAC,EAAEvD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAT,QAAQC,WAAWgE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAAStC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMsC,cAAcjE,MAAMgE,SAAS3C,IAAI,EAAE;gBAAE6C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA7D,IAAI8D,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI7C,YAAY;gBACdlB,IAAI8D,WAAW,CAAC5C,UAAU,GAAGA,WAAWN,MAAM,CAACwC,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBhD,IAAI8D,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZxC,UAAUwC,SAASxC,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAT,QAAQ;gBACV;YAEJ;YAEA,OAAOQ,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASgC,IAAI,EAAE;YACjC1D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIkE,eAAe,IAAI,IAAI1D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAT,QAAQ0C,SAAS1C,MAAM;YACvB4E,YAAYlC,SAASkC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOtE,WAAW;YAChBoB;YACAN,QAAQC;YACRwD;YACArE,KAAKA;QACP;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { assertBranchReadable } from '../branching/assertBranchReadable.js'\nimport { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js'\nimport { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { httpStatus } from './httpStatus.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequestFromWebRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    // Here rather than inside `createPayloadRequest`: the check needs the resolved user,\n    // and it has to be able to fail as a formatted response, which means the request has\n    // to exist first. §12.5 — a caller may not read through a branch they cannot see.\n    await assertBranchReadable({ req })\n\n    const { payload } = req\n    const { config } = payload\n\n    const rawPathname = path ?? new URL(req.url!).pathname\n    const pathname = stripTrailingSlash(rawPathname)\n    const rawBaseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n    const baseAPIPath = stripTrailingSlash(rawBaseAPIPath)\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["match","assertBranchReadable","createPayloadRequestFromWebRequest","formatAdminURL","stripTrailingSlash","headersWithCors","httpStatus","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","status","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","rawPathname","rawBaseAPIPath","apiRoute","routes","api","baseAPIPath","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,uCAAsC;AAC3E,SAASC,kCAAkC,QAAQ,0CAAyC;AAC5F,SAASC,cAAc,EAAEC,kBAAkB,QAAQ,sBAAqB;AACxE,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASZ,gBAAgB;YACvBY,SAAS,IAAIC;YACbR;QACF;QACAS,QAAQb,WAAWc,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIlB;IACJ,IAAImB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQV,OAAO,CAACe,GAAG,CAAC,sCAAsC,SACzDL,QAAQV,OAAO,CAACe,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQV,OAAO;QACtC,MAAMiB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAInB,MAAMW,QAAQX,GAAG;QACrB,IAAIoB,OAAYC;QAEhB,IAAIV,QAAQV,OAAO,CAACe,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCvB,MAAM,GAAGW,QAAQX,GAAG,CAAC,CAAC,EAAEsB,QAAQ;QAClC,OAAO,IAAIX,QAAQV,OAAO,CAACe,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQd,IAAI;YAEzB,wFAAwF;YACxF,IAAIuB,MAAMI,QAAQ;gBAChBxB,OAAO,CAAC,QAAQ,EAAEoB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBzB,OAAO,CAAC,gBAAgB,EAAEoB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAMhC,MAAM,IAAIiC,QAAQ3B,KAAK;YAC3BC,SAASgB;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChF1B,IAAI0B,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAASjB;QACX;QAEA,OAAOkC;IACT;IAEA,IAAI;QACFlC,MAAM,MAAMR,mCAAmC;YAC7C2C,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,qFAAqF;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,MAAM1B,qBAAqB;YAAES;QAAI;QAEjC,MAAM,EAAEoC,OAAO,EAAE,GAAGpC;QACpB,MAAM,EAAEa,MAAM,EAAE,GAAGuB;QAEnB,MAAMC,cAActB,QAAQ,IAAIV,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACtD,MAAMA,WAAWP,mBAAmB2C;QACpC,MAAMC,iBAAiB7C,eAAe;YACpC8C,UAAU1B,OAAO2B,MAAM,CAACC,GAAG;YAC3B1B,MAAM;QACR;QACA,MAAM2B,cAAchD,mBAAmB4C;QAEvC,IAAI,CAACrC,SAAS0C,UAAU,CAACD,cAAc;YACrC,OAAO3C,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAI2C,mBAAmB3C,SAAS4C,OAAO,CAACH,aAAa;QAErD,IAAII,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAef,QAAQgB,OAAO,CAACvC,MAAM,CAACwC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAId,QAAQoB,WAAW,CAACN,WAAW,EAAE;gBAC1C/B,aAAaiB,QAAQoB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC5C,OAAO4C,SAAS;QAEpD,IAAItC,YAAY;YACdsC,YAAYtC,WAAWN,MAAM,CAAC4C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAE1B,WAAWN,MAAM,CAAC0C,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOvD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAIoB,MAAM,EAAEsC,cAAc,CAAC,EAAE1D,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASZ,gBAAgB;oBACvBY,SAAS,IAAIC;oBACbR;gBACF;gBACAS,QAAQb,WAAW+D,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAASxC,MAAM,KAAKpB,IAAIoB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMwC,cAAcvE,MAAMsE,SAAS7C,IAAI,EAAE;gBAAE+C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEAhE,IAAIiE,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI/C,YAAY;gBACdnB,IAAIiE,WAAW,CAAC9C,UAAU,GAAGA,WAAWN,MAAM,CAAC0C,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBnD,IAAIiE,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZ1C,UAAU0C,SAAS1C,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIlB,IAAIoB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOnB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASZ,gBAAgB;wBACvBY,SAAS,IAAIC;wBACbR;oBACF;oBACAS,QAAQ;gBACV;YAEJ;YAEA,OAAOV,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMiC,WAAW,MAAMhB,QAAQlB;QAE/B,OAAO,IAAIE,SAASgC,SAASkC,IAAI,EAAE;YACjC7D,SAASZ,gBAAgB;gBACvBY,SAASV,aAAaG,IAAIqE,eAAe,IAAI,IAAI7D,WAAW0B,SAAS3B,OAAO;gBAC5EP;YACF;YACAS,QAAQyB,SAASzB,MAAM;YACvB6D,YAAYpC,SAASoC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOzE,WAAW;YAChBqB;YACAN,QAAQC;YACR0D;YACAxE,KAAKA;QACP;IACF;AACF,EAAC"}

package/dist/utilities/headersWithCors.js

@@ -20,7 +20,7 @@ export const headersWithCors = ({ headers, req })=>{
             if (typeof cors === 'object' && 'headers' in cors) {
                 headers.set('Access-Control-Allow-Headers', [
                     ...defaultAllowedHeaders,
-                    ...cors.headers
+                    ...cors.headers ?? []
                 ].filter(Boolean).join(', '));
             } else {
                 headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '));

package/dist/utilities/headersWithCors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...cors.headers].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA0BL,KAAKF,OAAO;iBAAC,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAErE,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...(cors.headers ?? [])].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA2BL,KAAKF,OAAO,IAAI,EAAE;iBAAE,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAE7E,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}

package/dist/utilities/httpStatus.d.ts

@@ -0,0 +1,18 @@
+/** HTTP status codes used by Payload. */
+export declare const httpStatus: {
+    readonly BAD_REQUEST: 400;
+    readonly CONFLICT: 409;
+    readonly CREATED: 201;
+    readonly FORBIDDEN: 403;
+    readonly INTERNAL_SERVER_ERROR: 500;
+    readonly LOCKED: 423;
+    readonly NOT_FOUND: 404;
+    readonly NOT_IMPLEMENTED: 501;
+    readonly OK: 200;
+    readonly PARTIAL_CONTENT: 206;
+    readonly REQUEST_ENTITY_TOO_LARGE: 413;
+    readonly REQUESTED_RANGE_NOT_SATISFIABLE: 416;
+    readonly UNAUTHORIZED: 401;
+    readonly UNPROCESSABLE_ENTITY: 422;
+};
+//# sourceMappingURL=httpStatus.d.ts.map

package/dist/utilities/httpStatus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"httpStatus.d.ts","sourceRoot":"","sources":["../../src/utilities/httpStatus.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC,eAAO,MAAM,UAAU;aACrB,WAAW,EAAE,GAAG;aAChB,QAAQ,EAAE,GAAG;aACb,OAAO,EAAE,GAAG;aACZ,SAAS,EAAE,GAAG;aACd,qBAAqB,EAAE,GAAG;aAC1B,MAAM,EAAE,GAAG;aACX,SAAS,EAAE,GAAG;aACd,eAAe,EAAE,GAAG;aACpB,EAAE,EAAE,GAAG;aACP,eAAe,EAAE,GAAG;aACpB,wBAAwB,EAAE,GAAG;aAC7B,+BAA+B,EAAE,GAAG;aACpC,YAAY,EAAE,GAAG;aACjB,oBAAoB,EAAE,GAAG;CACjB,CAAA"}

package/dist/utilities/httpStatus.js

@@ -0,0 +1,18 @@
+/** HTTP status codes used by Payload. */ export const httpStatus = {
+    BAD_REQUEST: 400,
+    CONFLICT: 409,
+    CREATED: 201,
+    FORBIDDEN: 403,
+    INTERNAL_SERVER_ERROR: 500,
+    LOCKED: 423,
+    NOT_FOUND: 404,
+    NOT_IMPLEMENTED: 501,
+    OK: 200,
+    PARTIAL_CONTENT: 206,
+    REQUEST_ENTITY_TOO_LARGE: 413,
+    REQUESTED_RANGE_NOT_SATISFIABLE: 416,
+    UNAUTHORIZED: 401,
+    UNPROCESSABLE_ENTITY: 422
+};
+
+//# sourceMappingURL=httpStatus.js.map

package/dist/utilities/httpStatus.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/httpStatus.ts"],"sourcesContent":["/** HTTP status codes used by Payload. */\nexport const httpStatus = {\n  BAD_REQUEST: 400,\n  CONFLICT: 409,\n  CREATED: 201,\n  FORBIDDEN: 403,\n  INTERNAL_SERVER_ERROR: 500,\n  LOCKED: 423,\n  NOT_FOUND: 404,\n  NOT_IMPLEMENTED: 501,\n  OK: 200,\n  PARTIAL_CONTENT: 206,\n  REQUEST_ENTITY_TOO_LARGE: 413,\n  REQUESTED_RANGE_NOT_SATISFIABLE: 416,\n  UNAUTHORIZED: 401,\n  UNPROCESSABLE_ENTITY: 422,\n} as const\n"],"names":["httpStatus","BAD_REQUEST","CONFLICT","CREATED","FORBIDDEN","INTERNAL_SERVER_ERROR","LOCKED","NOT_FOUND","NOT_IMPLEMENTED","OK","PARTIAL_CONTENT","REQUEST_ENTITY_TOO_LARGE","REQUESTED_RANGE_NOT_SATISFIABLE","UNAUTHORIZED","UNPROCESSABLE_ENTITY"],"mappings":"AAAA,uCAAuC,GACvC,OAAO,MAAMA,aAAa;IACxBC,aAAa;IACbC,UAAU;IACVC,SAAS;IACTC,WAAW;IACXC,uBAAuB;IACvBC,QAAQ;IACRC,WAAW;IACXC,iBAAiB;IACjBC,IAAI;IACJC,iBAAiB;IACjBC,0BAA0B;IAC1BC,iCAAiC;IACjCC,cAAc;IACdC,sBAAsB;AACxB,EAAU"}

package/dist/utilities/initTransaction.d.ts

@@ -1,5 +1,8 @@
 import type { MarkRequired } from 'ts-essentials';
 import type { PayloadRequest } from '../types/index.js';
+export declare function hasActiveTransaction({ req, }: {
+    req: Pick<PayloadRequest, 'transactionID'>;
+}): Promise<boolean>;
 /**
  * Starts a new transaction using the db adapter with a random id and then assigns it to the req.transaction
  * @returns true if beginning a transaction and false when req already has a transaction to use

package/dist/utilities/initTransaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"initTransaction.d.ts","sourceRoot":"","sources":["../../src/utilities/initTransaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,GACpD,OAAO,CAAC,OAAO,CAAC,CAwBlB"}
+{"version":3,"file":"initTransaction.d.ts","sourceRoot":"","sources":["../../src/utilities/initTransaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAEvD,wBAAsB,oBAAoB,CAAC,EACzC,GAAG,GACJ,EAAE;IACD,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAA;CAC3C,GAAG,OAAO,CAAC,OAAO,CAAC,CAInB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,SAAS,CAAC,GACpD,OAAO,CAAC,OAAO,CAAC,CA6DlB"}

package/dist/utilities/initTransaction.js

@@ -1,3 +1,7 @@
+export async function hasActiveTransaction({ req }) {
+    const transactionID = await req.transactionID;
+    return typeof transactionID === 'number' || typeof transactionID === 'string';
+}
 /**
  * Starts a new transaction using the db adapter with a random id and then assigns it to the req.transaction
  * @returns true if beginning a transaction and false when req already has a transaction to use
@@ -5,7 +9,18 @@
     const { payload, transactionID } = req;
     if (transactionID instanceof Promise) {
         // wait for whoever else is already creating the transaction
-        await transactionID;
+        let resolvedTransactionID;
+        try {
+            resolvedTransactionID = await transactionID;
+        } catch (error) {
+            if (req.transactionID === transactionID) {
+                delete req.transactionID;
+            }
+            throw error;
+        }
+        if (!resolvedTransactionID && req.transactionID === transactionID) {
+            delete req.transactionID;
+        }
         return false;
     }
     if (transactionID) {
@@ -14,13 +29,30 @@
     }
     if (typeof payload.db.beginTransaction === 'function') {
         // create a new transaction
-        req.transactionID = payload.db.beginTransaction().then((transactionID)=>{
-            if (transactionID) {
-                req.transactionID = transactionID;
+        const pendingTransactionID = payload.db.beginTransaction();
+        const pendingTransactionToken = pendingTransactionID;
+        req.transactionID = pendingTransactionToken;
+        let resolvedTransactionID;
+        try {
+            resolvedTransactionID = await pendingTransactionID;
+        } catch (error) {
+            if (req.transactionID === pendingTransactionToken) {
+                delete req.transactionID;
             }
-            return transactionID;
-        });
-        return !!await req.transactionID;
+            throw error;
+        }
+        if (!resolvedTransactionID && req.transactionID === pendingTransactionToken) {
+            delete req.transactionID;
+        }
+        if (!resolvedTransactionID) {
+            return false;
+        }
+        if (req.transactionID !== pendingTransactionToken) {
+            await payload.db.rollbackTransaction(resolvedTransactionID);
+            return false;
+        }
+        req.transactionID = resolvedTransactionID;
+        return true;
     }
     return false;
 }

package/dist/utilities/initTransaction.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/initTransaction.ts"],"sourcesContent":["import type { MarkRequired } from 'ts-essentials'\n\nimport type { PayloadRequest } from '../types/index.js'\n\n/**\n * Starts a new transaction using the db adapter with a random id and then assigns it to the req.transaction\n * @returns true if beginning a transaction and false when req already has a transaction to use\n */\nexport async function initTransaction(\n  req: MarkRequired<Partial<PayloadRequest>, 'payload'>,\n): Promise<boolean> {\n  const { payload, transactionID } = req\n  if (transactionID instanceof Promise) {\n    // wait for whoever else is already creating the transaction\n    await transactionID\n    return false\n  }\n\n  if (transactionID) {\n    // we already have a transaction, we're not in charge of committing it\n    return false\n  }\n  if (typeof payload.db.beginTransaction === 'function') {\n    // create a new transaction\n    req.transactionID = payload.db.beginTransaction().then((transactionID) => {\n      if (transactionID) {\n        req.transactionID = transactionID\n      }\n\n      return transactionID!\n    })\n    return !!(await req.transactionID)\n  }\n  return false\n}\n"],"names":["initTransaction","req","payload","transactionID","Promise","db","beginTransaction","then"],"mappings":"AAIA;;;CAGC,GACD,OAAO,eAAeA,gBACpBC,GAAqD;IAErD,MAAM,EAAEC,OAAO,EAAEC,aAAa,EAAE,GAAGF;IACnC,IAAIE,yBAAyBC,SAAS;QACpC,4DAA4D;QAC5D,MAAMD;QACN,OAAO;IACT;IAEA,IAAIA,eAAe;QACjB,sEAAsE;QACtE,OAAO;IACT;IACA,IAAI,OAAOD,QAAQG,EAAE,CAACC,gBAAgB,KAAK,YAAY;QACrD,2BAA2B;QAC3BL,IAAIE,aAAa,GAAGD,QAAQG,EAAE,CAACC,gBAAgB,GAAGC,IAAI,CAAC,CAACJ;YACtD,IAAIA,eAAe;gBACjBF,IAAIE,aAAa,GAAGA;YACtB;YAEA,OAAOA;QACT;QACA,OAAO,CAAC,CAAE,MAAMF,IAAIE,aAAa;IACnC;IACA,OAAO;AACT"}
+{"version":3,"sources":["../../src/utilities/initTransaction.ts"],"sourcesContent":["import type { MarkRequired } from 'ts-essentials'\n\nimport type { PayloadRequest } from '../types/index.js'\n\nexport async function hasActiveTransaction({\n  req,\n}: {\n  req: Pick<PayloadRequest, 'transactionID'>\n}): Promise<boolean> {\n  const transactionID = await req.transactionID\n\n  return typeof transactionID === 'number' || typeof transactionID === 'string'\n}\n\n/**\n * Starts a new transaction using the db adapter with a random id and then assigns it to the req.transaction\n * @returns true if beginning a transaction and false when req already has a transaction to use\n */\nexport async function initTransaction(\n  req: MarkRequired<Partial<PayloadRequest>, 'payload'>,\n): Promise<boolean> {\n  const { payload, transactionID } = req\n  if (transactionID instanceof Promise) {\n    // wait for whoever else is already creating the transaction\n    let resolvedTransactionID: Awaited<typeof transactionID>\n\n    try {\n      resolvedTransactionID = await transactionID\n    } catch (error) {\n      if (req.transactionID === transactionID) {\n        delete req.transactionID\n      }\n      throw error\n    }\n\n    if (!resolvedTransactionID && req.transactionID === transactionID) {\n      delete req.transactionID\n    }\n    return false\n  }\n\n  if (transactionID) {\n    // we already have a transaction, we're not in charge of committing it\n    return false\n  }\n  if (typeof payload.db.beginTransaction === 'function') {\n    // create a new transaction\n    const pendingTransactionID = payload.db.beginTransaction()\n    const pendingTransactionToken = pendingTransactionID as Promise<number | string>\n\n    req.transactionID = pendingTransactionToken\n    let resolvedTransactionID: Awaited<typeof pendingTransactionID>\n\n    try {\n      resolvedTransactionID = await pendingTransactionID\n    } catch (error) {\n      if (req.transactionID === pendingTransactionToken) {\n        delete req.transactionID\n      }\n      throw error\n    }\n\n    if (!resolvedTransactionID && req.transactionID === pendingTransactionToken) {\n      delete req.transactionID\n    }\n\n    if (!resolvedTransactionID) {\n      return false\n    }\n\n    if (req.transactionID !== pendingTransactionToken) {\n      await payload.db.rollbackTransaction(resolvedTransactionID)\n\n      return false\n    }\n\n    req.transactionID = resolvedTransactionID\n\n    return true\n  }\n  return false\n}\n"],"names":["hasActiveTransaction","req","transactionID","initTransaction","payload","Promise","resolvedTransactionID","error","db","beginTransaction","pendingTransactionID","pendingTransactionToken","rollbackTransaction"],"mappings":"AAIA,OAAO,eAAeA,qBAAqB,EACzCC,GAAG,EAGJ;IACC,MAAMC,gBAAgB,MAAMD,IAAIC,aAAa;IAE7C,OAAO,OAAOA,kBAAkB,YAAY,OAAOA,kBAAkB;AACvE;AAEA;;;CAGC,GACD,OAAO,eAAeC,gBACpBF,GAAqD;IAErD,MAAM,EAAEG,OAAO,EAAEF,aAAa,EAAE,GAAGD;IACnC,IAAIC,yBAAyBG,SAAS;QACpC,4DAA4D;QAC5D,IAAIC;QAEJ,IAAI;YACFA,wBAAwB,MAAMJ;QAChC,EAAE,OAAOK,OAAO;YACd,IAAIN,IAAIC,aAAa,KAAKA,eAAe;gBACvC,OAAOD,IAAIC,aAAa;YAC1B;YACA,MAAMK;QACR;QAEA,IAAI,CAACD,yBAAyBL,IAAIC,aAAa,KAAKA,eAAe;YACjE,OAAOD,IAAIC,aAAa;QAC1B;QACA,OAAO;IACT;IAEA,IAAIA,eAAe;QACjB,sEAAsE;QACtE,OAAO;IACT;IACA,IAAI,OAAOE,QAAQI,EAAE,CAACC,gBAAgB,KAAK,YAAY;QACrD,2BAA2B;QAC3B,MAAMC,uBAAuBN,QAAQI,EAAE,CAACC,gBAAgB;QACxD,MAAME,0BAA0BD;QAEhCT,IAAIC,aAAa,GAAGS;QACpB,IAAIL;QAEJ,IAAI;YACFA,wBAAwB,MAAMI;QAChC,EAAE,OAAOH,OAAO;YACd,IAAIN,IAAIC,aAAa,KAAKS,yBAAyB;gBACjD,OAAOV,IAAIC,aAAa;YAC1B;YACA,MAAMK;QACR;QAEA,IAAI,CAACD,yBAAyBL,IAAIC,aAAa,KAAKS,yBAAyB;YAC3E,OAAOV,IAAIC,aAAa;QAC1B;QAEA,IAAI,CAACI,uBAAuB;YAC1B,OAAO;QACT;QAEA,IAAIL,IAAIC,aAAa,KAAKS,yBAAyB;YACjD,MAAMP,QAAQI,EAAE,CAACI,mBAAmB,CAACN;YAErC,OAAO;QACT;QAEAL,IAAIC,aAAa,GAAGI;QAEpB,OAAO;IACT;IACA,OAAO;AACT"}

package/dist/utilities/isErrorPublic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isErrorPublic.d.ts","sourceRoot":"","sources":["../../src/utilities/isErrorPublic.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAOzD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,WAiBlE"}
+{"version":3,"file":"isErrorPublic.d.ts","sourceRoot":"","sources":["../../src/utilities/isErrorPublic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AASzD;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,WAiBlE"}

package/dist/utilities/isErrorPublic.js

@@ -1,4 +1,4 @@
-import { status as httpStatus } from 'http-status';
+import { httpStatus } from './httpStatus.js';
 /**
  * Determines if an error should be shown to the user.
  */ export function isErrorPublic(error, config) {

package/dist/utilities/isErrorPublic.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/isErrorPublic.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\n\nimport type { SanitizedConfig } from '../config/types.js'\n\ntype PayloadError = {\n  isPublic?: boolean\n  status?: number\n} & Error\n\n/**\n * Determines if an error should be shown to the user.\n */\nexport function isErrorPublic(error: Error, config: SanitizedConfig) {\n  const payloadError = error as PayloadError\n\n  if (config.debug) {\n    return true\n  }\n  if (payloadError.isPublic === true) {\n    return true\n  }\n  if (payloadError.isPublic === false) {\n    return false\n  }\n  if (payloadError.status && payloadError.status !== httpStatus.INTERNAL_SERVER_ERROR) {\n    return true\n  }\n\n  return false\n}\n"],"names":["status","httpStatus","isErrorPublic","error","config","payloadError","debug","isPublic","INTERNAL_SERVER_ERROR"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AASlD;;CAEC,GACD,OAAO,SAASC,cAAcC,KAAY,EAAEC,MAAuB;IACjE,MAAMC,eAAeF;IAErB,IAAIC,OAAOE,KAAK,EAAE;QAChB,OAAO;IACT;IACA,IAAID,aAAaE,QAAQ,KAAK,MAAM;QAClC,OAAO;IACT;IACA,IAAIF,aAAaE,QAAQ,KAAK,OAAO;QACnC,OAAO;IACT;IACA,IAAIF,aAAaL,MAAM,IAAIK,aAAaL,MAAM,KAAKC,WAAWO,qBAAqB,EAAE;QACnF,OAAO;IACT;IAEA,OAAO;AACT"}
+{"version":3,"sources":["../../src/utilities/isErrorPublic.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { httpStatus } from './httpStatus.js'\n\ntype PayloadError = {\n  isPublic?: boolean\n  status?: number\n} & Error\n\n/**\n * Determines if an error should be shown to the user.\n */\nexport function isErrorPublic(error: Error, config: SanitizedConfig) {\n  const payloadError = error as PayloadError\n\n  if (config.debug) {\n    return true\n  }\n  if (payloadError.isPublic === true) {\n    return true\n  }\n  if (payloadError.isPublic === false) {\n    return false\n  }\n  if (payloadError.status && payloadError.status !== httpStatus.INTERNAL_SERVER_ERROR) {\n    return true\n  }\n\n  return false\n}\n"],"names":["httpStatus","isErrorPublic","error","config","payloadError","debug","isPublic","status","INTERNAL_SERVER_ERROR"],"mappings":"AAEA,SAASA,UAAU,QAAQ,kBAAiB;AAO5C;;CAEC,GACD,OAAO,SAASC,cAAcC,KAAY,EAAEC,MAAuB;IACjE,MAAMC,eAAeF;IAErB,IAAIC,OAAOE,KAAK,EAAE;QAChB,OAAO;IACT;IACA,IAAID,aAAaE,QAAQ,KAAK,MAAM;QAClC,OAAO;IACT;IACA,IAAIF,aAAaE,QAAQ,KAAK,OAAO;QACnC,OAAO;IACT;IACA,IAAIF,aAAaG,MAAM,IAAIH,aAAaG,MAAM,KAAKP,WAAWQ,qBAAqB,EAAE;QACnF,OAAO;IACT;IAEA,OAAO;AACT"}