payload 4.0.0-internal.e7d4ebc → 4.0.0-internal.ec73d44

package/dist/utilities/getFieldPermissions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getFieldPermissions.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type {\n  SanitizedDocumentPermissions,\n  SanitizedFieldPermissions,\n  SanitizedFieldsPermissions,\n} from '../auth/types.js'\nimport type { ClientField, Field } from '../fields/config/types.js'\nimport type { Operation } from '../types/index.js'\n\n/**\n * Gets read and operation-level permissions for a given field based on cascading field permissions.\n * @returns An object with the following properties:\n * - `operation`: Whether the user has permission to perform the operation on the field (`create` or `update`).\n * - `permissions`: The field-level permissions.\n * - `read`: Whether the user has permission to read the field.\n */\nexport const getFieldPermissions = ({\n  collectionPermissions,\n  field,\n  operation,\n  parentName,\n  permissions,\n}: {\n  readonly collectionPermissions?: SanitizedDocumentPermissions\n  readonly field: ClientField | Field\n  readonly operation: Operation\n  readonly parentName: string\n  readonly permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n}): {\n  operation: boolean\n  /**\n   * The field-level permissions. This can be equal to the permissions passed to the\n   * `getFieldPermissions` function if the field has no name.\n   */\n  permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n  read: boolean\n} => {\n  // First, calculate permissions using the existing logic\n  const fieldOperation =\n    permissions === true ||\n    permissions?.[operation as keyof typeof permissions] === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      (permissions[field.name as keyof typeof permissions] === true ||\n        (operation in (permissions as any)[field.name] &&\n          (permissions as any)[field.name][operation])))\n\n  const fieldPermissions =\n    permissions === undefined || permissions === null || permissions === true\n      ? true\n      : 'name' in field\n        ? (permissions as any)[field.name]\n        : permissions\n\n  const fieldRead =\n    permissions === true ||\n    permissions?.read === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      ((permissions as any)[field.name] === true ||\n        ('read' in (permissions as any)[field.name] && (permissions as any)[field.name].read)))\n\n  // Check if field permissions are effectively empty/missing\n  const hasFieldPermissions =\n    permissions === true ||\n    (typeof permissions === 'object' && permissions !== null && Object.keys(permissions).length > 0)\n\n  // If no field permissions are defined, fallback to collection permissions\n  if (!hasFieldPermissions && collectionPermissions) {\n    const collectionRead = Boolean(collectionPermissions.read)\n    let collectionOperation = false\n\n    // Check operation-specific permission on collection\n    if (operation === 'create' && 'create' in collectionPermissions) {\n      collectionOperation = Boolean(collectionPermissions.create)\n    } else if (operation === 'update') {\n      collectionOperation = Boolean(collectionPermissions.update)\n    }\n\n    return {\n      operation: collectionOperation,\n      permissions: { read: collectionRead } as SanitizedFieldPermissions,\n      read: collectionRead,\n    }\n  }\n\n  // Return the calculated permissions\n  return {\n    operation: Boolean(fieldOperation),\n    permissions: fieldPermissions,\n    read: Boolean(fieldRead),\n  }\n}\n"],"names":["getFieldPermissions","collectionPermissions","field","operation","parentName","permissions","fieldOperation","name","fieldPermissions","undefined","fieldRead","read","hasFieldPermissions","Object","keys","length","collectionRead","Boolean","collectionOperation","create","update"],"mappings":"AAAA,qDAAqD,GASrD;;;;;;CAMC,GACD,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,qBAAqB,EACrBC,KAAK,EACLC,SAAS,EACTC,UAAU,EACVC,WAAW,EAOZ;IASC,wDAAwD;IACxD,MAAMC,iBACJD,gBAAgB,QAChBA,aAAa,CAACF,UAAsC,KAAK,QACzDE,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpDF,CAAAA,WAAW,CAACH,MAAMK,IAAI,CAA6B,KAAK,QACtDJ,aAAa,AAACE,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAC5C,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACJ,UAAU;IAEnD,MAAMK,mBACJH,gBAAgBI,aAAaJ,gBAAgB,QAAQA,gBAAgB,OACjE,OACA,UAAUH,QACR,AAACG,WAAmB,CAACH,MAAMK,IAAI,CAAC,GAChCF;IAER,MAAMK,YACJL,gBAAgB,QAChBA,aAAaM,SAAS,QACtBN,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpD,CAAA,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,KAAK,QACnC,UAAU,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAAI,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACI,IAAI;IAE1F,2DAA2D;IAC3D,MAAMC,sBACJP,gBAAgB,QACf,OAAOA,gBAAgB,YAAYA,gBAAgB,QAAQQ,OAAOC,IAAI,CAACT,aAAaU,MAAM,GAAG;IAEhG,0EAA0E;IAC1E,IAAI,CAACH,uBAAuBX,uBAAuB;QACjD,MAAMe,iBAAiBC,QAAQhB,sBAAsBU,IAAI;QACzD,IAAIO,sBAAsB;QAE1B,oDAAoD;QACpD,IAAIf,cAAc,YAAY,YAAYF,uBAAuB;YAC/DiB,sBAAsBD,QAAQhB,sBAAsBkB,MAAM;QAC5D,OAAO,IAAIhB,cAAc,UAAU;YACjCe,sBAAsBD,QAAQhB,sBAAsBmB,MAAM;QAC5D;QAEA,OAAO;YACLjB,WAAWe;YACXb,aAAa;gBAAEM,MAAMK;YAAe;YACpCL,MAAMK;QACR;IACF;IAEA,oCAAoC;IACpC,OAAO;QACLb,WAAWc,QAAQX;QACnBD,aAAaG;QACbG,MAAMM,QAAQP;IAChB;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/getFieldPermissions.ts"],"sourcesContent":["/* eslint-disable @typescript-eslint/no-explicit-any */\nimport type {\n  SanitizedDocumentPermissions,\n  SanitizedFieldPermissions,\n  SanitizedFieldsPermissions,\n} from '../auth/types.js'\nimport type { ClientField, Field } from '../fields/config/types.js'\nimport type { Operation } from '../types/index.js'\n\n/**\n * Gets read and operation-level permissions for a given field based on cascading field permissions.\n * @returns An object with the following properties:\n * - `operation`: Whether the user has permission to perform the operation on the field.\n * - `permissions`: The field-level permissions.\n * - `read`: Whether the user has permission to read the field.\n */\nexport const getFieldPermissions = ({\n  collectionPermissions,\n  field,\n  operation,\n  parentName,\n  permissions,\n}: {\n  readonly collectionPermissions?: SanitizedDocumentPermissions\n  readonly field: ClientField | Field\n  readonly operation: Operation\n  readonly parentName: string\n  readonly permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n}): {\n  operation: boolean\n  /**\n   * The field-level permissions. This can be equal to the permissions passed to the\n   * `getFieldPermissions` function if the field has no name.\n   */\n  permissions: SanitizedFieldPermissions | SanitizedFieldsPermissions\n  read: boolean\n} => {\n  // First, calculate permissions using the existing logic\n  const fieldOperation =\n    permissions === true ||\n    permissions?.[operation as keyof typeof permissions] === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      (permissions[field.name as keyof typeof permissions] === true ||\n        (operation in (permissions as any)[field.name] &&\n          (permissions as any)[field.name][operation])))\n\n  const fieldPermissions =\n    permissions === undefined || permissions === null || permissions === true\n      ? true\n      : 'name' in field\n        ? (permissions as any)[field.name]\n        : permissions\n\n  const fieldRead =\n    permissions === true ||\n    permissions?.read === true ||\n    permissions?.[parentName as keyof typeof permissions] === true ||\n    ('name' in field &&\n      typeof permissions === 'object' &&\n      permissions?.[field.name as keyof typeof permissions] &&\n      ((permissions as any)[field.name] === true ||\n        ('read' in (permissions as any)[field.name] && (permissions as any)[field.name].read)))\n\n  // Check if field permissions are effectively empty/missing\n  const hasFieldPermissions =\n    permissions === true ||\n    (typeof permissions === 'object' && permissions !== null && Object.keys(permissions).length > 0)\n\n  // If no field permissions are defined, fallback to collection permissions\n  if (!hasFieldPermissions && collectionPermissions) {\n    const collectionRead = Boolean(collectionPermissions.read)\n    let collectionOperation = false\n\n    // Check operation-specific permission on collection\n    if (operation === 'create' && 'create' in collectionPermissions) {\n      collectionOperation = Boolean(collectionPermissions.create)\n    } else if (operation === 'update') {\n      collectionOperation = Boolean(collectionPermissions.update)\n    } else if (operation === 'validate') {\n      collectionOperation = Boolean(collectionPermissions.validate)\n    }\n\n    return {\n      operation: collectionOperation,\n      permissions: { read: collectionRead } as SanitizedFieldPermissions,\n      read: collectionRead,\n    }\n  }\n\n  // Return the calculated permissions\n  return {\n    operation: Boolean(fieldOperation),\n    permissions: fieldPermissions,\n    read: Boolean(fieldRead),\n  }\n}\n"],"names":["getFieldPermissions","collectionPermissions","field","operation","parentName","permissions","fieldOperation","name","fieldPermissions","undefined","fieldRead","read","hasFieldPermissions","Object","keys","length","collectionRead","Boolean","collectionOperation","create","update","validate"],"mappings":"AAAA,qDAAqD,GASrD;;;;;;CAMC,GACD,OAAO,MAAMA,sBAAsB,CAAC,EAClCC,qBAAqB,EACrBC,KAAK,EACLC,SAAS,EACTC,UAAU,EACVC,WAAW,EAOZ;IASC,wDAAwD;IACxD,MAAMC,iBACJD,gBAAgB,QAChBA,aAAa,CAACF,UAAsC,KAAK,QACzDE,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpDF,CAAAA,WAAW,CAACH,MAAMK,IAAI,CAA6B,KAAK,QACtDJ,aAAa,AAACE,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAC5C,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACJ,UAAU;IAEnD,MAAMK,mBACJH,gBAAgBI,aAAaJ,gBAAgB,QAAQA,gBAAgB,OACjE,OACA,UAAUH,QACR,AAACG,WAAmB,CAACH,MAAMK,IAAI,CAAC,GAChCF;IAER,MAAMK,YACJL,gBAAgB,QAChBA,aAAaM,SAAS,QACtBN,aAAa,CAACD,WAAuC,KAAK,QACzD,UAAUF,SACT,OAAOG,gBAAgB,YACvBA,aAAa,CAACH,MAAMK,IAAI,CAA6B,IACpD,CAAA,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,KAAK,QACnC,UAAU,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,IAAI,AAACF,WAAmB,CAACH,MAAMK,IAAI,CAAC,CAACI,IAAI;IAE1F,2DAA2D;IAC3D,MAAMC,sBACJP,gBAAgB,QACf,OAAOA,gBAAgB,YAAYA,gBAAgB,QAAQQ,OAAOC,IAAI,CAACT,aAAaU,MAAM,GAAG;IAEhG,0EAA0E;IAC1E,IAAI,CAACH,uBAAuBX,uBAAuB;QACjD,MAAMe,iBAAiBC,QAAQhB,sBAAsBU,IAAI;QACzD,IAAIO,sBAAsB;QAE1B,oDAAoD;QACpD,IAAIf,cAAc,YAAY,YAAYF,uBAAuB;YAC/DiB,sBAAsBD,QAAQhB,sBAAsBkB,MAAM;QAC5D,OAAO,IAAIhB,cAAc,UAAU;YACjCe,sBAAsBD,QAAQhB,sBAAsBmB,MAAM;QAC5D,OAAO,IAAIjB,cAAc,YAAY;YACnCe,sBAAsBD,QAAQhB,sBAAsBoB,QAAQ;QAC9D;QAEA,OAAO;YACLlB,WAAWe;YACXb,aAAa;gBAAEM,MAAMK;YAAe;YACpCL,MAAMK;QACR;IACF;IAEA,oCAAoC;IACpC,OAAO;QACLb,WAAWc,QAAQX;QACnBD,aAAaG;QACbG,MAAMM,QAAQP;IAChB;AACF,EAAC"}

package/dist/utilities/getNextVersion.d.ts

@@ -0,0 +1,10 @@
+/**
+ * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported
+ * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.
+ *
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */
+export declare const getNextVersion: () => string | undefined;
+//# sourceMappingURL=getNextVersion.d.ts.map

package/dist/utilities/getNextVersion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getNextVersion.d.ts","sourceRoot":"","sources":["../../src/utilities/getNextVersion.ts"],"names":[],"mappings":"AAIA;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,QAAO,MAAM,GAAG,SAc1C,CAAA"}

package/dist/utilities/getNextVersion.js

@@ -0,0 +1,23 @@
+import { readFileSync } from 'fs';
+import { resolveFrom } from './dependencies/resolveFrom.js';
+/**
+ * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported
+ * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.
+ *
+ * Reads the version of the Next.js installed alongside the running app.
+ * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs
+ * outside of Next.js or from a directory the app's dependencies are not visible from.
+ */ export const getNextVersion = ()=>{
+    try {
+        const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true);
+        if (!packageJSONPath) {
+            return undefined;
+        }
+        const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'));
+        return typeof version === 'string' ? version : undefined;
+    } catch (_) {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=getNextVersion.js.map

package/dist/utilities/getNextVersion.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getNextVersion.ts"],"sourcesContent":["import { readFileSync } from 'fs'\n\nimport { resolveFrom } from './dependencies/resolveFrom.js'\n\n/**\n * TODO: Only used to pick the dev HMR path for Next.js versions older than the minimum supported\n * one, to make migrating easier. Remove together with the legacy path in `nextJsDevReloadStrategy`.\n *\n * Reads the version of the Next.js installed alongside the running app.\n * Returns undefined if Next.js cannot be resolved, e.g. because Payload runs\n * outside of Next.js or from a directory the app's dependencies are not visible from.\n */\nexport const getNextVersion = (): string | undefined => {\n  try {\n    const packageJSONPath = resolveFrom(process.cwd(), 'next/package.json', true)\n\n    if (!packageJSONPath) {\n      return undefined\n    }\n\n    const { version } = JSON.parse(readFileSync(packageJSONPath, 'utf-8'))\n\n    return typeof version === 'string' ? version : undefined\n  } catch (_) {\n    return undefined\n  }\n}\n"],"names":["readFileSync","resolveFrom","getNextVersion","packageJSONPath","process","cwd","undefined","version","JSON","parse","_"],"mappings":"AAAA,SAASA,YAAY,QAAQ,KAAI;AAEjC,SAASC,WAAW,QAAQ,gCAA+B;AAE3D;;;;;;;CAOC,GACD,OAAO,MAAMC,iBAAiB;IAC5B,IAAI;QACF,MAAMC,kBAAkBF,YAAYG,QAAQC,GAAG,IAAI,qBAAqB;QAExE,IAAI,CAACF,iBAAiB;YACpB,OAAOG;QACT;QAEA,MAAM,EAAEC,OAAO,EAAE,GAAGC,KAAKC,KAAK,CAACT,aAAaG,iBAAiB;QAE7D,OAAO,OAAOI,YAAY,WAAWA,UAAUD;IACjD,EAAE,OAAOI,GAAG;QACV,OAAOJ;IACT;AACF,EAAC"}

package/dist/utilities/getObjectDotNotation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAMF,CAAA"}
+{"version":3,"file":"getObjectDotNotation.d.ts","sourceRoot":"","sources":["../../src/utilities/getObjectDotNotation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,OAC/B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QACtB,MAAM,iBACG,CAAC,KACf,CAgBF,CAAA"}

package/dist/utilities/getObjectDotNotation.js

@@ -15,7 +15,13 @@
     if (!path || !obj) {
         return defaultValue;
     }
-    const result = path.split('.').reduce((o, i)=>o?.[i], obj);
+    let result = obj;
+    for (const segment of path.split('.')){
+        if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {
+            return defaultValue;
+        }
+        result = result[segment];
+    }
     return result === undefined ? defaultValue : result;
 };
 

package/dist/utilities/getObjectDotNotation.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n  const result = path.split('.').reduce((o, i) => o?.[i] as Record<string, unknown>, obj)\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","split","reduce","o","i","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IACA,MAAMC,SAASF,KAAKG,KAAK,CAAC,KAAKC,MAAM,CAAC,CAACC,GAAGC,IAAMD,GAAG,CAACC,EAAE,EAA6BP;IACnF,OAAOG,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}
+{"version":3,"sources":["../../src/utilities/getObjectDotNotation.ts"],"sourcesContent":["/**\n *\n * @deprecated use getObjectDotNotation from `'payload/shared'` instead of `'payload'`\n *\n * @example\n *\n * ```ts\n * import { getObjectDotNotation } from 'payload/shared'\n *\n * const obj = { a: { b: { c: 42 } } }\n * const value = getObjectDotNotation<number>(obj, 'a.b.c', 0) // value is 42\n * const defaultValue = getObjectDotNotation<number>(obj, 'a.b.x', 0) // defaultValue is 0\n * ```\n */\nexport const getObjectDotNotation = <T>(\n  obj: Record<string, unknown>,\n  path: string,\n  defaultValue?: T,\n): T => {\n  if (!path || !obj) {\n    return defaultValue!\n  }\n\n  let result: unknown = obj\n\n  for (const segment of path.split('.')) {\n    if (result === null || typeof result !== 'object' || !Object.hasOwn(result, segment)) {\n      return defaultValue!\n    }\n\n    result = (result as Record<string, unknown>)[segment]\n  }\n\n  return result === undefined ? defaultValue! : (result as T)\n}\n"],"names":["getObjectDotNotation","obj","path","defaultValue","result","segment","split","Object","hasOwn","undefined"],"mappings":"AAAA;;;;;;;;;;;;;CAaC,GACD,OAAO,MAAMA,uBAAuB,CAClCC,KACAC,MACAC;IAEA,IAAI,CAACD,QAAQ,CAACD,KAAK;QACjB,OAAOE;IACT;IAEA,IAAIC,SAAkBH;IAEtB,KAAK,MAAMI,WAAWH,KAAKI,KAAK,CAAC,KAAM;QACrC,IAAIF,WAAW,QAAQ,OAAOA,WAAW,YAAY,CAACG,OAAOC,MAAM,CAACJ,QAAQC,UAAU;YACpF,OAAOF;QACT;QAEAC,SAAS,AAACA,MAAkC,CAACC,QAAQ;IACvD;IAEA,OAAOD,WAAWK,YAAYN,eAAiBC;AACjD,EAAC"}

package/dist/utilities/getRequestOrigin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}
+{"version":3,"file":"getRequestOrigin.d.ts","sourceRoot":"","sources":["../../src/utilities/getRequestOrigin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AA8BvD;;GAEG;AACH,eAAO,MAAM,gBAAgB,qBAG1B;IACD,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,CAAC,CAAA;IAC5D,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,SAAS,GAAG,KAAK,CAAC,CAAA;CACzD,KAAG,MA4BH,CAAA"}

package/dist/utilities/getRequestOrigin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { CORSConfig, SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = (cors as CORSConfig).origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAc,AAACP,KAAoBF,OAAO;QAChD,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/getRequestOrigin.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nconst getTrustedOrigins = (config: Pick<SanitizedConfig, 'cors' | 'csrf'>): null | string[] => {\n  const origins = new Set<string>()\n\n  const { cors, csrf } = config\n\n  if (cors === '*') {\n    return null\n  }\n\n  if (Array.isArray(cors)) {\n    cors.forEach((o) => origins.add(o))\n  } else if (cors && typeof cors === 'object') {\n    const corsOrigins = cors.origins\n    if (corsOrigins === '*') {\n      return null\n    }\n    if (Array.isArray(corsOrigins)) {\n      corsOrigins.forEach((o) => origins.add(o))\n    }\n  }\n\n  if (Array.isArray(csrf)) {\n    csrf.forEach((o) => origins.add(o))\n  }\n\n  return [...origins]\n}\n\n/**\n * Returns a trusted request origin\n */\nexport const getRequestOrigin = ({\n  config,\n  req,\n}: {\n  config: Pick<SanitizedConfig, 'cors' | 'csrf' | 'serverURL'>\n  req: Pick<PayloadRequest, 'headers' | 'payload' | 'url'>\n}): string => {\n  if (config.serverURL !== null && config.serverURL !== '') {\n    return config.serverURL\n  }\n\n  let origin = ''\n  try {\n    const protocol = new URL(req.url!).protocol\n    const host = req.headers?.get('host')\n    if (host) {\n      origin = `${protocol}//${host}`\n    }\n  } catch {\n    // req.url is malformed; origin stays empty\n  }\n\n  const trustedOrigins = getTrustedOrigins(config)\n\n  if (trustedOrigins !== null && origin && trustedOrigins.includes(origin)) {\n    // Host header value is explicitly listed in the CORS/CSRF allowlist — safe to use.\n    return origin\n  }\n\n  req.payload.logger.warn(\n    `Request origin \"${origin}\" is not in the CORS/CSRF allowlist. Falling back to empty string as request origin. It is recommended to explicitly set the serverURL in the config to avoid this warning and ensure correct request origin is used.`,\n  )\n\n  return ''\n}\n"],"names":["getTrustedOrigins","config","origins","Set","cors","csrf","Array","isArray","forEach","o","add","corsOrigins","getRequestOrigin","req","serverURL","origin","protocol","URL","url","host","headers","get","trustedOrigins","includes","payload","logger","warn"],"mappings":"AAGA,MAAMA,oBAAoB,CAACC;IACzB,MAAMC,UAAU,IAAIC;IAEpB,MAAM,EAAEC,IAAI,EAAEC,IAAI,EAAE,GAAGJ;IAEvB,IAAIG,SAAS,KAAK;QAChB,OAAO;IACT;IAEA,IAAIE,MAAMC,OAAO,CAACH,OAAO;QACvBA,KAAKI,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC,OAAO,IAAIL,QAAQ,OAAOA,SAAS,UAAU;QAC3C,MAAMO,cAAcP,KAAKF,OAAO;QAChC,IAAIS,gBAAgB,KAAK;YACvB,OAAO;QACT;QACA,IAAIL,MAAMC,OAAO,CAACI,cAAc;YAC9BA,YAAYH,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;QACzC;IACF;IAEA,IAAIH,MAAMC,OAAO,CAACF,OAAO;QACvBA,KAAKG,OAAO,CAAC,CAACC,IAAMP,QAAQQ,GAAG,CAACD;IAClC;IAEA,OAAO;WAAIP;KAAQ;AACrB;AAEA;;CAEC,GACD,OAAO,MAAMU,mBAAmB,CAAC,EAC/BX,MAAM,EACNY,GAAG,EAIJ;IACC,IAAIZ,OAAOa,SAAS,KAAK,QAAQb,OAAOa,SAAS,KAAK,IAAI;QACxD,OAAOb,OAAOa,SAAS;IACzB;IAEA,IAAIC,SAAS;IACb,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIJ,IAAIK,GAAG,EAAGF,QAAQ;QAC3C,MAAMG,OAAON,IAAIO,OAAO,EAAEC,IAAI;QAC9B,IAAIF,MAAM;YACRJ,SAAS,GAAGC,SAAS,EAAE,EAAEG,MAAM;QACjC;IACF,EAAE,OAAM;IACN,2CAA2C;IAC7C;IAEA,MAAMG,iBAAiBtB,kBAAkBC;IAEzC,IAAIqB,mBAAmB,QAAQP,UAAUO,eAAeC,QAAQ,CAACR,SAAS;QACxE,mFAAmF;QACnF,OAAOA;IACT;IAEAF,IAAIW,OAAO,CAACC,MAAM,CAACC,IAAI,CACrB,CAAC,gBAAgB,EAAEX,OAAO,qNAAqN,CAAC;IAGlP,OAAO;AACT,EAAC"}

package/dist/utilities/getSafeRedirect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAmCH,CAAA"}
+{"version":3,"file":"getSafeRedirect.d.ts","sourceRoot":"","sources":["../../src/utilities/getSafeRedirect.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,mDAIzB;IACD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CAC9B,KAAG,MAgDH,CAAA"}

package/dist/utilities/getSafeRedirect.js

@@ -2,23 +2,30 @@ export const getSafeRedirect = ({ allowAbsoluteUrls = false, fallbackTo = '/', r
     if (typeof redirectTo !== 'string') {
         return fallbackTo;
     }
-    // Normalize and decode the path
-    let redirectPath;
+    const redirectPath = redirectTo.trim();
+    const hasControlCharacters = [
+        ...redirectPath
+    ].some((character)=>{
+        const code = character.charCodeAt(0);
+        return code <= 31 || code === 127;
+    });
+    const hasAmbiguousPathPrefix = /^\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath);
+    let parsedRedirect;
     try {
-        redirectPath = decodeURIComponent(redirectTo.trim());
+        parsedRedirect = new URL(redirectPath, 'http://localhost');
     } catch  {
-        return fallbackTo // invalid encoding
-        ;
+        return fallbackTo;
     }
-    const isSafeRedirect = // Must start with a single forward slash (e.g., "/admin")
-    redirectPath.startsWith('/') && // Prevent protocol-relative URLs (e.g., "//example.com")
+    const isSafeRedirect = !hasControlCharacters && !hasAmbiguousPathPrefix && // Must start with a single forward slash (e.g., "/admin")
+    redirectPath.startsWith('/') && // Must resolve to the same origin after URL parser normalization
+    parsedRedirect.origin === 'http://localhost' && // Prevent protocol-relative URLs (e.g., "//example.com")
     !redirectPath.startsWith('//') && // Prevent encoded slashes that could resolve to protocol-relative
     !redirectPath.startsWith('/%2F') && // Prevent backslash-based escape attempts (e.g., "/\\/example.com", "/\\\\example.com", "/\\example.com")
     !redirectPath.startsWith('/\\/') && !redirectPath.startsWith('/\\\\') && !redirectPath.startsWith('/\\') && // Prevent javascript-based schemes (e.g., "/javascript:alert(1)")
     !redirectPath.toLowerCase().startsWith('/javascript:') && // Prevent attempts to redirect to full URLs using "/http:" or "/https:"
     !redirectPath.toLowerCase().startsWith('/http');
-    const isAbsoluteSafeRedirect = allowAbsoluteUrls && // Must be a valid absolute URL with http or https
-    /^https?:\/\/\S+$/i.test(redirectPath);
+    const isAbsoluteSafeRedirect = allowAbsoluteUrls && !hasControlCharacters && // Must be a valid absolute URL with http or https
+    /^https?:\/\/\S+$/i.test(redirectPath) && (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:');
     return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo;
 };
 

package/dist/utilities/getSafeRedirect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  // Normalize and decode the path\n  let redirectPath: string\n  try {\n    redirectPath = decodeURIComponent(redirectTo.trim())\n  } catch {\n    return fallbackTo // invalid encoding\n  }\n\n  const isSafeRedirect =\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath)\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","decodeURIComponent","trim","isSafeRedirect","startsWith","toLowerCase","isAbsoluteSafeRedirect","test"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,gCAAgC;IAChC,IAAIE;IACJ,IAAI;QACFA,eAAeC,mBAAmBF,WAAWG,IAAI;IACnD,EAAE,OAAM;QACN,OAAOJ,WAAW,mBAAmB;;IACvC;IAEA,MAAMK,iBACJ,0DAA0D;IAC1DH,aAAaI,UAAU,CAAC,QACxB,yDAAyD;IACzD,CAACJ,aAAaI,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACJ,aAAaI,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACJ,aAAaI,UAAU,CAAC,WACzB,CAACJ,aAAaI,UAAU,CAAC,YACzB,CAACJ,aAAaI,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACJ,aAAaK,WAAW,GAAGD,UAAU,CAAC;IAEzC,MAAME,yBACJT,qBACA,kDAAkD;IAClD,oBAAoBU,IAAI,CAACP;IAE3B,OAAOG,kBAAkBG,yBAAyBN,eAAeF;AACnE,EAAC"}
+{"version":3,"sources":["../../src/utilities/getSafeRedirect.ts"],"sourcesContent":["export const getSafeRedirect = ({\n  allowAbsoluteUrls = false,\n  fallbackTo = '/',\n  redirectTo,\n}: {\n  allowAbsoluteUrls?: boolean\n  fallbackTo?: string\n  redirectTo: string | string[]\n}): string => {\n  if (typeof redirectTo !== 'string') {\n    return fallbackTo\n  }\n\n  const redirectPath = redirectTo.trim()\n\n  const hasControlCharacters = [...redirectPath].some((character) => {\n    const code = character.charCodeAt(0)\n    return code <= 31 || code === 127\n  })\n  const hasAmbiguousPathPrefix = /^\\/%(?:25)*(?:09|0a|0d|2f|5c)/i.test(redirectPath)\n\n  let parsedRedirect: URL\n  try {\n    parsedRedirect = new URL(redirectPath, 'http://localhost')\n  } catch {\n    return fallbackTo\n  }\n\n  const isSafeRedirect =\n    !hasControlCharacters &&\n    !hasAmbiguousPathPrefix &&\n    // Must start with a single forward slash (e.g., \"/admin\")\n    redirectPath.startsWith('/') &&\n    // Must resolve to the same origin after URL parser normalization\n    parsedRedirect.origin === 'http://localhost' &&\n    // Prevent protocol-relative URLs (e.g., \"//example.com\")\n    !redirectPath.startsWith('//') &&\n    // Prevent encoded slashes that could resolve to protocol-relative\n    !redirectPath.startsWith('/%2F') &&\n    // Prevent backslash-based escape attempts (e.g., \"/\\\\/example.com\", \"/\\\\\\\\example.com\", \"/\\\\example.com\")\n    !redirectPath.startsWith('/\\\\/') &&\n    !redirectPath.startsWith('/\\\\\\\\') &&\n    !redirectPath.startsWith('/\\\\') &&\n    // Prevent javascript-based schemes (e.g., \"/javascript:alert(1)\")\n    !redirectPath.toLowerCase().startsWith('/javascript:') &&\n    // Prevent attempts to redirect to full URLs using \"/http:\" or \"/https:\"\n    !redirectPath.toLowerCase().startsWith('/http')\n\n  const isAbsoluteSafeRedirect =\n    allowAbsoluteUrls &&\n    !hasControlCharacters &&\n    // Must be a valid absolute URL with http or https\n    /^https?:\\/\\/\\S+$/i.test(redirectPath) &&\n    (parsedRedirect.protocol === 'http:' || parsedRedirect.protocol === 'https:')\n\n  return isSafeRedirect || isAbsoluteSafeRedirect ? redirectPath : fallbackTo\n}\n"],"names":["getSafeRedirect","allowAbsoluteUrls","fallbackTo","redirectTo","redirectPath","trim","hasControlCharacters","some","character","code","charCodeAt","hasAmbiguousPathPrefix","test","parsedRedirect","URL","isSafeRedirect","startsWith","origin","toLowerCase","isAbsoluteSafeRedirect","protocol"],"mappings":"AAAA,OAAO,MAAMA,kBAAkB,CAAC,EAC9BC,oBAAoB,KAAK,EACzBC,aAAa,GAAG,EAChBC,UAAU,EAKX;IACC,IAAI,OAAOA,eAAe,UAAU;QAClC,OAAOD;IACT;IAEA,MAAME,eAAeD,WAAWE,IAAI;IAEpC,MAAMC,uBAAuB;WAAIF;KAAa,CAACG,IAAI,CAAC,CAACC;QACnD,MAAMC,OAAOD,UAAUE,UAAU,CAAC;QAClC,OAAOD,QAAQ,MAAMA,SAAS;IAChC;IACA,MAAME,yBAAyB,iCAAiCC,IAAI,CAACR;IAErE,IAAIS;IACJ,IAAI;QACFA,iBAAiB,IAAIC,IAAIV,cAAc;IACzC,EAAE,OAAM;QACN,OAAOF;IACT;IAEA,MAAMa,iBACJ,CAACT,wBACD,CAACK,0BACD,0DAA0D;IAC1DP,aAAaY,UAAU,CAAC,QACxB,iEAAiE;IACjEH,eAAeI,MAAM,KAAK,sBAC1B,yDAAyD;IACzD,CAACb,aAAaY,UAAU,CAAC,SACzB,kEAAkE;IAClE,CAACZ,aAAaY,UAAU,CAAC,WACzB,0GAA0G;IAC1G,CAACZ,aAAaY,UAAU,CAAC,WACzB,CAACZ,aAAaY,UAAU,CAAC,YACzB,CAACZ,aAAaY,UAAU,CAAC,UACzB,kEAAkE;IAClE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC,mBACvC,wEAAwE;IACxE,CAACZ,aAAac,WAAW,GAAGF,UAAU,CAAC;IAEzC,MAAMG,yBACJlB,qBACA,CAACK,wBACD,kDAAkD;IAClD,oBAAoBM,IAAI,CAACR,iBACxBS,CAAAA,eAAeO,QAAQ,KAAK,WAAWP,eAAeO,QAAQ,KAAK,QAAO;IAE7E,OAAOL,kBAAkBI,yBAAyBf,eAAeF;AACnE,EAAC"}

package/dist/utilities/getTopLevelFieldNames.d.ts

@@ -0,0 +1,2 @@
+export declare const getTopLevelFieldNames: (data: object) => Set<string>;
+//# sourceMappingURL=getTopLevelFieldNames.d.ts.map

package/dist/utilities/getTopLevelFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getTopLevelFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getTopLevelFieldNames.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,SAAU,MAAM,KAAG,GAAG,CAAC,MAAM,CACa,CAAA"}

package/dist/utilities/getTopLevelFieldNames.js

@@ -0,0 +1,3 @@
+export const getTopLevelFieldNames = (data)=>new Set(Object.keys(data).map((fieldPath)=>fieldPath.split('.', 1)[0]));
+
+//# sourceMappingURL=getTopLevelFieldNames.js.map

package/dist/utilities/getTopLevelFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getTopLevelFieldNames.ts"],"sourcesContent":["export const getTopLevelFieldNames = (data: object): Set<string> =>\n  new Set(Object.keys(data).map((fieldPath) => fieldPath.split('.', 1)[0]!))\n"],"names":["getTopLevelFieldNames","data","Set","Object","keys","map","fieldPath","split"],"mappings":"AAAA,OAAO,MAAMA,wBAAwB,CAACC,OACpC,IAAIC,IAAIC,OAAOC,IAAI,CAACH,MAAMI,GAAG,CAAC,CAACC,YAAcA,UAAUC,KAAK,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG"}

package/dist/utilities/getUniqueFieldValue.d.ts

@@ -0,0 +1,28 @@
+import type { DefaultDocumentIDType, Locale } from '../index.js';
+import type { PayloadRequest } from '../types/index.js';
+type Args = {
+    collection: string;
+    /** Also treat a value taken by a draft-only version as unavailable. */
+    draftsEnabled?: boolean;
+    /** Field name to check for uniqueness. */
+    field: string;
+    /** Exclude this doc from the check when updating; omit for a new doc. */
+    id?: DefaultDocumentIDType;
+    /** Locale to scope the check to, for localized fields. */
+    locale?: Locale['code'];
+    overrideAccess?: boolean;
+    req: PayloadRequest;
+    /**
+     * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …
+     * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.
+     */
+    startIndex?: number;
+    value: string;
+};
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */
+export declare const getUniqueFieldValue: ({ id, collection, draftsEnabled, field, locale, overrideAccess, req, startIndex, value, }: Args) => Promise<string>;
+export {};
+//# sourceMappingURL=getUniqueFieldValue.d.ts.map

package/dist/utilities/getUniqueFieldValue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getUniqueFieldValue.d.ts","sourceRoot":"","sources":["../../src/utilities/getUniqueFieldValue.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,KAAK,IAAI,GAAG;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,EAAE,CAAC,EAAE,qBAAqB,CAAA;IAC1B,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACvB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,GAAG,EAAE,cAAc,CAAA;IACnB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAKD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,8FAU7B,IAAI,KAAG,OAAO,CAAC,MAAM,CAqBvB,CAAA"}

package/dist/utilities/getUniqueFieldValue.js

@@ -0,0 +1,27 @@
+import { fieldValueExists } from './fieldValueExists.js';
+// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.
+const MAX_SUFFIX_ATTEMPTS = 50;
+/**
+ * Returns the first available value for `field` in `collection` — either the bare `value` or a
+ * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.
+ */ export const getUniqueFieldValue = async ({ id, collection, draftsEnabled, field, locale, overrideAccess = false, req, startIndex = 0, value })=>{
+    for(let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++){
+        const candidate = index === 0 ? value : `${value}-${index}`;
+        const taken = await fieldValueExists({
+            id,
+            collection,
+            draftsEnabled,
+            field,
+            locale,
+            overrideAccess,
+            req,
+            value: candidate
+        });
+        if (!taken) {
+            return candidate;
+        }
+    }
+    return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`;
+};
+
+//# sourceMappingURL=getUniqueFieldValue.js.map

package/dist/utilities/getUniqueFieldValue.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getUniqueFieldValue.ts"],"sourcesContent":["import type { DefaultDocumentIDType, Locale } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { fieldValueExists } from './fieldValueExists.js'\n\ntype Args = {\n  collection: string\n  /** Also treat a value taken by a draft-only version as unavailable. */\n  draftsEnabled?: boolean\n  /** Field name to check for uniqueness. */\n  field: string\n  /** Exclude this doc from the check when updating; omit for a new doc. */\n  id?: DefaultDocumentIDType\n  /** Locale to scope the check to, for localized fields. */\n  locale?: Locale['code']\n  overrideAccess?: boolean\n  req: PayloadRequest\n  /**\n   * Index the search starts from. `0` (default) tries the bare `value` first, then `value-1`, …\n   * `1` always suffixes: `value-1`, `value-2`, … — useful for a counter that reads as `value-N`.\n   */\n  startIndex?: number\n  value: string\n}\n\n// Bounded so a pathological run of taken suffixes can't loop forever; the check below is the guard.\nconst MAX_SUFFIX_ATTEMPTS = 50\n\n/**\n * Returns the first available value for `field` in `collection` — either the bare `value` or a\n * `value-N` variant. Useful when a unique field value is minted outside the operation pipeline.\n */\nexport const getUniqueFieldValue = async ({\n  id,\n  collection,\n  draftsEnabled,\n  field,\n  locale,\n  overrideAccess = false,\n  req,\n  startIndex = 0,\n  value,\n}: Args): Promise<string> => {\n  for (let index = startIndex; index <= startIndex + MAX_SUFFIX_ATTEMPTS; index++) {\n    const candidate = index === 0 ? value : `${value}-${index}`\n\n    const taken = await fieldValueExists({\n      id,\n      collection,\n      draftsEnabled,\n      field,\n      locale,\n      overrideAccess,\n      req,\n      value: candidate,\n    })\n\n    if (!taken) {\n      return candidate\n    }\n  }\n\n  return `${value}-${startIndex + MAX_SUFFIX_ATTEMPTS}`\n}\n"],"names":["fieldValueExists","MAX_SUFFIX_ATTEMPTS","getUniqueFieldValue","id","collection","draftsEnabled","field","locale","overrideAccess","req","startIndex","value","index","candidate","taken"],"mappings":"AAGA,SAASA,gBAAgB,QAAQ,wBAAuB;AAsBxD,oGAAoG;AACpG,MAAMC,sBAAsB;AAE5B;;;CAGC,GACD,OAAO,MAAMC,sBAAsB,OAAO,EACxCC,EAAE,EACFC,UAAU,EACVC,aAAa,EACbC,KAAK,EACLC,MAAM,EACNC,iBAAiB,KAAK,EACtBC,GAAG,EACHC,aAAa,CAAC,EACdC,KAAK,EACA;IACL,IAAK,IAAIC,QAAQF,YAAYE,SAASF,aAAaT,qBAAqBW,QAAS;QAC/E,MAAMC,YAAYD,UAAU,IAAID,QAAQ,GAAGA,MAAM,CAAC,EAAEC,OAAO;QAE3D,MAAME,QAAQ,MAAMd,iBAAiB;YACnCG;YACAC;YACAC;YACAC;YACAC;YACAC;YACAC;YACAE,OAAOE;QACT;QAEA,IAAI,CAACC,OAAO;YACV,OAAOD;QACT;IACF;IAEA,OAAO,GAAGF,MAAM,CAAC,EAAED,aAAaT,qBAAqB;AACvD,EAAC"}

package/dist/utilities/getVersionsConfig.d.ts

@@ -2,6 +2,10 @@ import type { CollectionConfig } from '../collections/config/types.js';
 import type { GlobalConfig } from '../globals/config/types.js';
 import type { Autosave, SanitizedDrafts } from '../versions/types.js';
 type EntityConfig = Pick<CollectionConfig | GlobalConfig, 'versions'>;
+/**
+ * Check if an entity has versions enabled at all
+ */
+export declare const hasVersionsEnabled: (config: EntityConfig) => boolean;
 /**
  * Check if an entity has drafts enabled
  */

package/dist/utilities/getVersionsConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,gBAAgB,WAAY,YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,WAAY,YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,WACrB,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAY,YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,WAC7B,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,YAAY,KAAG,MAa1D,CAAA"}
+{"version":3,"file":"getVersionsConfig.d.ts","sourceRoot":"","sources":["../../src/utilities/getVersionsConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIrE,KAAK,YAAY,GAAG,IAAI,CAAC,gBAAgB,GAAG,YAAY,EAAE,UAAU,CAAC,CAAA;AAErE;;GAEG;AACH,eAAO,MAAM,kBAAkB,WAAY,YAAY,KAAG,OAEzD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,gBAAgB,WAAY,YAAY,KAAG,OAEvD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,wBAAwB,WAAY,YAAY,KAAG,OAQ/D,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,WACrB,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,QAAQ,EAAE,QAAQ,GAAG,KAAK,CAAA;SAAE,CAAA;KACvC,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAY,YAAY,KAAG,OAQhE,CAAA;AAED,eAAO,MAAM,0BAA0B,WAC7B,YAAY,KACnB,MAAM,IAAI;IACX,QAAQ,EAAE;QACR,MAAM,EAAE;YAAE,eAAe,EAAE,eAAe,CAAC,iBAAiB,CAAC,CAAA;SAAE,CAAA;KAChE,CAAA;CACF,GAAG,YAQH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,WAAY,YAAY,KAAG,MAYrD,CAAA;AAED,eAAO,MAAM,mBAAmB,WAAY,YAAY,KAAG,MAa1D,CAAA"}

package/dist/utilities/getVersionsConfig.js

@@ -1,4 +1,9 @@
 import { versionDefaults } from '../versions/defaults.js';
+/**
+ * Check if an entity has versions enabled at all
+ */ export const hasVersionsEnabled = (config)=>{
+    return Boolean(config?.versions);
+};
 /**
  * Check if an entity has drafts enabled
  */ export const hasDraftsEnabled = (config)=>{

package/dist/utilities/getVersionsConfig.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/getVersionsConfig.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { Autosave, SanitizedDrafts } from '../versions/types.js'\n\nimport { versionDefaults } from '../versions/defaults.js'\n\ntype EntityConfig = Pick<CollectionConfig | GlobalConfig, 'versions'>\n\n/**\n * Check if an entity has drafts enabled\n */\nexport const hasDraftsEnabled = (config: EntityConfig): boolean => {\n  return Boolean(config?.versions && typeof config.versions === 'object' && config.versions.drafts)\n}\n\n/**\n * Check if an entity has localized status enabled\n */\nexport const hasLocalizeStatusEnabled = (config: EntityConfig): boolean => {\n  return Boolean(\n    config?.versions &&\n      typeof config.versions === 'object' &&\n      config.versions.drafts &&\n      typeof config.versions.drafts === 'object' &&\n      (config.versions.drafts as SanitizedDrafts).localizeStatus,\n  )\n}\n\n/**\n * Check if an entity has autosave enabled\n */\nexport const hasAutosaveEnabled = (\n  config: EntityConfig,\n): config is {\n  versions: {\n    drafts: { autosave: Autosave | false }\n  }\n} & EntityConfig => {\n  return Boolean(\n    config?.versions &&\n      typeof config.versions === 'object' &&\n      config.versions.drafts &&\n      typeof config.versions.drafts === 'object' &&\n      config.versions.drafts.autosave,\n  )\n}\n\n/**\n * Check if an entity has validate drafts enabled\n */\nexport const hasDraftValidationEnabled = (config: EntityConfig): boolean => {\n  return Boolean(\n    config?.versions &&\n      typeof config.versions === 'object' &&\n      config.versions.drafts &&\n      typeof config.versions.drafts === 'object' &&\n      config.versions.drafts.validate,\n  )\n}\n\nexport const hasScheduledPublishEnabled = (\n  config: EntityConfig,\n): config is {\n  versions: {\n    drafts: { schedulePublish: SanitizedDrafts['schedulePublish'] }\n  }\n} & EntityConfig => {\n  return Boolean(\n    config?.versions &&\n      typeof config.versions === 'object' &&\n      config.versions.drafts &&\n      typeof config.versions.drafts === 'object' &&\n      config.versions.drafts.schedulePublish,\n  )\n}\n\n/**\n * Get the maximum number of versions to keep for an entity\n * Returns maxPerDoc for collections or max for globals\n */\nexport const getVersionsMax = (config: EntityConfig): number => {\n  if (!config?.versions || typeof config.versions !== 'object') {\n    return 0\n  }\n  // Collections have maxPerDoc, globals have max\n  if ('maxPerDoc' in config.versions) {\n    return config.versions.maxPerDoc ?? 100\n  }\n  if ('max' in config.versions) {\n    return config.versions.max ?? 100\n  }\n  return 0\n}\n\nexport const getAutosaveInterval = (config: EntityConfig): number => {\n  let interval = versionDefaults.autosaveInterval\n  if (\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    config.versions.drafts.autosave &&\n    typeof config.versions.drafts.autosave === 'object'\n  ) {\n    interval = config.versions.drafts.autosave.interval ?? versionDefaults.autosaveInterval\n  }\n  return interval\n}\n"],"names":["versionDefaults","hasDraftsEnabled","config","Boolean","versions","drafts","hasLocalizeStatusEnabled","localizeStatus","hasAutosaveEnabled","autosave","hasDraftValidationEnabled","validate","hasScheduledPublishEnabled","schedulePublish","getVersionsMax","maxPerDoc","max","getAutosaveInterval","interval","autosaveInterval"],"mappings":"AAIA,SAASA,eAAe,QAAQ,0BAAyB;AAIzD;;CAEC,GACD,OAAO,MAAMC,mBAAmB,CAACC;IAC/B,OAAOC,QAAQD,QAAQE,YAAY,OAAOF,OAAOE,QAAQ,KAAK,YAAYF,OAAOE,QAAQ,CAACC,MAAM;AAClG,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,2BAA2B,CAACJ;IACvC,OAAOC,QACLD,QAAQE,YACN,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACC,MAAM,IACtB,OAAOH,OAAOE,QAAQ,CAACC,MAAM,KAAK,YAClC,AAACH,OAAOE,QAAQ,CAACC,MAAM,CAAqBE,cAAc;AAEhE,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,qBAAqB,CAChCN;IAMA,OAAOC,QACLD,QAAQE,YACN,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACC,MAAM,IACtB,OAAOH,OAAOE,QAAQ,CAACC,MAAM,KAAK,YAClCH,OAAOE,QAAQ,CAACC,MAAM,CAACI,QAAQ;AAErC,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,4BAA4B,CAACR;IACxC,OAAOC,QACLD,QAAQE,YACN,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACC,MAAM,IACtB,OAAOH,OAAOE,QAAQ,CAACC,MAAM,KAAK,YAClCH,OAAOE,QAAQ,CAACC,MAAM,CAACM,QAAQ;AAErC,EAAC;AAED,OAAO,MAAMC,6BAA6B,CACxCV;IAMA,OAAOC,QACLD,QAAQE,YACN,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACC,MAAM,IACtB,OAAOH,OAAOE,QAAQ,CAACC,MAAM,KAAK,YAClCH,OAAOE,QAAQ,CAACC,MAAM,CAACQ,eAAe;AAE5C,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,iBAAiB,CAACZ;IAC7B,IAAI,CAACA,QAAQE,YAAY,OAAOF,OAAOE,QAAQ,KAAK,UAAU;QAC5D,OAAO;IACT;IACA,+CAA+C;IAC/C,IAAI,eAAeF,OAAOE,QAAQ,EAAE;QAClC,OAAOF,OAAOE,QAAQ,CAACW,SAAS,IAAI;IACtC;IACA,IAAI,SAASb,OAAOE,QAAQ,EAAE;QAC5B,OAAOF,OAAOE,QAAQ,CAACY,GAAG,IAAI;IAChC;IACA,OAAO;AACT,EAAC;AAED,OAAO,MAAMC,sBAAsB,CAACf;IAClC,IAAIgB,WAAWlB,gBAAgBmB,gBAAgB;IAC/C,IACEjB,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACC,MAAM,IACtB,OAAOH,OAAOE,QAAQ,CAACC,MAAM,KAAK,YAClCH,OAAOE,QAAQ,CAACC,MAAM,CAACI,QAAQ,IAC/B,OAAOP,OAAOE,QAAQ,CAACC,MAAM,CAACI,QAAQ,KAAK,UAC3C;QACAS,WAAWhB,OAAOE,QAAQ,CAACC,MAAM,CAACI,QAAQ,CAACS,QAAQ,IAAIlB,gBAAgBmB,gBAAgB;IACzF;IACA,OAAOD;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/getVersionsConfig.ts"],"sourcesContent":["import type { CollectionConfig } from '../collections/config/types.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { Autosave, SanitizedDrafts } from '../versions/types.js'\n\nimport { versionDefaults } from '../versions/defaults.js'\n\ntype EntityConfig = Pick<CollectionConfig | GlobalConfig, 'versions'>\n\n/**\n * Check if an entity has versions enabled at all\n */\nexport const hasVersionsEnabled = (config: EntityConfig): boolean => {\n  return Boolean(config?.versions)\n}\n\n/**\n * Check if an entity has drafts enabled\n */\nexport const hasDraftsEnabled = (config: EntityConfig): boolean => {\n  return Boolean(config?.versions && typeof config.versions === 'object' && config.versions.drafts)\n}\n\n/**\n * Check if an entity has localized status enabled\n */\nexport const hasLocalizeStatusEnabled = (config: EntityConfig): boolean => {\n  return Boolean(\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    (config.versions.drafts as SanitizedDrafts).localizeStatus,\n  )\n}\n\n/**\n * Check if an entity has autosave enabled\n */\nexport const hasAutosaveEnabled = (\n  config: EntityConfig,\n): config is {\n  versions: {\n    drafts: { autosave: Autosave | false }\n  }\n} & EntityConfig => {\n  return Boolean(\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    config.versions.drafts.autosave,\n  )\n}\n\n/**\n * Check if an entity has validate drafts enabled\n */\nexport const hasDraftValidationEnabled = (config: EntityConfig): boolean => {\n  return Boolean(\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    config.versions.drafts.validate,\n  )\n}\n\nexport const hasScheduledPublishEnabled = (\n  config: EntityConfig,\n): config is {\n  versions: {\n    drafts: { schedulePublish: SanitizedDrafts['schedulePublish'] }\n  }\n} & EntityConfig => {\n  return Boolean(\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    config.versions.drafts.schedulePublish,\n  )\n}\n\n/**\n * Get the maximum number of versions to keep for an entity\n * Returns maxPerDoc for collections or max for globals\n */\nexport const getVersionsMax = (config: EntityConfig): number => {\n  if (!config?.versions || typeof config.versions !== 'object') {\n    return 0\n  }\n  // Collections have maxPerDoc, globals have max\n  if ('maxPerDoc' in config.versions) {\n    return config.versions.maxPerDoc ?? 100\n  }\n  if ('max' in config.versions) {\n    return config.versions.max ?? 100\n  }\n  return 0\n}\n\nexport const getAutosaveInterval = (config: EntityConfig): number => {\n  let interval = versionDefaults.autosaveInterval\n  if (\n    config?.versions &&\n    typeof config.versions === 'object' &&\n    config.versions.drafts &&\n    typeof config.versions.drafts === 'object' &&\n    config.versions.drafts.autosave &&\n    typeof config.versions.drafts.autosave === 'object'\n  ) {\n    interval = config.versions.drafts.autosave.interval ?? versionDefaults.autosaveInterval\n  }\n  return interval\n}\n"],"names":["versionDefaults","hasVersionsEnabled","config","Boolean","versions","hasDraftsEnabled","drafts","hasLocalizeStatusEnabled","localizeStatus","hasAutosaveEnabled","autosave","hasDraftValidationEnabled","validate","hasScheduledPublishEnabled","schedulePublish","getVersionsMax","maxPerDoc","max","getAutosaveInterval","interval","autosaveInterval"],"mappings":"AAIA,SAASA,eAAe,QAAQ,0BAAyB;AAIzD;;CAEC,GACD,OAAO,MAAMC,qBAAqB,CAACC;IACjC,OAAOC,QAAQD,QAAQE;AACzB,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,mBAAmB,CAACH;IAC/B,OAAOC,QAAQD,QAAQE,YAAY,OAAOF,OAAOE,QAAQ,KAAK,YAAYF,OAAOE,QAAQ,CAACE,MAAM;AAClG,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,2BAA2B,CAACL;IACvC,OAAOC,QACLD,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACE,MAAM,IACtB,OAAOJ,OAAOE,QAAQ,CAACE,MAAM,KAAK,YAClC,AAACJ,OAAOE,QAAQ,CAACE,MAAM,CAAqBE,cAAc;AAE9D,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,qBAAqB,CAChCP;IAMA,OAAOC,QACLD,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACE,MAAM,IACtB,OAAOJ,OAAOE,QAAQ,CAACE,MAAM,KAAK,YAClCJ,OAAOE,QAAQ,CAACE,MAAM,CAACI,QAAQ;AAEnC,EAAC;AAED;;CAEC,GACD,OAAO,MAAMC,4BAA4B,CAACT;IACxC,OAAOC,QACLD,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACE,MAAM,IACtB,OAAOJ,OAAOE,QAAQ,CAACE,MAAM,KAAK,YAClCJ,OAAOE,QAAQ,CAACE,MAAM,CAACM,QAAQ;AAEnC,EAAC;AAED,OAAO,MAAMC,6BAA6B,CACxCX;IAMA,OAAOC,QACLD,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACE,MAAM,IACtB,OAAOJ,OAAOE,QAAQ,CAACE,MAAM,KAAK,YAClCJ,OAAOE,QAAQ,CAACE,MAAM,CAACQ,eAAe;AAE1C,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMC,iBAAiB,CAACb;IAC7B,IAAI,CAACA,QAAQE,YAAY,OAAOF,OAAOE,QAAQ,KAAK,UAAU;QAC5D,OAAO;IACT;IACA,+CAA+C;IAC/C,IAAI,eAAeF,OAAOE,QAAQ,EAAE;QAClC,OAAOF,OAAOE,QAAQ,CAACY,SAAS,IAAI;IACtC;IACA,IAAI,SAASd,OAAOE,QAAQ,EAAE;QAC5B,OAAOF,OAAOE,QAAQ,CAACa,GAAG,IAAI;IAChC;IACA,OAAO;AACT,EAAC;AAED,OAAO,MAAMC,sBAAsB,CAAChB;IAClC,IAAIiB,WAAWnB,gBAAgBoB,gBAAgB;IAC/C,IACElB,QAAQE,YACR,OAAOF,OAAOE,QAAQ,KAAK,YAC3BF,OAAOE,QAAQ,CAACE,MAAM,IACtB,OAAOJ,OAAOE,QAAQ,CAACE,MAAM,KAAK,YAClCJ,OAAOE,QAAQ,CAACE,MAAM,CAACI,QAAQ,IAC/B,OAAOR,OAAOE,QAAQ,CAACE,MAAM,CAACI,QAAQ,KAAK,UAC3C;QACAS,WAAWjB,OAAOE,QAAQ,CAACE,MAAM,CAACI,QAAQ,CAACS,QAAQ,IAAInB,gBAAgBoB,gBAAgB;IACzF;IACA,OAAOD;AACT,EAAC"}

package/dist/utilities/getVirtualFieldNames.d.ts

@@ -0,0 +1,14 @@
+import type { SanitizedConfig } from '../config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export declare function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export declare function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[];
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export declare function stripVirtualFields(data: Record<string, unknown>, virtualFieldNames: string[]): Record<string, unknown>;
+//# sourceMappingURL=getVirtualFieldNames.d.ts.map

package/dist/utilities/getVirtualFieldNames.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"getVirtualFieldNames.d.ts","sourceRoot":"","sources":["../../src/utilities/getVirtualFieldNames.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAIzD;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAU1F;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,iBAAiB,EAAE,MAAM,EAAE,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAYzB"}

package/dist/utilities/getVirtualFieldNames.js

@@ -0,0 +1,35 @@
+import { fieldIsVirtual } from '../fields/config/types.js';
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */ export function getCollectionVirtualFieldNames(config, slug) {
+    const collection = config.collections.find((c)=>c.slug === slug);
+    if (!collection) {
+        return [];
+    }
+    return collection.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */ export function getGlobalVirtualFieldNames(config, slug) {
+    const global = config.globals.find((g)=>g.slug === slug);
+    if (!global) {
+        return [];
+    }
+    return global.flattenedFields.filter((field)=>'name' in field && fieldIsVirtual(field)).map((field)=>field.name);
+}
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */ export function stripVirtualFields(data, virtualFieldNames) {
+    if (virtualFieldNames.length === 0) {
+        return data;
+    }
+    const stripped = {
+        ...data
+    };
+    for (const name of virtualFieldNames){
+        delete stripped[name];
+    }
+    return stripped;
+}
+
+//# sourceMappingURL=getVirtualFieldNames.js.map

package/dist/utilities/getVirtualFieldNames.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/getVirtualFieldNames.ts"],"sourcesContent":["import type { SanitizedConfig } from '../config/types.js'\n\nimport { fieldIsVirtual } from '../fields/config/types.js'\n\n/**\n * Returns the names of all top-level virtual fields for a given collection slug.\n */\nexport function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const collection = config.collections.find((c) => c.slug === slug)\n\n  if (!collection) {\n    return []\n  }\n\n  return collection.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Returns the names of all top-level virtual fields for a given global slug.\n */\nexport function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {\n  const global = config.globals.find((g) => g.slug === slug)\n\n  if (!global) {\n    return []\n  }\n\n  return global.flattenedFields\n    .filter((field) => 'name' in field && fieldIsVirtual(field))\n    .map((field) => (field as { name: string }).name)\n}\n\n/**\n * Strips virtual field values from a data object given a list of virtual field names.\n */\nexport function stripVirtualFields(\n  data: Record<string, unknown>,\n  virtualFieldNames: string[],\n): Record<string, unknown> {\n  if (virtualFieldNames.length === 0) {\n    return data\n  }\n\n  const stripped = { ...data }\n\n  for (const name of virtualFieldNames) {\n    delete stripped[name]\n  }\n\n  return stripped\n}\n"],"names":["fieldIsVirtual","getCollectionVirtualFieldNames","config","slug","collection","collections","find","c","flattenedFields","filter","field","map","name","getGlobalVirtualFieldNames","global","globals","g","stripVirtualFields","data","virtualFieldNames","length","stripped"],"mappings":"AAEA,SAASA,cAAc,QAAQ,4BAA2B;AAE1D;;CAEC,GACD,OAAO,SAASC,+BAA+BC,MAAuB,EAAEC,IAAY;IAClF,MAAMC,aAAaF,OAAOG,WAAW,CAACC,IAAI,CAAC,CAACC,IAAMA,EAAEJ,IAAI,KAAKA;IAE7D,IAAI,CAACC,YAAY;QACf,OAAO,EAAE;IACX;IAEA,OAAOA,WAAWI,eAAe,CAC9BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASC,2BAA2BX,MAAuB,EAAEC,IAAY;IAC9E,MAAMW,SAASZ,OAAOa,OAAO,CAACT,IAAI,CAAC,CAACU,IAAMA,EAAEb,IAAI,KAAKA;IAErD,IAAI,CAACW,QAAQ;QACX,OAAO,EAAE;IACX;IAEA,OAAOA,OAAON,eAAe,CAC1BC,MAAM,CAAC,CAACC,QAAU,UAAUA,SAASV,eAAeU,QACpDC,GAAG,CAAC,CAACD,QAAU,AAACA,MAA2BE,IAAI;AACpD;AAEA;;CAEC,GACD,OAAO,SAASK,mBACdC,IAA6B,EAC7BC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,MAAMG,WAAW;QAAE,GAAGH,IAAI;IAAC;IAE3B,KAAK,MAAMN,QAAQO,kBAAmB;QACpC,OAAOE,QAAQ,CAACT,KAAK;IACvB;IAEA,OAAOS;AACT"}

package/dist/utilities/handleEndpoints.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA0BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAmNnB,CAAA"}
+{"version":3,"file":"handleEndpoints.d.ts","sourceRoot":"","sources":["../../src/utilities/handleEndpoints.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAA4B,eAAe,EAAE,MAAM,oBAAoB,CAAA;AA4BnF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,eAAe,kFAMzB;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAA;IAClD,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,OAAO,CAAC,QAAQ,CAyNnB,CAAA"}

package/dist/utilities/handleEndpoints.js

@@ -1,8 +1,9 @@
-import { status as httpStatus } from 'http-status';
 import { match } from 'path-to-regexp';
-import { createPayloadRequest } from './createPayloadRequest.js';
-import { formatAdminURL } from './formatAdminURL.js';
+import { assertBranchReadable } from '../branching/assertBranchReadable.js';
+import { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js';
+import { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js';
 import { headersWithCors } from './headersWithCors.js';
+import { httpStatus } from './httpStatus.js';
 import { mergeHeaders } from './mergeHeaders.js';
 import { routeError } from './routeError.js';
 const notFoundResponse = (req, pathname)=>{
@@ -69,8 +70,7 @@ const notFoundResponse = (req, pathname)=>{
         } else if (request.headers.get('Content-Type') === 'application/json') {
             // May not be supported by every endpoint
             data = await request.json();
-            // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale
-            // => add to searchParams
+            // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.
             if (data?.locale) {
                 url += `?locale=${data.locale}`;
             }
@@ -97,19 +97,27 @@ const notFoundResponse = (req, pathname)=>{
         return response;
     }
     try {
-        req = await createPayloadRequest({
+        req = await createPayloadRequestFromWebRequest({
             canSetHeaders: true,
             config: incomingConfig,
             payloadInstanceCacheKey,
             request
         });
+        // Here rather than inside `createPayloadRequest`: the check needs the resolved user,
+        // and it has to be able to fail as a formatted response, which means the request has
+        // to exist first. §12.5 — a caller may not read through a branch they cannot see.
+        await assertBranchReadable({
+            req
+        });
         const { payload } = req;
         const { config } = payload;
-        const pathname = path ?? new URL(req.url).pathname;
-        const baseAPIPath = formatAdminURL({
+        const rawPathname = path ?? new URL(req.url).pathname;
+        const pathname = stripTrailingSlash(rawPathname);
+        const rawBaseAPIPath = formatAdminURL({
             apiRoute: config.routes.api,
             path: ''
         });
+        const baseAPIPath = stripTrailingSlash(rawBaseAPIPath);
         if (!pathname.startsWith(baseAPIPath)) {
             return notFoundResponse(req, pathname);
         }

package/dist/utilities/handleEndpoints.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { status as httpStatus } from 'http-status'\nimport { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { createPayloadRequest } from './createPayloadRequest.js'\nimport { formatAdminURL } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // locale and fallbackLocale is read by createPayloadRequest to populate req.locale and req.fallbackLocale\n      // => add to searchParams\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    const { payload } = req\n    const { config } = payload\n\n    const pathname = path ?? new URL(req.url!).pathname\n    const baseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["status","httpStatus","match","createPayloadRequest","formatAdminURL","headersWithCors","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","baseAPIPath","apiRoute","routes","api","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,UAAUC,UAAU,QAAQ,cAAa;AAClD,SAASC,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,cAAc,QAAQ,sBAAqB;AACpD,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASX,gBAAgB;YACvBW,SAAS,IAAIC;YACbR;QACF;QACAT,QAAQC,WAAWiB,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIjB;IACJ,IAAIkB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQT,OAAO,CAACc,GAAG,CAAC,sCAAsC,SACzDL,QAAQT,OAAO,CAACc,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQT,OAAO;QACtC,MAAMgB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAIlB,MAAMU,QAAQV,GAAG;QACrB,IAAImB,OAAYC;QAEhB,IAAIV,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCtB,MAAM,GAAGU,QAAQV,GAAG,CAAC,CAAC,EAAEqB,QAAQ;QAClC,OAAO,IAAIX,QAAQT,OAAO,CAACc,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQb,IAAI;YAEzB,0GAA0G;YAC1G,yBAAyB;YACzB,IAAIsB,MAAMI,QAAQ;gBAChBvB,OAAO,CAAC,QAAQ,EAAEmB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBxB,OAAO,CAAC,gBAAgB,EAAEmB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAM/B,MAAM,IAAIgC,QAAQ1B,KAAK;YAC3BC,SAASe;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChFzB,IAAIyB,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAAShB;QACX;QAEA,OAAOiC;IACT;IAEA,IAAI;QACFjC,MAAM,MAAMN,qBAAqB;YAC/BwC,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,MAAM,EAAEmB,OAAO,EAAE,GAAGnC;QACpB,MAAM,EAAEY,MAAM,EAAE,GAAGuB;QAEnB,MAAMlC,WAAWa,QAAQ,IAAIT,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACnD,MAAMmC,cAAczC,eAAe;YACjC0C,UAAUzB,OAAO0B,MAAM,CAACC,GAAG;YAC3BzB,MAAM;QACR;QAEA,IAAI,CAACb,SAASuC,UAAU,CAACJ,cAAc;YACrC,OAAOrC,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAIwC,mBAAmBxC,SAASyC,OAAO,CAACN,aAAa;QAErD,IAAIO,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAeb,QAAQc,OAAO,CAACrC,MAAM,CAACsC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAIZ,QAAQkB,WAAW,CAACN,WAAW,EAAE;gBAC1C7B,aAAaiB,QAAQkB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC1C,OAAO0C,SAAS;QAEpD,IAAIpC,YAAY;YACdoC,YAAYpC,WAAWN,MAAM,CAAC0C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAExB,WAAWN,MAAM,CAACwC,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOpD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAImB,MAAM,EAAEoC,cAAc,CAAC,EAAEvD,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASX,gBAAgB;oBACvBW,SAAS,IAAIC;oBACbR;gBACF;gBACAT,QAAQC,WAAWgE,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAAStC,MAAM,KAAKnB,IAAImB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMsC,cAAcjE,MAAMgE,SAAS3C,IAAI,EAAE;gBAAE6C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEA7D,IAAI8D,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI7C,YAAY;gBACdlB,IAAI8D,WAAW,CAAC5C,UAAU,GAAGA,WAAWN,MAAM,CAACwC,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBhD,IAAI8D,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZxC,UAAUwC,SAASxC,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIjB,IAAImB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOlB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASX,gBAAgB;wBACvBW,SAAS,IAAIC;wBACbR;oBACF;oBACAT,QAAQ;gBACV;YAEJ;YAEA,OAAOQ,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMgC,WAAW,MAAMhB,QAAQjB;QAE/B,OAAO,IAAIE,SAAS+B,SAASgC,IAAI,EAAE;YACjC1D,SAASX,gBAAgB;gBACvBW,SAASV,aAAaG,IAAIkE,eAAe,IAAI,IAAI1D,WAAWyB,SAAS1B,OAAO;gBAC5EP;YACF;YACAT,QAAQ0C,SAAS1C,MAAM;YACvB4E,YAAYlC,SAASkC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOtE,WAAW;YAChBoB;YACAN,QAAQC;YACRwD;YACArE,KAAKA;QACP;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/utilities/handleEndpoints.ts"],"sourcesContent":["import { match } from 'path-to-regexp'\n\nimport type { Collection } from '../collections/config/types.js'\nimport type { Endpoint, PayloadHandler, SanitizedConfig } from '../config/types.js'\nimport type { APIError } from '../errors/APIError.js'\nimport type { GlobalConfig } from '../globals/config/types.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { assertBranchReadable } from '../branching/assertBranchReadable.js'\nimport { createPayloadRequestFromWebRequest } from './createPayloadRequestFromWebRequest.js'\nimport { formatAdminURL, stripTrailingSlash } from './formatAdminURL.js'\nimport { headersWithCors } from './headersWithCors.js'\nimport { httpStatus } from './httpStatus.js'\nimport { mergeHeaders } from './mergeHeaders.js'\nimport { routeError } from './routeError.js'\n\nconst notFoundResponse = (req: PayloadRequest, pathname?: string) => {\n  return Response.json(\n    {\n      message: `Route not found \"${pathname ?? new URL(req.url!).pathname}\"`,\n    },\n    {\n      headers: headersWithCors({\n        headers: new Headers(),\n        req,\n      }),\n      status: httpStatus.NOT_FOUND,\n    },\n  )\n}\n\n/**\n * Attaches the Payload REST API to any backend framework that uses Fetch Request/Response\n * like Next.js (app router), Remix, Bun, Hono.\n *\n * ### Example: Using Hono\n * ```ts\n * import { handleEndpoints } from 'payload';\n * import { serve } from '@hono/node-server';\n * import { loadEnv } from 'payload/node';\n *\n * const port = 3001;\n * loadEnv();\n *\n * const { default: config } = await import('@payload-config');\n *\n * const server = serve({\n *   fetch: async (request) => {\n *     const response = await handleEndpoints({\n *       config,\n *       request: request.clone(),\n *     });\n *\n *     return response;\n *   },\n *   port,\n * });\n *\n * server.on('listening', () => {\n *   console.log(`API server is listening on http://localhost:${port}/api`);\n * });\n * ```\n */\nexport const handleEndpoints = async ({\n  basePath = '',\n  config: incomingConfig,\n  path,\n  payloadInstanceCacheKey,\n  request,\n}: {\n  basePath?: string\n  config: Promise<SanitizedConfig> | SanitizedConfig\n  /** Override path from the request */\n  path?: string\n  payloadInstanceCacheKey?: string\n  request: Request\n}): Promise<Response> => {\n  let handler!: PayloadHandler\n  let req: PayloadRequest\n  let collection!: Collection\n\n  // This can be used against GET request search params size limit.\n  // Instead you can do POST request with a text body as search params.\n  // We use this internally for relationships querying on the frontend\n  // packages/ui/src/fields/Relationship/index.tsx\n  if (\n    request.method.toLowerCase() === 'post' &&\n    (request.headers.get('X-Payload-HTTP-Method-Override') === 'GET' ||\n      request.headers.get('X-HTTP-Method-Override') === 'GET')\n  ) {\n    // Extract properties before consuming the body — srvx (TanStack Start) uses\n    // lazy property getters that reconstruct the underlying Request, which throws\n    // after the body has been read via .text() / .json().\n    const requestHeaders = request.headers\n    const requestSignal = request.signal\n\n    let url = request.url\n    let data: any = undefined\n\n    if (request.headers.get('Content-Type') === 'application/x-www-form-urlencoded') {\n      const search = await request.text()\n      url = `${request.url}?${search}`\n    } else if (request.headers.get('Content-Type') === 'application/json') {\n      // May not be supported by every endpoint\n      data = await request.json()\n\n      // createPayloadRequestFromWebRequest reads locale and fallbackLocale from searchParams.\n      if (data?.locale) {\n        url += `?locale=${data.locale}`\n      }\n      if (data?.fallbackLocale) {\n        url += `&fallbackLocale=${data.depth}`\n      }\n    }\n\n    const req = new Request(url, {\n      headers: requestHeaders,\n      method: 'GET',\n      signal: requestSignal,\n    })\n\n    if (data) {\n      // @ts-expect-error attach data to request - less overhead than using urlencoded\n      req.data = data\n    }\n\n    const response = await handleEndpoints({\n      basePath,\n      config: incomingConfig,\n      path,\n      payloadInstanceCacheKey,\n      request: req,\n    })\n\n    return response\n  }\n\n  try {\n    req = await createPayloadRequestFromWebRequest({\n      canSetHeaders: true,\n      config: incomingConfig,\n      payloadInstanceCacheKey,\n      request,\n    })\n\n    // Here rather than inside `createPayloadRequest`: the check needs the resolved user,\n    // and it has to be able to fail as a formatted response, which means the request has\n    // to exist first. §12.5 — a caller may not read through a branch they cannot see.\n    await assertBranchReadable({ req })\n\n    const { payload } = req\n    const { config } = payload\n\n    const rawPathname = path ?? new URL(req.url!).pathname\n    const pathname = stripTrailingSlash(rawPathname)\n    const rawBaseAPIPath = formatAdminURL({\n      apiRoute: config.routes.api,\n      path: '',\n    })\n    const baseAPIPath = stripTrailingSlash(rawBaseAPIPath)\n\n    if (!pathname.startsWith(baseAPIPath)) {\n      return notFoundResponse(req, pathname)\n    }\n\n    // /api/posts/route -> /posts/route\n    let adjustedPathname = pathname.replace(baseAPIPath, '')\n\n    let isGlobals = false\n\n    // /globals/header/route -> /header/route\n    if (adjustedPathname.startsWith('/globals')) {\n      isGlobals = true\n      adjustedPathname = adjustedPathname.replace('/globals', '')\n    }\n\n    const segments = adjustedPathname.split('/')\n    // remove empty string first element\n    segments.shift()\n\n    const firstParam = segments[0]\n\n    let globalConfig!: GlobalConfig\n\n    // first param can be a global slug or collection slug, find the relevant config\n    if (firstParam) {\n      if (isGlobals) {\n        globalConfig = payload.globals.config.find((each) => each.slug === firstParam)!\n      } else if (payload.collections[firstParam]) {\n        collection = payload.collections[firstParam]\n      }\n    }\n\n    let endpoints: Endpoint[] | false = config.endpoints\n\n    if (collection) {\n      endpoints = collection.config.endpoints\n      // /posts/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${collection.config.slug}`, '')\n    } else if (globalConfig) {\n      // /header/route -> /route\n      adjustedPathname = adjustedPathname.replace(`/${globalConfig.slug}`, '')\n      endpoints = globalConfig.endpoints!\n    }\n\n    // sanitize when endpoint.path is '/'\n    if (adjustedPathname === '') {\n      adjustedPathname = '/'\n    }\n\n    if (endpoints === false) {\n      return Response.json(\n        {\n          message: `Cannot ${req.method?.toUpperCase()} ${req.url}`,\n        },\n        {\n          headers: headersWithCors({\n            headers: new Headers(),\n            req,\n          }),\n          status: httpStatus.NOT_IMPLEMENTED,\n        },\n      )\n    }\n\n    // Find the relevant endpoint configuration\n    const endpoint = endpoints?.find((endpoint) => {\n      if (endpoint.method !== req.method?.toLowerCase()) {\n        return false\n      }\n\n      const pathMatchFn = match(endpoint.path, { decode: decodeURIComponent })\n\n      const matchResult = pathMatchFn(adjustedPathname)\n\n      if (!matchResult) {\n        return false\n      }\n\n      req.routeParams = matchResult.params as Record<string, unknown>\n\n      // Inject to routeParams the slug as well so it can be used later\n      if (collection) {\n        req.routeParams.collection = collection.config.slug\n      } else if (globalConfig) {\n        req.routeParams.global = globalConfig.slug\n      }\n\n      return true\n    })\n\n    if (endpoint) {\n      handler = endpoint.handler\n    }\n\n    if (!handler) {\n      // If no custom handler found and this is an OPTIONS request,\n      // return default CORS response for preflight requests\n      if (req.method?.toLowerCase() === 'options') {\n        return Response.json(\n          {},\n          {\n            headers: headersWithCors({\n              headers: new Headers(),\n              req,\n            }),\n            status: 200,\n          },\n        )\n      }\n\n      return notFoundResponse(req, pathname)\n    }\n\n    const response = await handler(req)\n\n    return new Response(response.body, {\n      headers: headersWithCors({\n        headers: mergeHeaders(req.responseHeaders ?? new Headers(), response.headers),\n        req,\n      }),\n      status: response.status,\n      statusText: response.statusText,\n    })\n  } catch (_err) {\n    const err = _err as APIError\n    return routeError({\n      collection,\n      config: incomingConfig,\n      err,\n      req: req!,\n    })\n  }\n}\n"],"names":["match","assertBranchReadable","createPayloadRequestFromWebRequest","formatAdminURL","stripTrailingSlash","headersWithCors","httpStatus","mergeHeaders","routeError","notFoundResponse","req","pathname","Response","json","message","URL","url","headers","Headers","status","NOT_FOUND","handleEndpoints","basePath","config","incomingConfig","path","payloadInstanceCacheKey","request","handler","collection","method","toLowerCase","get","requestHeaders","requestSignal","signal","data","undefined","search","text","locale","fallbackLocale","depth","Request","response","canSetHeaders","payload","rawPathname","rawBaseAPIPath","apiRoute","routes","api","baseAPIPath","startsWith","adjustedPathname","replace","isGlobals","segments","split","shift","firstParam","globalConfig","globals","find","each","slug","collections","endpoints","toUpperCase","NOT_IMPLEMENTED","endpoint","pathMatchFn","decode","decodeURIComponent","matchResult","routeParams","params","global","body","responseHeaders","statusText","_err","err"],"mappings":"AAAA,SAASA,KAAK,QAAQ,iBAAgB;AAQtC,SAASC,oBAAoB,QAAQ,uCAAsC;AAC3E,SAASC,kCAAkC,QAAQ,0CAAyC;AAC5F,SAASC,cAAc,EAAEC,kBAAkB,QAAQ,sBAAqB;AACxE,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,UAAU,QAAQ,kBAAiB;AAC5C,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,UAAU,QAAQ,kBAAiB;AAE5C,MAAMC,mBAAmB,CAACC,KAAqBC;IAC7C,OAAOC,SAASC,IAAI,CAClB;QACEC,SAAS,CAAC,iBAAiB,EAAEH,YAAY,IAAII,IAAIL,IAAIM,GAAG,EAAGL,QAAQ,CAAC,CAAC,CAAC;IACxE,GACA;QACEM,SAASZ,gBAAgB;YACvBY,SAAS,IAAIC;YACbR;QACF;QACAS,QAAQb,WAAWc,SAAS;IAC9B;AAEJ;AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BC,GACD,OAAO,MAAMC,kBAAkB,OAAO,EACpCC,WAAW,EAAE,EACbC,QAAQC,cAAc,EACtBC,IAAI,EACJC,uBAAuB,EACvBC,OAAO,EAQR;IACC,IAAIC;IACJ,IAAIlB;IACJ,IAAImB;IAEJ,iEAAiE;IACjE,qEAAqE;IACrE,oEAAoE;IACpE,gDAAgD;IAChD,IACEF,QAAQG,MAAM,CAACC,WAAW,OAAO,UAChCJ,CAAAA,QAAQV,OAAO,CAACe,GAAG,CAAC,sCAAsC,SACzDL,QAAQV,OAAO,CAACe,GAAG,CAAC,8BAA8B,KAAI,GACxD;QACA,4EAA4E;QAC5E,8EAA8E;QAC9E,sDAAsD;QACtD,MAAMC,iBAAiBN,QAAQV,OAAO;QACtC,MAAMiB,gBAAgBP,QAAQQ,MAAM;QAEpC,IAAInB,MAAMW,QAAQX,GAAG;QACrB,IAAIoB,OAAYC;QAEhB,IAAIV,QAAQV,OAAO,CAACe,GAAG,CAAC,oBAAoB,qCAAqC;YAC/E,MAAMM,SAAS,MAAMX,QAAQY,IAAI;YACjCvB,MAAM,GAAGW,QAAQX,GAAG,CAAC,CAAC,EAAEsB,QAAQ;QAClC,OAAO,IAAIX,QAAQV,OAAO,CAACe,GAAG,CAAC,oBAAoB,oBAAoB;YACrE,yCAAyC;YACzCI,OAAO,MAAMT,QAAQd,IAAI;YAEzB,wFAAwF;YACxF,IAAIuB,MAAMI,QAAQ;gBAChBxB,OAAO,CAAC,QAAQ,EAAEoB,KAAKI,MAAM,EAAE;YACjC;YACA,IAAIJ,MAAMK,gBAAgB;gBACxBzB,OAAO,CAAC,gBAAgB,EAAEoB,KAAKM,KAAK,EAAE;YACxC;QACF;QAEA,MAAMhC,MAAM,IAAIiC,QAAQ3B,KAAK;YAC3BC,SAASgB;YACTH,QAAQ;YACRK,QAAQD;QACV;QAEA,IAAIE,MAAM;YACR,gFAAgF;YAChF1B,IAAI0B,IAAI,GAAGA;QACb;QAEA,MAAMQ,WAAW,MAAMvB,gBAAgB;YACrCC;YACAC,QAAQC;YACRC;YACAC;YACAC,SAASjB;QACX;QAEA,OAAOkC;IACT;IAEA,IAAI;QACFlC,MAAM,MAAMR,mCAAmC;YAC7C2C,eAAe;YACftB,QAAQC;YACRE;YACAC;QACF;QAEA,qFAAqF;QACrF,qFAAqF;QACrF,kFAAkF;QAClF,MAAM1B,qBAAqB;YAAES;QAAI;QAEjC,MAAM,EAAEoC,OAAO,EAAE,GAAGpC;QACpB,MAAM,EAAEa,MAAM,EAAE,GAAGuB;QAEnB,MAAMC,cAActB,QAAQ,IAAIV,IAAIL,IAAIM,GAAG,EAAGL,QAAQ;QACtD,MAAMA,WAAWP,mBAAmB2C;QACpC,MAAMC,iBAAiB7C,eAAe;YACpC8C,UAAU1B,OAAO2B,MAAM,CAACC,GAAG;YAC3B1B,MAAM;QACR;QACA,MAAM2B,cAAchD,mBAAmB4C;QAEvC,IAAI,CAACrC,SAAS0C,UAAU,CAACD,cAAc;YACrC,OAAO3C,iBAAiBC,KAAKC;QAC/B;QAEA,mCAAmC;QACnC,IAAI2C,mBAAmB3C,SAAS4C,OAAO,CAACH,aAAa;QAErD,IAAII,YAAY;QAEhB,yCAAyC;QACzC,IAAIF,iBAAiBD,UAAU,CAAC,aAAa;YAC3CG,YAAY;YACZF,mBAAmBA,iBAAiBC,OAAO,CAAC,YAAY;QAC1D;QAEA,MAAME,WAAWH,iBAAiBI,KAAK,CAAC;QACxC,oCAAoC;QACpCD,SAASE,KAAK;QAEd,MAAMC,aAAaH,QAAQ,CAAC,EAAE;QAE9B,IAAII;QAEJ,gFAAgF;QAChF,IAAID,YAAY;YACd,IAAIJ,WAAW;gBACbK,eAAef,QAAQgB,OAAO,CAACvC,MAAM,CAACwC,IAAI,CAAC,CAACC,OAASA,KAAKC,IAAI,KAAKL;YACrE,OAAO,IAAId,QAAQoB,WAAW,CAACN,WAAW,EAAE;gBAC1C/B,aAAaiB,QAAQoB,WAAW,CAACN,WAAW;YAC9C;QACF;QAEA,IAAIO,YAAgC5C,OAAO4C,SAAS;QAEpD,IAAItC,YAAY;YACdsC,YAAYtC,WAAWN,MAAM,CAAC4C,SAAS;YACvC,yBAAyB;YACzBb,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAE1B,WAAWN,MAAM,CAAC0C,IAAI,EAAE,EAAE;QAC5E,OAAO,IAAIJ,cAAc;YACvB,0BAA0B;YAC1BP,mBAAmBA,iBAAiBC,OAAO,CAAC,CAAC,CAAC,EAAEM,aAAaI,IAAI,EAAE,EAAE;YACrEE,YAAYN,aAAaM,SAAS;QACpC;QAEA,qCAAqC;QACrC,IAAIb,qBAAqB,IAAI;YAC3BA,mBAAmB;QACrB;QAEA,IAAIa,cAAc,OAAO;YACvB,OAAOvD,SAASC,IAAI,CAClB;gBACEC,SAAS,CAAC,OAAO,EAAEJ,IAAIoB,MAAM,EAAEsC,cAAc,CAAC,EAAE1D,IAAIM,GAAG,EAAE;YAC3D,GACA;gBACEC,SAASZ,gBAAgB;oBACvBY,SAAS,IAAIC;oBACbR;gBACF;gBACAS,QAAQb,WAAW+D,eAAe;YACpC;QAEJ;QAEA,2CAA2C;QAC3C,MAAMC,WAAWH,WAAWJ,KAAK,CAACO;YAChC,IAAIA,SAASxC,MAAM,KAAKpB,IAAIoB,MAAM,EAAEC,eAAe;gBACjD,OAAO;YACT;YAEA,MAAMwC,cAAcvE,MAAMsE,SAAS7C,IAAI,EAAE;gBAAE+C,QAAQC;YAAmB;YAEtE,MAAMC,cAAcH,YAAYjB;YAEhC,IAAI,CAACoB,aAAa;gBAChB,OAAO;YACT;YAEAhE,IAAIiE,WAAW,GAAGD,YAAYE,MAAM;YAEpC,iEAAiE;YACjE,IAAI/C,YAAY;gBACdnB,IAAIiE,WAAW,CAAC9C,UAAU,GAAGA,WAAWN,MAAM,CAAC0C,IAAI;YACrD,OAAO,IAAIJ,cAAc;gBACvBnD,IAAIiE,WAAW,CAACE,MAAM,GAAGhB,aAAaI,IAAI;YAC5C;YAEA,OAAO;QACT;QAEA,IAAIK,UAAU;YACZ1C,UAAU0C,SAAS1C,OAAO;QAC5B;QAEA,IAAI,CAACA,SAAS;YACZ,6DAA6D;YAC7D,sDAAsD;YACtD,IAAIlB,IAAIoB,MAAM,EAAEC,kBAAkB,WAAW;gBAC3C,OAAOnB,SAASC,IAAI,CAClB,CAAC,GACD;oBACEI,SAASZ,gBAAgB;wBACvBY,SAAS,IAAIC;wBACbR;oBACF;oBACAS,QAAQ;gBACV;YAEJ;YAEA,OAAOV,iBAAiBC,KAAKC;QAC/B;QAEA,MAAMiC,WAAW,MAAMhB,QAAQlB;QAE/B,OAAO,IAAIE,SAASgC,SAASkC,IAAI,EAAE;YACjC7D,SAASZ,gBAAgB;gBACvBY,SAASV,aAAaG,IAAIqE,eAAe,IAAI,IAAI7D,WAAW0B,SAAS3B,OAAO;gBAC5EP;YACF;YACAS,QAAQyB,SAASzB,MAAM;YACvB6D,YAAYpC,SAASoC,UAAU;QACjC;IACF,EAAE,OAAOC,MAAM;QACb,MAAMC,MAAMD;QACZ,OAAOzE,WAAW;YAChBqB;YACAN,QAAQC;YACR0D;YACAxE,KAAKA;QACP;IACF;AACF,EAAC"}

package/dist/utilities/headersWithCors.js

@@ -20,7 +20,7 @@ export const headersWithCors = ({ headers, req })=>{
             if (typeof cors === 'object' && 'headers' in cors) {
                 headers.set('Access-Control-Allow-Headers', [
                     ...defaultAllowedHeaders,
-                    ...cors.headers
+                    ...cors.headers ?? []
                 ].filter(Boolean).join(', '));
             } else {
                 headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '));

package/dist/utilities/headersWithCors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...cors.headers].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA0BL,KAAKF,OAAO;iBAAC,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAErE,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}
+{"version":3,"sources":["../../src/utilities/headersWithCors.ts"],"sourcesContent":["import type { PayloadRequest } from '../types/index.js'\n\ntype CorsArgs = {\n  headers: Headers\n  req: Partial<PayloadRequest>\n}\nexport const headersWithCors = ({ headers, req }: CorsArgs): Headers => {\n  const cors = req?.payload?.config.cors\n  const requestOrigin = req?.headers?.get('Origin')\n\n  if (cors) {\n    const defaultAllowedHeaders = [\n      'Origin',\n      'X-Requested-With',\n      'Content-Type',\n      'Accept',\n      'Authorization',\n      'Content-Encoding',\n      'x-apollo-tracing',\n      'X-Payload-HTTP-Method-Override',\n    ]\n\n    // Only set default CORS headers if they haven't been set by custom handler\n    if (!headers.has('Access-Control-Allow-Methods')) {\n      headers.set('Access-Control-Allow-Methods', 'PUT, PATCH, POST, GET, DELETE, OPTIONS')\n    }\n\n    if (!headers.has('Access-Control-Allow-Headers')) {\n      if (typeof cors === 'object' && 'headers' in cors) {\n        headers.set(\n          'Access-Control-Allow-Headers',\n          [...defaultAllowedHeaders, ...(cors.headers ?? [])].filter(Boolean).join(', '),\n        )\n      } else {\n        headers.set('Access-Control-Allow-Headers', defaultAllowedHeaders.join(', '))\n      }\n    }\n\n    if (!headers.has('Access-Control-Allow-Origin')) {\n      if (cors === '*' || (typeof cors === 'object' && 'origins' in cors && cors.origins === '*')) {\n        headers.set('Access-Control-Allow-Origin', '*')\n      } else if (\n        (Array.isArray(cors) && cors.indexOf(requestOrigin!) > -1) ||\n        (!Array.isArray(cors) &&\n          typeof cors === 'object' &&\n          'origins' in cors &&\n          cors.origins.indexOf(requestOrigin!) > -1)\n      ) {\n        headers.set('Access-Control-Allow-Credentials', 'true')\n        headers.set('Access-Control-Allow-Origin', requestOrigin!)\n      }\n    }\n  }\n\n  return headers\n}\n"],"names":["headersWithCors","headers","req","cors","payload","config","requestOrigin","get","defaultAllowedHeaders","has","set","filter","Boolean","join","origins","Array","isArray","indexOf"],"mappings":"AAMA,OAAO,MAAMA,kBAAkB,CAAC,EAAEC,OAAO,EAAEC,GAAG,EAAY;IACxD,MAAMC,OAAOD,KAAKE,SAASC,OAAOF;IAClC,MAAMG,gBAAgBJ,KAAKD,SAASM,IAAI;IAExC,IAAIJ,MAAM;QACR,MAAMK,wBAAwB;YAC5B;YACA;YACA;YACA;YACA;YACA;YACA;YACA;SACD;QAED,2EAA2E;QAC3E,IAAI,CAACP,QAAQQ,GAAG,CAAC,iCAAiC;YAChDR,QAAQS,GAAG,CAAC,gCAAgC;QAC9C;QAEA,IAAI,CAACT,QAAQQ,GAAG,CAAC,iCAAiC;YAChD,IAAI,OAAON,SAAS,YAAY,aAAaA,MAAM;gBACjDF,QAAQS,GAAG,CACT,gCACA;uBAAIF;uBAA2BL,KAAKF,OAAO,IAAI,EAAE;iBAAE,CAACU,MAAM,CAACC,SAASC,IAAI,CAAC;YAE7E,OAAO;gBACLZ,QAAQS,GAAG,CAAC,gCAAgCF,sBAAsBK,IAAI,CAAC;YACzE;QACF;QAEA,IAAI,CAACZ,QAAQQ,GAAG,CAAC,gCAAgC;YAC/C,IAAIN,SAAS,OAAQ,OAAOA,SAAS,YAAY,aAAaA,QAAQA,KAAKW,OAAO,KAAK,KAAM;gBAC3Fb,QAAQS,GAAG,CAAC,+BAA+B;YAC7C,OAAO,IACL,AAACK,MAAMC,OAAO,CAACb,SAASA,KAAKc,OAAO,CAACX,iBAAkB,CAAC,KACvD,CAACS,MAAMC,OAAO,CAACb,SACd,OAAOA,SAAS,YAChB,aAAaA,QACbA,KAAKW,OAAO,CAACG,OAAO,CAACX,iBAAkB,CAAC,GAC1C;gBACAL,QAAQS,GAAG,CAAC,oCAAoC;gBAChDT,QAAQS,GAAG,CAAC,+BAA+BJ;YAC7C;QACF;IACF;IAEA,OAAOL;AACT,EAAC"}