payload 4.0.0-internal.ea6e8f8 → 4.0.0-internal.ee5d8bd

package/dist/auth/refreshAuthToken.js

@@ -0,0 +1,113 @@
+import { defaultRefreshTokenExpiration } from '../collections/config/defaults.js';
+import { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js';
+import { getFieldsToSign } from './getFieldsToSign.js';
+import { jwtSign } from './jwt.js';
+import { removeExpiredSessions, revokeSession } from './sessions.js';
+/**
+ * How long an already used refresh token still works, in milliseconds. Clients that send requests
+ * in parallel can refresh twice at once.
+ */ const reuseInterval = 30 * 1000;
+/**
+ * Trades a refresh token from `createAuthToken` or an earlier refresh for a new token and a new
+ * refresh token. Every refresh moves the session's `expiresAt`, which the refresh token remembers,
+ * so a refresh token with an outdated one was already used. That means it was copied, and its
+ * session is logged out.
+ *
+ * @returns `null` when the refresh token is invalid, its session ended, or it was reused
+ */ export const refreshAuthToken = async ({ collection, refreshToken, req })=>{
+    assertNoValidationWrite(req);
+    const contents = readRefreshToken({
+        refreshToken,
+        req
+    });
+    const collectionConfig = contents && req.payload.collections[contents.collection]?.config;
+    if (!contents || !collectionConfig || collection && collection !== contents.collection) {
+        return null;
+    }
+    const user = await req.payload.db.findOne({
+        collection: collectionConfig.slug,
+        req,
+        where: {
+            id: {
+                equals: contents.userID
+            }
+        }
+    });
+    const session = removeExpiredSessions(user?.sessions ?? []).find(({ id })=>id === contents.sid);
+    if (!user || !session) {
+        return null;
+    }
+    const expiration = getRefreshTokenExpiration(collectionConfig);
+    const sessionExpiresAt = new Date(session.expiresAt).getTime();
+    const refreshedAt = sessionExpiresAt - expiration * 1000;
+    if (sessionExpiresAt === contents.expiresAt) {
+        session.expiresAt = new Date(Date.now() + expiration * 1000);
+        await req.payload.db.updateOne({
+            id: user.id,
+            collection: collectionConfig.slug,
+            data: {
+                ...user,
+                // Prevent updatedAt from being updated when only refreshing a session
+                sessions: removeExpiredSessions(user.sessions),
+                updatedAt: null
+            },
+            req,
+            returning: false
+        });
+    } else if (Date.now() - refreshedAt >= reuseInterval) {
+        await revokeSession({
+            collectionConfig,
+            payload: req.payload,
+            req,
+            sid: session.id,
+            user
+        });
+        return null;
+    }
+    // Otherwise the client refreshed twice at once, and gets the current session again
+    const { exp, token } = await jwtSign({
+        fieldsToSign: getFieldsToSign({
+            collectionConfig,
+            email: user.email,
+            sid: session.id,
+            user
+        }),
+        secret: req.payload.secret,
+        tokenExpiration: collectionConfig.auth.tokenExpiration
+    });
+    return {
+        collectionConfig,
+        exp,
+        refreshToken: createRefreshToken({
+            collectionConfig,
+            req,
+            session,
+            userID: user.id
+        }),
+        token,
+        user
+    };
+};
+/** How many seconds a session with a refresh token lasts from each refresh. */ export const getRefreshTokenExpiration = (collectionConfig)=>collectionConfig.auth.refreshTokens ? collectionConfig.auth.refreshTokens.expiration : defaultRefreshTokenExpiration;
+export const createRefreshToken = ({ collectionConfig, req, session, userID })=>req.payload.encrypt(JSON.stringify({
+        collection: collectionConfig.slug,
+        expiresAt: new Date(session.expiresAt).getTime(),
+        sid: session.id,
+        userID
+    }));
+const readRefreshToken = ({ refreshToken, req })=>{
+    // Only the v1 format is authenticated. Older formats decrypt anything without an error.
+    if (!refreshToken.startsWith('v1:')) {
+        return undefined;
+    }
+    try {
+        // Only the current secret, since previous secrets can be public, like a default from source code
+        return JSON.parse(req.payload.decrypt(refreshToken, {
+            secret: req.payload.config.secret
+        }));
+    } catch  {
+        return undefined;
+    }
+};
+
+//# sourceMappingURL=refreshAuthToken.js.map

package/dist/auth/refreshAuthToken.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth/refreshAuthToken.ts"],"sourcesContent":["import type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, UserSession } from '../index.js'\nimport type { PayloadRequest } from '../types/index.js'\n\nimport { defaultRefreshTokenExpiration } from '../collections/config/defaults.js'\nimport { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js'\nimport { getFieldsToSign } from './getFieldsToSign.js'\nimport { jwtSign } from './jwt.js'\nimport { removeExpiredSessions, revokeSession } from './sessions.js'\n\n/**\n * How long an already used refresh token still works, in milliseconds. Clients that send requests\n * in parallel can refresh twice at once.\n */\nconst reuseInterval = 30 * 1000\n\n/** What a refresh token points to. It's encrypted, so clients can't read or change it. */\ntype RefreshTokenContents = {\n  collection: string\n  /** The session's `expiresAt` when the refresh token was created. Every refresh moves it. */\n  expiresAt: number\n  sid: string\n  userID: number | string\n}\n\n/**\n * Trades a refresh token from `createAuthToken` or an earlier refresh for a new token and a new\n * refresh token. Every refresh moves the session's `expiresAt`, which the refresh token remembers,\n * so a refresh token with an outdated one was already used. That means it was copied, and its\n * session is logged out.\n *\n * @returns `null` when the refresh token is invalid, its session ended, or it was reused\n */\nexport const refreshAuthToken = async ({\n  collection,\n  refreshToken,\n  req,\n}: {\n  /** Only accept refresh tokens of this collection. */\n  collection?: string\n  refreshToken: string\n  req: PayloadRequest\n}): Promise<{\n  collectionConfig: SanitizedCollectionConfig\n  exp: number\n  refreshToken: string\n  token: string\n  user: AuthenticatedUser\n} | null> => {\n  assertNoValidationWrite(req)\n\n  const contents = readRefreshToken({ refreshToken, req })\n  const collectionConfig = contents && req.payload.collections[contents.collection]?.config\n\n  if (!contents || !collectionConfig || (collection && collection !== contents.collection)) {\n    return null\n  }\n\n  const user = await req.payload.db.findOne<AuthenticatedUser>({\n    collection: collectionConfig.slug,\n    req,\n    where: { id: { equals: contents.userID } },\n  })\n  const session = removeExpiredSessions(user?.sessions ?? []).find(({ id }) => id === contents.sid)\n\n  if (!user || !session) {\n    return null\n  }\n\n  const expiration = getRefreshTokenExpiration(collectionConfig)\n  const sessionExpiresAt = new Date(session.expiresAt).getTime()\n  const refreshedAt = sessionExpiresAt - expiration * 1000\n\n  if (sessionExpiresAt === contents.expiresAt) {\n    session.expiresAt = new Date(Date.now() + expiration * 1000)\n\n    await req.payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only refreshing a session\n        sessions: removeExpiredSessions(user.sessions!),\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n  } else if (Date.now() - refreshedAt >= reuseInterval) {\n    await revokeSession({ collectionConfig, payload: req.payload, req, sid: session.id, user })\n\n    return null\n  }\n  // Otherwise the client refreshed twice at once, and gets the current session again\n\n  const { exp, token } = await jwtSign({\n    fieldsToSign: getFieldsToSign({ collectionConfig, email: user.email!, sid: session.id, user }),\n    secret: req.payload.secret,\n    tokenExpiration: collectionConfig.auth.tokenExpiration,\n  })\n\n  return {\n    collectionConfig,\n    exp,\n    refreshToken: createRefreshToken({ collectionConfig, req, session, userID: user.id }),\n    token,\n    user,\n  }\n}\n\n/** How many seconds a session with a refresh token lasts from each refresh. */\nexport const getRefreshTokenExpiration = (collectionConfig: SanitizedCollectionConfig): number =>\n  collectionConfig.auth.refreshTokens\n    ? collectionConfig.auth.refreshTokens.expiration\n    : defaultRefreshTokenExpiration\n\nexport const createRefreshToken = ({\n  collectionConfig,\n  req,\n  session,\n  userID,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  req: PayloadRequest\n  session: UserSession\n  userID: number | string\n}): string =>\n  req.payload.encrypt(\n    JSON.stringify({\n      collection: collectionConfig.slug,\n      expiresAt: new Date(session.expiresAt).getTime(),\n      sid: session.id,\n      userID,\n    } satisfies RefreshTokenContents),\n  )\n\nconst readRefreshToken = ({\n  refreshToken,\n  req,\n}: {\n  refreshToken: string\n  req: PayloadRequest\n}): RefreshTokenContents | undefined => {\n  // Only the v1 format is authenticated. Older formats decrypt anything without an error.\n  if (!refreshToken.startsWith('v1:')) {\n    return undefined\n  }\n\n  try {\n    // Only the current secret, since previous secrets can be public, like a default from source code\n    return JSON.parse(req.payload.decrypt(refreshToken, { secret: req.payload.config.secret }))\n  } catch {\n    return undefined\n  }\n}\n"],"names":["defaultRefreshTokenExpiration","assertNoValidationWrite","getFieldsToSign","jwtSign","removeExpiredSessions","revokeSession","reuseInterval","refreshAuthToken","collection","refreshToken","req","contents","readRefreshToken","collectionConfig","payload","collections","config","user","db","findOne","slug","where","id","equals","userID","session","sessions","find","sid","expiration","getRefreshTokenExpiration","sessionExpiresAt","Date","expiresAt","getTime","refreshedAt","now","updateOne","data","updatedAt","returning","exp","token","fieldsToSign","email","secret","tokenExpiration","auth","createRefreshToken","refreshTokens","encrypt","JSON","stringify","startsWith","undefined","parse","decrypt"],"mappings":"AAIA,SAASA,6BAA6B,QAAQ,oCAAmC;AACjF,SAASC,uBAAuB,QAAQ,0CAAyC;AACjF,SAASC,eAAe,QAAQ,uBAAsB;AACtD,SAASC,OAAO,QAAQ,WAAU;AAClC,SAASC,qBAAqB,EAAEC,aAAa,QAAQ,gBAAe;AAEpE;;;CAGC,GACD,MAAMC,gBAAgB,KAAK;AAW3B;;;;;;;CAOC,GACD,OAAO,MAAMC,mBAAmB,OAAO,EACrCC,UAAU,EACVC,YAAY,EACZC,GAAG,EAMJ;IAOCT,wBAAwBS;IAExB,MAAMC,WAAWC,iBAAiB;QAAEH;QAAcC;IAAI;IACtD,MAAMG,mBAAmBF,YAAYD,IAAII,OAAO,CAACC,WAAW,CAACJ,SAASH,UAAU,CAAC,EAAEQ;IAEnF,IAAI,CAACL,YAAY,CAACE,oBAAqBL,cAAcA,eAAeG,SAASH,UAAU,EAAG;QACxF,OAAO;IACT;IAEA,MAAMS,OAAO,MAAMP,IAAII,OAAO,CAACI,EAAE,CAACC,OAAO,CAAoB;QAC3DX,YAAYK,iBAAiBO,IAAI;QACjCV;QACAW,OAAO;YAAEC,IAAI;gBAAEC,QAAQZ,SAASa,MAAM;YAAC;QAAE;IAC3C;IACA,MAAMC,UAAUrB,sBAAsBa,MAAMS,YAAY,EAAE,EAAEC,IAAI,CAAC,CAAC,EAAEL,EAAE,EAAE,GAAKA,OAAOX,SAASiB,GAAG;IAEhG,IAAI,CAACX,QAAQ,CAACQ,SAAS;QACrB,OAAO;IACT;IAEA,MAAMI,aAAaC,0BAA0BjB;IAC7C,MAAMkB,mBAAmB,IAAIC,KAAKP,QAAQQ,SAAS,EAAEC,OAAO;IAC5D,MAAMC,cAAcJ,mBAAmBF,aAAa;IAEpD,IAAIE,qBAAqBpB,SAASsB,SAAS,EAAE;QAC3CR,QAAQQ,SAAS,GAAG,IAAID,KAAKA,KAAKI,GAAG,KAAKP,aAAa;QAEvD,MAAMnB,IAAII,OAAO,CAACI,EAAE,CAACmB,SAAS,CAAC;YAC7Bf,IAAIL,KAAKK,EAAE;YACXd,YAAYK,iBAAiBO,IAAI;YACjCkB,MAAM;gBACJ,GAAGrB,IAAI;gBACP,sEAAsE;gBACtES,UAAUtB,sBAAsBa,KAAKS,QAAQ;gBAC7Ca,WAAW;YACb;YACA7B;YACA8B,WAAW;QACb;IACF,OAAO,IAAIR,KAAKI,GAAG,KAAKD,eAAe7B,eAAe;QACpD,MAAMD,cAAc;YAAEQ;YAAkBC,SAASJ,IAAII,OAAO;YAAEJ;YAAKkB,KAAKH,QAAQH,EAAE;YAAEL;QAAK;QAEzF,OAAO;IACT;IACA,mFAAmF;IAEnF,MAAM,EAAEwB,GAAG,EAAEC,KAAK,EAAE,GAAG,MAAMvC,QAAQ;QACnCwC,cAAczC,gBAAgB;YAAEW;YAAkB+B,OAAO3B,KAAK2B,KAAK;YAAGhB,KAAKH,QAAQH,EAAE;YAAEL;QAAK;QAC5F4B,QAAQnC,IAAII,OAAO,CAAC+B,MAAM;QAC1BC,iBAAiBjC,iBAAiBkC,IAAI,CAACD,eAAe;IACxD;IAEA,OAAO;QACLjC;QACA4B;QACAhC,cAAcuC,mBAAmB;YAAEnC;YAAkBH;YAAKe;YAASD,QAAQP,KAAKK,EAAE;QAAC;QACnFoB;QACAzB;IACF;AACF,EAAC;AAED,6EAA6E,GAC7E,OAAO,MAAMa,4BAA4B,CAACjB,mBACxCA,iBAAiBkC,IAAI,CAACE,aAAa,GAC/BpC,iBAAiBkC,IAAI,CAACE,aAAa,CAACpB,UAAU,GAC9C7B,8BAA6B;AAEnC,OAAO,MAAMgD,qBAAqB,CAAC,EACjCnC,gBAAgB,EAChBH,GAAG,EACHe,OAAO,EACPD,MAAM,EAMP,GACCd,IAAII,OAAO,CAACoC,OAAO,CACjBC,KAAKC,SAAS,CAAC;QACb5C,YAAYK,iBAAiBO,IAAI;QACjCa,WAAW,IAAID,KAAKP,QAAQQ,SAAS,EAAEC,OAAO;QAC9CN,KAAKH,QAAQH,EAAE;QACfE;IACF,IACD;AAEH,MAAMZ,mBAAmB,CAAC,EACxBH,YAAY,EACZC,GAAG,EAIJ;IACC,wFAAwF;IACxF,IAAI,CAACD,aAAa4C,UAAU,CAAC,QAAQ;QACnC,OAAOC;IACT;IAEA,IAAI;QACF,iGAAiG;QACjG,OAAOH,KAAKI,KAAK,CAAC7C,IAAII,OAAO,CAAC0C,OAAO,CAAC/C,cAAc;YAAEoC,QAAQnC,IAAII,OAAO,CAACE,MAAM,CAAC6B,MAAM;QAAC;IAC1F,EAAE,OAAM;QACN,OAAOS;IACT;AACF"}

package/dist/auth/serverFunctions/cookies.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/serverFunctions/cookies.ts"],"sourcesContent":["import type { CookieOptions } from '../../admin/adapters/cookies.js'\nimport type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { Auth } from '../types.js'\n\nimport { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js'\n\n/**\n * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`\n * when `returnCookieAsObject` is `true`.\n */\nexport type GeneratedCookie = {\n  domain?: string\n  expires?: string\n  httpOnly?: boolean\n  maxAge?: number\n  name: string\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n  value: string | undefined\n}\n\n// `generateCookie` emits capitalized `SameSite` values (as they appear in the\n// header); `CookieOptions` takes the lowercase form.\nconst toCookieOptions = (cookie: GeneratedCookie): CookieOptions => ({\n  domain: cookie.domain,\n  expires: cookie.expires ? new Date(cookie.expires) : undefined,\n  httpOnly: cookie.httpOnly,\n  maxAge: cookie.maxAge,\n  path: cookie.path,\n  sameSite: cookie.sameSite?.toLowerCase() as CookieOptions['sameSite'],\n  secure: cookie.secure,\n})\n\ntype AuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}\n\n/** Writes an already-generated cookie through the framework's cookie API. */\nexport async function applyAuthCookie({\n  cookie,\n  serverAdapter,\n}: {\n  cookie: GeneratedCookie\n  serverAdapter: ServerAdapter\n}): Promise<void> {\n  if (!cookie.value) {\n    return\n  }\n\n  await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie))\n}\n\n/** Writes the Payload auth cookie for `token` through the framework's cookie API. */\nexport async function setAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n  token,\n}: { token: string } & AuthCookieArgs): Promise<void> {\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n    token,\n  }) as GeneratedCookie\n\n  await applyAuthCookie({ cookie, serverAdapter })\n}\n\n/**\n * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`\n * attributes it was set with — a mismatched `domain` leaves the original cookie\n * in place.\n */\nexport async function clearAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n}: AuthCookieArgs): Promise<void> {\n  const cookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n  }) as GeneratedCookie\n\n  await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie))\n}\n\n/** Reads the request's existing Payload auth cookie, if any. */\nexport async function getExistingAuthToken({\n  cookiePrefix,\n  serverAdapter,\n}: {\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}): Promise<{ name: string; value: string } | undefined> {\n  const store = await serverAdapter.getCookies()\n  const allCookies = store.getAll?.()\n\n  if (allCookies) {\n    return allCookies.find((cookie) => cookie.name.startsWith(cookiePrefix))\n  }\n\n  return store.get(`${cookiePrefix}-token`) ?? undefined\n}\n"],"names":["generateExpiredPayloadCookie","generatePayloadCookie","toCookieOptions","cookie","domain","expires","Date","undefined","httpOnly","maxAge","path","sameSite","toLowerCase","secure","applyAuthCookie","serverAdapter","value","setCookie","name","setAuthCookie","authConfig","cookiePrefix","token","collectionAuthConfig","returnCookieAsObject","clearAuthCookie","getExistingAuthToken","store","getCookies","allCookies","getAll","find","startsWith","get"],"mappings":"AAIA,SAASA,4BAA4B,EAAEC,qBAAqB,QAAQ,gBAAe;AAkBnF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAMC,kBAAkB,CAACC,SAA4C,CAAA;QACnEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO,GAAG,IAAIC,KAAKH,OAAOE,OAAO,IAAIE;QACrDC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,MAAMP,OAAOO,IAAI;QACjBC,UAAUR,OAAOQ,QAAQ,EAAEC;QAC3BC,QAAQV,OAAOU,MAAM;IACvB,CAAA;AAQA,2EAA2E,GAC3E,OAAO,eAAeC,gBAAgB,EACpCX,MAAM,EACNY,aAAa,EAId;IACC,IAAI,CAACZ,OAAOa,KAAK,EAAE;QACjB;IACF;IAEA,MAAMD,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAEf,OAAOa,KAAK,EAAEd,gBAAgBC;AAC3E;AAEA,mFAAmF,GACnF,OAAO,eAAegB,cAAc,EAClCC,UAAU,EACVC,YAAY,EACZN,aAAa,EACbO,KAAK,EAC8B;IACnC,MAAMnB,SAASF,sBAAsB;QACnCsB,sBAAsBH;QACtBC;QACAG,sBAAsB;QACtBF;IACF;IAEA,MAAMR,gBAAgB;QAAEX;QAAQY;IAAc;AAChD;AAEA;;;;CAIC,GACD,OAAO,eAAeU,gBAAgB,EACpCL,UAAU,EACVC,YAAY,EACZN,aAAa,EACE;IACf,MAAMZ,SAASH,6BAA6B;QAC1CuB,sBAAsBH;QACtBC;QACAG,sBAAsB;IACxB;IAEA,MAAMT,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAE,IAAIhB,gBAAgBC;AACjE;AAEA,8DAA8D,GAC9D,OAAO,eAAeuB,qBAAqB,EACzCL,YAAY,EACZN,aAAa,EAId;IACC,MAAMY,QAAQ,MAAMZ,cAAca,UAAU;IAC5C,MAAMC,aAAaF,MAAMG,MAAM;IAE/B,IAAID,YAAY;QACd,OAAOA,WAAWE,IAAI,CAAC,CAAC5B,SAAWA,OAAOe,IAAI,CAACc,UAAU,CAACX;IAC5D;IAEA,OAAOM,MAAMM,GAAG,CAAC,GAAGZ,aAAa,MAAM,CAAC,KAAKd;AAC/C"}
+{"version":3,"sources":["../../../src/auth/serverFunctions/cookies.ts"],"sourcesContent":["import type { CookieOptions } from '../../admin/adapters/cookies.js'\nimport type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { Auth } from '../types.js'\n\nimport { generateExpiredPayloadCookie, generatePayloadCookie } from '../cookies.js'\n\n/**\n * Object form returned by `generatePayloadCookie`/`generateExpiredPayloadCookie`\n * when `returnCookieAsObject` is `true`.\n */\nexport type GeneratedCookie = {\n  domain?: string\n  expires?: string\n  httpOnly?: boolean\n  maxAge?: number\n  name: string\n  path?: string\n  sameSite?: 'Lax' | 'None' | 'Strict'\n  secure?: boolean\n  value: string | undefined\n}\n\n// `generateCookie` emits capitalized `SameSite` values (as they appear in the\n// header); `CookieOptions` takes the lowercase form.\nconst toCookieOptions = (cookie: GeneratedCookie): CookieOptions => ({\n  domain: cookie.domain,\n  expires: cookie.expires ? new Date(cookie.expires) : undefined,\n  httpOnly: cookie.httpOnly,\n  maxAge: cookie.maxAge,\n  path: cookie.path,\n  sameSite: cookie.sameSite?.toLowerCase() as CookieOptions['sameSite'],\n  secure: cookie.secure,\n})\n\ntype AuthCookieArgs = {\n  authConfig: Auth\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}\n\n/** Writes an already-generated cookie through the framework's cookie API. */\nexport async function applyAuthCookie({\n  cookie,\n  serverAdapter,\n}: {\n  cookie: GeneratedCookie\n  serverAdapter: ServerAdapter\n}): Promise<void> {\n  if (!cookie.value) {\n    return\n  }\n\n  await serverAdapter.setCookie(cookie.name, cookie.value, toCookieOptions(cookie))\n}\n\n/** Writes the Payload auth cookie for `token` through the framework's cookie API. */\nexport async function setAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n  token,\n}: { token: string } & AuthCookieArgs): Promise<void> {\n  const cookie = generatePayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n    token,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n}\n\n/**\n * Expires the Payload auth cookie. Written with the same `domain`/`path`/`secure`\n * attributes it was set with — a mismatched `domain` leaves the original cookie\n * in place.\n */\nexport async function clearAuthCookie({\n  authConfig,\n  cookiePrefix,\n  serverAdapter,\n}: AuthCookieArgs): Promise<void> {\n  const cookie = generateExpiredPayloadCookie({\n    collectionAuthConfig: authConfig,\n    cookiePrefix,\n    returnCookieAsObject: true,\n  })\n\n  await serverAdapter.setCookie(cookie.name, '', toCookieOptions(cookie))\n}\n\n/** Reads the request's existing Payload auth cookie, if any. */\nexport async function getExistingAuthToken({\n  cookiePrefix,\n  serverAdapter,\n}: {\n  cookiePrefix: string\n  serverAdapter: ServerAdapter\n}): Promise<{ name: string; value: string } | undefined> {\n  const store = await serverAdapter.getCookies()\n  const allCookies = store.getAll?.()\n\n  if (allCookies) {\n    return allCookies.find((cookie) => cookie.name.startsWith(cookiePrefix))\n  }\n\n  return store.get(`${cookiePrefix}-token`) ?? undefined\n}\n"],"names":["generateExpiredPayloadCookie","generatePayloadCookie","toCookieOptions","cookie","domain","expires","Date","undefined","httpOnly","maxAge","path","sameSite","toLowerCase","secure","applyAuthCookie","serverAdapter","value","setCookie","name","setAuthCookie","authConfig","cookiePrefix","token","collectionAuthConfig","returnCookieAsObject","clearAuthCookie","getExistingAuthToken","store","getCookies","allCookies","getAll","find","startsWith","get"],"mappings":"AAIA,SAASA,4BAA4B,EAAEC,qBAAqB,QAAQ,gBAAe;AAkBnF,8EAA8E;AAC9E,qDAAqD;AACrD,MAAMC,kBAAkB,CAACC,SAA4C,CAAA;QACnEC,QAAQD,OAAOC,MAAM;QACrBC,SAASF,OAAOE,OAAO,GAAG,IAAIC,KAAKH,OAAOE,OAAO,IAAIE;QACrDC,UAAUL,OAAOK,QAAQ;QACzBC,QAAQN,OAAOM,MAAM;QACrBC,MAAMP,OAAOO,IAAI;QACjBC,UAAUR,OAAOQ,QAAQ,EAAEC;QAC3BC,QAAQV,OAAOU,MAAM;IACvB,CAAA;AAQA,2EAA2E,GAC3E,OAAO,eAAeC,gBAAgB,EACpCX,MAAM,EACNY,aAAa,EAId;IACC,IAAI,CAACZ,OAAOa,KAAK,EAAE;QACjB;IACF;IAEA,MAAMD,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAEf,OAAOa,KAAK,EAAEd,gBAAgBC;AAC3E;AAEA,mFAAmF,GACnF,OAAO,eAAegB,cAAc,EAClCC,UAAU,EACVC,YAAY,EACZN,aAAa,EACbO,KAAK,EAC8B;IACnC,MAAMnB,SAASF,sBAAsB;QACnCsB,sBAAsBH;QACtBC;QACAG,sBAAsB;QACtBF;IACF;IAEA,MAAMR,gBAAgB;QAAEX;QAAQY;IAAc;AAChD;AAEA;;;;CAIC,GACD,OAAO,eAAeU,gBAAgB,EACpCL,UAAU,EACVC,YAAY,EACZN,aAAa,EACE;IACf,MAAMZ,SAASH,6BAA6B;QAC1CuB,sBAAsBH;QACtBC;QACAG,sBAAsB;IACxB;IAEA,MAAMT,cAAcE,SAAS,CAACd,OAAOe,IAAI,EAAE,IAAIhB,gBAAgBC;AACjE;AAEA,8DAA8D,GAC9D,OAAO,eAAeuB,qBAAqB,EACzCL,YAAY,EACZN,aAAa,EAId;IACC,MAAMY,QAAQ,MAAMZ,cAAca,UAAU;IAC5C,MAAMC,aAAaF,MAAMG,MAAM;IAE/B,IAAID,YAAY;QACd,OAAOA,WAAWE,IAAI,CAAC,CAAC5B,SAAWA,OAAOe,IAAI,CAACc,UAAU,CAACX;IAC5D;IAEA,OAAOM,MAAMM,GAAG,CAAC,GAAGZ,aAAa,MAAM,CAAC,KAAKd;AAC/C"}

package/dist/auth/serverFunctions/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/auth/serverFunctions/login.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\nimport type { LoginResult } from '../operations/login.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\nimport { applyAuthCookie } from './cookies.js'\n\nexport type LoginArgs<TSlug extends AuthCollectionSlug> = {\n  collection: TSlug\n  config: MaybePromise<SanitizedConfig>\n  password: string\n  serverAdapter: ServerAdapter\n} & ({ email: string; username?: never } | { email?: never; username: string })\n\n/**\n * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.\n * Distributes over the email/username union so the either-or survives; a plain\n * `Omit` collapses the union and accepts both keys at once.\n */\nexport type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> =\n  LoginArgs<TSlug> extends infer TArgs\n    ? TArgs extends unknown\n      ? Omit<TArgs, 'serverAdapter'>\n      : never\n    : never\n\n/**\n * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,\n * so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function login<TSlug extends AuthCollectionSlug>({\n  collection,\n  config,\n  email,\n  password,\n  serverAdapter,\n  username,\n}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>> {\n  const payload = await getPayload({ config, cron: true })\n\n  const authConfig = payload.collections[collection]?.config.auth\n\n  if (!authConfig) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const loginWithUsername = authConfig.loginWithUsername ?? false\n\n  if (loginWithUsername) {\n    if (loginWithUsername.allowEmailLogin) {\n      if (!email && !username) {\n        throw new Error('Email or username is required.')\n      }\n    } else {\n      if (!username) {\n        throw new Error('Username is required.')\n      }\n    }\n  } else {\n    if (!email) {\n      throw new Error('Email is required.')\n    }\n  }\n\n  let loginData\n\n  if (loginWithUsername) {\n    loginData = username ? { password, username } : { email, password }\n  } else {\n    loginData = { email, password }\n  }\n\n  const collectionConfig = payload.collections[collection]!\n\n  const { cookie, result } = await loginWithCookie({\n    collection: collectionConfig,\n    data: loginData as Parameters<typeof loginWithCookie>[0]['data'],\n    overrideAccess: true,\n    req: await createPayloadRequest({ payload }),\n    returnCookieAsObject: true,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n\n  return result as LoginResult<TSlug>\n}\n"],"names":["getPayload","createPayloadRequest","loginWithCookie","applyAuthCookie","login","collection","config","email","password","serverAdapter","username","payload","cron","authConfig","collections","auth","Error","loginWithUsername","allowEmailLogin","loginData","collectionConfig","cookie","result","data","overrideAccess","req","returnCookieAsObject"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,eAAc;AAqB9C;;;CAGC,GACD,OAAO,eAAeC,MAAwC,EAC5DC,UAAU,EACVC,MAAM,EACNC,KAAK,EACLC,QAAQ,EACRC,aAAa,EACbC,QAAQ,EACS;IACjB,MAAMC,UAAU,MAAMX,WAAW;QAAEM;QAAQM,MAAM;IAAK;IAEtD,MAAMC,aAAaF,QAAQG,WAAW,CAACT,WAAW,EAAEC,OAAOS;IAE3D,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM,CAAC,qCAAqC,EAAEX,YAAY;IACtE;IAEA,MAAMY,oBAAoBJ,WAAWI,iBAAiB,IAAI;IAE1D,IAAIA,mBAAmB;QACrB,IAAIA,kBAAkBC,eAAe,EAAE;YACrC,IAAI,CAACX,SAAS,CAACG,UAAU;gBACvB,MAAM,IAAIM,MAAM;YAClB;QACF,OAAO;YACL,IAAI,CAACN,UAAU;gBACb,MAAM,IAAIM,MAAM;YAClB;QACF;IACF,OAAO;QACL,IAAI,CAACT,OAAO;YACV,MAAM,IAAIS,MAAM;QAClB;IACF;IAEA,IAAIG;IAEJ,IAAIF,mBAAmB;QACrBE,YAAYT,WAAW;YAAEF;YAAUE;QAAS,IAAI;YAAEH;YAAOC;QAAS;IACpE,OAAO;QACLW,YAAY;YAAEZ;YAAOC;QAAS;IAChC;IAEA,MAAMY,mBAAmBT,QAAQG,WAAW,CAACT,WAAW;IAExD,MAAM,EAAEgB,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMpB,gBAAgB;QAC/CG,YAAYe;QACZG,MAAMJ;QACNK,gBAAgB;QAChBC,KAAK,MAAMxB,qBAAqB;YAAEU;QAAQ;QAC1Ce,sBAAsB;IACxB;IAEA,MAAMvB,gBAAgB;QAAEkB;QAAQZ;IAAc;IAE9C,OAAOa;AACT"}
+{"version":3,"sources":["../../../src/auth/serverFunctions/login.ts"],"sourcesContent":["import type { ServerAdapter } from '../../admin/adapters/server.js'\nimport type { SanitizedConfig } from '../../config/types.js'\nimport type { AuthCollectionSlug } from '../../index.js'\nimport type { MaybePromise } from '../../types/index.js'\nimport type { LoginResult } from '../operations/login.js'\n\nimport { getPayload } from '../../index.js'\nimport { createPayloadRequest } from '../../utilities/createPayloadRequest.js'\nimport { loginWithCookie } from '../loginWithCookie.js'\nimport { applyAuthCookie } from './cookies.js'\n\nexport type LoginArgs<TSlug extends AuthCollectionSlug> = {\n  collection: TSlug\n  config: MaybePromise<SanitizedConfig>\n  password: string\n  serverAdapter: ServerAdapter\n} & ({ email: string; username?: never } | { email?: never; username: string })\n\n/**\n * `LoginArgs` as the adapters expose it — they bind `serverAdapter` themselves.\n * Distributes over the email/username union so the either-or survives; a plain\n * `Omit` collapses the union and accepts both keys at once.\n */\nexport type LoginArgsWithoutServerAdapter<TSlug extends AuthCollectionSlug> =\n  LoginArgs<TSlug> extends infer TArgs\n    ? TArgs extends unknown\n      ? Omit<TArgs, 'serverAdapter'>\n      : never\n    : never\n\n/**\n * Logs a user in and writes the auth cookie through the supplied `serverAdapter`,\n * so the function is framework-agnostic; each adapter binds its own.\n */\nexport async function login<TSlug extends AuthCollectionSlug>({\n  collection,\n  config,\n  email,\n  password,\n  serverAdapter,\n  username,\n}: LoginArgs<TSlug>): Promise<LoginResult<TSlug>> {\n  const payload = await getPayload({ config, cron: true })\n\n  const authConfig = payload.collections[collection]?.config.auth\n\n  if (!authConfig) {\n    throw new Error(`No auth config found for collection: ${collection}`)\n  }\n\n  const loginWithUsername = authConfig.loginWithUsername ?? false\n\n  if (loginWithUsername) {\n    if (loginWithUsername.allowEmailLogin) {\n      if (!email && !username) {\n        throw new Error('Email or username is required.')\n      }\n    } else {\n      if (!username) {\n        throw new Error('Username is required.')\n      }\n    }\n  } else {\n    if (!email) {\n      throw new Error('Email is required.')\n    }\n  }\n\n  let loginData\n\n  if (loginWithUsername) {\n    loginData = username ? { password, username } : { email, password }\n  } else {\n    loginData = { email, password }\n  }\n\n  const collectionConfig = payload.collections[collection]!\n\n  const { cookie, result } = await loginWithCookie({\n    collection: collectionConfig,\n    data: loginData as Parameters<typeof loginWithCookie>[0]['data'],\n    overrideAccess: true,\n    req: await createPayloadRequest({ payload }),\n    returnCookieAsObject: true,\n  })\n\n  await applyAuthCookie({ cookie, serverAdapter })\n\n  return result\n}\n"],"names":["getPayload","createPayloadRequest","loginWithCookie","applyAuthCookie","login","collection","config","email","password","serverAdapter","username","payload","cron","authConfig","collections","auth","Error","loginWithUsername","allowEmailLogin","loginData","collectionConfig","cookie","result","data","overrideAccess","req","returnCookieAsObject"],"mappings":"AAMA,SAASA,UAAU,QAAQ,iBAAgB;AAC3C,SAASC,oBAAoB,QAAQ,0CAAyC;AAC9E,SAASC,eAAe,QAAQ,wBAAuB;AACvD,SAASC,eAAe,QAAQ,eAAc;AAqB9C;;;CAGC,GACD,OAAO,eAAeC,MAAwC,EAC5DC,UAAU,EACVC,MAAM,EACNC,KAAK,EACLC,QAAQ,EACRC,aAAa,EACbC,QAAQ,EACS;IACjB,MAAMC,UAAU,MAAMX,WAAW;QAAEM;QAAQM,MAAM;IAAK;IAEtD,MAAMC,aAAaF,QAAQG,WAAW,CAACT,WAAW,EAAEC,OAAOS;IAE3D,IAAI,CAACF,YAAY;QACf,MAAM,IAAIG,MAAM,CAAC,qCAAqC,EAAEX,YAAY;IACtE;IAEA,MAAMY,oBAAoBJ,WAAWI,iBAAiB,IAAI;IAE1D,IAAIA,mBAAmB;QACrB,IAAIA,kBAAkBC,eAAe,EAAE;YACrC,IAAI,CAACX,SAAS,CAACG,UAAU;gBACvB,MAAM,IAAIM,MAAM;YAClB;QACF,OAAO;YACL,IAAI,CAACN,UAAU;gBACb,MAAM,IAAIM,MAAM;YAClB;QACF;IACF,OAAO;QACL,IAAI,CAACT,OAAO;YACV,MAAM,IAAIS,MAAM;QAClB;IACF;IAEA,IAAIG;IAEJ,IAAIF,mBAAmB;QACrBE,YAAYT,WAAW;YAAEF;YAAUE;QAAS,IAAI;YAAEH;YAAOC;QAAS;IACpE,OAAO;QACLW,YAAY;YAAEZ;YAAOC;QAAS;IAChC;IAEA,MAAMY,mBAAmBT,QAAQG,WAAW,CAACT,WAAW;IAExD,MAAM,EAAEgB,MAAM,EAAEC,MAAM,EAAE,GAAG,MAAMpB,gBAAgB;QAC/CG,YAAYe;QACZG,MAAMJ;QACNK,gBAAgB;QAChBC,KAAK,MAAMxB,qBAAqB;YAAEU;QAAQ;QAC1Ce,sBAAsB;IACxB;IAEA,MAAMvB,gBAAgB;QAAEkB;QAAQZ;IAAc;IAE9C,OAAOa;AACT"}

package/dist/auth/sessions.d.ts

@@ -7,14 +7,21 @@ import type { Payload, PayloadRequest } from '../types/index.js';
 export declare const removeExpiredSessions: (sessions: UserSession[]) => UserSession[];
 /**
  * Adds a session to the user and removes expired sessions
- * @returns The session ID (sid) if sessions are used
+ * @returns The session and its ID (sid) if sessions are used
  */
-export declare const addSessionToUser: ({ collectionConfig, payload, req, user, }: {
+export declare const addSessionToUser: ({ collectionConfig, payload, req, sessionExpiration, user, }: {
     collectionConfig: SanitizedCollectionConfig;
     payload: Payload;
     req: PayloadRequest;
+    /**
+     * Seconds until the session expires.
+     *
+     * @default collectionConfig.auth.tokenExpiration
+     */
+    sessionExpiration?: number;
     user: AuthenticatedUser;
 }) => Promise<{
+    session?: UserSession;
     sid?: string;
 }>;
 export declare const revokeSession: ({ collectionConfig, payload, req, sid, user, }: {

package/dist/auth/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,8CAK1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAuC3B,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAaf,CAAA"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAA;AAC/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIhE;;GAEG;AACH,eAAO,MAAM,qBAAqB,aAAc,WAAW,EAAE,KAAG,WAAW,EAO1E,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,iEAM1B;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,IAAI,EAAE,iBAAiB,CAAA;CACxB,KAAG,OAAO,CAAC;IAAE,OAAO,CAAC,EAAE,WAAW,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAwClD,CAAA;AAED,eAAO,MAAM,aAAa,mDAMvB;IACD,gBAAgB,EAAE,yBAAyB,CAAA;IAC3C,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,cAAc,CAAA;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,KAAG,OAAO,CAAC,IAAI,CAaf,CAAA"}

package/dist/auth/sessions.js

@@ -11,17 +11,17 @@ import { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js
 };
 /**
  * Adds a session to the user and removes expired sessions
- * @returns The session ID (sid) if sessions are used
- */ export const addSessionToUser = async ({ collectionConfig, payload, req, user })=>{
+ * @returns The session and its ID (sid) if sessions are used
+ */ export const addSessionToUser = async ({ collectionConfig, payload, req, sessionExpiration = collectionConfig.auth.tokenExpiration, user })=>{
     assertNoValidationWrite(req);
+    let session;
     let sid;
     if (collectionConfig.auth.useSessions) {
         // Add session to user
         sid = uuid();
         const now = new Date();
-        const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000;
-        const expiresAt = new Date(now.getTime() + tokenExpInMs);
-        const session = {
+        const expiresAt = new Date(now.getTime() + sessionExpiration * 1000);
+        session = {
             id: sid,
             createdAt: now,
             expiresAt
@@ -49,6 +49,7 @@ import { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js
         user._strategy = 'local-jwt';
     }
     return {
+        session,
         sid
     };
 };

package/dist/auth/sessions.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\nimport { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  user: AuthenticatedUser\n}): Promise<{ sid?: string }> => {\n  assertNoValidationWrite(req)\n\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const tokenExpInMs = collectionConfig.auth.tokenExpiration * 1000\n    const expiresAt = new Date(now.getTime() + tokenExpInMs)\n\n    const session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only adding a session\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | User\n}): Promise<void> => {\n  assertNoValidationWrite(req)\n\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","assertNoValidationWrite","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","user","sid","auth","useSessions","tokenExpInMs","tokenExpiration","getTime","session","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC,SAASC,uBAAuB,QAAQ,0CAAyC;AAEjF;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,IAAI,EAML;IACCZ,wBAAwBW;IAExB,IAAIE;IACJ,IAAIJ,iBAAiBK,IAAI,CAACC,WAAW,EAAE;QACrC,sBAAsB;QACtBF,MAAMd;QACN,MAAMI,MAAM,IAAIC;QAChB,MAAMY,eAAeP,iBAAiBK,IAAI,CAACG,eAAe,GAAG;QAC7D,MAAMX,YAAY,IAAIF,KAAKD,IAAIe,OAAO,KAAKF;QAE3C,MAAMG,UAAU;YAAEC,IAAIP;YAAKQ,WAAWlB;YAAKG;QAAU;QAErD,IAAI,CAACM,KAAKV,QAAQ,EAAEoB,QAAQ;YAC1BV,KAAKV,QAAQ,GAAG;gBAACiB;aAAQ;QAC3B,OAAO;YACLP,KAAKV,QAAQ,GAAGD,sBAAsBW,KAAKV,QAAQ;YACnDU,KAAKV,QAAQ,CAACqB,IAAI,CAACJ;QACrB;QAEA,MAAMT,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGhB,IAAI;gBACP,kEAAkE;gBAClEiB,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAlB,KAAKc,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCf,KAAKmB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLlB;IACF;AACF,EAAC;AAED,OAAO,MAAMmB,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHE,GAAG,EACHD,IAAI,EAOL;IACCZ,wBAAwBW;IAExB,IAAIF,iBAAiBK,IAAI,CAACC,WAAW,IAAIH,QAAQA,KAAKV,QAAQ,EAAEoB,QAAQ;QACtEV,KAAKV,QAAQ,GAAGU,KAAKV,QAAQ,CAACG,MAAM,CAAC,CAACc,UAAYA,QAAQC,EAAE,KAAKP;QACjE,MAAMH,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIR,KAAKQ,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMhB;YACND;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/auth/sessions.ts"],"sourcesContent":["import { v4 as uuid } from 'uuid'\n\nimport type { SanitizedCollectionConfig } from '../collections/config/types.js'\nimport type { AuthenticatedUser, User, UserSession } from '../index.js'\nimport type { Payload, PayloadRequest } from '../types/index.js'\n\nimport { assertNoValidationWrite } from '../utilities/assertNoValidationWrite.js'\n\n/**\n * Removes expired sessions from an array of sessions\n */\nexport const removeExpiredSessions = (sessions: UserSession[]): UserSession[] => {\n  const now = new Date()\n\n  return sessions.filter(({ expiresAt }) => {\n    const expiry = expiresAt instanceof Date ? expiresAt : new Date(expiresAt)\n    return expiry > now\n  })\n}\n\n/**\n * Adds a session to the user and removes expired sessions\n * @returns The session and its ID (sid) if sessions are used\n */\nexport const addSessionToUser = async ({\n  collectionConfig,\n  payload,\n  req,\n  sessionExpiration = collectionConfig.auth.tokenExpiration,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  /**\n   * Seconds until the session expires.\n   *\n   * @default collectionConfig.auth.tokenExpiration\n   */\n  sessionExpiration?: number\n  user: AuthenticatedUser\n}): Promise<{ session?: UserSession; sid?: string }> => {\n  assertNoValidationWrite(req)\n\n  let session: undefined | UserSession\n  let sid: string | undefined\n  if (collectionConfig.auth.useSessions) {\n    // Add session to user\n    sid = uuid()\n    const now = new Date()\n    const expiresAt = new Date(now.getTime() + sessionExpiration * 1000)\n\n    session = { id: sid, createdAt: now, expiresAt }\n\n    if (!user.sessions?.length) {\n      user.sessions = [session]\n    } else {\n      user.sessions = removeExpiredSessions(user.sessions)\n      user.sessions.push(session)\n    }\n\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: {\n        ...user,\n        // Prevent updatedAt from being updated when only adding a session\n        updatedAt: null,\n      },\n      req,\n      returning: false,\n    })\n\n    user.collection = collectionConfig.slug\n    user._strategy = 'local-jwt'\n  }\n\n  return {\n    session,\n    sid,\n  }\n}\n\nexport const revokeSession = async ({\n  collectionConfig,\n  payload,\n  req,\n  sid,\n  user,\n}: {\n  collectionConfig: SanitizedCollectionConfig\n  payload: Payload\n  req: PayloadRequest\n  sid: string\n  user: null | User\n}): Promise<void> => {\n  assertNoValidationWrite(req)\n\n  if (collectionConfig.auth.useSessions && user && user.sessions?.length) {\n    user.sessions = user.sessions.filter((session) => session.id !== sid)\n    await payload.db.updateOne({\n      id: user.id,\n      collection: collectionConfig.slug,\n      data: user,\n      req,\n      returning: false,\n    })\n  }\n}\n"],"names":["v4","uuid","assertNoValidationWrite","removeExpiredSessions","sessions","now","Date","filter","expiresAt","expiry","addSessionToUser","collectionConfig","payload","req","sessionExpiration","auth","tokenExpiration","user","session","sid","useSessions","getTime","id","createdAt","length","push","db","updateOne","collection","slug","data","updatedAt","returning","_strategy","revokeSession"],"mappings":"AAAA,SAASA,MAAMC,IAAI,QAAQ,OAAM;AAMjC,SAASC,uBAAuB,QAAQ,0CAAyC;AAEjF;;CAEC,GACD,OAAO,MAAMC,wBAAwB,CAACC;IACpC,MAAMC,MAAM,IAAIC;IAEhB,OAAOF,SAASG,MAAM,CAAC,CAAC,EAAEC,SAAS,EAAE;QACnC,MAAMC,SAASD,qBAAqBF,OAAOE,YAAY,IAAIF,KAAKE;QAChE,OAAOC,SAASJ;IAClB;AACF,EAAC;AAED;;;CAGC,GACD,OAAO,MAAMK,mBAAmB,OAAO,EACrCC,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHC,oBAAoBH,iBAAiBI,IAAI,CAACC,eAAe,EACzDC,IAAI,EAYL;IACCf,wBAAwBW;IAExB,IAAIK;IACJ,IAAIC;IACJ,IAAIR,iBAAiBI,IAAI,CAACK,WAAW,EAAE;QACrC,sBAAsB;QACtBD,MAAMlB;QACN,MAAMI,MAAM,IAAIC;QAChB,MAAME,YAAY,IAAIF,KAAKD,IAAIgB,OAAO,KAAKP,oBAAoB;QAE/DI,UAAU;YAAEI,IAAIH;YAAKI,WAAWlB;YAAKG;QAAU;QAE/C,IAAI,CAACS,KAAKb,QAAQ,EAAEoB,QAAQ;YAC1BP,KAAKb,QAAQ,GAAG;gBAACc;aAAQ;QAC3B,OAAO;YACLD,KAAKb,QAAQ,GAAGD,sBAAsBc,KAAKb,QAAQ;YACnDa,KAAKb,QAAQ,CAACqB,IAAI,CAACP;QACrB;QAEA,MAAMN,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIL,KAAKK,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAM;gBACJ,GAAGb,IAAI;gBACP,kEAAkE;gBAClEc,WAAW;YACb;YACAlB;YACAmB,WAAW;QACb;QAEAf,KAAKW,UAAU,GAAGjB,iBAAiBkB,IAAI;QACvCZ,KAAKgB,SAAS,GAAG;IACnB;IAEA,OAAO;QACLf;QACAC;IACF;AACF,EAAC;AAED,OAAO,MAAMe,gBAAgB,OAAO,EAClCvB,gBAAgB,EAChBC,OAAO,EACPC,GAAG,EACHM,GAAG,EACHF,IAAI,EAOL;IACCf,wBAAwBW;IAExB,IAAIF,iBAAiBI,IAAI,CAACK,WAAW,IAAIH,QAAQA,KAAKb,QAAQ,EAAEoB,QAAQ;QACtEP,KAAKb,QAAQ,GAAGa,KAAKb,QAAQ,CAACG,MAAM,CAAC,CAACW,UAAYA,QAAQI,EAAE,KAAKH;QACjE,MAAMP,QAAQc,EAAE,CAACC,SAAS,CAAC;YACzBL,IAAIL,KAAKK,EAAE;YACXM,YAAYjB,iBAAiBkB,IAAI;YACjCC,MAAMb;YACNJ;YACAmB,WAAW;QACb;IACF;AACF,EAAC"}

package/dist/auth/types.d.ts

@@ -250,6 +250,27 @@ export interface IncomingAuthType {
      * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.
      */
     maxLoginAttempts?: number;
+    /**
+     * Lets clients stay logged in after their token expires. Logins also return a refresh token,
+     * which the refresh operation trades for a new token and a new refresh token. Each refresh token
+     * works once: when a used one comes back, its session is logged out. Requires `useSessions`.
+     *
+     * Refresh tokens don't expire on their own. They work as long as their login session, which lasts
+     * `expiration` from the last refresh instead of `tokenExpiration`.
+     *
+     * @default false
+     * @link https://payloadcms.com/docs/authentication/overview#refresh-tokens
+     */
+    refreshTokens?: {
+        /**
+         * How many seconds a login session with a refresh token lasts without a refresh, which is
+         * how long its refresh token can be used. Every refresh starts this time again. The token
+         * itself still expires after `tokenExpiration`.
+         *
+         * @default 2592000 (30 days)
+         */
+        expiration?: number;
+    } | boolean;
     /***
      * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.
      */
@@ -295,9 +316,12 @@ export type VerifyConfig = {
     generateEmailHTML?: GenerateVerifyEmailHTML;
     generateEmailSubject?: GenerateVerifyEmailSubject;
 };
-export interface Auth extends Omit<IncomingAuthType, 'cookies' | 'forgotPassword' | 'lockTime' | 'loginWithUsername' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>, Required<Pick<IncomingAuthType, 'forgotPassword' | 'lockTime' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>> {
+export interface Auth extends Omit<IncomingAuthType, 'cookies' | 'forgotPassword' | 'lockTime' | 'loginWithUsername' | 'maxLoginAttempts' | 'refreshTokens' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>, Required<Pick<IncomingAuthType, 'forgotPassword' | 'lockTime' | 'maxLoginAttempts' | 'strategies' | 'tokenExpiration' | 'useSessions' | 'verify'>> {
     cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>;
     loginWithUsername: false | Required<LoginWithUsernameOptions>;
+    refreshTokens: {
+        expiration: number;
+    } | false;
 }
 export declare function hasWhereAccessResult(result: boolean | Where): result is Where;
 export {};

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,kEAAkE;IAClE,QAAQ,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;IACZ,QAAQ,EAAE,IAAI,CAAA;CACf,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,iEAAiE;IACjE,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,KAAK,WAAW,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB;;WAEG;QACH,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,OAAO,CAAA;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;QACzD;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EACN;QACE;;;WAGG;QACH,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GACD,OAAO,CAAA;IAEX;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SAAQ,IAAI,CACR,gBAAgB,EACd,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,EACD,QAAQ,CACN,IAAI,CACF,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,CACF;IACH,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAA;IACzF,iBAAiB,EAAE,KAAK,GAAG,QAAQ,CAAC,wBAAwB,CAAC,CAAA;CAC9D;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9D;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,UAAU,EAAE,OAAO,CAAA;IACnB,KAAK,CAAC,EAAE,KAAK,CAAA;CACd,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,UAAU,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,EAAE,UAAU,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,kEAAkE;IAClE,QAAQ,EAAE,UAAU,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,EAAE,0BAA0B,CAAA;CACnC,GACD,IAAI,CAAA;AAER,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,CAAA;CACtC,CAAA;AAED,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GACjC;IACE,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,MAAM,EAAE,IAAI,CAAA;IACZ,MAAM,CAAC,EAAE,0BAA0B,CAAA;IACnC,IAAI,EAAE,IAAI,CAAA;IACV,MAAM,EAAE,IAAI,CAAA;IACZ,QAAQ,EAAE,IAAI,CAAA;CACf,GACD,IAAI,CAAA;AAER,MAAM,MAAM,0BAA0B,GAClC;IACE,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAAA;CAC/C,GACD,IAAI,CAAA;AAER,MAAM,MAAM,oBAAoB,GAAG;IACjC,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IAEzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IAEnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,iBAAiB,CAAA;IACzB,IAAI,CAAC,EAAE,UAAU,CAAA;IACjB,YAAY,CAAC,EAAE,UAAU,CAAA;IACzB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,UAAU,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM,EAAE,0BAA0B,CAAA;IAClC,IAAI,CAAC,EAAE,IAAI,CAAA;IACX,YAAY,CAAC,EAAE,IAAI,CAAA;IACnB,MAAM,CAAC,EAAE,IAAI,CAAA;IACb,QAAQ,CAAC,EAAE,IAAI,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,oBAAoB,GAAG,gBAAgB,CAAA;AAEzE,MAAM,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,yBAAyB,CAAA;AAEpG,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAA;IAC1D,OAAO,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAA;CAC/C,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,WAAW,CAAC,EAAE;QACZ,CAAC,cAAc,EAAE,MAAM,GAAG,6BAA6B,CAAA;KACxD,CAAA;IACD,OAAO,CAAC,EAAE;QACR,CAAC,UAAU,EAAE,MAAM,GAAG,yBAAyB,CAAA;KAChD,CAAA;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;GAIG;AACH;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,GAAG,IAAI,CAAA;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,MAAM,CAAA;IAChC,SAAS,EAAE,IAAI,GAAG,MAAM,CAAA;IACxB,EAAE,EAAE,MAAM,CAAA;CACX,CAAA;AACD,KAAK,uBAAuB,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACjD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,0BAA0B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE;IACpD,GAAG,EAAE,cAAc,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,KAAK,CAAA;CACZ,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,+BAA+B,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,KAAK,kCAAkC,CAAC,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE;IAC7D,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,KAAK,CAAA;CACb,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;AAE9B,MAAM,MAAM,wBAAwB,GAAG;IACrC;;OAEG;IACH,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC3B,SAAS,CAAC,EAAE,OAAO,CAAA;IACnB,OAAO,EAAE,OAAO,CAAA;IAChB,iEAAiE;IACjE,GAAG,CAAC,EAAE,cAAc,CAAA;IACpB;;OAEG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG;IAC/B,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,oBAAoB,GAAG,CACjC,IAAI,EAAE,wBAAwB,KAC3B,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;AACrD,MAAM,MAAM,YAAY,GAAG;IACzB,YAAY,EAAE,oBAAoB,CAAA;IAClC,IAAI,EAAE,MAAM,CAAA;CACb,CAAA;AAED,MAAM,MAAM,wBAAwB,GAChC;IACE,eAAe,CAAC,EAAE,KAAK,CAAA;IACvB,YAAY,CAAC,EAAE,OAAO,CAAA;IAEtB,eAAe,CAAC,EAAE,IAAI,CAAA;CACvB,GACD;IACE,eAAe,CAAC,EAAE,IAAI,CAAA;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,eAAe,CAAC,EAAE,OAAO,CAAA;CAC1B,CAAA;AAEL,KAAK,WAAW,GAAG;IACjB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,MAAM,WAAW,gBAAgB;IAC/B;;OAEG;IACH,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;;OAOG;IACH,oBAAoB,CAAC,EACjB;QACE;;;WAGG;QACH,YAAY,CAAC,EAAE,IAAI,CAAA;QACnB;;WAEG;QACH,gBAAgB,CAAC,EAAE,IAAI,CAAA;KACxB,GACD,OAAO,CAAA;IACX;;;OAGG;IACH,cAAc,CAAC,EAAE;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,iBAAiB,CAAC,EAAE,+BAA+B,CAAA;QACnD,oBAAoB,CAAC,EAAE,kCAAkC,CAAA;QACzD;;;;WAIG;QACH,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,OAAO,GAAG,wBAAwB,CAAA;IACtD;;OAEG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EACV;QACE;;;;;;WAMG;QACH,UAAU,CAAC,EAAE,MAAM,CAAA;KACpB,GACD,OAAO,CAAA;IACX;;OAEG;IACH,wBAAwB,CAAC,EAAE,IAAI,CAAA;IAC/B;;;OAGG;IACH,UAAU,CAAC,EAAE,YAAY,EAAE,CAAA;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB;;;;OAIG;IACH,SAAS,CAAC,EACN;QACE;;;WAGG;QACH,MAAM,CAAC,EAAE,OAAO,CAAA;KACjB,GACD,OAAO,CAAA;IAEX;;;OAGG;IACH,WAAW,CAAC,EAAE,OAAO,CAAA;IAErB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;QAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;KAClD,GACD,OAAO,CAAA;CACZ;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,iBAAiB,CAAC,EAAE,uBAAuB,CAAA;IAC3C,oBAAoB,CAAC,EAAE,0BAA0B,CAAA;CAClD,CAAA;AAED,MAAM,WAAW,IACf,SACE,IAAI,CACF,gBAAgB,EACd,SAAS,GACT,gBAAgB,GAChB,UAAU,GACV,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,EACD,QAAQ,CACN,IAAI,CACF,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,kBAAkB,GAClB,YAAY,GACZ,iBAAiB,GACjB,aAAa,GACb,QAAQ,CACX,CACF;IACH,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAA;IACzF,iBAAiB,EAAE,KAAK,GAAG,QAAQ,CAAC,wBAAwB,CAAC,CAAA;IAC7D,aAAa,EAAE;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAA;CAC9C;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,IAAI,KAAK,CAE7E"}

package/dist/auth/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n  /** Permission to validate candidate block data without saving. */\n  validate: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n  /** Permission to validate candidate field data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n      validate: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n  /** Permission to validate collection candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n  validate?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n  /** Permission to validate global candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n  validate?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\n/**\n * Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n */\nexport type AuthRuntimeFields = {\n  /**\n   * The session ID of the current request. May be present on request-authenticated users when\n   * sessions are enabled.\n   */\n  _sid?: string\n  /**\n   * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n   */\n  _strategy?: string\n}\n\n/**\n * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n */\n/**\n * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`).\n * Server authentication APIs may retain complete fields, while response boundaries apply read access.\n */\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\nexport type UserSession = {\n  createdAt?: Date | null | string\n  expiresAt: Date | string\n  id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /** The request that initiated authentication, when available. */\n  req?: PayloadRequest\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\ntype AuthCookies = {\n  domain?: string\n  sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n  secure?: boolean\n}\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: AuthCookies\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Controls whether Payload's built-in local auth strategy is disabled. Set to `true` to disable\n   * local authentication or `false` to keep it enabled.\n   *\n   * Pass an object to disable local authentication while configuring how its fields are retained.\n   * Only disable local authentication if you have replaced Payload's auth mechanisms with your own.\n   * @default false\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        /**\n         * When auth fields are retained, make the password field optional.\n         */\n        optionalPassword?: true\n      }\n    | boolean\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n    /**\n     * The minimum number of milliseconds between password reset emails for the same user.\n     * @default 15000\n     * Set to 0 to disable.\n     */\n    minRequestInterval?: number\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?:\n    | {\n        /**\n         * Allows administrators to reveal stored API keys from the Admin Panel.\n         * @default false\n         */\n        reveal?: boolean\n      }\n    | boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends Omit<\n      IncomingAuthType,\n      | 'cookies'\n      | 'forgotPassword'\n      | 'lockTime'\n      | 'loginWithUsername'\n      | 'maxLoginAttempts'\n      | 'strategies'\n      | 'tokenExpiration'\n      | 'useSessions'\n      | 'verify'\n    >,\n    Required<\n      Pick<\n        IncomingAuthType,\n        | 'forgotPassword'\n        | 'lockTime'\n        | 'maxLoginAttempts'\n        | 'strategies'\n        | 'tokenExpiration'\n        | 'useSessions'\n        | 'verify'\n      >\n    > {\n  cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>\n  loginWithUsername: false | Required<LoginWithUsernameOptions>\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AA4XA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}
+{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { CollectionSlug, GlobalSlug, Payload, User } from '../index.js'\nimport type { PayloadRequest, Where } from '../types/index.js'\n\n/**\n * A permission object that can be used to determine if a user has access to a specific operation.\n */\nexport type Permission = {\n  permission: boolean\n  where?: Where\n}\n\nexport type FieldsPermissions = {\n  [fieldName: string]: FieldPermissions\n}\n\nexport type BlockPermissions = {\n  create: Permission\n  fields: FieldsPermissions\n  read: Permission\n  update: Permission\n  /** Permission to validate candidate block data without saving. */\n  validate: Permission\n}\n\nexport type SanitizedBlockPermissions =\n  | {\n      fields: SanitizedFieldsPermissions\n    }\n  | true\n\nexport type BlocksPermissions = {\n  [blockSlug: string]: BlockPermissions\n}\n\nexport type SanitizedBlocksPermissions =\n  | {\n      [blockSlug: string]: SanitizedBlockPermissions\n    }\n  | true\n\nexport type FieldPermissions = {\n  blocks?: BlocksPermissions\n  create?: Permission\n  fields?: FieldsPermissions\n  read?: Permission\n  update?: Permission\n  /** Permission to validate candidate field data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedFieldPermissions =\n  | {\n      blocks?: SanitizedBlocksPermissions\n      create: true\n      fields?: SanitizedFieldsPermissions\n      read: true\n      update: true\n      validate: true\n    }\n  | true\n\nexport type SanitizedFieldsPermissions =\n  | {\n      [fieldName: string]: SanitizedFieldPermissions\n    }\n  | true\n\nexport type CollectionPermission = {\n  create?: Permission\n  delete?: Permission\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  // Auth-enabled Collections only\n  unlock?: Permission\n  update?: Permission\n  /** Permission to validate collection candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedCollectionPermission = {\n  create?: true\n  delete?: true\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  // Auth-enabled Collections only\n  unlock?: true\n  update?: true\n  validate?: true\n}\n\nexport type GlobalPermission = {\n  fields: FieldsPermissions\n  read?: Permission\n  readVersions?: Permission\n  update?: Permission\n  /** Permission to validate global candidate data without saving. */\n  validate?: Permission\n}\n\nexport type SanitizedGlobalPermission = {\n  fields: SanitizedFieldsPermissions\n  read?: true\n  readVersions?: true\n  update?: true\n  validate?: true\n}\n\nexport type DocumentPermissions = CollectionPermission | GlobalPermission\n\nexport type SanitizedDocumentPermissions = SanitizedCollectionPermission | SanitizedGlobalPermission\n\nexport type Permissions = {\n  canAccessAdmin: boolean\n  collections?: Record<CollectionSlug, CollectionPermission>\n  globals?: Record<GlobalSlug, GlobalPermission>\n}\n\nexport type SanitizedPermissions = {\n  canAccessAdmin?: boolean\n  collections?: {\n    [collectionSlug: string]: SanitizedCollectionPermission\n  }\n  globals?: {\n    [globalSlug: string]: SanitizedGlobalPermission\n  }\n}\n\n/**\n * Fields injected onto a user at authentication time. They are never stored in the database and\n * never present on a plain document read (e.g. `payload.findByID`) - only on the authenticated\n * user (`req.user`, login/auth/me results, auth strategies).\n */\nexport type AuthRuntimeFields = {\n  /**\n   * The session ID of the current request. May be present on request-authenticated users when\n   * sessions are enabled.\n   */\n  _sid?: string\n  /**\n   * The name of the auth strategy that authenticated the request (e.g. `local-jwt`).\n   */\n  _strategy?: string\n}\n\n/**\n * Note: AuthenticatedUser still carries the write-only `password` from `User` (always `undefined` at runtime).\n * Stripping it cleanly isn't possible, because auth operations build the authenticated user\n * from a read `User` doc, so a `never`-typed `password` would break those assignments\n */\n/**\n * The signed-in user: the read user plus the runtime auth markers (`_strategy`, `_sid`).\n * Server authentication APIs may retain complete fields, while response boundaries apply read access.\n */\nexport type AuthenticatedUser = AuthRuntimeFields & User\n\nexport type UserSession = {\n  createdAt?: Date | null | string\n  expiresAt: Date | string\n  id: string\n}\ntype GenerateVerifyEmailHTML<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateVerifyEmailSubject<TUser = any> = (args: {\n  req: PayloadRequest\n  token: string\n  user: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailHTML<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\ntype GenerateForgotPasswordEmailSubject<TUser = any> = (args?: {\n  req?: PayloadRequest\n  token?: string\n  user?: TUser\n}) => Promise<string> | string\n\nexport type AuthStrategyFunctionArgs = {\n  /**\n   * Specifies whether or not response headers can be set from this strategy.\n   */\n  canSetHeaders?: boolean\n  headers: Request['headers']\n  isGraphQL?: boolean\n  payload: Payload\n  /** The request that initiated authentication, when available. */\n  req?: PayloadRequest\n  /**\n   * The AuthStrategy name property from the payload config.\n   */\n  strategyName?: string\n}\n\nexport type AuthStrategyResult = {\n  responseHeaders?: Headers\n  user: AuthenticatedUser | null\n}\n\nexport type AuthStrategyFunction = (\n  args: AuthStrategyFunctionArgs,\n) => AuthStrategyResult | Promise<AuthStrategyResult>\nexport type AuthStrategy = {\n  authenticate: AuthStrategyFunction\n  name: string\n}\n\nexport type LoginWithUsernameOptions =\n  | {\n      allowEmailLogin?: false\n      requireEmail?: boolean\n      // If `allowEmailLogin` is false, `requireUsername` must be true (default: true)\n      requireUsername?: true\n    }\n  | {\n      allowEmailLogin?: true\n      requireEmail?: boolean\n      requireUsername?: boolean\n    }\n\ntype AuthCookies = {\n  domain?: string\n  sameSite?: 'Lax' | 'None' | 'Strict' | boolean\n  secure?: boolean\n}\n\nexport interface IncomingAuthType {\n  /**\n   * Set cookie options, including secure, sameSite, and domain. For advanced users.\n   */\n  cookies?: AuthCookies\n  /**\n   * How many levels deep a user document should be populated when creating the JWT and binding the user to the req. Defaults to 0 and should only be modified if absolutely necessary, as this will affect performance.\n   * @default 0\n   */\n  depth?: number\n  /**\n   * Controls whether Payload's built-in local auth strategy is disabled. Set to `true` to disable\n   * local authentication or `false` to keep it enabled.\n   *\n   * Pass an object to disable local authentication while configuring how its fields are retained.\n   * Only disable local authentication if you have replaced Payload's auth mechanisms with your own.\n   * @default false\n   */\n  disableLocalStrategy?:\n    | {\n        /**\n         * Include auth fields on the collection even though the local strategy is disabled.\n         * Useful when you do not want the database or types to vary depending on the auth configuration.\n         */\n        enableFields?: true\n        /**\n         * When auth fields are retained, make the password field optional.\n         */\n        optionalPassword?: true\n      }\n    | boolean\n  /**\n   * Customize the way that the forgotPassword operation functions.\n   * @link https://payloadcms.com/docs/authentication/email#forgot-password\n   */\n  forgotPassword?: {\n    /**\n     * The number of milliseconds that the forgot password token should be valid for.\n     * @default 3600000 // 1 hour\n     */\n    expiration?: number\n    generateEmailHTML?: GenerateForgotPasswordEmailHTML\n    generateEmailSubject?: GenerateForgotPasswordEmailSubject\n    /**\n     * The minimum number of milliseconds between password reset emails for the same user.\n     * @default 15000\n     * Set to 0 to disable.\n     */\n    minRequestInterval?: number\n  }\n  /**\n   * Set the time (in milliseconds) that a user should be locked out if they fail authentication more times than maxLoginAttempts allows for.\n   */\n  lockTime?: number\n  /**\n   * Ability to allow users to login with username/password.\n   *\n   * @link https://payloadcms.com/docs/authentication/overview#login-with-username\n   */\n  loginWithUsername?: boolean | LoginWithUsernameOptions\n  /**\n   * Only allow a user to attempt logging in X amount of times. Automatically locks out a user from authenticating if this limit is passed. Set to 0 to disable.\n   */\n  maxLoginAttempts?: number\n  /**\n   * Lets clients stay logged in after their token expires. Logins also return a refresh token,\n   * which the refresh operation trades for a new token and a new refresh token. Each refresh token\n   * works once: when a used one comes back, its session is logged out. Requires `useSessions`.\n   *\n   * Refresh tokens don't expire on their own. They work as long as their login session, which lasts\n   * `expiration` from the last refresh instead of `tokenExpiration`.\n   *\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/overview#refresh-tokens\n   */\n  refreshTokens?:\n    | {\n        /**\n         * How many seconds a login session with a refresh token lasts without a refresh, which is\n         * how long its refresh token can be used. Every refresh starts this time again. The token\n         * itself still expires after `tokenExpiration`.\n         *\n         * @default 2592000 (30 days)\n         */\n        expiration?: number\n      }\n    | boolean\n  /***\n   * Set to true if you want to remove the token from the returned authentication API responses such as login or refresh.\n   */\n  removeTokenFromResponses?: true\n  /**\n   * Advanced - an array of custom authentification strategies to extend this collection's authentication with.\n   * @link https://payloadcms.com/docs/authentication/custom-strategies\n   */\n  strategies?: AuthStrategy[]\n  /**\n   * Controls how many seconds the token will be valid for. Default is 2 hours.\n   * @default 7200\n   * @link https://payloadcms.com/docs/authentication/overview#config-options\n   */\n  tokenExpiration?: number\n  /**\n   * Payload Authentication provides for API keys to be set on each user within an Authentication-enabled Collection.\n   * @default false\n   * @link https://payloadcms.com/docs/authentication/api-keys\n   */\n  useAPIKey?:\n    | {\n        /**\n         * Allows administrators to reveal stored API keys from the Admin Panel.\n         * @default false\n         */\n        reveal?: boolean\n      }\n    | boolean\n\n  /**\n   * Use sessions for authentication. Enabled by default.\n   * @default true\n   */\n  useSessions?: boolean\n\n  /**\n   * Set to true or pass an object with verification options to require users to verify by email before they are allowed to log into your app.\n   * @link https://payloadcms.com/docs/authentication/email#email-verification\n   */\n  verify?:\n    | {\n        generateEmailHTML?: GenerateVerifyEmailHTML\n        generateEmailSubject?: GenerateVerifyEmailSubject\n      }\n    | boolean\n}\n\nexport type VerifyConfig = {\n  generateEmailHTML?: GenerateVerifyEmailHTML\n  generateEmailSubject?: GenerateVerifyEmailSubject\n}\n\nexport interface Auth\n  extends\n    Omit<\n      IncomingAuthType,\n      | 'cookies'\n      | 'forgotPassword'\n      | 'lockTime'\n      | 'loginWithUsername'\n      | 'maxLoginAttempts'\n      | 'refreshTokens'\n      | 'strategies'\n      | 'tokenExpiration'\n      | 'useSessions'\n      | 'verify'\n    >,\n    Required<\n      Pick<\n        IncomingAuthType,\n        | 'forgotPassword'\n        | 'lockTime'\n        | 'maxLoginAttempts'\n        | 'strategies'\n        | 'tokenExpiration'\n        | 'useSessions'\n        | 'verify'\n      >\n    > {\n  cookies: Pick<AuthCookies, 'domain'> & Required<Pick<AuthCookies, 'sameSite' | 'secure'>>\n  loginWithUsername: false | Required<LoginWithUsernameOptions>\n  refreshTokens: { expiration: number } | false\n}\n\nexport function hasWhereAccessResult(result: boolean | Where): result is Where {\n  return result && typeof result === 'object'\n}\n"],"names":["hasWhereAccessResult","result"],"mappings":"AAsZA,OAAO,SAASA,qBAAqBC,MAAuB;IAC1D,OAAOA,UAAU,OAAOA,WAAW;AACrC"}

package/dist/cli/commands/data/utilities.d.ts

@@ -18,7 +18,7 @@ export declare const getGlobalValidationResult: ({ slug, error, req, }: {
     errors: import("../../../index.js").ValidationFieldError[];
     schema?: import("../../../index.js").EntityInputSchema | undefined;
 } | undefined;
-export declare const getCollectionSchema: ({ slug, req, }: {
+export declare const getCollectionSchema: ({ slug, req }: {
     req: PayloadRequest;
     slug: CollectionSlug;
 }) => import("../../../index.js").EntityInputSchema | null;

package/dist/cli/commands/data/utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/data/utilities.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,EACX,MAAM,mBAAmB,CAAA;AAc1B,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,4DAA4D,CAAA;AAEnE,eAAO,MAAM,6BAA6B,0BAIvC;IACD,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,cAAc,CAAA;CACrB;;;;aAQA,CAAA;AAED,eAAO,MAAM,yBAAyB,0BAInC;IACD,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,UAAU,CAAA;CACjB;;;;aAQA,CAAA;AAED,eAAO,MAAM,mBAAmB,mBAG7B;IACD,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,cAAc,CAAA;CACrB,yDAA4D,CAAA;AAE7D,eAAO,MAAM,cAAc,YAAa;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;IACC,KAAK;IACL,cAAc;IACd,MAAM;IACN,cAAc;IACd,QAAQ;;;IACR,MAAM;IACN,gBAAgB;CAChB,CAAA;AAEF,eAAO,MAAM,qBAAqB,mCAI/B;IACD,UAAU,EAAE,cAAc,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACgE,CAAA;AAE1F,eAAO,MAAM,4BAA4B,mCAItC;IACD,UAAU,EAAE,cAAc,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAC4D,CAAA;AAEtF,eAAO,MAAM,iBAAiB,6BAI3B;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsD,CAAA;AAEhF,eAAO,MAAM,wBAAwB,6BAIlC;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACkD,CAAA;AAE5E,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,IAI1C,CAAA"}
+{"version":3,"file":"utilities.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/data/utilities.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EACd,UAAU,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,UAAU,EACX,MAAM,mBAAmB,CAAA;AAc1B,OAAO,EACL,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,4DAA4D,CAAA;AAEnE,eAAO,MAAM,6BAA6B,0BAIvC;IACD,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,cAAc,CAAA;CACrB;;;;aAQA,CAAA;AAED,eAAO,MAAM,yBAAyB,0BAInC;IACD,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,IAAI,EAAE,UAAU,CAAA;CACjB;;;;aAQA,CAAA;AAED,eAAO,MAAM,mBAAmB,kBAAmB;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,yDACvC,CAAA;AAEzD,eAAO,MAAM,cAAc,YAAa;IACtC,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,MAAM,CAAC,EAAE,UAAU,CAAA;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAA;CAC3B;IACC,KAAK;IACL,cAAc;IACd,MAAM;IACN,cAAc;IACd,QAAQ;;;IACR,MAAM;IACN,gBAAgB;CAChB,CAAA;AAEF,eAAO,MAAM,qBAAqB,mCAI/B;IACD,UAAU,EAAE,cAAc,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACgE,CAAA;AAE1F,eAAO,MAAM,4BAA4B,mCAItC;IACD,UAAU,EAAE,cAAc,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAC4D,CAAA;AAEtF,eAAO,MAAM,iBAAiB,6BAI3B;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACsD,CAAA;AAEhF,eAAO,MAAM,wBAAwB,6BAIlC;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;CACjB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CACkD,CAAA;AAE5E,eAAO,MAAM,SAAS,UAAW,OAAO,KAAG,IAI1C,CAAA"}

package/dist/cli/commands/data/utilities.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/cli/commands/data/utilities.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type {\n  CollectionSlug,\n  GlobalSlug,\n  Payload,\n  PayloadRequest,\n  PopulateType,\n  SelectType,\n} from '../../../index.js'\n\nimport { ValidationError } from '../../../errors/ValidationError.js'\nimport {\n  getCollectionInputSchema,\n  getGlobalInputSchema,\n} from '../../../utilities/entityInputSchema/getEntityInputSchema.js'\nimport {\n  getCollectionVirtualFieldNames,\n  getGlobalVirtualFieldNames,\n  stripVirtualFields,\n} from '../../../utilities/getVirtualFieldNames.js'\nimport { transformPointDataToPayload } from '../../../utilities/transformPointDataToPayload.js'\n\nexport {\n  validateCollectionData,\n  validateGlobalData,\n} from '../../../utilities/entityInputSchema/validateEntityData.js'\n\nexport const getCollectionValidationResult = ({\n  slug,\n  error,\n  req,\n}: {\n  error: unknown\n  req: PayloadRequest\n  slug: CollectionSlug\n}) => {\n  if (!(error instanceof ValidationError)) {\n    return undefined\n  }\n\n  const schema = getCollectionInputSchema({ collectionSlug: slug, req })\n\n  return { slug, errors: error.data.errors, ...(schema ? { schema } : {}) }\n}\n\nexport const getGlobalValidationResult = ({\n  slug,\n  error,\n  req,\n}: {\n  error: unknown\n  req: PayloadRequest\n  slug: GlobalSlug\n}) => {\n  if (!(error instanceof ValidationError)) {\n    return undefined\n  }\n\n  const schema = getGlobalInputSchema({ globalSlug: slug, req })\n\n  return { slug, errors: error.data.errors, ...(schema ? { schema } : {}) }\n}\n\nexport const getCollectionSchema = ({\n  slug,\n  req,\n}: {\n  req: PayloadRequest\n  slug: CollectionSlug\n}) => getCollectionInputSchema({ collectionSlug: slug, req })\n\nexport const getReadOptions = (options: {\n  depth: number\n  fallbackLocale?: false | string\n  locale?: string\n  overrideAccess: boolean\n  populate?: PopulateType\n  select?: SelectType\n  showHiddenFields?: boolean\n}) => ({\n  depth: options.depth,\n  fallbackLocale: options.fallbackLocale,\n  locale: options.locale,\n  overrideAccess: options.overrideAccess,\n  populate: options.populate,\n  select: options.select,\n  showHiddenFields: options.showHiddenFields,\n})\n\nexport const prepareCollectionData = ({\n  collection,\n  data,\n  payload,\n}: {\n  collection: CollectionSlug\n  data: Record<string, unknown>\n  payload: Payload\n}): Record<string, unknown> =>\n  transformPointDataToPayload(stripCollectionVirtualFields({ collection, data, payload }))\n\nexport const stripCollectionVirtualFields = ({\n  collection,\n  data,\n  payload,\n}: {\n  collection: CollectionSlug\n  data: Record<string, unknown>\n  payload: Payload\n}): Record<string, unknown> =>\n  stripVirtualFields(data, getCollectionVirtualFieldNames(payload.config, collection))\n\nexport const prepareGlobalData = ({\n  slug,\n  data,\n  payload,\n}: {\n  data: Record<string, unknown>\n  payload: Payload\n  slug: GlobalSlug\n}): Record<string, unknown> =>\n  transformPointDataToPayload(stripGlobalVirtualFields({ slug, data, payload }))\n\nexport const stripGlobalVirtualFields = ({\n  slug,\n  data,\n  payload,\n}: {\n  data: Record<string, unknown>\n  payload: Payload\n  slug: GlobalSlug\n}): Record<string, unknown> =>\n  stripVirtualFields(data, getGlobalVirtualFieldNames(payload.config, slug))\n\nexport const printJSON = (value: unknown): void => {\n  console.log(\n    JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item), 2),\n  )\n}\n"],"names":["ValidationError","getCollectionInputSchema","getGlobalInputSchema","getCollectionVirtualFieldNames","getGlobalVirtualFieldNames","stripVirtualFields","transformPointDataToPayload","validateCollectionData","validateGlobalData","getCollectionValidationResult","slug","error","req","undefined","schema","collectionSlug","errors","data","getGlobalValidationResult","globalSlug","getCollectionSchema","getReadOptions","options","depth","fallbackLocale","locale","overrideAccess","populate","select","showHiddenFields","prepareCollectionData","collection","payload","stripCollectionVirtualFields","config","prepareGlobalData","stripGlobalVirtualFields","printJSON","value","console","log","JSON","stringify","_key","item","toString"],"mappings":"AAAA,6BAA6B,GAU7B,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SACEC,wBAAwB,EACxBC,oBAAoB,QACf,+DAA8D;AACrE,SACEC,8BAA8B,EAC9BC,0BAA0B,EAC1BC,kBAAkB,QACb,6CAA4C;AACnD,SAASC,2BAA2B,QAAQ,oDAAmD;AAE/F,SACEC,sBAAsB,EACtBC,kBAAkB,QACb,6DAA4D;AAEnE,OAAO,MAAMC,gCAAgC,CAAC,EAC5CC,IAAI,EACJC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAAED,CAAAA,iBAAiBX,eAAc,GAAI;QACvC,OAAOa;IACT;IAEA,MAAMC,SAASb,yBAAyB;QAAEc,gBAAgBL;QAAME;IAAI;IAEpE,OAAO;QAAEF;QAAMM,QAAQL,MAAMM,IAAI,CAACD,MAAM;QAAE,GAAIF,SAAS;YAAEA;QAAO,IAAI,CAAC,CAAC;IAAE;AAC1E,EAAC;AAED,OAAO,MAAMI,4BAA4B,CAAC,EACxCR,IAAI,EACJC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAAED,CAAAA,iBAAiBX,eAAc,GAAI;QACvC,OAAOa;IACT;IAEA,MAAMC,SAASZ,qBAAqB;QAAEiB,YAAYT;QAAME;IAAI;IAE5D,OAAO;QAAEF;QAAMM,QAAQL,MAAMM,IAAI,CAACD,MAAM;QAAE,GAAIF,SAAS;YAAEA;QAAO,IAAI,CAAC,CAAC;IAAE;AAC1E,EAAC;AAED,OAAO,MAAMM,sBAAsB,CAAC,EAClCV,IAAI,EACJE,GAAG,EAIJ,GAAKX,yBAAyB;QAAEc,gBAAgBL;QAAME;IAAI,GAAE;AAE7D,OAAO,MAAMS,iBAAiB,CAACC,UAQxB,CAAA;QACLC,OAAOD,QAAQC,KAAK;QACpBC,gBAAgBF,QAAQE,cAAc;QACtCC,QAAQH,QAAQG,MAAM;QACtBC,gBAAgBJ,QAAQI,cAAc;QACtCC,UAAUL,QAAQK,QAAQ;QAC1BC,QAAQN,QAAQM,MAAM;QACtBC,kBAAkBP,QAAQO,gBAAgB;IAC5C,CAAA,EAAE;AAEF,OAAO,MAAMC,wBAAwB,CAAC,EACpCC,UAAU,EACVd,IAAI,EACJe,OAAO,EAKR,GACC1B,4BAA4B2B,6BAA6B;QAAEF;QAAYd;QAAMe;IAAQ,IAAG;AAE1F,OAAO,MAAMC,+BAA+B,CAAC,EAC3CF,UAAU,EACVd,IAAI,EACJe,OAAO,EAKR,GACC3B,mBAAmBY,MAAMd,+BAA+B6B,QAAQE,MAAM,EAAEH,aAAY;AAEtF,OAAO,MAAMI,oBAAoB,CAAC,EAChCzB,IAAI,EACJO,IAAI,EACJe,OAAO,EAKR,GACC1B,4BAA4B8B,yBAAyB;QAAE1B;QAAMO;QAAMe;IAAQ,IAAG;AAEhF,OAAO,MAAMI,2BAA2B,CAAC,EACvC1B,IAAI,EACJO,IAAI,EACJe,OAAO,EAKR,GACC3B,mBAAmBY,MAAMb,2BAA2B4B,QAAQE,MAAM,EAAExB,OAAM;AAE5E,OAAO,MAAM2B,YAAY,CAACC;IACxBC,QAAQC,GAAG,CACTC,KAAKC,SAAS,CAACJ,OAAO,CAACK,MAAMC,OAAU,OAAOA,SAAS,WAAWA,KAAKC,QAAQ,KAAKD,MAAO;AAE/F,EAAC"}
+{"version":3,"sources":["../../../../src/cli/commands/data/utilities.ts"],"sourcesContent":["/* eslint-disable no-console */\nimport type {\n  CollectionSlug,\n  GlobalSlug,\n  Payload,\n  PayloadRequest,\n  PopulateType,\n  SelectType,\n} from '../../../index.js'\n\nimport { ValidationError } from '../../../errors/ValidationError.js'\nimport {\n  getCollectionInputSchema,\n  getGlobalInputSchema,\n} from '../../../utilities/entityInputSchema/getEntityInputSchema.js'\nimport {\n  getCollectionVirtualFieldNames,\n  getGlobalVirtualFieldNames,\n  stripVirtualFields,\n} from '../../../utilities/getVirtualFieldNames.js'\nimport { transformPointDataToPayload } from '../../../utilities/transformPointDataToPayload.js'\n\nexport {\n  validateCollectionData,\n  validateGlobalData,\n} from '../../../utilities/entityInputSchema/validateEntityData.js'\n\nexport const getCollectionValidationResult = ({\n  slug,\n  error,\n  req,\n}: {\n  error: unknown\n  req: PayloadRequest\n  slug: CollectionSlug\n}) => {\n  if (!(error instanceof ValidationError)) {\n    return undefined\n  }\n\n  const schema = getCollectionInputSchema({ collectionSlug: slug, req })\n\n  return { slug, errors: error.data.errors, ...(schema ? { schema } : {}) }\n}\n\nexport const getGlobalValidationResult = ({\n  slug,\n  error,\n  req,\n}: {\n  error: unknown\n  req: PayloadRequest\n  slug: GlobalSlug\n}) => {\n  if (!(error instanceof ValidationError)) {\n    return undefined\n  }\n\n  const schema = getGlobalInputSchema({ globalSlug: slug, req })\n\n  return { slug, errors: error.data.errors, ...(schema ? { schema } : {}) }\n}\n\nexport const getCollectionSchema = ({ slug, req }: { req: PayloadRequest; slug: CollectionSlug }) =>\n  getCollectionInputSchema({ collectionSlug: slug, req })\n\nexport const getReadOptions = (options: {\n  depth: number\n  fallbackLocale?: false | string\n  locale?: string\n  overrideAccess: boolean\n  populate?: PopulateType\n  select?: SelectType\n  showHiddenFields?: boolean\n}) => ({\n  depth: options.depth,\n  fallbackLocale: options.fallbackLocale,\n  locale: options.locale,\n  overrideAccess: options.overrideAccess,\n  populate: options.populate,\n  select: options.select,\n  showHiddenFields: options.showHiddenFields,\n})\n\nexport const prepareCollectionData = ({\n  collection,\n  data,\n  payload,\n}: {\n  collection: CollectionSlug\n  data: Record<string, unknown>\n  payload: Payload\n}): Record<string, unknown> =>\n  transformPointDataToPayload(stripCollectionVirtualFields({ collection, data, payload }))\n\nexport const stripCollectionVirtualFields = ({\n  collection,\n  data,\n  payload,\n}: {\n  collection: CollectionSlug\n  data: Record<string, unknown>\n  payload: Payload\n}): Record<string, unknown> =>\n  stripVirtualFields(data, getCollectionVirtualFieldNames(payload.config, collection))\n\nexport const prepareGlobalData = ({\n  slug,\n  data,\n  payload,\n}: {\n  data: Record<string, unknown>\n  payload: Payload\n  slug: GlobalSlug\n}): Record<string, unknown> =>\n  transformPointDataToPayload(stripGlobalVirtualFields({ slug, data, payload }))\n\nexport const stripGlobalVirtualFields = ({\n  slug,\n  data,\n  payload,\n}: {\n  data: Record<string, unknown>\n  payload: Payload\n  slug: GlobalSlug\n}): Record<string, unknown> =>\n  stripVirtualFields(data, getGlobalVirtualFieldNames(payload.config, slug))\n\nexport const printJSON = (value: unknown): void => {\n  console.log(\n    JSON.stringify(value, (_key, item) => (typeof item === 'bigint' ? item.toString() : item), 2),\n  )\n}\n"],"names":["ValidationError","getCollectionInputSchema","getGlobalInputSchema","getCollectionVirtualFieldNames","getGlobalVirtualFieldNames","stripVirtualFields","transformPointDataToPayload","validateCollectionData","validateGlobalData","getCollectionValidationResult","slug","error","req","undefined","schema","collectionSlug","errors","data","getGlobalValidationResult","globalSlug","getCollectionSchema","getReadOptions","options","depth","fallbackLocale","locale","overrideAccess","populate","select","showHiddenFields","prepareCollectionData","collection","payload","stripCollectionVirtualFields","config","prepareGlobalData","stripGlobalVirtualFields","printJSON","value","console","log","JSON","stringify","_key","item","toString"],"mappings":"AAAA,6BAA6B,GAU7B,SAASA,eAAe,QAAQ,qCAAoC;AACpE,SACEC,wBAAwB,EACxBC,oBAAoB,QACf,+DAA8D;AACrE,SACEC,8BAA8B,EAC9BC,0BAA0B,EAC1BC,kBAAkB,QACb,6CAA4C;AACnD,SAASC,2BAA2B,QAAQ,oDAAmD;AAE/F,SACEC,sBAAsB,EACtBC,kBAAkB,QACb,6DAA4D;AAEnE,OAAO,MAAMC,gCAAgC,CAAC,EAC5CC,IAAI,EACJC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAAED,CAAAA,iBAAiBX,eAAc,GAAI;QACvC,OAAOa;IACT;IAEA,MAAMC,SAASb,yBAAyB;QAAEc,gBAAgBL;QAAME;IAAI;IAEpE,OAAO;QAAEF;QAAMM,QAAQL,MAAMM,IAAI,CAACD,MAAM;QAAE,GAAIF,SAAS;YAAEA;QAAO,IAAI,CAAC,CAAC;IAAE;AAC1E,EAAC;AAED,OAAO,MAAMI,4BAA4B,CAAC,EACxCR,IAAI,EACJC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAAED,CAAAA,iBAAiBX,eAAc,GAAI;QACvC,OAAOa;IACT;IAEA,MAAMC,SAASZ,qBAAqB;QAAEiB,YAAYT;QAAME;IAAI;IAE5D,OAAO;QAAEF;QAAMM,QAAQL,MAAMM,IAAI,CAACD,MAAM;QAAE,GAAIF,SAAS;YAAEA;QAAO,IAAI,CAAC,CAAC;IAAE;AAC1E,EAAC;AAED,OAAO,MAAMM,sBAAsB,CAAC,EAAEV,IAAI,EAAEE,GAAG,EAAiD,GAC9FX,yBAAyB;QAAEc,gBAAgBL;QAAME;IAAI,GAAE;AAEzD,OAAO,MAAMS,iBAAiB,CAACC,UAQxB,CAAA;QACLC,OAAOD,QAAQC,KAAK;QACpBC,gBAAgBF,QAAQE,cAAc;QACtCC,QAAQH,QAAQG,MAAM;QACtBC,gBAAgBJ,QAAQI,cAAc;QACtCC,UAAUL,QAAQK,QAAQ;QAC1BC,QAAQN,QAAQM,MAAM;QACtBC,kBAAkBP,QAAQO,gBAAgB;IAC5C,CAAA,EAAE;AAEF,OAAO,MAAMC,wBAAwB,CAAC,EACpCC,UAAU,EACVd,IAAI,EACJe,OAAO,EAKR,GACC1B,4BAA4B2B,6BAA6B;QAAEF;QAAYd;QAAMe;IAAQ,IAAG;AAE1F,OAAO,MAAMC,+BAA+B,CAAC,EAC3CF,UAAU,EACVd,IAAI,EACJe,OAAO,EAKR,GACC3B,mBAAmBY,MAAMd,+BAA+B6B,QAAQE,MAAM,EAAEH,aAAY;AAEtF,OAAO,MAAMI,oBAAoB,CAAC,EAChCzB,IAAI,EACJO,IAAI,EACJe,OAAO,EAKR,GACC1B,4BAA4B8B,yBAAyB;QAAE1B;QAAMO;QAAMe;IAAQ,IAAG;AAEhF,OAAO,MAAMI,2BAA2B,CAAC,EACvC1B,IAAI,EACJO,IAAI,EACJe,OAAO,EAKR,GACC3B,mBAAmBY,MAAMb,2BAA2B4B,QAAQE,MAAM,EAAExB,OAAM;AAE5E,OAAO,MAAM2B,YAAY,CAACC;IACxBC,QAAQC,GAAG,CACTC,KAAKC,SAAS,CAACJ,OAAO,CAACK,MAAMC,OAAU,OAAOA,SAAS,WAAWA,KAAKC,QAAQ,KAAKD,MAAO;AAE/F,EAAC"}

package/dist/cli/defineCLICommand.js

@@ -18,7 +18,7 @@
         allowUnknownOption: definition.allowUnknownOption ?? false,
         cli: cli === false ? false : overrides,
         handler: definition.handler,
-        input: input,
+        input,
         schema
     };
 };

package/dist/cli/defineCLICommand.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/cli/defineCLICommand.ts"],"sourcesContent":["import type { StandardSchemaV1 } from '@standard-schema/spec'\n\nimport type {\n  CLICommand,\n  CLICommandResult,\n  CLIFieldOverride,\n  CLIHelp,\n  CLIInputSchema,\n  CLIRuntime,\n} from '../config/types.js'\nimport type { MaybePromise } from '../types/index.js'\n\ntype CLICommandDefinition<TInput extends CLIInputSchema> = {\n  aliases?: string[]\n  allowUnknownOption?: boolean\n  cli?:\n    | false\n    | Partial<Record<Extract<keyof StandardSchemaV1.InferInput<TInput>, string>, CLIFieldOverride>>\n  description: string\n  examples?: string[]\n  /**\n   * Runs after Payload validates the command input. `args` contains the validated values.\n   *\n   * - Return nothing when the command succeeds without a result.\n   * - Return a number to set the process exit code.\n   * - Return `{ result }` to include data in JSON output.\n   * - Return `{ exitCode, result }` when the command needs both.\n   *\n   * Console and Payload logger output is sent to stderr in JSON mode. Use `isJSON` when the\n   * command's behavior itself needs to change for machine-readable output.\n   */\n  handler: (\n    context: {\n      args: StandardSchemaV1.InferOutput<TInput>\n      help: CLIHelp\n      isJSON: boolean\n    } & Pick<CLIRuntime, 'getConfig' | 'getPayload'>,\n  ) => MaybePromise<CLICommandResult | number | void>\n  helpGroup?: string\n  input: TInput\n}\n\n/** Defines a CLI command from its input schema, shell input, and handler. */\nexport const defineCLICommand = <TInput extends CLIInputSchema>(\n  definition: CLICommandDefinition<TInput>,\n): CLICommand => {\n  const { cli, input } = definition\n  const schema = input['~standard'].jsonSchema.input({ target: 'draft-2020-12' })\n\n  if (schema.type !== 'object') {\n    throw new Error('CLI command input schema must describe an object.')\n  }\n\n  const properties = (schema.properties ?? {}) as Record<string, unknown>\n  const overrides = cli === false ? {} : (cli ?? {})\n\n  for (const field of Object.keys(overrides)) {\n    if (!(field in properties)) {\n      throw new Error(`CLI command configures unknown input '${field}'.`)\n    }\n  }\n\n  return {\n    ...definition,\n    allowUnknownOption: definition.allowUnknownOption ?? false,\n    cli: cli === false ? false : overrides,\n    handler: definition.handler as CLICommand['handler'],\n    input: input as CLIInputSchema,\n    schema,\n  }\n}\n"],"names":["defineCLICommand","definition","cli","input","schema","jsonSchema","target","type","Error","properties","overrides","field","Object","keys","allowUnknownOption","handler"],"mappings":"AA0CA,2EAA2E,GAC3E,OAAO,MAAMA,mBAAmB,CAC9BC;IAEA,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGF;IACvB,MAAMG,SAASD,KAAK,CAAC,YAAY,CAACE,UAAU,CAACF,KAAK,CAAC;QAAEG,QAAQ;IAAgB;IAE7E,IAAIF,OAAOG,IAAI,KAAK,UAAU;QAC5B,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,aAAcL,OAAOK,UAAU,IAAI,CAAC;IAC1C,MAAMC,YAAYR,QAAQ,QAAQ,CAAC,IAAKA,OAAO,CAAC;IAEhD,KAAK,MAAMS,SAASC,OAAOC,IAAI,CAACH,WAAY;QAC1C,IAAI,CAAEC,CAAAA,SAASF,UAAS,GAAI;YAC1B,MAAM,IAAID,MAAM,CAAC,sCAAsC,EAAEG,MAAM,EAAE,CAAC;QACpE;IACF;IAEA,OAAO;QACL,GAAGV,UAAU;QACba,oBAAoBb,WAAWa,kBAAkB,IAAI;QACrDZ,KAAKA,QAAQ,QAAQ,QAAQQ;QAC7BK,SAASd,WAAWc,OAAO;QAC3BZ,OAAOA;QACPC;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/cli/defineCLICommand.ts"],"sourcesContent":["import type { StandardSchemaV1 } from '@standard-schema/spec'\n\nimport type {\n  CLICommand,\n  CLICommandResult,\n  CLIFieldOverride,\n  CLIHelp,\n  CLIInputSchema,\n  CLIRuntime,\n} from '../config/types.js'\nimport type { MaybePromise } from '../types/index.js'\n\ntype CLICommandDefinition<TInput extends CLIInputSchema> = {\n  aliases?: string[]\n  allowUnknownOption?: boolean\n  cli?:\n    | false\n    | Partial<Record<Extract<keyof StandardSchemaV1.InferInput<TInput>, string>, CLIFieldOverride>>\n  description: string\n  examples?: string[]\n  /**\n   * Runs after Payload validates the command input. `args` contains the validated values.\n   *\n   * - Return nothing when the command succeeds without a result.\n   * - Return a number to set the process exit code.\n   * - Return `{ result }` to include data in JSON output.\n   * - Return `{ exitCode, result }` when the command needs both.\n   *\n   * Console and Payload logger output is sent to stderr in JSON mode. Use `isJSON` when the\n   * command's behavior itself needs to change for machine-readable output.\n   */\n  handler: (\n    context: {\n      args: StandardSchemaV1.InferOutput<TInput>\n      help: CLIHelp\n      isJSON: boolean\n    } & Pick<CLIRuntime, 'getConfig' | 'getPayload'>,\n  ) => MaybePromise<CLICommandResult | number | void>\n  helpGroup?: string\n  input: TInput\n}\n\n/** Defines a CLI command from its input schema, shell input, and handler. */\nexport const defineCLICommand = <TInput extends CLIInputSchema>(\n  definition: CLICommandDefinition<TInput>,\n): CLICommand => {\n  const { cli, input } = definition\n  const schema = input['~standard'].jsonSchema.input({ target: 'draft-2020-12' })\n\n  if (schema.type !== 'object') {\n    throw new Error('CLI command input schema must describe an object.')\n  }\n\n  const properties = (schema.properties ?? {}) as Record<string, unknown>\n  const overrides = cli === false ? {} : (cli ?? {})\n\n  for (const field of Object.keys(overrides)) {\n    if (!(field in properties)) {\n      throw new Error(`CLI command configures unknown input '${field}'.`)\n    }\n  }\n\n  return {\n    ...definition,\n    allowUnknownOption: definition.allowUnknownOption ?? false,\n    cli: cli === false ? false : overrides,\n    handler: definition.handler,\n    input,\n    schema,\n  }\n}\n"],"names":["defineCLICommand","definition","cli","input","schema","jsonSchema","target","type","Error","properties","overrides","field","Object","keys","allowUnknownOption","handler"],"mappings":"AA0CA,2EAA2E,GAC3E,OAAO,MAAMA,mBAAmB,CAC9BC;IAEA,MAAM,EAAEC,GAAG,EAAEC,KAAK,EAAE,GAAGF;IACvB,MAAMG,SAASD,KAAK,CAAC,YAAY,CAACE,UAAU,CAACF,KAAK,CAAC;QAAEG,QAAQ;IAAgB;IAE7E,IAAIF,OAAOG,IAAI,KAAK,UAAU;QAC5B,MAAM,IAAIC,MAAM;IAClB;IAEA,MAAMC,aAAcL,OAAOK,UAAU,IAAI,CAAC;IAC1C,MAAMC,YAAYR,QAAQ,QAAQ,CAAC,IAAKA,OAAO,CAAC;IAEhD,KAAK,MAAMS,SAASC,OAAOC,IAAI,CAACH,WAAY;QAC1C,IAAI,CAAEC,CAAAA,SAASF,UAAS,GAAI;YAC1B,MAAM,IAAID,MAAM,CAAC,sCAAsC,EAAEG,MAAM,EAAE,CAAC;QACpE;IACF;IAEA,OAAO;QACL,GAAGV,UAAU;QACba,oBAAoBb,WAAWa,kBAAkB,IAAI;QACrDZ,KAAKA,QAAQ,QAAQ,QAAQQ;QAC7BK,SAASd,WAAWc,OAAO;QAC3BZ;QACAC;IACF;AACF,EAAC"}

package/dist/collections/config/client.d.ts

@@ -9,7 +9,7 @@ import type { SanitizedUploadConfig, UploadInstructionsCapability } from '../../
 import type { SanitizedCollectionConfig } from './types.js';
 export type ServerOnlyCollectionProperties = keyof Pick<SanitizedCollectionConfig, 'access' | 'custom' | 'endpoints' | 'flattenedFields' | 'hooks' | 'indexes' | 'joins' | 'llmInstructions' | 'polymorphicJoins' | 'sanitizedIndexes' | 'select'>;
 export type ServerOnlyCollectionAdminProperties = keyof Pick<SanitizedCollectionConfig['admin'], 'baseFilter' | 'baseListFilter' | 'components' | 'formatDocURL' | 'hidden'>;
-export type ServerOnlyUploadProperties = keyof Pick<SanitizedCollectionConfig['upload'], 'admin' | 'adminThumbnail' | 'deleteFiles' | 'externalFileHeaderFilter' | 'fileOperations' | 'handlers' | 'modifyResponseHeaders' | 'uploadInstructions'>;
+export type ServerOnlyUploadProperties = keyof Pick<SanitizedCollectionConfig['upload'], 'admin' | 'adminThumbnail' | 'externalFileHeaderFilter' | 'fileOperations' | 'handlers' | 'modifyResponseHeaders' | 'uploadInstructions'>;
 type ClientUploadConfig = {
     uploadInstructions: Pick<UploadInstructionsCapability, 'useInAdmin'>;
 } & Omit<SanitizedUploadConfig, 'fileOperations' | 'uploadInstructions'>;

package/dist/collections/config/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/collections/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,0BAA0B,CAAA;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2DAA2D,CAAA;AAC1F,OAAO,KAAK,EACV,iBAAiB,EACjB,+BAA+B,EAC/B,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAI3D,MAAM,MAAM,8BAA8B,GAAG,MAAM,IAAI,CACrD,yBAAyB,EACvB,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,OAAO,GACP,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,QAAQ,CACX,CAAA;AAED,MAAM,MAAM,mCAAmC,GAAG,MAAM,IAAI,CAC1D,yBAAyB,CAAC,OAAO,CAAC,EAClC,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,QAAQ,CAC3E,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG,MAAM,IAAI,CACjD,yBAAyB,CAAC,QAAQ,CAAC,EACjC,OAAO,GACP,gBAAgB,GAChB,aAAa,GACb,0BAA0B,GAC1B,gBAAgB,GAChB,UAAU,GACV,uBAAuB,GACvB,oBAAoB,CACvB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB,kBAAkB,EAAE,IAAI,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAA;CACrE,GAAG,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAA;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE;QACL,WAAW,CAAC,EAAE,iBAAiB,CAAA;QAC/B,WAAW,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAA;QACtE,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,GAAG,IAAI,CACN,yBAAyB,CAAC,OAAO,CAAC,EAChC,YAAY,GACZ,aAAa,GACb,cAAc,GACd,OAAO,GACP,aAAa,GACb,SAAS,GACT,mCAAmC,CACtC,CAAA;IACD,IAAI,CAAC,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC/F,MAAM,CAAC,EAAE,IAAI,CAAA;KACd,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC,CAAA;IACvF,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;IACzC,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAA;QACnB,QAAQ,EAAE,WAAW,CAAA;KACtB,CAAA;IACD,MAAM,EAAE,kBAAkB,CAAA;CAC3B,GAAG,IAAI,CACN,yBAAyB,EACzB,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,8BAA8B,CACjG,CAAA;AAwCD,eAAO,MAAM,4BAA4B,oDAKtC;IACD,UAAU,EAAE,yBAAyB,CAAA;IACrC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;CACrB,KAAG,sBAkMH,CAAA;AAED,eAAO,MAAM,6BAA6B,qDAKvC;IACD,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;CACrB,KAAG,sBAAsB,EAezB,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/collections/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,0BAA0B,CAAA;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2DAA2D,CAAA;AAC1F,OAAO,KAAK,EACV,iBAAiB,EACjB,+BAA+B,EAC/B,WAAW,EACZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,KAAK,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AACjG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAA;AAI3D,MAAM,MAAM,8BAA8B,GAAG,MAAM,IAAI,CACrD,yBAAyB,EACvB,QAAQ,GACR,QAAQ,GACR,WAAW,GACX,iBAAiB,GACjB,OAAO,GACP,SAAS,GACT,OAAO,GACP,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,QAAQ,CACX,CAAA;AAED,MAAM,MAAM,mCAAmC,GAAG,MAAM,IAAI,CAC1D,yBAAyB,CAAC,OAAO,CAAC,EAClC,YAAY,GAAG,gBAAgB,GAAG,YAAY,GAAG,cAAc,GAAG,QAAQ,CAC3E,CAAA;AAED,MAAM,MAAM,0BAA0B,GAAG,MAAM,IAAI,CACjD,yBAAyB,CAAC,QAAQ,CAAC,EACjC,OAAO,GACP,gBAAgB,GAChB,0BAA0B,GAC1B,gBAAgB,GAChB,UAAU,GACV,uBAAuB,GACvB,oBAAoB,CACvB,CAAA;AAED,KAAK,kBAAkB,GAAG;IACxB,kBAAkB,EAAE,IAAI,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAA;CACrE,GAAG,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,GAAG,oBAAoB,CAAC,CAAA;AAExE,MAAM,MAAM,sBAAsB,GAAG;IACnC,KAAK,EAAE;QACL,WAAW,CAAC,EAAE,iBAAiB,CAAA;QAC/B,WAAW,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAA;QACtE,OAAO,CAAC,EAAE,OAAO,CAAA;KAClB,GAAG,IAAI,CACN,yBAAyB,CAAC,OAAO,CAAC,EAChC,YAAY,GACZ,aAAa,GACb,cAAc,GACd,OAAO,GACP,aAAa,GACb,SAAS,GACT,mCAAmC,CACtC,CAAA;IACD,IAAI,CAAC,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC,CAAA;QAC/F,MAAM,CAAC,EAAE,IAAI,CAAA;KACd,GAAG,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,YAAY,GAAG,QAAQ,CAAC,CAAA;IACvF,MAAM,EAAE,WAAW,EAAE,CAAA;IACrB,SAAS,CAAC,EAAE,qBAAqB,GAAG,KAAK,CAAA;IACzC,MAAM,EAAE;QACN,MAAM,EAAE,WAAW,CAAA;QACnB,QAAQ,EAAE,WAAW,CAAA;KACtB,CAAA;IACD,MAAM,EAAE,kBAAkB,CAAA;CAC3B,GAAG,IAAI,CACN,yBAAyB,EACzB,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,8BAA8B,CACjG,CAAA;AAuCD,eAAO,MAAM,4BAA4B,oDAKtC;IACD,UAAU,EAAE,yBAAyB,CAAA;IACrC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;CACrB,KAAG,sBAkMH,CAAA;AAED,eAAO,MAAM,6BAA6B,qDAKvC;IACD,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAA;IACvD,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,SAAS,CAAA;CACrB,KAAG,sBAAsB,EAezB,CAAA"}

package/dist/collections/config/client.js

@@ -15,7 +15,6 @@ const serverOnlyCollectionProperties = [
 const serverOnlyUploadProperties = [
     'admin',
     'adminThumbnail',
-    'deleteFiles',
     'externalFileHeaderFilter',
     'fileOperations',
     'handlers',