exports point to dist, remove prepare

dist/modules/turnstile/Turnstile.js

@@ -59,6 +59,6 @@ const SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render
     return /*#__PURE__*/ _jsx("div", {
         ref: ref
     });
-}
+} //# sourceMappingURL=Turnstile.js.map
 
 //# sourceMappingURL=Turnstile.js.map

dist/modules/turnstile/Turnstile.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/modules/turnstile/Turnstile.tsx"],"sourcesContent":["'use client'\nimport { useEffect, useRef } from 'react'\n\ndeclare global {\n  interface Window {\n    turnstile?: {\n      render: (el: HTMLElement, opts: Record<string, unknown>) => string\n      reset: (id?: string) => void\n    }\n  }\n}\n\nconst SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'\n\n/** Loads the Turnstile script once, shared across all widget instances. */\nfunction ensureScript(): void {\n  if (typeof document === 'undefined') {return}\n  if (document.querySelector(`script[src=\"${SCRIPT_SRC}\"]`)) {return}\n  const script = document.createElement('script')\n  script.src = SCRIPT_SRC\n  script.async = true\n  script.defer = true\n  document.head.appendChild(script)\n}\n\nexport type TurnstileProps = {\n  /** Called with the token once solved, or null on expiry/error. */\n  onToken: (token: null | string) => void\n  /**\n   * Public Turnstile site key. The client project reads it server-side from\n   * SiteIntegrations (turnstileSiteKey) and passes it in — the widget is a pure\n   * client component and can't read Payload itself.\n   */\n  siteKey: string\n  theme?: 'auto' | 'dark' | 'light'\n}\n\n/**\n * Cloudflare Turnstile widget — reusable across any form. Renders the challenge\n * and reports the token via onToken. The token must then be verified\n * server-side (see verifyTurnstile) before a submission is trusted.\n *\n * siteKey is a prop rather than an env var so all Turnstile config lives in one\n * place (SiteIntegrations), consistent with the plugin's panel-managed model.\n * The script is injected directly (no next/script dependency) so the widget\n * stays framework-agnostic.\n */\nexport function Turnstile({ onToken, siteKey, theme = 'auto' }: TurnstileProps) {\n  const ref = useRef<HTMLDivElement>(null)\n  const widgetId = useRef<null | string>(null)\n\n  useEffect(() => {\n    if (!siteKey) {return}\n\n    ensureScript()\n\n    function render() {\n      if (!ref.current || !window.turnstile || widgetId.current) {return}\n      widgetId.current = window.turnstile.render(ref.current, {\n        callback: (token: string) => onToken(token),\n        'error-callback': () => onToken(null),\n        'expired-callback': () => onToken(null),\n        sitekey: siteKey,\n        theme,\n      })\n    }\n\n    render()\n    // Script may load after mount — retry briefly until ready.\n    const interval = setInterval(render, 300)\n    return () => clearInterval(interval)\n  }, [siteKey, theme, onToken])\n\n  if (!siteKey) {return null}\n\n  return <div ref={ref} />\n}\n"],"names":["useEffect","useRef","SCRIPT_SRC","ensureScript","document","querySelector","script","createElement","src","async","defer","head","appendChild","Turnstile","onToken","siteKey","theme","ref","widgetId","render","current","window","turnstile","callback","token","sitekey","interval","setInterval","clearInterval","div"],"mappings":"AAAA;;AACA,SAASA,SAAS,EAAEC,MAAM,QAAQ,QAAO;AAWzC,MAAMC,aAAa;AAEnB,yEAAyE,GACzE,SAASC;IACP,IAAI,OAAOC,aAAa,aAAa;QAAC;IAAM;IAC5C,IAAIA,SAASC,aAAa,CAAC,CAAC,YAAY,EAAEH,WAAW,EAAE,CAAC,GAAG;QAAC;IAAM;IAClE,MAAMI,SAASF,SAASG,aAAa,CAAC;IACtCD,OAAOE,GAAG,GAAGN;IACbI,OAAOG,KAAK,GAAG;IACfH,OAAOI,KAAK,GAAG;IACfN,SAASO,IAAI,CAACC,WAAW,CAACN;AAC5B;AAcA;;;;;;;;;CASC,GACD,OAAO,SAASO,UAAU,EAAEC,OAAO,EAAEC,OAAO,EAAEC,QAAQ,MAAM,EAAkB;IAC5E,MAAMC,MAAMhB,OAAuB;IACnC,MAAMiB,WAAWjB,OAAsB;IAEvCD,UAAU;QACR,IAAI,CAACe,SAAS;YAAC;QAAM;QAErBZ;QAEA,SAASgB;YACP,IAAI,CAACF,IAAIG,OAAO,IAAI,CAACC,OAAOC,SAAS,IAAIJ,SAASE,OAAO,EAAE;gBAAC;YAAM;YAClEF,SAASE,OAAO,GAAGC,OAAOC,SAAS,CAACH,MAAM,CAACF,IAAIG,OAAO,EAAE;gBACtDG,UAAU,CAACC,QAAkBV,QAAQU;gBACrC,kBAAkB,IAAMV,QAAQ;gBAChC,oBAAoB,IAAMA,QAAQ;gBAClCW,SAASV;gBACTC;YACF;QACF;QAEAG;QACA,2DAA2D;QAC3D,MAAMO,WAAWC,YAAYR,QAAQ;QACrC,OAAO,IAAMS,cAAcF;IAC7B,GAAG;QAACX;QAASC;QAAOF;KAAQ;IAE5B,IAAI,CAACC,SAAS;QAAC,OAAO;IAAI;IAE1B,qBAAO,KAACc;QAAIZ,KAAKA;;AACnB"}
+{"version":3,"sources":["Turnstile.js"],"sourcesContent":["'use client'\nimport { useEffect, useRef } from 'react'\n\ndeclare global {\n  interface Window {\n    turnstile?: {\n      render: (el: HTMLElement, opts: Record<string, unknown>) => string\n      reset: (id?: string) => void\n    }\n  }\n}\n\nconst SCRIPT_SRC = 'https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit'\n\n/** Loads the Turnstile script once, shared across all widget instances. */\nfunction ensureScript(): void {\n  if (typeof document === 'undefined') {return}\n  if (document.querySelector(`script[src=\"${SCRIPT_SRC}\"]`)) {return}\n  const script = document.createElement('script')\n  script.src = SCRIPT_SRC\n  script.async = true\n  script.defer = true\n  document.head.appendChild(script)\n}\n\nexport type TurnstileProps = {\n  /** Called with the token once solved, or null on expiry/error. */\n  onToken: (token: null | string) => void\n  /**\n   * Public Turnstile site key. The client project reads it server-side from\n   * SiteIntegrations (turnstileSiteKey) and passes it in — the widget is a pure\n   * client component and can't read Payload itself.\n   */\n  siteKey: string\n  theme?: 'auto' | 'dark' | 'light'\n}\n\n/**\n * Cloudflare Turnstile widget — reusable across any form. Renders the challenge\n * and reports the token via onToken. The token must then be verified\n * server-side (see verifyTurnstile) before a submission is trusted.\n *\n * siteKey is a prop rather than an env var so all Turnstile config lives in one\n * place (SiteIntegrations), consistent with the plugin's panel-managed model.\n * The script is injected directly (no next/script dependency) so the widget\n * stays framework-agnostic.\n */\nexport function Turnstile({ onToken, siteKey, theme = 'auto' }: TurnstileProps) {\n  const ref = useRef<HTMLDivElement>(null)\n  const widgetId = useRef<null | string>(null)\n\n  useEffect(() => {\n    if (!siteKey) {return}\n\n    ensureScript()\n\n    function render() {\n      if (!ref.current || !window.turnstile || widgetId.current) {return}\n      widgetId.current = window.turnstile.render(ref.current, {\n        callback: (token: string) => onToken(token),\n        'error-callback': () => onToken(null),\n        'expired-callback': () => onToken(null),\n        sitekey: siteKey,\n        theme,\n      })\n    }\n\n    render()\n    // Script may load after mount — retry briefly until ready.\n    const interval = setInterval(render, 300)\n    return () => clearInterval(interval)\n  }, [siteKey, theme, onToken])\n\n  if (!siteKey) {return null}\n\n  return <div ref={ref} />\n}\n"],"names":["useEffect","useRef","SCRIPT_SRC","ensureScript","document","querySelector","script","createElement","src","async","defer","head","appendChild","Turnstile","onToken","siteKey","theme","ref","widgetId","render","current","window","turnstile","callback","token","sitekey","interval","setInterval","clearInterval","div"],"mappings":"AAAA;;AACA,SAASA,SAAS,EAAEC,MAAM,QAAQ,QAAO;AAWzC,MAAMC,aAAa;AAEnB,yEAAyE,GACzE,SAASC;IACP,IAAI,OAAOC,aAAa,aAAa;QAAC;IAAM;IAC5C,IAAIA,SAASC,aAAa,CAAC,CAAC,YAAY,EAAEH,WAAW,EAAE,CAAC,GAAG;QAAC;IAAM;IAClE,MAAMI,SAASF,SAASG,aAAa,CAAC;IACtCD,OAAOE,GAAG,GAAGN;IACbI,OAAOG,KAAK,GAAG;IACfH,OAAOI,KAAK,GAAG;IACfN,SAASO,IAAI,CAACC,WAAW,CAACN;AAC5B;AAcA;;;;;;;;;CASC,GACD,OAAO,SAASO,UAAU,EAAEC,OAAO,EAAEC,OAAO,EAAEC,QAAQ,MAAM,EAAkB;IAC5E,MAAMC,MAAMhB,OAAuB;IACnC,MAAMiB,WAAWjB,OAAsB;IAEvCD,UAAU;QACR,IAAI,CAACe,SAAS;YAAC;QAAM;QAErBZ;QAEA,SAASgB;YACP,IAAI,CAACF,IAAIG,OAAO,IAAI,CAACC,OAAOC,SAAS,IAAIJ,SAASE,OAAO,EAAE;gBAAC;YAAM;YAClEF,SAASE,OAAO,GAAGC,OAAOC,SAAS,CAACH,MAAM,CAACF,IAAIG,OAAO,EAAE;gBACtDG,UAAU,CAACC,QAAkBV,QAAQU;gBACrC,kBAAkB,IAAMV,QAAQ;gBAChC,oBAAoB,IAAMA,QAAQ;gBAClCW,SAASV;gBACTC;YACF;QACF;QAEAG;QACA,2DAA2D;QAC3D,MAAMO,WAAWC,YAAYR,QAAQ;QACrC,OAAO,IAAMS,cAAcF;IAC7B,GAAG;QAACX;QAASC;QAAOF;KAAQ;IAE5B,IAAI,CAACC,SAAS;QAAC,OAAO;IAAI;IAE1B,OAAA,WAAA,GAAO,KAACc,OAAAA;QAAIZ,KAAKA;;AACnB"}

dist/modules/turnstile/client.js

@@ -1,6 +1,6 @@
 'use client';
 // Client-only exports — the Turnstile widget. Kept separate from index.ts so
 // the server-only verify never leaks into a browser bundle.
-export { Turnstile } from './Turnstile.js';
+export { Turnstile } from './Turnstile.js'; //# sourceMappingURL=client.js.map
 
 //# sourceMappingURL=client.js.map

dist/modules/turnstile/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/modules/turnstile/client.ts"],"sourcesContent":["'use client'\n// Client-only exports — the Turnstile widget. Kept separate from index.ts so\n// the server-only verify never leaks into a browser bundle.\nexport { Turnstile } from './Turnstile.js'\nexport type { TurnstileProps } from './Turnstile.js'\n"],"names":["Turnstile"],"mappings":"AAAA;AACA,6EAA6E;AAC7E,4DAA4D;AAC5D,SAASA,SAAS,QAAQ,iBAAgB"}
+{"version":3,"sources":["client.js"],"sourcesContent":["'use client'\n// Client-only exports — the Turnstile widget. Kept separate from index.ts so\n// the server-only verify never leaks into a browser bundle.\nexport { Turnstile } from './Turnstile.js'\nexport type { TurnstileProps } from './Turnstile.js'\n"],"names":["Turnstile"],"mappings":"AAAA;AACA,6EAA6E;AAC7E,4DAA4D;AAC5D,SAASA,SAAS,QAAQ,iBAAgB"}

dist/modules/turnstile/index.js

@@ -1,5 +1,5 @@
 // Server-only exports. verify.ts imports 'server-only', so this must never be
 // imported from a client component — use ./client for the widget instead.
-export { verifyTurnstile } from './verify.js';
+export { verifyTurnstile } from './verify.js'; //# sourceMappingURL=index.js.map
 
 //# sourceMappingURL=index.js.map

dist/modules/turnstile/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/modules/turnstile/index.ts"],"sourcesContent":["// Server-only exports. verify.ts imports 'server-only', so this must never be\n// imported from a client component — use ./client for the widget instead.\nexport { verifyTurnstile } from './verify.js'\n"],"names":["verifyTurnstile"],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,SAASA,eAAe,QAAQ,cAAa"}
+{"version":3,"sources":["index.js"],"sourcesContent":["// Server-only exports. verify.ts imports 'server-only', so this must never be\n// imported from a client component — use ./client for the widget instead.\nexport { verifyTurnstile } from './verify.js'\n"],"names":["verifyTurnstile"],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,SAASA,eAAe,QAAQ,cAAa"}

dist/modules/turnstile/verify.js

@@ -36,6 +36,6 @@ import { getSiteIntegrations } from '../payload/index.js';
     } catch  {
         return false;
     }
-}
+} //# sourceMappingURL=verify.js.map
 
 //# sourceMappingURL=verify.js.map

dist/modules/turnstile/verify.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/modules/turnstile/verify.ts"],"sourcesContent":["import 'server-only'\n\nimport type { BasePayload } from 'payload'\n\nimport { getSiteIntegrations } from '../payload/index.js'\n\ntype SiteverifyResponse = {\n  challenge_ts?: string\n  'error-codes'?: string[]\n  hostname?: string\n  success: boolean\n}\n\ntype IntegrationsWithTurnstile = {\n  turnstileSecretKey?: null | string\n}\n\ntype VerifyTurnstileArgs = {\n  /** Optional client IP for stricter verification. */\n  ip?: string\n  /** Payload instance — used to read the secret from SiteIntegrations. */\n  payload: BasePayload\n  /** Token produced by the client-side widget. */\n  token: string\n}\n\n/**\n * Verifies a Turnstile token with Cloudflare, server-side only.\n *\n * The secret comes from the SiteIntegrations global (editor-managed, per the\n * plugin's \"secrets in the panel\" model), read via the Local API which bypasses\n * access control. `server-only` guarantees this never reaches the browser\n * bundle, keeping the secret off the client.\n *\n * Returns false on any failure (missing secret/token, network error, rejected\n * challenge) — callers treat false as \"do not trust this submission\".\n */\nexport async function verifyTurnstile({\n  ip,\n  payload,\n  token,\n}: VerifyTurnstileArgs): Promise<boolean> {\n  if (!token) {return false}\n\n  const integrations = await getSiteIntegrations<IntegrationsWithTurnstile>(payload)\n  const secret = integrations.turnstileSecretKey\n  if (!secret) {return false}\n\n  const body = new URLSearchParams({ response: token, secret })\n  if (ip) {body.append('remoteip', ip)}\n\n  try {\n    const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n      body,\n      method: 'POST',\n    })\n    const data = (await res.json()) as SiteverifyResponse\n    return data.success\n  } catch {\n    return false\n  }\n}\n"],"names":["getSiteIntegrations","verifyTurnstile","ip","payload","token","integrations","secret","turnstileSecretKey","body","URLSearchParams","response","append","res","fetch","method","data","json","success"],"mappings":"AAAA,OAAO,cAAa;AAIpB,SAASA,mBAAmB,QAAQ,sBAAqB;AAsBzD;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,gBAAgB,EACpCC,EAAE,EACFC,OAAO,EACPC,KAAK,EACe;IACpB,IAAI,CAACA,OAAO;QAAC,OAAO;IAAK;IAEzB,MAAMC,eAAe,MAAML,oBAA+CG;IAC1E,MAAMG,SAASD,aAAaE,kBAAkB;IAC9C,IAAI,CAACD,QAAQ;QAAC,OAAO;IAAK;IAE1B,MAAME,OAAO,IAAIC,gBAAgB;QAAEC,UAAUN;QAAOE;IAAO;IAC3D,IAAIJ,IAAI;QAACM,KAAKG,MAAM,CAAC,YAAYT;IAAG;IAEpC,IAAI;QACF,MAAMU,MAAM,MAAMC,MAAM,6DAA6D;YACnFL;YACAM,QAAQ;QACV;QACA,MAAMC,OAAQ,MAAMH,IAAII,IAAI;QAC5B,OAAOD,KAAKE,OAAO;IACrB,EAAE,OAAM;QACN,OAAO;IACT;AACF"}
+{"version":3,"sources":["verify.js"],"sourcesContent":["import 'server-only'\n\nimport type { BasePayload } from 'payload'\n\nimport { getSiteIntegrations } from '../payload/index.js'\n\ntype SiteverifyResponse = {\n  challenge_ts?: string\n  'error-codes'?: string[]\n  hostname?: string\n  success: boolean\n}\n\ntype IntegrationsWithTurnstile = {\n  turnstileSecretKey?: null | string\n}\n\ntype VerifyTurnstileArgs = {\n  /** Optional client IP for stricter verification. */\n  ip?: string\n  /** Payload instance — used to read the secret from SiteIntegrations. */\n  payload: BasePayload\n  /** Token produced by the client-side widget. */\n  token: string\n}\n\n/**\n * Verifies a Turnstile token with Cloudflare, server-side only.\n *\n * The secret comes from the SiteIntegrations global (editor-managed, per the\n * plugin's \"secrets in the panel\" model), read via the Local API which bypasses\n * access control. `server-only` guarantees this never reaches the browser\n * bundle, keeping the secret off the client.\n *\n * Returns false on any failure (missing secret/token, network error, rejected\n * challenge) — callers treat false as \"do not trust this submission\".\n */\nexport async function verifyTurnstile({\n  ip,\n  payload,\n  token,\n}: VerifyTurnstileArgs): Promise<boolean> {\n  if (!token) {return false}\n\n  const integrations = await getSiteIntegrations<IntegrationsWithTurnstile>(payload)\n  const secret = integrations.turnstileSecretKey\n  if (!secret) {return false}\n\n  const body = new URLSearchParams({ response: token, secret })\n  if (ip) {body.append('remoteip', ip)}\n\n  try {\n    const res = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n      body,\n      method: 'POST',\n    })\n    const data = (await res.json()) as SiteverifyResponse\n    return data.success\n  } catch {\n    return false\n  }\n}\n"],"names":["getSiteIntegrations","verifyTurnstile","ip","payload","token","integrations","secret","turnstileSecretKey","body","URLSearchParams","response","append","res","fetch","method","data","json","success"],"mappings":"AAAA,OAAO,cAAa;AAIpB,SAASA,mBAAmB,QAAQ,sBAAqB;AAsBzD;;;;;;;;;;CAUC,GACD,OAAO,eAAeC,gBAAgB,EACpCC,EAAE,EACFC,OAAO,EACPC,KAAK,EACe;IACpB,IAAI,CAACA,OAAO;QAAC,OAAO;IAAK;IAEzB,MAAMC,eAAe,MAAML,oBAA+CG;IAC1E,MAAMG,SAASD,aAAaE,kBAAkB;IAC9C,IAAI,CAACD,QAAQ;QAAC,OAAO;IAAK;IAE1B,MAAME,OAAO,IAAIC,gBAAgB;QAAEC,UAAUN;QAAOE;IAAO;IAC3D,IAAIJ,IAAI;QAACM,KAAKG,MAAM,CAAC,YAAYT;IAAG;IAEpC,IAAI;QACF,MAAMU,MAAM,MAAMC,MAAM,6DAA6D;YACnFL;YACAM,QAAQ;QACV;QACA,MAAMC,OAAQ,MAAMH,IAAII,IAAI;QAC5B,OAAOD,KAAKE,OAAO;IACrB,EAAE,OAAM;QACN,OAAO;IACT;AACF"}