@forumone/throughline 0.0.0-stage → 1.0.0-next.0

package/dist/references/tools.js

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import { deniedEnvelope } from '../mcp/envelope.js';
+import { findReferences } from './find.js';
+import { referenceRefusal } from './guards.js';
+/*
+The MCP counterparts of the "Used on" panel and the delete guard.
+
+Both read past access control, as the guard does, because the question is about
+the database: a draft the caller cannot see still breaks when its image goes. So
+by default only admins and editors may ask, the same line the audit tools draw,
+since the answer names documents by title. A host can draw it elsewhere with
+`canUse`.
+*/
+export const REFERENCE_TOOLS = {
+    findReferences: {
+        name: 'find_references',
+        description: 'Lists every document and global that references a document: an image, a person, a taxonomy term, or anything else that can be linked or embedded. Covers references inside blocks and rich text, which Payload itself cannot query, and both the published and draft state of each document. Use before replacing or deleting something shared, or to answer "where is this used?".',
+    },
+    canDelete: {
+        name: 'can_delete',
+        description: 'Whether a document can be deleted or moved to the trash without breaking another document that uses it. Returns canDelete, and when false, the documents that still reference it and the message an editor would see. Deleting is refused while anything references a guarded document, so ask this first and remove the references before trying.',
+    },
+};
+export const REFERENCE_TOOL_DESCRIPTORS = Object.values(REFERENCE_TOOLS);
+const inputSchema = z.object({
+    collection: z.string().describe('The collection slug of the document, e.g. "media".'),
+    id: z.union([z.string(), z.number()]).describe('The document id.'),
+});
+const findInputSchema = inputSchema.extend({
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(200)
+        .optional()
+        .describe('Max documents to list. Default: 50.'),
+});
+function defaultCanUse(ctx) {
+    const roles = ctx.user?.roles ?? [];
+    return roles.includes('admin') || roles.includes('editor');
+}
+function summarize(entry) {
+    return {
+        collection: entry.collection,
+        id: entry.id,
+        label: entry.label,
+        ...(entry.global ? { global: true } : {}),
+        insideBlock: entry.viaBlock,
+        paths: entry.references.map((reference) => reference.path),
+    };
+}
+/** Refuses an unknown collection by name rather than scanning for nothing. */
+function unknownCollection(payload, collection) {
+    const known = payload.config.collections.some((c) => c.slug === collection);
+    return known ? undefined : { error: `There is no collection "${collection}".` };
+}
+async function scan(deps, collection, id) {
+    return findReferences(deps.payload, { collection: collection, id }, deps.blocks ? { blocks: deps.blocks } : {});
+}
+export function createFindReferencesTool(deps) {
+    const canUse = deps.canUse ?? defaultCanUse;
+    return {
+        ...REFERENCE_TOOLS.findReferences,
+        inputSchema: findInputSchema,
+        handler: async (input, ctx) => {
+            if (!canUse(ctx))
+                return deniedEnvelope('Only admins and editors can look up where a document is used.');
+            const unknown = unknownCollection(deps.payload, input.collection);
+            if (unknown)
+                return unknown;
+            const found = await scan(deps, input.collection, input.id);
+            const limit = input.limit ?? 50;
+            return {
+                collection: input.collection,
+                id: input.id,
+                count: found.length,
+                insideBlocks: found.filter((entry) => entry.viaBlock).length,
+                documents: found.slice(0, limit).map(summarize),
+                ...(found.length > limit ? { truncated: true } : {}),
+            };
+        },
+    };
+}
+export function createCanDeleteTool(deps) {
+    const canUse = deps.canUse ?? defaultCanUse;
+    return {
+        ...REFERENCE_TOOLS.canDelete,
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!canUse(ctx))
+                return deniedEnvelope('Only admins and editors can check whether a document can be deleted.');
+            const unknown = unknownCollection(deps.payload, input.collection);
+            if (unknown)
+                return unknown;
+            const found = await scan(deps, input.collection, input.id);
+            const guard = deps.guarded.get(input.collection);
+            if (found.length === 0) {
+                return {
+                    collection: input.collection,
+                    id: input.id,
+                    canDelete: true,
+                    guarded: guard !== undefined,
+                };
+            }
+            return {
+                collection: input.collection,
+                id: input.id,
+                /*
+                False even for an unguarded collection: the delete would go through, but
+                it would break the documents listed. `guarded` says which it is.
+                */
+                canDelete: false,
+                guarded: guard !== undefined,
+                referencedBy: found.length,
+                documents: found.slice(0, 20).map(summarize),
+                message: referenceRefusal(found, {
+                    ...(guard?.noun ? { noun: guard.noun } : {}),
+                    ...(guard?.consequence ? { consequence: guard.consequence } : {}),
+                }),
+            };
+        },
+    };
+}
+//# sourceMappingURL=tools.js.map

package/dist/references/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../src/references/tools.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,cAAc,EAA2B,MAAM,WAAW,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C;;;;;;;;EAQE;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,cAAc,EAAE;QACd,IAAI,EAAE,iBAAiB;QACvB,WAAW,EACT,qXAAqX;KACxX;IACD,SAAS,EAAE;QACT,IAAI,EAAE,YAAY;QAClB,WAAW,EACT,oVAAoV;KACvV;CACmD,CAAA;AAEtD,MAAM,CAAC,MAAM,0BAA0B,GACrC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;AAWhC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IACrF,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CACnE,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;CACnD,CAAC,CAAA;AAEF,SAAS,aAAa,CAAC,GAAmB;IACxC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAA;IACnC,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB;IAC1C,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,WAAW,EAAE,KAAK,CAAC,QAAQ;QAC3B,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3D,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB,CAAC,OAAgB,EAAE,UAAkB;IAC7D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAA;IAC3E,OAAO,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,2BAA2B,UAAU,IAAI,EAAE,CAAA;AACjF,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAuB,EAAE,UAAkB,EAAE,EAAmB;IAClF,OAAO,cAAc,CACnB,IAAI,CAAC,OAAO,EACZ,EAAE,UAAU,EAAE,UAA4B,EAAE,EAAE,EAAE,EAChD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAC3C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAA;IAC3C,OAAO;QACL,GAAG,eAAe,CAAC,cAAc;QACjC,WAAW,EAAE,eAAe;QAC5B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,cAAc,CAAC,+DAA+D,CAAC,CAAA;YACxF,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACjE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAA;YAC/B,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM;gBAC5D,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,IAAuB;IAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,aAAa,CAAA;IAC3C,OAAO;QACL,GAAG,eAAe,CAAC,SAAS;QAC5B,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,cAAc,CACnB,sEAAsE,CACvE,CAAA;YACH,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACjE,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAA;YAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;YAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO;oBACL,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;oBACZ,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,KAAK,KAAK,SAAS;iBAC7B,CAAA;YACH,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ;;;kBAGE;gBACF,SAAS,EAAE,KAAK;gBAChB,OAAO,EAAE,KAAK,KAAK,SAAS;gBAC5B,YAAY,EAAE,KAAK,CAAC,MAAM;gBAC1B,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;gBAC5C,OAAO,EAAE,gBAAgB,CAAC,KAAK,EAAE;oBAC/B,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5C,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAClE,CAAC;aACH,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/references/walk.d.ts

@@ -0,0 +1,43 @@
+import type { Block, CollectionSlug, Field } from 'payload';
+/** One reference, and enough to say where it is. */
+export interface Reference {
+    /** The referenced document's id, as it appears in the data. */
+    id: number | string;
+    /** A human-readable path: `layout[3] › ImageHero › image`. */
+    path: string;
+    /**
+     * Whether the reference is inside a block, and so has no foreign key.
+     * A `false` is one the database will null out on delete; a `true` is one it
+     * does not know exists.
+     */
+    viaBlock: boolean;
+}
+export interface ReferencesInOptions {
+    /** The collection whose documents are being looked for. */
+    collection: CollectionSlug;
+    /**
+     * Blocks to resolve by slug: the config's `blocks` registry, for
+     * `blockReferences` and Lexical block nodes, plus any extras. A `blocks`
+     * field's own blocks are always used and need not be listed.
+     */
+    blocks?: readonly Block[] | ReadonlyMap<string, Block>;
+}
+/** Whether an upload or relationship field can point at `collection`. */
+export declare function pointsAt(field: Field, collection: CollectionSlug): boolean;
+/**
+ * Every reference to `collection` inside one document. Pure: it takes the field
+ * config and the data and touches nothing, so the whole decision is testable
+ * without a database.
+ */
+export declare function referencesIn(fields: readonly Field[], data: Record<string, unknown> | undefined, options: ReferencesInOptions): Reference[];
+/** The references to one document, comparing ids as strings. */
+export declare function referencesTo(fields: readonly Field[], data: Record<string, unknown> | undefined, options: ReferencesInOptions & {
+    id: number | string;
+}): Reference[];
+/**
+ * Whether a field tree could hold a reference to `collection` at all: a field
+ * pointing at it, a `blocks` field, or rich text. Decided from the config
+ * rather than from a list, so a collection that gains an image is covered.
+ */
+export declare function couldReference(fields: readonly Field[], collection: CollectionSlug): boolean;
+//# sourceMappingURL=walk.d.ts.map

package/dist/references/walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.d.ts","sourceRoot":"","sources":["../../src/references/walk.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AA6C3D,oDAAoD;AACpD,MAAM,WAAW,SAAS;IACxB,+DAA+D;IAC/D,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;IACnB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,CAAA;IACZ;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,UAAU,EAAE,cAAc,CAAA;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CACvD;AA0BD,yEAAyE;AACzE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAI1E;AAyKD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,EAAE,mBAAmB,GAC3B,SAAS,EAAE,CAQb;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,EAAE,mBAAmB,GAAG;IAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GACrD,SAAS,EAAE,CAIb;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,EAAE,UAAU,EAAE,cAAc,GAAG,OAAO,CAW5F"}

package/dist/references/walk.js

@@ -0,0 +1,214 @@
+function isNamed(field) {
+    return 'name' in field && typeof field.name === 'string';
+}
+function childrenOf(field) {
+    return 'fields' in field && Array.isArray(field.fields) ? field.fields : [];
+}
+/**
+ * The id out of a relationship value. An id at `depth: 0`, a populated object
+ * above it. `String({ id: 3 })` is `[object Object]`, which matches nothing and
+ * fails open, so the object case is handled rather than coerced.
+ */
+function idOf(value) {
+    if (typeof value === 'number' || typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object' && 'id' in value) {
+        const { id } = value;
+        if (typeof id === 'number' || typeof id === 'string')
+            return id;
+    }
+    return undefined;
+}
+/** Whether an upload or relationship field can point at `collection`. */
+export function pointsAt(field, collection) {
+    if (field.type !== 'upload' && field.type !== 'relationship')
+        return false;
+    const { relationTo } = field;
+    return Array.isArray(relationTo) ? relationTo.includes(collection) : relationTo === collection;
+}
+/** Every id out of a relationship value that points at `collection`. */
+function idsIn(value, collection) {
+    const entries = Array.isArray(value) ? value : [value];
+    const ids = [];
+    for (const entry of entries) {
+        if (entry && typeof entry === 'object' && 'relationTo' in entry && 'value' in entry) {
+            // Polymorphic: counts only when it names the collection.
+            if (entry.relationTo !== collection)
+                continue;
+            const id = idOf(entry.value);
+            if (id !== undefined)
+                ids.push(id);
+            continue;
+        }
+        const id = idOf(entry);
+        if (id !== undefined)
+            ids.push(id);
+    }
+    return ids;
+}
+/** The blocks a `blocks` field can hold, by slug. */
+function blocksOf(field, registry) {
+    const own = new Map();
+    const { blocks, blockReferences } = field;
+    if (Array.isArray(blocks)) {
+        for (const block of blocks)
+            own.set(block.slug, block);
+    }
+    if (Array.isArray(blockReferences)) {
+        for (const ref of blockReferences) {
+            const block = typeof ref === 'string' ? registry.get(ref) : ref;
+            if (block)
+                own.set(block.slug, block);
+        }
+    }
+    return own;
+}
+/**
+ * Rich text: `upload` nodes, and `block` / `inlineBlock` nodes walked as the
+ * block they name. Shape-matched rather than typed against Lexical's node
+ * union, because the column was written by whatever editor version was current.
+ */
+function walkRichText(value, path, viaBlock, ctx) {
+    if (!value || typeof value !== 'object')
+        return;
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            walkRichText(entry, path, viaBlock, ctx);
+        return;
+    }
+    const node = value;
+    const embedded = node['type'] === 'upload'
+        ? 'embedded upload'
+        : node['type'] === 'relationship'
+            ? 'embedded link'
+            : undefined;
+    if (embedded && node['relationTo'] === ctx.collection) {
+        const id = idOf(node['value']);
+        if (id !== undefined)
+            ctx.out.push({ id, path: `${path} › ${embedded}`, viaBlock });
+    }
+    if (node['type'] === 'block' || node['type'] === 'inlineBlock') {
+        const fields = node['fields'];
+        const slug = typeof fields?.['blockType'] === 'string' ? fields['blockType'] : undefined;
+        const block = slug ? ctx.registry.get(slug) : undefined;
+        // An unknown block is skipped rather than guessed at, as in a `blocks` field.
+        if (block && fields)
+            walkFields(block.fields, fields, `${path} › ${block.slug}`, true, ctx);
+    }
+    for (const key of ['root', 'children']) {
+        if (key in node)
+            walkRichText(node[key], path, viaBlock, ctx);
+    }
+}
+function walkFields(fields, data, path, viaBlock, ctx) {
+    if (!data)
+        return;
+    for (const field of fields) {
+        // Unnamed wrappers hold their children under the *parent's* data object.
+        if (!isNamed(field)) {
+            if (field.type === 'tabs' && 'tabs' in field && Array.isArray(field.tabs)) {
+                for (const tab of field.tabs) {
+                    const named = 'name' in tab && typeof tab.name === 'string' ? tab.name : undefined;
+                    const nested = named ? data[named] : data;
+                    const here = named ? `${path}${path ? ' › ' : ''}${named}` : path;
+                    walkFields(tab.fields, nested, here, viaBlock, ctx);
+                }
+                continue;
+            }
+            walkFields(childrenOf(field), data, path, viaBlock, ctx);
+            continue;
+        }
+        const value = data[field.name];
+        if (value === undefined || value === null)
+            continue;
+        const here = path ? `${path} › ${field.name}` : field.name;
+        if (pointsAt(field, ctx.collection)) {
+            for (const id of idsIn(value, ctx.collection))
+                ctx.out.push({ id, path: here, viaBlock });
+            continue;
+        }
+        switch (field.type) {
+            case 'richText':
+                walkRichText(value, here, viaBlock, ctx);
+                break;
+            case 'group':
+                walkFields(childrenOf(field), value, here, viaBlock, ctx);
+                break;
+            case 'array':
+                if (Array.isArray(value)) {
+                    value.forEach((row, index) => {
+                        walkFields(childrenOf(field), row, `${here}[${index}]`, viaBlock, ctx);
+                    });
+                }
+                break;
+            case 'blocks': {
+                if (!Array.isArray(value))
+                    break;
+                const own = blocksOf(field, ctx.registry);
+                value.forEach((row, index) => {
+                    const entry = row;
+                    const slug = typeof entry['blockType'] === 'string' ? entry['blockType'] : undefined;
+                    const block = slug ? (own.get(slug) ?? ctx.registry.get(slug)) : undefined;
+                    /*
+                    A row whose `blockType` names no known block is skipped rather than
+                    guessed at: the config and the data disagree, and inventing a field
+                    list for it would be the string-search failure by another route.
+                    */
+                    if (!block)
+                        return;
+                    walkFields(block.fields, entry, `${here}[${index}] › ${block.slug}`, true, ctx);
+                });
+                break;
+            }
+            default:
+                break;
+        }
+    }
+}
+function registryOf(blocks) {
+    if (!blocks)
+        return new Map();
+    if (blocks instanceof Map)
+        return blocks;
+    return new Map(blocks.map((block) => [block.slug, block]));
+}
+/**
+ * Every reference to `collection` inside one document. Pure: it takes the field
+ * config and the data and touches nothing, so the whole decision is testable
+ * without a database.
+ */
+export function referencesIn(fields, data, options) {
+    const out = [];
+    walkFields(fields, data, '', false, {
+        collection: options.collection,
+        registry: registryOf(options.blocks),
+        out,
+    });
+    return out;
+}
+/** The references to one document, comparing ids as strings. */
+export function referencesTo(fields, data, options) {
+    return referencesIn(fields, data, options).filter((reference) => String(reference.id) === String(options.id));
+}
+/**
+ * Whether a field tree could hold a reference to `collection` at all: a field
+ * pointing at it, a `blocks` field, or rich text. Decided from the config
+ * rather than from a list, so a collection that gains an image is covered.
+ */
+export function couldReference(fields, collection) {
+    for (const field of fields) {
+        if (pointsAt(field, collection))
+            return true;
+        if (field.type === 'blocks' || field.type === 'richText')
+            return true;
+        if (field.type === 'tabs' && 'tabs' in field && Array.isArray(field.tabs)) {
+            if (field.tabs.some((tab) => couldReference(tab.fields, collection)))
+                return true;
+            continue;
+        }
+        if (couldReference(childrenOf(field), collection))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=walk.js.map

package/dist/references/walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walk.js","sourceRoot":"","sources":["../../src/references/walk.ts"],"names":[],"mappings":"AAwEA,SAAS,OAAO,CAAC,KAAY;IAC3B,OAAO,MAAM,IAAI,KAAK,IAAI,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAA;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,KAAY;IAC9B,OAAO,QAAQ,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AAC7E,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IACxE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxD,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAA;QACpB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,QAAQ,CAAC,KAAY,EAAE,UAA0B;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,KAAK,CAAA;IAC1E,MAAM,EAAE,UAAU,EAAE,GAAG,KAAiC,CAAA;IACxD,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAA;AAChG,CAAC;AAED,wEAAwE;AACxE,SAAS,KAAK,CAAC,KAAc,EAAE,UAA0B;IACvD,MAAM,OAAO,GAAc,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IACjE,MAAM,GAAG,GAAwB,EAAE,CAAA;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,YAAY,IAAI,KAAK,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;YACpF,yDAAyD;YACzD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;gBAAE,SAAQ;YAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YAC5B,IAAI,EAAE,KAAK,SAAS;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAA;QACtB,IAAI,EAAE,KAAK,SAAS;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpC,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAQD,qDAAqD;AACrD,SAAS,QAAQ,CAAC,KAAY,EAAE,QAAoC;IAClE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAA;IACpC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,KAGnC,CAAA;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,MAAiB;YAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,eAAqC,EAAE,CAAC;YACxD,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;YAC/D,IAAI,KAAK;gBAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY,EAAE,QAAiB,EAAE,GAAgB;IACrF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,KAAK,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QACnE,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ;QACvB,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,cAAc;YAC/B,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,SAAS,CAAA;IACjB,IAAI,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,GAAG,CAAC,UAAU,EAAE,CAAC;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9B,IAAI,EAAE,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,MAAM,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IACrF,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,aAAa,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAwC,CAAA;QACpE,MAAM,IAAI,GAAG,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACxF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACvD,8EAA8E;QAC9E,IAAI,KAAK,IAAI,MAAM;YAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI;YAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,MAAwB,EACxB,IAAyC,EACzC,IAAY,EACZ,QAAiB,EACjB,GAAgB;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAM;IAEjB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1E,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;oBAC7B,MAAM,KAAK,GAAG,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;oBAClF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAyC,CAAC,CAAC,CAAC,IAAI,CAAA;oBAClF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;oBACjE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACrD,CAAC;gBACD,SAAQ;YACV,CAAC;YACD,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;YACxD,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC9B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAQ;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAA;QAE1D,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;YACzF,SAAQ;QACV,CAAC;QAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,UAAU;gBACb,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACxC,MAAK;YAEP,KAAK,OAAO;gBACV,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAgC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;gBACpF,MAAK;YAEP,KAAK,OAAO;gBACV,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;wBAC3B,UAAU,CACR,UAAU,CAAC,KAAK,CAAC,EACjB,GAA8B,EAC9B,GAAG,IAAI,IAAI,KAAK,GAAG,EACnB,QAAQ,EACR,GAAG,CACJ,CAAA;oBACH,CAAC,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAK;YAEP,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,MAAK;gBAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;gBACzC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;oBAC3B,MAAM,KAAK,GAAG,GAA8B,CAAA;oBAC5C,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBACpF,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC1E;;;;sBAIE;oBACF,IAAI,CAAC,KAAK;wBAAE,OAAM;oBAClB,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,OAAO,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;gBACjF,CAAC,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;YAED;gBACE,MAAK;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,MAAqC;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAC7B,IAAI,MAAM,YAAY,GAAG;QAAE,OAAO,MAAM,CAAA;IACxC,OAAO,IAAI,GAAG,CAAE,MAA2B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,IAAyC,EACzC,OAA4B;IAE5B,MAAM,GAAG,GAAgB,EAAE,CAAA;IAC3B,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE;QAClC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,GAAG;KACJ,CAAC,CAAA;IACF,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAC1B,MAAwB,EACxB,IAAyC,EACzC,OAAsD;IAEtD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAC/C,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAC3D,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAwB,EAAE,UAA0B;IACjF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;YAAE,OAAO,IAAI,CAAA;QAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,IAAI,CAAA;QACrE,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1E,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjF,SAAQ;QACV,CAAC;QACD,IAAI,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;YAAE,OAAO,IAAI,CAAA;IAChE,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/testing/anonymousAccess.d.ts

@@ -0,0 +1,111 @@
+import type { Access } from 'payload';
+/** Where each collection sits. Site data: the buckets are the site's decision. */
+export interface AnonymousAccessBuckets {
+    /**
+     * Collections a published page reads with nobody signed in, each with where
+     * it is read. Populated relationships count: Payload applies the related
+     * collection's own rule when it resolves one at depth, so an upload
+     * collection is here whenever a page shows an image.
+     */
+    renderPath: Readonly<Record<string, string>>;
+    /**
+     * Collections the internet must not read. A reason per entry is optional,
+     * and worth writing for anything that is not obvious.
+     */
+    private: Readonly<Record<string, string>> | readonly string[];
+    /**
+     * The same two buckets for globals. Omit it when the site has none; when it
+     * is given, every global must be in it.
+     */
+    globals?: {
+        renderPath?: Readonly<Record<string, string>>;
+        private?: Readonly<Record<string, string>> | readonly string[];
+    };
+}
+/** The slice of a collection or global config this reads. */
+export interface AccessCheckedEntity {
+    slug: string;
+    access?: {
+        read?: unknown;
+    } | undefined;
+    versions?: unknown;
+}
+/** The slice of a Payload config this reads — a `SanitizedConfig` satisfies it. */
+export interface AccessCheckedConfig {
+    collections?: readonly AccessCheckedEntity[] | undefined;
+    globals?: readonly AccessCheckedEntity[] | undefined;
+}
+export type AccessFindingKind = 
+/** In the config and in no bucket. */
+'unclassified'
+/** In both buckets, or listed twice. */
+ | 'classified-twice'
+/** In a bucket and not in the config: renamed, or removed. */
+ | 'not-in-config'
+/** On the render path and refusing an anonymous read. */
+ | 'render-path-refused'
+/** On the render path with drafts on, and answering a bare `true`. */
+ | 'drafts-unfiltered'
+/** Private, and answering an anonymous read with `true` or a query. */
+ | 'private-readable';
+export interface AccessFinding {
+    kind: AccessFindingKind;
+    /** `collection` or `global`. */
+    entity: 'collection' | 'global';
+    slug: string;
+    message: string;
+}
+/**
+ * The anonymous request an access rule is handed.
+ *
+ * `req.payload` is a stub that throws on use rather than a mock that answers:
+ * a read rule that looks something up to decide is one this cannot evaluate
+ * without a database, and it should say so here rather than pass on a guess.
+ */
+export declare function anonymousAccessArgs(): Parameters<Access>[0];
+/**
+ * What a read rule answers an anonymous request: `true`, `false`, a `where`
+ * query, or `undefined` when there is no rule at all.
+ */
+export declare function anonymousRead(entity: AccessCheckedEntity): Promise<unknown>;
+/** Whether an entity keeps drafts, so an anonymous read must be narrowed to published. */
+export declare function hasDrafts(entity: AccessCheckedEntity): boolean;
+/**
+ * Why a render-path entity fails, or `undefined` when it passes.
+ *
+ * `undefined` is a failure here and not in `privateProblem`, deliberately. A
+ * collection with no `read` rule gets Payload's default, which requires a user
+ * — so leaving one off is the same outage as writing an editors-only rule, and
+ * reads in review as though no decision were needed.
+ */
+export declare function renderPathProblem(entity: AccessCheckedEntity): Promise<{
+    kind: AccessFindingKind;
+    message: string;
+} | undefined>;
+/**
+ * Why a private entity fails, or `undefined` when it passes.
+ *
+ * `undefined` passes: Payload's default refuses an anonymous read, so a plugin
+ * collection with no rule of its own is already closed. What must not happen is
+ * `true`, or a query — a query is a successful read of some subset.
+ */
+export declare function privateProblem(entity: AccessCheckedEntity): Promise<{
+    kind: AccessFindingKind;
+    message: string;
+} | undefined>;
+/** Slugs of a bucket, whichever shape it was written in. */
+export declare function bucketSlugs(bucket: Readonly<Record<string, string>> | readonly string[] | undefined): string[];
+/**
+ * Every entity in exactly one bucket, and every bucket entry in the config.
+ */
+export declare function classificationFindings(entity: 'collection' | 'global', inConfig: readonly AccessCheckedEntity[], renderPath: readonly string[], closed: readonly string[]): AccessFinding[];
+/** A Payload config, or the promise `buildConfig` returns. */
+export type ConfigInput = AccessCheckedConfig | Promise<AccessCheckedConfig>;
+/**
+ * Every finding for a config and its buckets, empty when it is sound.
+ *
+ * The pure form of `describeAnonymousAccess`, for a script or a test that
+ * wants the list rather than one test per collection.
+ */
+export declare function checkAnonymousAccess(config: ConfigInput, buckets: AnonymousAccessBuckets): Promise<AccessFinding[]>;
+//# sourceMappingURL=anonymousAccess.d.ts.map

package/dist/testing/anonymousAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymousAccess.d.ts","sourceRoot":"","sources":["../../src/testing/anonymousAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AA2BrC,kFAAkF;AAClF,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5C;;;OAGG;IACH,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;IAC7D;;;OAGG;IACH,OAAO,CAAC,EAAE;QACR,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;QAC7C,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,CAAA;KAC/D,CAAA;CACF;AAED,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,SAAS,CAAA;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,CAAA;IACxD,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,GAAG,SAAS,CAAA;CACrD;AAED,MAAM,MAAM,iBAAiB;AAC3B,sCAAsC;AACpC,cAAc;AAChB,wCAAwC;GACtC,kBAAkB;AACpB,8DAA8D;GAC5D,eAAe;AACjB,yDAAyD;GACvD,qBAAqB;AACvB,sEAAsE;GACpE,mBAAmB;AACrB,uEAAuE;GACrE,kBAAkB,CAAA;AAEtB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAA;IACvB,gCAAgC;IAChC,MAAM,EAAE,YAAY,GAAG,QAAQ,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAmB3D;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAIjF;AAED,0FAA0F;AAC1F,wBAAgB,SAAS,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAG9D;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CA0BnE;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAYnE;AAED,4DAA4D;AAC5D,wBAAgB,WAAW,CACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,MAAM,EAAE,GAAG,SAAS,GACvE,MAAM,EAAE,CAGV;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,YAAY,GAAG,QAAQ,EAC/B,QAAQ,EAAE,SAAS,mBAAmB,EAAE,EACxC,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,aAAa,EAAE,CA2CjB;AAED,8DAA8D;AAC9D,MAAM,MAAM,WAAW,GAAG,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAA;AAE5E;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,aAAa,EAAE,CAAC,CA2C1B"}