@open-aih/payload-ddb 3.1.0

package/dist/utilities/operators.js

@@ -0,0 +1,58 @@
+/**
+ * The where-operator coverage shared by `matchesWhere` (in-JS evaluator) and
+ * `buildFilterExpression` (DynamoDB pushdown). Keeping the set in one place
+ * keeps the two paths honest — if an operator is supported in one, it should
+ * be supported in the other, since callers can't know which path runs.
+ */ export const SUPPORTED_OPERATORS = new Set([
+    'equals',
+    'exists',
+    'greater_than',
+    'greater_than_equal',
+    'in',
+    'less_than',
+    'less_than_equal',
+    'like',
+    'not_equals',
+    'not_in'
+]);
+/**
+ * Operators we can't faithfully express in a DynamoDB `FilterExpression` and
+ * therefore evaluate in JS after fetching candidate rows. `like` is here
+ * because Payload's contract is case-insensitive substring matching while
+ * DynamoDB's `contains()` is case-sensitive — pushing it down would silently
+ * change semantics. When `where` contains any of these, the read helpers
+ * `Query` the partition without server-side filtering and apply
+ * `matchesWhere` in memory.
+ */ export const JS_ONLY_OPERATORS = new Set([
+    'like'
+]);
+export const SUPPORTED_OPERATORS_DESCRIPTION = `${[
+    ...SUPPORTED_OPERATORS
+].join(', ')}, and, or`;
+export function unsupportedOperatorError(operator, field) {
+    return new Error(`payload-ddb: operator \`${operator}\` is not supported yet on field \`${field}\`. ` + `Supported: ${SUPPORTED_OPERATORS_DESCRIPTION}.`);
+}
+/**
+ * Walk a `Where` and return true if any leaf clause uses an operator that
+ * forces JS-side evaluation. Recurses into `and`/`or` groups.
+ */ export function whereHasJsOnlyOperator(where) {
+    if (!where) return false;
+    for (const [key, raw] of Object.entries(where)){
+        if (key === 'and' || key === 'or') {
+            if (!Array.isArray(raw)) continue;
+            for (const sub of raw){
+                if (sub && typeof sub === 'object' && whereHasJsOnlyOperator(sub)) {
+                    return true;
+                }
+            }
+            continue;
+        }
+        if (!raw || typeof raw !== 'object') continue;
+        for (const op of Object.keys(raw)){
+            if (JS_ONLY_OPERATORS.has(op)) return true;
+        }
+    }
+    return false;
+}
+
+//# sourceMappingURL=operators.js.map

package/dist/utilities/operators.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/operators.ts"],"sourcesContent":["import type { Where } from 'payload'\n\n/**\n * The where-operator coverage shared by `matchesWhere` (in-JS evaluator) and\n * `buildFilterExpression` (DynamoDB pushdown). Keeping the set in one place\n * keeps the two paths honest — if an operator is supported in one, it should\n * be supported in the other, since callers can't know which path runs.\n */\nexport const SUPPORTED_OPERATORS = new Set([\n  'equals',\n  'exists',\n  'greater_than',\n  'greater_than_equal',\n  'in',\n  'less_than',\n  'less_than_equal',\n  'like',\n  'not_equals',\n  'not_in',\n])\n\n/**\n * Operators we can't faithfully express in a DynamoDB `FilterExpression` and\n * therefore evaluate in JS after fetching candidate rows. `like` is here\n * because Payload's contract is case-insensitive substring matching while\n * DynamoDB's `contains()` is case-sensitive — pushing it down would silently\n * change semantics. When `where` contains any of these, the read helpers\n * `Query` the partition without server-side filtering and apply\n * `matchesWhere` in memory.\n */\nexport const JS_ONLY_OPERATORS = new Set(['like'])\n\nexport const SUPPORTED_OPERATORS_DESCRIPTION = `${[...SUPPORTED_OPERATORS].join(', ')}, and, or`\n\nexport function unsupportedOperatorError(operator: string, field: string): Error {\n  return new Error(\n    `payload-ddb: operator \\`${operator}\\` is not supported yet on field \\`${field}\\`. ` +\n      `Supported: ${SUPPORTED_OPERATORS_DESCRIPTION}.`,\n  )\n}\n\n/**\n * Walk a `Where` and return true if any leaf clause uses an operator that\n * forces JS-side evaluation. Recurses into `and`/`or` groups.\n */\nexport function whereHasJsOnlyOperator(where: undefined | Where): boolean {\n  if (!where) return false\n  for (const [key, raw] of Object.entries(where)) {\n    if (key === 'and' || key === 'or') {\n      if (!Array.isArray(raw)) continue\n      for (const sub of raw) {\n        if (sub && typeof sub === 'object' && whereHasJsOnlyOperator(sub as Where)) {\n          return true\n        }\n      }\n      continue\n    }\n    if (!raw || typeof raw !== 'object') continue\n    for (const op of Object.keys(raw)) {\n      if (JS_ONLY_OPERATORS.has(op)) return true\n    }\n  }\n  return false\n}\n"],"names":["SUPPORTED_OPERATORS","Set","JS_ONLY_OPERATORS","SUPPORTED_OPERATORS_DESCRIPTION","join","unsupportedOperatorError","operator","field","Error","whereHasJsOnlyOperator","where","key","raw","Object","entries","Array","isArray","sub","op","keys","has"],"mappings":"AAEA;;;;;CAKC,GACD,OAAO,MAAMA,sBAAsB,IAAIC,IAAI;IACzC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,EAAC;AAEF;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAoB,IAAID,IAAI;IAAC;CAAO,EAAC;AAElD,OAAO,MAAME,kCAAkC,GAAG;OAAIH;CAAoB,CAACI,IAAI,CAAC,MAAM,SAAS,CAAC,CAAA;AAEhG,OAAO,SAASC,yBAAyBC,QAAgB,EAAEC,KAAa;IACtE,OAAO,IAAIC,MACT,CAAC,wBAAwB,EAAEF,SAAS,mCAAmC,EAAEC,MAAM,IAAI,CAAC,GAClF,CAAC,WAAW,EAAEJ,gCAAgC,CAAC,CAAC;AAEtD;AAEA;;;CAGC,GACD,OAAO,SAASM,uBAAuBC,KAAwB;IAC7D,IAAI,CAACA,OAAO,OAAO;IACnB,KAAK,MAAM,CAACC,KAAKC,IAAI,IAAIC,OAAOC,OAAO,CAACJ,OAAQ;QAC9C,IAAIC,QAAQ,SAASA,QAAQ,MAAM;YACjC,IAAI,CAACI,MAAMC,OAAO,CAACJ,MAAM;YACzB,KAAK,MAAMK,OAAOL,IAAK;gBACrB,IAAIK,OAAO,OAAOA,QAAQ,YAAYR,uBAAuBQ,MAAe;oBAC1E,OAAO;gBACT;YACF;YACA;QACF;QACA,IAAI,CAACL,OAAO,OAAOA,QAAQ,UAAU;QACrC,KAAK,MAAMM,MAAML,OAAOM,IAAI,CAACP,KAAM;YACjC,IAAIV,kBAAkBkB,GAAG,CAACF,KAAK,OAAO;QACxC;IACF;IACA,OAAO;AACT"}

package/dist/utilities/pickConfiguredFields.d.ts

@@ -0,0 +1,10 @@
+import type { Field } from 'payload';
+export declare function pickConfiguredFields(data: Record<string, unknown>, fields: Field[], extraAllowed?: readonly string[]): Record<string, unknown>;
+/**
+ * Strip a version row to its declared shape. Allow-lists Payload's
+ * version-row metadata (`parent`, `latest`, `autosave`, etc.) and recurses
+ * into the inner `version` snapshot against the parent collection/global's
+ * own fields.
+ */
+export declare function pickConfiguredVersionRow(row: Record<string, unknown>, parentFields: Field[]): Record<string, unknown>;
+//# sourceMappingURL=pickConfiguredFields.d.ts.map

package/dist/utilities/pickConfiguredFields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pickConfiguredFields.d.ts","sourceRoot":"","sources":["../../src/utilities/pickConfiguredFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAA;AAkCpD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM,EAAE,KAAK,EAAE,EACf,YAAY,GAAE,SAAS,MAAM,EAAO,GACnC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB;AA2ED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,YAAY,EAAE,KAAK,EAAE,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB"}

package/dist/utilities/pickConfiguredFields.js

@@ -0,0 +1,113 @@
+import { flattenTopLevelFields } from 'payload';
+import { ROW_RESERVED_KEYS, VERSION_ROW_RESERVED_KEYS } from './resolveSchema.js';
+/**
+ * Project an arbitrary `data` object onto the keys declared by a Payload
+ * collection or global's `fields` config, recursively. Mongoose's `strict`
+ * mode and Drizzle's column allow-list give the other adapters this behavior
+ * for free; DynamoDB has no schema layer, so without this projection any
+ * stray request-body field rides into the row verbatim. Most visibly,
+ * registration-form `confirm-password` would persist alongside the auth
+ * collection's actual fields and surface back through `/api/users/me` —
+ * leaking a plaintext credential.
+ *
+ * Allowed top-level keys at each level are derived from
+ * `flattenTopLevelFields`, which already inlines unnamed containers (row,
+ * collapsible, unnamed tabs) and drops `ui` fields. We additionally skip
+ * `join` (read-side virtual relation, never persisted) and recurse into
+ * named containers (`group`, `tab`, `array`, `blocks`).
+ *
+ * `localized: true` short-circuits recursion: persisted localized values are
+ * `{ [locale]: value }` maps and we don't introspect locale codes here.
+ * Top-level allow-listing still drops the unknown sibling fields the bug
+ * actually surfaces.
+ *
+ * Reserved keys passed via `extraAllowed` (e.g. `id`, `createdAt`,
+ * `updatedAt`, `_status`) are passed through unchanged. They aren't always
+ * declared in `fields` but are owned by Payload's framework layer.
+ */ const PRESENTATIONAL_OR_VIRTUAL = new Set([
+    'ui',
+    'join'
+]);
+export function pickConfiguredFields(data, fields, extraAllowed = []) {
+    return pickAtLevel(data, fields, extraAllowed);
+}
+function pickAtLevel(data, fields, extraAllowed = []) {
+    if (!isPlainRecord(data)) return data;
+    const out = {};
+    for (const key of extraAllowed){
+        if (key in data) out[key] = data[key];
+    }
+    for (const field of flattenTopLevelFields(fields)){
+        if (PRESENTATIONAL_OR_VIRTUAL.has(field.type)) continue;
+        const name = field.name;
+        if (!name || !(name in data)) continue;
+        const value = data[name];
+        // Localized values are `{ locale: value }` maps; we don't recurse into
+        // locale codes. Top-level field name is allow-listed, which is what
+        // closes the credential-leak class.
+        if (field.localized) {
+            out[name] = value;
+            continue;
+        }
+        if (field.type === 'group' || field.type === 'tab') {
+            out[name] = pickAtLevel(value, field.fields ?? []);
+        } else if (field.type === 'array') {
+            out[name] = pickArrayItems(value, field.fields ?? []);
+        } else if (field.type === 'blocks') {
+            out[name] = pickBlockItems(value, field.blocks ?? []);
+        } else {
+            out[name] = value;
+        }
+    }
+    return out;
+}
+function pickArrayItems(value, fields) {
+    if (!Array.isArray(value)) return value;
+    return value.map((item)=>{
+        if (!isPlainRecord(item)) return item;
+        // Array items get an auto-generated `id` from Payload that isn't in `fields`.
+        return pickAtLevel(item, fields, [
+            'id'
+        ]);
+    });
+}
+function pickBlockItems(value, blocks) {
+    if (!Array.isArray(value)) return value;
+    const bySlug = new Map(blocks.map((b)=>[
+            b.slug,
+            b
+        ]));
+    return value.map((item)=>{
+        if (!isPlainRecord(item)) return item;
+        const blockType = item['blockType'];
+        const block = typeof blockType === 'string' ? bySlug.get(blockType) : undefined;
+        // Unknown blockType: pass through. Mirrors Mongo's behavior — a stale
+        // blockType lingering in data after a config change shouldn't be
+        // silently nuked by the adapter.
+        if (!block) return item;
+        return pickAtLevel(item, block.fields ?? [], [
+            'id',
+            'blockType'
+        ]);
+    });
+}
+function isPlainRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date);
+}
+/**
+ * Strip a version row to its declared shape. Allow-lists Payload's
+ * version-row metadata (`parent`, `latest`, `autosave`, etc.) and recurses
+ * into the inner `version` snapshot against the parent collection/global's
+ * own fields.
+ */ export function pickConfiguredVersionRow(row, parentFields) {
+    const out = {};
+    for (const key of VERSION_ROW_RESERVED_KEYS){
+        if (key in row) out[key] = row[key];
+    }
+    if (isPlainRecord(out['version'])) {
+        out['version'] = pickConfiguredFields(out['version'], parentFields, ROW_RESERVED_KEYS);
+    }
+    return out;
+}
+
+//# sourceMappingURL=pickConfiguredFields.js.map

package/dist/utilities/pickConfiguredFields.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/pickConfiguredFields.ts"],"sourcesContent":["import type { Field, FlattenedField } from 'payload'\n\nimport { flattenTopLevelFields } from 'payload'\n\nimport { ROW_RESERVED_KEYS, VERSION_ROW_RESERVED_KEYS } from './resolveSchema.js'\n\n/**\n * Project an arbitrary `data` object onto the keys declared by a Payload\n * collection or global's `fields` config, recursively. Mongoose's `strict`\n * mode and Drizzle's column allow-list give the other adapters this behavior\n * for free; DynamoDB has no schema layer, so without this projection any\n * stray request-body field rides into the row verbatim. Most visibly,\n * registration-form `confirm-password` would persist alongside the auth\n * collection's actual fields and surface back through `/api/users/me` —\n * leaking a plaintext credential.\n *\n * Allowed top-level keys at each level are derived from\n * `flattenTopLevelFields`, which already inlines unnamed containers (row,\n * collapsible, unnamed tabs) and drops `ui` fields. We additionally skip\n * `join` (read-side virtual relation, never persisted) and recurse into\n * named containers (`group`, `tab`, `array`, `blocks`).\n *\n * `localized: true` short-circuits recursion: persisted localized values are\n * `{ [locale]: value }` maps and we don't introspect locale codes here.\n * Top-level allow-listing still drops the unknown sibling fields the bug\n * actually surfaces.\n *\n * Reserved keys passed via `extraAllowed` (e.g. `id`, `createdAt`,\n * `updatedAt`, `_status`) are passed through unchanged. They aren't always\n * declared in `fields` but are owned by Payload's framework layer.\n */\n\nconst PRESENTATIONAL_OR_VIRTUAL = new Set(['ui', 'join'])\n\nexport function pickConfiguredFields(\n  data: Record<string, unknown>,\n  fields: Field[],\n  extraAllowed: readonly string[] = [],\n): Record<string, unknown> {\n  return pickAtLevel(data, fields, extraAllowed) as Record<string, unknown>\n}\n\nfunction pickAtLevel(\n  data: unknown,\n  fields: Field[],\n  extraAllowed: readonly string[] = [],\n): unknown {\n  if (!isPlainRecord(data)) return data\n\n  const out: Record<string, unknown> = {}\n\n  for (const key of extraAllowed) {\n    if (key in data) out[key] = data[key]\n  }\n\n  for (const field of flattenTopLevelFields(fields) as FlattenedField[]) {\n    if (PRESENTATIONAL_OR_VIRTUAL.has(field.type)) continue\n    const name = (field as { name?: string }).name\n    if (!name || !(name in data)) continue\n\n    const value = data[name]\n\n    // Localized values are `{ locale: value }` maps; we don't recurse into\n    // locale codes. Top-level field name is allow-listed, which is what\n    // closes the credential-leak class.\n    if ((field as { localized?: boolean }).localized) {\n      out[name] = value\n      continue\n    }\n\n    if (field.type === 'group' || field.type === 'tab') {\n      out[name] = pickAtLevel(value, field.fields ?? [])\n    } else if (field.type === 'array') {\n      out[name] = pickArrayItems(value, field.fields ?? [])\n    } else if (field.type === 'blocks') {\n      out[name] = pickBlockItems(value, field.blocks ?? [])\n    } else {\n      out[name] = value\n    }\n  }\n\n  return out\n}\n\nfunction pickArrayItems(value: unknown, fields: Field[]): unknown {\n  if (!Array.isArray(value)) return value\n  return value.map((item) => {\n    if (!isPlainRecord(item)) return item\n    // Array items get an auto-generated `id` from Payload that isn't in `fields`.\n    return pickAtLevel(item, fields, ['id']) as Record<string, unknown>\n  })\n}\n\nfunction pickBlockItems(\n  value: unknown,\n  blocks: { slug: string; fields: Field[] }[],\n): unknown {\n  if (!Array.isArray(value)) return value\n  const bySlug = new Map(blocks.map((b) => [b.slug, b]))\n  return value.map((item) => {\n    if (!isPlainRecord(item)) return item\n    const blockType = item['blockType']\n    const block = typeof blockType === 'string' ? bySlug.get(blockType) : undefined\n    // Unknown blockType: pass through. Mirrors Mongo's behavior — a stale\n    // blockType lingering in data after a config change shouldn't be\n    // silently nuked by the adapter.\n    if (!block) return item\n    return pickAtLevel(item, block.fields ?? [], ['id', 'blockType']) as Record<string, unknown>\n  })\n}\n\nfunction isPlainRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value) && !(value instanceof Date)\n}\n\n/**\n * Strip a version row to its declared shape. Allow-lists Payload's\n * version-row metadata (`parent`, `latest`, `autosave`, etc.) and recurses\n * into the inner `version` snapshot against the parent collection/global's\n * own fields.\n */\nexport function pickConfiguredVersionRow(\n  row: Record<string, unknown>,\n  parentFields: Field[],\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {}\n  for (const key of VERSION_ROW_RESERVED_KEYS) {\n    if (key in row) out[key] = row[key]\n  }\n  if (isPlainRecord(out['version'])) {\n    out['version'] = pickConfiguredFields(out['version'], parentFields, ROW_RESERVED_KEYS)\n  }\n  return out\n}\n"],"names":["flattenTopLevelFields","ROW_RESERVED_KEYS","VERSION_ROW_RESERVED_KEYS","PRESENTATIONAL_OR_VIRTUAL","Set","pickConfiguredFields","data","fields","extraAllowed","pickAtLevel","isPlainRecord","out","key","field","has","type","name","value","localized","pickArrayItems","pickBlockItems","blocks","Array","isArray","map","item","bySlug","Map","b","slug","blockType","block","get","undefined","Date","pickConfiguredVersionRow","row","parentFields"],"mappings":"AAEA,SAASA,qBAAqB,QAAQ,UAAS;AAE/C,SAASC,iBAAiB,EAAEC,yBAAyB,QAAQ,qBAAoB;AAEjF;;;;;;;;;;;;;;;;;;;;;;;;CAwBC,GAED,MAAMC,4BAA4B,IAAIC,IAAI;IAAC;IAAM;CAAO;AAExD,OAAO,SAASC,qBACdC,IAA6B,EAC7BC,MAAe,EACfC,eAAkC,EAAE;IAEpC,OAAOC,YAAYH,MAAMC,QAAQC;AACnC;AAEA,SAASC,YACPH,IAAa,EACbC,MAAe,EACfC,eAAkC,EAAE;IAEpC,IAAI,CAACE,cAAcJ,OAAO,OAAOA;IAEjC,MAAMK,MAA+B,CAAC;IAEtC,KAAK,MAAMC,OAAOJ,aAAc;QAC9B,IAAII,OAAON,MAAMK,GAAG,CAACC,IAAI,GAAGN,IAAI,CAACM,IAAI;IACvC;IAEA,KAAK,MAAMC,SAASb,sBAAsBO,QAA6B;QACrE,IAAIJ,0BAA0BW,GAAG,CAACD,MAAME,IAAI,GAAG;QAC/C,MAAMC,OAAO,AAACH,MAA4BG,IAAI;QAC9C,IAAI,CAACA,QAAQ,CAAEA,CAAAA,QAAQV,IAAG,GAAI;QAE9B,MAAMW,QAAQX,IAAI,CAACU,KAAK;QAExB,uEAAuE;QACvE,oEAAoE;QACpE,oCAAoC;QACpC,IAAI,AAACH,MAAkCK,SAAS,EAAE;YAChDP,GAAG,CAACK,KAAK,GAAGC;YACZ;QACF;QAEA,IAAIJ,MAAME,IAAI,KAAK,WAAWF,MAAME,IAAI,KAAK,OAAO;YAClDJ,GAAG,CAACK,KAAK,GAAGP,YAAYQ,OAAOJ,MAAMN,MAAM,IAAI,EAAE;QACnD,OAAO,IAAIM,MAAME,IAAI,KAAK,SAAS;YACjCJ,GAAG,CAACK,KAAK,GAAGG,eAAeF,OAAOJ,MAAMN,MAAM,IAAI,EAAE;QACtD,OAAO,IAAIM,MAAME,IAAI,KAAK,UAAU;YAClCJ,GAAG,CAACK,KAAK,GAAGI,eAAeH,OAAOJ,MAAMQ,MAAM,IAAI,EAAE;QACtD,OAAO;YACLV,GAAG,CAACK,KAAK,GAAGC;QACd;IACF;IAEA,OAAON;AACT;AAEA,SAASQ,eAAeF,KAAc,EAAEV,MAAe;IACrD,IAAI,CAACe,MAAMC,OAAO,CAACN,QAAQ,OAAOA;IAClC,OAAOA,MAAMO,GAAG,CAAC,CAACC;QAChB,IAAI,CAACf,cAAce,OAAO,OAAOA;QACjC,8EAA8E;QAC9E,OAAOhB,YAAYgB,MAAMlB,QAAQ;YAAC;SAAK;IACzC;AACF;AAEA,SAASa,eACPH,KAAc,EACdI,MAA2C;IAE3C,IAAI,CAACC,MAAMC,OAAO,CAACN,QAAQ,OAAOA;IAClC,MAAMS,SAAS,IAAIC,IAAIN,OAAOG,GAAG,CAAC,CAACI,IAAM;YAACA,EAAEC,IAAI;YAAED;SAAE;IACpD,OAAOX,MAAMO,GAAG,CAAC,CAACC;QAChB,IAAI,CAACf,cAAce,OAAO,OAAOA;QACjC,MAAMK,YAAYL,IAAI,CAAC,YAAY;QACnC,MAAMM,QAAQ,OAAOD,cAAc,WAAWJ,OAAOM,GAAG,CAACF,aAAaG;QACtE,sEAAsE;QACtE,iEAAiE;QACjE,iCAAiC;QACjC,IAAI,CAACF,OAAO,OAAON;QACnB,OAAOhB,YAAYgB,MAAMM,MAAMxB,MAAM,IAAI,EAAE,EAAE;YAAC;YAAM;SAAY;IAClE;AACF;AAEA,SAASG,cAAcO,KAAc;IACnC,OAAOA,UAAU,QAAQ,OAAOA,UAAU,YAAY,CAACK,MAAMC,OAAO,CAACN,UAAU,CAAEA,CAAAA,iBAAiBiB,IAAG;AACvG;AAEA;;;;;CAKC,GACD,OAAO,SAASC,yBACdC,GAA4B,EAC5BC,YAAqB;IAErB,MAAM1B,MAA+B,CAAC;IACtC,KAAK,MAAMC,OAAOV,0BAA2B;QAC3C,IAAIU,OAAOwB,KAAKzB,GAAG,CAACC,IAAI,GAAGwB,GAAG,CAACxB,IAAI;IACrC;IACA,IAAIF,cAAcC,GAAG,CAAC,UAAU,GAAG;QACjCA,GAAG,CAAC,UAAU,GAAGN,qBAAqBM,GAAG,CAAC,UAAU,EAAE0B,cAAcpC;IACtE;IACA,OAAOU;AACT"}

package/dist/utilities/queryCount.d.ts

@@ -0,0 +1,9 @@
+import type { Where } from 'payload';
+import type { DynamoAdapter } from '../types.js';
+/**
+ * Paginated count over a single partition with optional `FilterExpression`
+ * pushdown. Uses `Select: 'COUNT'` so DynamoDB doesn't ship item bytes —
+ * only the post-filter `Count` per page comes back over the wire.
+ */
+export declare function queryCount(adapter: DynamoAdapter, partition: string, where: undefined | Where): Promise<number>;
+//# sourceMappingURL=queryCount.d.ts.map

package/dist/utilities/queryCount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryCount.d.ts","sourceRoot":"","sources":["../../src/utilities/queryCount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAIpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAMhD;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,KAAK,GACvB,OAAO,CAAC,MAAM,CAAC,CAiDjB"}

package/dist/utilities/queryCount.js

@@ -0,0 +1,56 @@
+import { QueryCommand } from '@aws-sdk/lib-dynamodb';
+import { buildFilterExpression } from './buildFilterExpression.js';
+import { whereHasJsOnlyOperator } from './operators.js';
+import { queryMatching } from './queryMatching.js';
+/**
+ * Paginated count over a single partition with optional `FilterExpression`
+ * pushdown. Uses `Select: 'COUNT'` so DynamoDB doesn't ship item bytes —
+ * only the post-filter `Count` per page comes back over the wire.
+ */ export async function queryCount(adapter, partition, where) {
+    const docClient = adapter.docClient;
+    if (!docClient) {
+        throw new Error('payload-ddb: docClient is not initialized — call connect() first.');
+    }
+    // JS-only operators (e.g. `like`) can't be expressed in `FilterExpression`,
+    // so the only correct count is "fetch and count the matches in memory".
+    // Loses the `Select: 'COUNT'` byte-savings but keeps semantics consistent
+    // with `queryMatching`.
+    if (whereHasJsOnlyOperator(where)) {
+        const matched = await queryMatching(adapter, partition, where);
+        return matched.length;
+    }
+    const filter = buildFilterExpression(where);
+    // Always-false predicate (e.g. `in: []`) → zero rows without a round-trip.
+    if (filter === null) return 0;
+    let totalDocs = 0;
+    let exclusiveStartKey;
+    while(true){
+        const result = await docClient.send(new QueryCommand({
+            TableName: adapter.tableName,
+            KeyConditionExpression: '#pk = :pk',
+            ExpressionAttributeNames: {
+                '#pk': 'pk',
+                ...filter?.names ?? {}
+            },
+            ExpressionAttributeValues: {
+                ':pk': partition,
+                ...filter?.values ?? {}
+            },
+            // Strong consistency — see `queryMatching` for rationale.
+            ConsistentRead: true,
+            Select: 'COUNT',
+            ...filter ? {
+                FilterExpression: filter.expression
+            } : {},
+            ...exclusiveStartKey ? {
+                ExclusiveStartKey: exclusiveStartKey
+            } : {}
+        }));
+        totalDocs += result.Count ?? 0;
+        if (!result.LastEvaluatedKey) break;
+        exclusiveStartKey = result.LastEvaluatedKey;
+    }
+    return totalDocs;
+}
+
+//# sourceMappingURL=queryCount.js.map

package/dist/utilities/queryCount.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/queryCount.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport { QueryCommand } from '@aws-sdk/lib-dynamodb'\n\nimport type { DynamoAdapter } from '../types.js'\n\nimport { buildFilterExpression } from './buildFilterExpression.js'\nimport { whereHasJsOnlyOperator } from './operators.js'\nimport { queryMatching } from './queryMatching.js'\n\n/**\n * Paginated count over a single partition with optional `FilterExpression`\n * pushdown. Uses `Select: 'COUNT'` so DynamoDB doesn't ship item bytes —\n * only the post-filter `Count` per page comes back over the wire.\n */\nexport async function queryCount(\n  adapter: DynamoAdapter,\n  partition: string,\n  where: undefined | Where,\n): Promise<number> {\n  const docClient = adapter.docClient\n  if (!docClient) {\n    throw new Error('payload-ddb: docClient is not initialized — call connect() first.')\n  }\n\n  // JS-only operators (e.g. `like`) can't be expressed in `FilterExpression`,\n  // so the only correct count is \"fetch and count the matches in memory\".\n  // Loses the `Select: 'COUNT'` byte-savings but keeps semantics consistent\n  // with `queryMatching`.\n  if (whereHasJsOnlyOperator(where)) {\n    const matched = await queryMatching(adapter, partition, where)\n    return matched.length\n  }\n\n  const filter = buildFilterExpression(where)\n  // Always-false predicate (e.g. `in: []`) → zero rows without a round-trip.\n  if (filter === null) return 0\n  let totalDocs = 0\n  let exclusiveStartKey: Record<string, unknown> | undefined\n\n  while (true) {\n    const result = await docClient.send(\n      new QueryCommand({\n        TableName: adapter.tableName,\n        KeyConditionExpression: '#pk = :pk',\n        ExpressionAttributeNames: {\n          '#pk': 'pk',\n          ...(filter?.names ?? {}),\n        },\n        ExpressionAttributeValues: {\n          ':pk': partition,\n          ...(filter?.values ?? {}),\n        },\n        // Strong consistency — see `queryMatching` for rationale.\n        ConsistentRead: true,\n        Select: 'COUNT',\n        ...(filter ? { FilterExpression: filter.expression } : {}),\n        ...(exclusiveStartKey ? { ExclusiveStartKey: exclusiveStartKey } : {}),\n      }),\n    )\n\n    totalDocs += result.Count ?? 0\n\n    if (!result.LastEvaluatedKey) break\n    exclusiveStartKey = result.LastEvaluatedKey\n  }\n\n  return totalDocs\n}\n"],"names":["QueryCommand","buildFilterExpression","whereHasJsOnlyOperator","queryMatching","queryCount","adapter","partition","where","docClient","Error","matched","length","filter","totalDocs","exclusiveStartKey","result","send","TableName","tableName","KeyConditionExpression","ExpressionAttributeNames","names","ExpressionAttributeValues","values","ConsistentRead","Select","FilterExpression","expression","ExclusiveStartKey","Count","LastEvaluatedKey"],"mappings":"AAEA,SAASA,YAAY,QAAQ,wBAAuB;AAIpD,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,sBAAsB,QAAQ,iBAAgB;AACvD,SAASC,aAAa,QAAQ,qBAAoB;AAElD;;;;CAIC,GACD,OAAO,eAAeC,WACpBC,OAAsB,EACtBC,SAAiB,EACjBC,KAAwB;IAExB,MAAMC,YAAYH,QAAQG,SAAS;IACnC,IAAI,CAACA,WAAW;QACd,MAAM,IAAIC,MAAM;IAClB;IAEA,4EAA4E;IAC5E,wEAAwE;IACxE,0EAA0E;IAC1E,wBAAwB;IACxB,IAAIP,uBAAuBK,QAAQ;QACjC,MAAMG,UAAU,MAAMP,cAAcE,SAASC,WAAWC;QACxD,OAAOG,QAAQC,MAAM;IACvB;IAEA,MAAMC,SAASX,sBAAsBM;IACrC,2EAA2E;IAC3E,IAAIK,WAAW,MAAM,OAAO;IAC5B,IAAIC,YAAY;IAChB,IAAIC;IAEJ,MAAO,KAAM;QACX,MAAMC,SAAS,MAAMP,UAAUQ,IAAI,CACjC,IAAIhB,aAAa;YACfiB,WAAWZ,QAAQa,SAAS;YAC5BC,wBAAwB;YACxBC,0BAA0B;gBACxB,OAAO;gBACP,GAAIR,QAAQS,SAAS,CAAC,CAAC;YACzB;YACAC,2BAA2B;gBACzB,OAAOhB;gBACP,GAAIM,QAAQW,UAAU,CAAC,CAAC;YAC1B;YACA,0DAA0D;YAC1DC,gBAAgB;YAChBC,QAAQ;YACR,GAAIb,SAAS;gBAAEc,kBAAkBd,OAAOe,UAAU;YAAC,IAAI,CAAC,CAAC;YACzD,GAAIb,oBAAoB;gBAAEc,mBAAmBd;YAAkB,IAAI,CAAC,CAAC;QACvE;QAGFD,aAAaE,OAAOc,KAAK,IAAI;QAE7B,IAAI,CAACd,OAAOe,gBAAgB,EAAE;QAC9BhB,oBAAoBC,OAAOe,gBAAgB;IAC7C;IAEA,OAAOjB;AACT"}

package/dist/utilities/queryMatching.d.ts

@@ -0,0 +1,18 @@
+import type { Where } from 'payload';
+import type { DynamoAdapter } from '../types.js';
+/**
+ * Walk a partition via paginated `Query` (`pk = :partition`), pushing the
+ * caller's `where` into `FilterExpression` so non-matching rows are skipped
+ * server-side. Returns every matching item materialized in memory — suitable
+ * for callers that need the full set (sort, paginate, bulk-mutate).
+ *
+ * Use `findFirst` instead when you only need the first match: that helper
+ * stops on the first hit.
+ *
+ * Cost note: `FilterExpression` reduces network bytes but not RCU
+ * consumption. DynamoDB still reads every row in the partition before
+ * filtering. The next meaningful optimization is GSIs that mirror specific
+ * access patterns (e.g. `email` for auth, `slug` for public collections).
+ */
+export declare function queryMatching(adapter: DynamoAdapter, partition: string, where: undefined | Where): Promise<Record<string, unknown>[]>;
+//# sourceMappingURL=queryMatching.d.ts.map

package/dist/utilities/queryMatching.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queryMatching.d.ts","sourceRoot":"","sources":["../../src/utilities/queryMatching.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAIpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAOhD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,KAAK,GACvB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAoDpC"}

package/dist/utilities/queryMatching.js

@@ -0,0 +1,71 @@
+import { QueryCommand } from '@aws-sdk/lib-dynamodb';
+import { buildFilterExpression } from './buildFilterExpression.js';
+import { matchesWhere } from './matchesWhere.js';
+import { whereHasJsOnlyOperator } from './operators.js';
+import { stripInternalKeys } from './stripInternalKeys.js';
+/**
+ * Walk a partition via paginated `Query` (`pk = :partition`), pushing the
+ * caller's `where` into `FilterExpression` so non-matching rows are skipped
+ * server-side. Returns every matching item materialized in memory — suitable
+ * for callers that need the full set (sort, paginate, bulk-mutate).
+ *
+ * Use `findFirst` instead when you only need the first match: that helper
+ * stops on the first hit.
+ *
+ * Cost note: `FilterExpression` reduces network bytes but not RCU
+ * consumption. DynamoDB still reads every row in the partition before
+ * filtering. The next meaningful optimization is GSIs that mirror specific
+ * access patterns (e.g. `email` for auth, `slug` for public collections).
+ */ export async function queryMatching(adapter, partition, where) {
+    const docClient = adapter.docClient;
+    if (!docClient) {
+        throw new Error('payload-ddb: docClient is not initialized — call connect() first.');
+    }
+    // When `where` uses an operator we can't faithfully push down (today: `like`,
+    // because Payload's contract is case-insensitive while DynamoDB's
+    // `contains()` isn't), we fetch the whole partition and evaluate in JS.
+    // Recurse with `where = undefined` to reuse the standard pagination loop.
+    if (whereHasJsOnlyOperator(where)) {
+        const all = await queryMatching(adapter, partition, undefined);
+        return all.filter((row)=>matchesWhere(row, where));
+    }
+    const filter = buildFilterExpression(where);
+    // `null` signals an always-false predicate (e.g. `id: { in: [] }` from
+    // access control). Short-circuit so we don't pay for a Query just to
+    // return nothing.
+    if (filter === null) return [];
+    const matched = [];
+    let exclusiveStartKey;
+    while(true){
+        const result = await docClient.send(new QueryCommand({
+            TableName: adapter.tableName,
+            KeyConditionExpression: '#pk = :pk',
+            ExpressionAttributeNames: {
+                '#pk': 'pk',
+                ...filter?.names ?? {}
+            },
+            ExpressionAttributeValues: {
+                ':pk': partition,
+                ...filter?.values ?? {}
+            },
+            // Strong consistency by default — Payload assumes read-after-write
+            // visibility (Mongo/Postgres do), and DynamoDB's default eventual
+            // consistency breaks "create-then-list" flows. 2x RCU but correct.
+            ConsistentRead: true,
+            ...filter ? {
+                FilterExpression: filter.expression
+            } : {},
+            ...exclusiveStartKey ? {
+                ExclusiveStartKey: exclusiveStartKey
+            } : {}
+        }));
+        for (const item of result.Items ?? []){
+            matched.push(stripInternalKeys(item));
+        }
+        if (!result.LastEvaluatedKey) break;
+        exclusiveStartKey = result.LastEvaluatedKey;
+    }
+    return matched;
+}
+
+//# sourceMappingURL=queryMatching.js.map

package/dist/utilities/queryMatching.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/queryMatching.ts"],"sourcesContent":["import type { Where } from 'payload'\n\nimport { QueryCommand } from '@aws-sdk/lib-dynamodb'\n\nimport type { DynamoAdapter } from '../types.js'\n\nimport { buildFilterExpression } from './buildFilterExpression.js'\nimport { matchesWhere } from './matchesWhere.js'\nimport { whereHasJsOnlyOperator } from './operators.js'\nimport { stripInternalKeys } from './stripInternalKeys.js'\n\n/**\n * Walk a partition via paginated `Query` (`pk = :partition`), pushing the\n * caller's `where` into `FilterExpression` so non-matching rows are skipped\n * server-side. Returns every matching item materialized in memory — suitable\n * for callers that need the full set (sort, paginate, bulk-mutate).\n *\n * Use `findFirst` instead when you only need the first match: that helper\n * stops on the first hit.\n *\n * Cost note: `FilterExpression` reduces network bytes but not RCU\n * consumption. DynamoDB still reads every row in the partition before\n * filtering. The next meaningful optimization is GSIs that mirror specific\n * access patterns (e.g. `email` for auth, `slug` for public collections).\n */\nexport async function queryMatching(\n  adapter: DynamoAdapter,\n  partition: string,\n  where: undefined | Where,\n): Promise<Record<string, unknown>[]> {\n  const docClient = adapter.docClient\n  if (!docClient) {\n    throw new Error('payload-ddb: docClient is not initialized — call connect() first.')\n  }\n\n  // When `where` uses an operator we can't faithfully push down (today: `like`,\n  // because Payload's contract is case-insensitive while DynamoDB's\n  // `contains()` isn't), we fetch the whole partition and evaluate in JS.\n  // Recurse with `where = undefined` to reuse the standard pagination loop.\n  if (whereHasJsOnlyOperator(where)) {\n    const all = await queryMatching(adapter, partition, undefined)\n    return all.filter((row) => matchesWhere(row, where))\n  }\n\n  const filter = buildFilterExpression(where)\n  // `null` signals an always-false predicate (e.g. `id: { in: [] }` from\n  // access control). Short-circuit so we don't pay for a Query just to\n  // return nothing.\n  if (filter === null) return []\n  const matched: Record<string, unknown>[] = []\n  let exclusiveStartKey: Record<string, unknown> | undefined\n\n  while (true) {\n    const result = await docClient.send(\n      new QueryCommand({\n        TableName: adapter.tableName,\n        KeyConditionExpression: '#pk = :pk',\n        ExpressionAttributeNames: {\n          '#pk': 'pk',\n          ...(filter?.names ?? {}),\n        },\n        ExpressionAttributeValues: {\n          ':pk': partition,\n          ...(filter?.values ?? {}),\n        },\n        // Strong consistency by default — Payload assumes read-after-write\n        // visibility (Mongo/Postgres do), and DynamoDB's default eventual\n        // consistency breaks \"create-then-list\" flows. 2x RCU but correct.\n        ConsistentRead: true,\n        ...(filter ? { FilterExpression: filter.expression } : {}),\n        ...(exclusiveStartKey ? { ExclusiveStartKey: exclusiveStartKey } : {}),\n      }),\n    )\n    for (const item of result.Items ?? []) {\n      matched.push(stripInternalKeys(item))\n    }\n    if (!result.LastEvaluatedKey) break\n    exclusiveStartKey = result.LastEvaluatedKey\n  }\n\n  return matched\n}\n"],"names":["QueryCommand","buildFilterExpression","matchesWhere","whereHasJsOnlyOperator","stripInternalKeys","queryMatching","adapter","partition","where","docClient","Error","all","undefined","filter","row","matched","exclusiveStartKey","result","send","TableName","tableName","KeyConditionExpression","ExpressionAttributeNames","names","ExpressionAttributeValues","values","ConsistentRead","FilterExpression","expression","ExclusiveStartKey","item","Items","push","LastEvaluatedKey"],"mappings":"AAEA,SAASA,YAAY,QAAQ,wBAAuB;AAIpD,SAASC,qBAAqB,QAAQ,6BAA4B;AAClE,SAASC,YAAY,QAAQ,oBAAmB;AAChD,SAASC,sBAAsB,QAAQ,iBAAgB;AACvD,SAASC,iBAAiB,QAAQ,yBAAwB;AAE1D;;;;;;;;;;;;;CAaC,GACD,OAAO,eAAeC,cACpBC,OAAsB,EACtBC,SAAiB,EACjBC,KAAwB;IAExB,MAAMC,YAAYH,QAAQG,SAAS;IACnC,IAAI,CAACA,WAAW;QACd,MAAM,IAAIC,MAAM;IAClB;IAEA,8EAA8E;IAC9E,kEAAkE;IAClE,wEAAwE;IACxE,0EAA0E;IAC1E,IAAIP,uBAAuBK,QAAQ;QACjC,MAAMG,MAAM,MAAMN,cAAcC,SAASC,WAAWK;QACpD,OAAOD,IAAIE,MAAM,CAAC,CAACC,MAAQZ,aAAaY,KAAKN;IAC/C;IAEA,MAAMK,SAASZ,sBAAsBO;IACrC,uEAAuE;IACvE,qEAAqE;IACrE,kBAAkB;IAClB,IAAIK,WAAW,MAAM,OAAO,EAAE;IAC9B,MAAME,UAAqC,EAAE;IAC7C,IAAIC;IAEJ,MAAO,KAAM;QACX,MAAMC,SAAS,MAAMR,UAAUS,IAAI,CACjC,IAAIlB,aAAa;YACfmB,WAAWb,QAAQc,SAAS;YAC5BC,wBAAwB;YACxBC,0BAA0B;gBACxB,OAAO;gBACP,GAAIT,QAAQU,SAAS,CAAC,CAAC;YACzB;YACAC,2BAA2B;gBACzB,OAAOjB;gBACP,GAAIM,QAAQY,UAAU,CAAC,CAAC;YAC1B;YACA,mEAAmE;YACnE,kEAAkE;YAClE,mEAAmE;YACnEC,gBAAgB;YAChB,GAAIb,SAAS;gBAAEc,kBAAkBd,OAAOe,UAAU;YAAC,IAAI,CAAC,CAAC;YACzD,GAAIZ,oBAAoB;gBAAEa,mBAAmBb;YAAkB,IAAI,CAAC,CAAC;QACvE;QAEF,KAAK,MAAMc,QAAQb,OAAOc,KAAK,IAAI,EAAE,CAAE;YACrChB,QAAQiB,IAAI,CAAC5B,kBAAkB0B;QACjC;QACA,IAAI,CAACb,OAAOgB,gBAAgB,EAAE;QAC9BjB,oBAAoBC,OAAOgB,gBAAgB;IAC7C;IAEA,OAAOlB;AACT"}

package/dist/utilities/resolveSchema.d.ts

@@ -0,0 +1,56 @@
+import type { Field } from 'payload';
+import type { DynamoAdapter } from '../types.js';
+/**
+ * Look up the sanitized `fields` array for a collection or global. Lives in
+ * one place so the write-path projection (see `pickConfiguredFields`) doesn't
+ * have to learn Payload's collection/global storage layout per call site.
+ *
+ * Returns `null` (rather than throwing) when a slug is unrecognized — a
+ * caller using an out-of-config slug is a programmer error elsewhere, but
+ * the right blast radius for that here is "skip projection," not "kill the
+ * write."
+ */
+export declare function getCollectionFields(adapter: DynamoAdapter, slug: string): Field[] | null;
+export declare function getGlobalFields(adapter: DynamoAdapter, slug: string): Field[] | null;
+/**
+ * Reserved keys Payload's framework layer owns rather than declaring through
+ * `fields`. Allowed at the top of every collection/global row.
+ *
+ *  - `id`                    — primary key
+ *  - `createdAt`/`updatedAt` — timestamp pair (default-on per collection config)
+ *  - `_status`               — drafts state (only present when drafts enabled,
+ *                              but allow-listing it unconditionally is harmless)
+ *  - `globalType`            — Payload tags global rows with this internally
+ */
+export declare const ROW_RESERVED_KEYS: readonly ["id", "createdAt", "updatedAt", "_status", "globalType"];
+/**
+ * Reserved keys at the top of a *version* row. The inner `version` field
+ * holds the actual doc snapshot and is recursed into separately against the
+ * parent collection/global's own fields.
+ */
+export declare const VERSION_ROW_RESERVED_KEYS: readonly ["id", "parent", "version", "createdAt", "updatedAt", "latest", "autosave", "snapshot", "publishedLocale"];
+/**
+ * Strip a row against its collection's `fields`, falling back to a no-op
+ * if the slug isn't recognized (defensive — see `getCollectionFields`).
+ */
+export declare function projectForCollection(adapter: DynamoAdapter, slug: string, data: Record<string, unknown>): Record<string, unknown>;
+export declare function projectForGlobal(adapter: DynamoAdapter, slug: string, data: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Strip the inner doc snapshot of a version's `versionData` argument against
+ * the parent collection or global's fields. The createVersion adapters wrap
+ * the result into a version row whose other keys (parent, latest, ...) are
+ * set explicitly by the adapter, so we only need to project the snapshot.
+ */
+export declare function projectVersionSnapshot(adapter: DynamoAdapter, parent: {
+    kind: 'collection' | 'global';
+    slug: string;
+}, data: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Strip a fully-merged version row (top-level metadata + nested `version`
+ * snapshot) against the parent collection or global's fields.
+ */
+export declare function projectVersionRow(adapter: DynamoAdapter, parent: {
+    kind: 'collection' | 'global';
+    slug: string;
+}, row: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=resolveSchema.d.ts.map

package/dist/utilities/resolveSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveSchema.d.ts","sourceRoot":"","sources":["../../src/utilities/resolveSchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAIhD;;;;;;;;;GASG;AAEH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,CAGxF;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,IAAI,CAKpF;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB,oEAAqE,CAAA;AAEnG;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,qHAU5B,CAAA;AAEV;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,aAAa,EACtB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIzB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE;IAAE,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE;IAAE,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACvD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOzB"}

package/dist/utilities/resolveSchema.js

@@ -0,0 +1,84 @@
+import { pickConfiguredFields, pickConfiguredVersionRow } from './pickConfiguredFields.js';
+/**
+ * Look up the sanitized `fields` array for a collection or global. Lives in
+ * one place so the write-path projection (see `pickConfiguredFields`) doesn't
+ * have to learn Payload's collection/global storage layout per call site.
+ *
+ * Returns `null` (rather than throwing) when a slug is unrecognized — a
+ * caller using an out-of-config slug is a programmer error elsewhere, but
+ * the right blast radius for that here is "skip projection," not "kill the
+ * write."
+ */ export function getCollectionFields(adapter, slug) {
+    const config = adapter.payload?.collections?.[slug]?.config;
+    return config?.fields ?? null;
+}
+export function getGlobalFields(adapter, slug) {
+    const globals = adapter.payload?.config?.globals;
+    if (!Array.isArray(globals)) return null;
+    const config = globals.find((g)=>g.slug === slug);
+    return config?.fields ?? null;
+}
+/**
+ * Reserved keys Payload's framework layer owns rather than declaring through
+ * `fields`. Allowed at the top of every collection/global row.
+ *
+ *  - `id`                    — primary key
+ *  - `createdAt`/`updatedAt` — timestamp pair (default-on per collection config)
+ *  - `_status`               — drafts state (only present when drafts enabled,
+ *                              but allow-listing it unconditionally is harmless)
+ *  - `globalType`            — Payload tags global rows with this internally
+ */ export const ROW_RESERVED_KEYS = [
+    'id',
+    'createdAt',
+    'updatedAt',
+    '_status',
+    'globalType'
+];
+/**
+ * Reserved keys at the top of a *version* row. The inner `version` field
+ * holds the actual doc snapshot and is recursed into separately against the
+ * parent collection/global's own fields.
+ */ export const VERSION_ROW_RESERVED_KEYS = [
+    'id',
+    'parent',
+    'version',
+    'createdAt',
+    'updatedAt',
+    'latest',
+    'autosave',
+    'snapshot',
+    'publishedLocale'
+];
+/**
+ * Strip a row against its collection's `fields`, falling back to a no-op
+ * if the slug isn't recognized (defensive — see `getCollectionFields`).
+ */ export function projectForCollection(adapter, slug, data) {
+    const fields = getCollectionFields(adapter, slug);
+    if (!fields) return data;
+    return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS);
+}
+export function projectForGlobal(adapter, slug, data) {
+    const fields = getGlobalFields(adapter, slug);
+    if (!fields) return data;
+    return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS);
+}
+/**
+ * Strip the inner doc snapshot of a version's `versionData` argument against
+ * the parent collection or global's fields. The createVersion adapters wrap
+ * the result into a version row whose other keys (parent, latest, ...) are
+ * set explicitly by the adapter, so we only need to project the snapshot.
+ */ export function projectVersionSnapshot(adapter, parent, data) {
+    const fields = parent.kind === 'collection' ? getCollectionFields(adapter, parent.slug) : getGlobalFields(adapter, parent.slug);
+    if (!fields) return data;
+    return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS);
+}
+/**
+ * Strip a fully-merged version row (top-level metadata + nested `version`
+ * snapshot) against the parent collection or global's fields.
+ */ export function projectVersionRow(adapter, parent, row) {
+    const fields = parent.kind === 'collection' ? getCollectionFields(adapter, parent.slug) : getGlobalFields(adapter, parent.slug);
+    if (!fields) return row;
+    return pickConfiguredVersionRow(row, fields);
+}
+
+//# sourceMappingURL=resolveSchema.js.map

package/dist/utilities/resolveSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utilities/resolveSchema.ts"],"sourcesContent":["import type { Field } from 'payload'\n\nimport type { DynamoAdapter } from '../types.js'\n\nimport { pickConfiguredFields, pickConfiguredVersionRow } from './pickConfiguredFields.js'\n\n/**\n * Look up the sanitized `fields` array for a collection or global. Lives in\n * one place so the write-path projection (see `pickConfiguredFields`) doesn't\n * have to learn Payload's collection/global storage layout per call site.\n *\n * Returns `null` (rather than throwing) when a slug is unrecognized — a\n * caller using an out-of-config slug is a programmer error elsewhere, but\n * the right blast radius for that here is \"skip projection,\" not \"kill the\n * write.\"\n */\n\nexport function getCollectionFields(adapter: DynamoAdapter, slug: string): Field[] | null {\n  const config = adapter.payload?.collections?.[slug]?.config\n  return config?.fields ?? null\n}\n\nexport function getGlobalFields(adapter: DynamoAdapter, slug: string): Field[] | null {\n  const globals = adapter.payload?.config?.globals\n  if (!Array.isArray(globals)) return null\n  const config = globals.find((g: { slug: string }) => g.slug === slug)\n  return config?.fields ?? null\n}\n\n/**\n * Reserved keys Payload's framework layer owns rather than declaring through\n * `fields`. Allowed at the top of every collection/global row.\n *\n *  - `id`                    — primary key\n *  - `createdAt`/`updatedAt` — timestamp pair (default-on per collection config)\n *  - `_status`               — drafts state (only present when drafts enabled,\n *                              but allow-listing it unconditionally is harmless)\n *  - `globalType`            — Payload tags global rows with this internally\n */\nexport const ROW_RESERVED_KEYS = ['id', 'createdAt', 'updatedAt', '_status', 'globalType'] as const\n\n/**\n * Reserved keys at the top of a *version* row. The inner `version` field\n * holds the actual doc snapshot and is recursed into separately against the\n * parent collection/global's own fields.\n */\nexport const VERSION_ROW_RESERVED_KEYS = [\n  'id',\n  'parent',\n  'version',\n  'createdAt',\n  'updatedAt',\n  'latest',\n  'autosave',\n  'snapshot',\n  'publishedLocale',\n] as const\n\n/**\n * Strip a row against its collection's `fields`, falling back to a no-op\n * if the slug isn't recognized (defensive — see `getCollectionFields`).\n */\nexport function projectForCollection(\n  adapter: DynamoAdapter,\n  slug: string,\n  data: Record<string, unknown>,\n): Record<string, unknown> {\n  const fields = getCollectionFields(adapter, slug)\n  if (!fields) return data\n  return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS)\n}\n\nexport function projectForGlobal(\n  adapter: DynamoAdapter,\n  slug: string,\n  data: Record<string, unknown>,\n): Record<string, unknown> {\n  const fields = getGlobalFields(adapter, slug)\n  if (!fields) return data\n  return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS)\n}\n\n/**\n * Strip the inner doc snapshot of a version's `versionData` argument against\n * the parent collection or global's fields. The createVersion adapters wrap\n * the result into a version row whose other keys (parent, latest, ...) are\n * set explicitly by the adapter, so we only need to project the snapshot.\n */\nexport function projectVersionSnapshot(\n  adapter: DynamoAdapter,\n  parent: { kind: 'collection' | 'global'; slug: string },\n  data: Record<string, unknown>,\n): Record<string, unknown> {\n  const fields =\n    parent.kind === 'collection'\n      ? getCollectionFields(adapter, parent.slug)\n      : getGlobalFields(adapter, parent.slug)\n  if (!fields) return data\n  return pickConfiguredFields(data, fields, ROW_RESERVED_KEYS)\n}\n\n/**\n * Strip a fully-merged version row (top-level metadata + nested `version`\n * snapshot) against the parent collection or global's fields.\n */\nexport function projectVersionRow(\n  adapter: DynamoAdapter,\n  parent: { kind: 'collection' | 'global'; slug: string },\n  row: Record<string, unknown>,\n): Record<string, unknown> {\n  const fields =\n    parent.kind === 'collection'\n      ? getCollectionFields(adapter, parent.slug)\n      : getGlobalFields(adapter, parent.slug)\n  if (!fields) return row\n  return pickConfiguredVersionRow(row, fields)\n}\n"],"names":["pickConfiguredFields","pickConfiguredVersionRow","getCollectionFields","adapter","slug","config","payload","collections","fields","getGlobalFields","globals","Array","isArray","find","g","ROW_RESERVED_KEYS","VERSION_ROW_RESERVED_KEYS","projectForCollection","data","projectForGlobal","projectVersionSnapshot","parent","kind","projectVersionRow","row"],"mappings":"AAIA,SAASA,oBAAoB,EAAEC,wBAAwB,QAAQ,4BAA2B;AAE1F;;;;;;;;;CASC,GAED,OAAO,SAASC,oBAAoBC,OAAsB,EAAEC,IAAY;IACtE,MAAMC,SAASF,QAAQG,OAAO,EAAEC,aAAa,CAACH,KAAK,EAAEC;IACrD,OAAOA,QAAQG,UAAU;AAC3B;AAEA,OAAO,SAASC,gBAAgBN,OAAsB,EAAEC,IAAY;IAClE,MAAMM,UAAUP,QAAQG,OAAO,EAAED,QAAQK;IACzC,IAAI,CAACC,MAAMC,OAAO,CAACF,UAAU,OAAO;IACpC,MAAML,SAASK,QAAQG,IAAI,CAAC,CAACC,IAAwBA,EAAEV,IAAI,KAAKA;IAChE,OAAOC,QAAQG,UAAU;AAC3B;AAEA;;;;;;;;;CASC,GACD,OAAO,MAAMO,oBAAoB;IAAC;IAAM;IAAa;IAAa;IAAW;CAAa,CAAS;AAEnG;;;;CAIC,GACD,OAAO,MAAMC,4BAA4B;IACvC;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,CAAS;AAEV;;;CAGC,GACD,OAAO,SAASC,qBACdd,OAAsB,EACtBC,IAAY,EACZc,IAA6B;IAE7B,MAAMV,SAASN,oBAAoBC,SAASC;IAC5C,IAAI,CAACI,QAAQ,OAAOU;IACpB,OAAOlB,qBAAqBkB,MAAMV,QAAQO;AAC5C;AAEA,OAAO,SAASI,iBACdhB,OAAsB,EACtBC,IAAY,EACZc,IAA6B;IAE7B,MAAMV,SAASC,gBAAgBN,SAASC;IACxC,IAAI,CAACI,QAAQ,OAAOU;IACpB,OAAOlB,qBAAqBkB,MAAMV,QAAQO;AAC5C;AAEA;;;;;CAKC,GACD,OAAO,SAASK,uBACdjB,OAAsB,EACtBkB,MAAuD,EACvDH,IAA6B;IAE7B,MAAMV,SACJa,OAAOC,IAAI,KAAK,eACZpB,oBAAoBC,SAASkB,OAAOjB,IAAI,IACxCK,gBAAgBN,SAASkB,OAAOjB,IAAI;IAC1C,IAAI,CAACI,QAAQ,OAAOU;IACpB,OAAOlB,qBAAqBkB,MAAMV,QAAQO;AAC5C;AAEA;;;CAGC,GACD,OAAO,SAASQ,kBACdpB,OAAsB,EACtBkB,MAAuD,EACvDG,GAA4B;IAE5B,MAAMhB,SACJa,OAAOC,IAAI,KAAK,eACZpB,oBAAoBC,SAASkB,OAAOjB,IAAI,IACxCK,gBAAgBN,SAASkB,OAAOjB,IAAI;IAC1C,IAAI,CAACI,QAAQ,OAAOgB;IACpB,OAAOvB,yBAAyBuB,KAAKhB;AACvC"}

package/dist/utilities/scrubUnknownFields.d.ts

@@ -0,0 +1,44 @@
+import type { Payload } from 'payload';
+/**
+ * One-shot cleanup pass for rows that were written before write-time
+ * projection landed. Walks every collection, global, and versions partition
+ * the adapter knows about, applies the same projection that today's writes
+ * use, and re-`Put`s rows that changed. Rows whose contents are already
+ * clean stay untouched.
+ *
+ * Intended to be called once after upgrading; not on every boot. The
+ * adapter's regular write paths now project on every mutation, so once a
+ * row has been written under the new code it stays clean. This helper
+ * exists for the static legacy data that hasn't been touched since the bug
+ * was active.
+ *
+ * @example
+ *   import { getPayload } from 'payload'
+ *   import config from './payload.config'
+ *   import { scrubUnknownFields } from '@aih-software/payload-ddb'
+ *
+ *   const payload = await getPayload({ config })
+ *   const report = await scrubUnknownFields(payload)
+ *   console.log(report)
+ *   await payload.destroy()
+ */
+export interface ScrubReport {
+    collections: Record<string, {
+        scanned: number;
+        modified: number;
+    }>;
+    collectionVersions: Record<string, {
+        scanned: number;
+        modified: number;
+    }>;
+    globals: Record<string, {
+        scanned: number;
+        modified: number;
+    }>;
+    globalVersions: Record<string, {
+        scanned: number;
+        modified: number;
+    }>;
+}
+export declare function scrubUnknownFields(payload: Payload): Promise<ScrubReport>;
+//# sourceMappingURL=scrubUnknownFields.d.ts.map

package/dist/utilities/scrubUnknownFields.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrubUnknownFields.d.ts","sourceRoot":"","sources":["../../src/utilities/scrubUnknownFields.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAyB,MAAM,SAAS,CAAA;AAa7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAClE,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACzE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9D,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACtE;AAED,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CAkD/E"}