@ploaness/governance 1.0.0 → 1.1.0

package/dist/index.d.ts

@@ -1,8 +1,13 @@
+export * from './a11y-hit-target.js';
+export * from './a11y-incomplete.js';
 export * from './access-boundary.js';
+export * from './admin-view-coverage.js';
 export * from './agent-references.js';
 export * from './architecture-layers.js';
 export * from './asset-policy.js';
+export * from './axe-coverage.js';
 export * from './banned-typography.js';
+export * from './build-diagnosis.js';
 export * from './bundle-budget.js';
 export * from './commit-message.js';
 export * from './config-references.js';
@@ -13,9 +18,11 @@ export * from './dependency-freshness.js';
 export * from './doc-blocks.js';
 export * from './document-references.js';
 export * from './editorconfig-policy.js';
+export * from './environment-coherence.js';
 export * from './environment-files.js';
 export * from './file-roles.js';
 export * from './generated-denial.js';
+export * from './generated-drift.js';
 export * from './history-policy.js';
 export * from './image-assets.js';
 export * from './install-policy.js';
@@ -26,8 +33,11 @@ export * from './paired-assets.js';
 export * from './payload-access.js';
 export * from './payload-policy.js';
 export * from './payload-source.js';
+export * from './relationship-cleanup.js';
 export * from './release-age.js';
 export * from './request-limits.js';
+export * from './route-coverage.js';
+export * from './route-map.js';
 export * from './run-plan.js';
 export * from './run-policy.js';
 export * from './secret-policy.js';
@@ -39,7 +49,6 @@ export * from './suppression-ceiling.js';
 export * from './tailwind-tokens.js';
 export * from './text-escapes.js';
 export * from './toolchain-pins.js';
-export * from './url-safety.js';
 export * from './version-policy.js';
 export * from './vulnerability-policy.js';
 export * from './wiring-policy.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/index.js

@@ -2,11 +2,16 @@
 // process, and network access. Every gate in the CLI is a thin I/O shell around a function exported
 // here. The split is what makes the rules cheap to test exhaustively: a pure function over strings
 // needs no fixture repository to exercise its edge cases.
+export * from './a11y-hit-target.js';
+export * from './a11y-incomplete.js';
 export * from './access-boundary.js';
+export * from './admin-view-coverage.js';
 export * from './agent-references.js';
 export * from './architecture-layers.js';
 export * from './asset-policy.js';
+export * from './axe-coverage.js';
 export * from './banned-typography.js';
+export * from './build-diagnosis.js';
 export * from './bundle-budget.js';
 export * from './commit-message.js';
 export * from './config-references.js';
@@ -17,9 +22,11 @@ export * from './dependency-freshness.js';
 export * from './doc-blocks.js';
 export * from './document-references.js';
 export * from './editorconfig-policy.js';
+export * from './environment-coherence.js';
 export * from './environment-files.js';
 export * from './file-roles.js';
 export * from './generated-denial.js';
+export * from './generated-drift.js';
 export * from './history-policy.js';
 export * from './image-assets.js';
 export * from './install-policy.js';
@@ -30,8 +37,11 @@ export * from './paired-assets.js';
 export * from './payload-access.js';
 export * from './payload-policy.js';
 export * from './payload-source.js';
+export * from './relationship-cleanup.js';
 export * from './release-age.js';
 export * from './request-limits.js';
+export * from './route-coverage.js';
+export * from './route-map.js';
 export * from './run-plan.js';
 export * from './run-policy.js';
 export * from './secret-policy.js';
@@ -43,7 +53,6 @@ export * from './suppression-ceiling.js';
 export * from './tailwind-tokens.js';
 export * from './text-escapes.js';
 export * from './toolchain-pins.js';
-export * from './url-safety.js';
 export * from './version-policy.js';
 export * from './vulnerability-policy.js';
 export * from './wiring-policy.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAE1D,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,mBAAmB,CAAA;AACjC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,wBAAwB,CAAA;AACtC,cAAc,wBAAwB,CAAA;AACtC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA;AACxC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,0BAA0B,CAAA;AACxC,cAAc,0BAA0B,CAAA;AACxC,cAAc,4BAA4B,CAAA;AAC1C,cAAc,wBAAwB,CAAA;AACtC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,qBAAqB,CAAA;AACnC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,kBAAkB,CAAA;AAChC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,eAAe,CAAA;AAC7B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,wBAAwB,CAAA;AACtC,cAAc,qBAAqB,CAAA;AACnC,cAAc,kBAAkB,CAAA;AAChC,cAAc,0BAA0B,CAAA;AACxC,cAAc,sBAAsB,CAAA;AACpC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,qBAAqB,CAAA;AACnC,cAAc,2BAA2B,CAAA;AACzC,cAAc,oBAAoB,CAAA;AAClC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA"}

package/dist/payload-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AA4E5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAkB3E,CAAA;AAkCJ,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG1E,CAAA;AA2CH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAa/E,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG/E,CAAA"}
+{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAe5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAqB5E,CAAA;AA8CH,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AA2CH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA"}

package/dist/payload-access.js

@@ -5,45 +5,10 @@
 // question the others do not ask - "which object literal IS this config" - and because together the two
 // halves passed the file size cap. Every one of them is a security decision that Payload will silently
 // make on the project's behalf if the project does not make it first.
+import { payloadConfigsIn, } from './payload-configs.js';
 import { configBody, depthOneBlockKeys, depthOneValue, } from './payload-source.js';
-import { lineOf, NOT_FOUND, topLevelKeys } from './source-text.js';
-// The three ways a Payload config is declared, all of them idiomatic:
-//
-//   const Users: CollectionConfig = { ... }          the annotation
-//   const Users: CollectionConfig<'users'> = { ... } the annotation, with the slug as a type argument
-//   const Users = { ... } satisfies CollectionConfig the inferred form
-//
-// Only the first was matched for a long time, because the lookahead that stopped `CollectionConfigs`
-// from matching also excluded `<`, and nothing looked for `satisfies` at all. A collection written
-// either of the other two ways passed every rule below without one of them ever reading it - which is
-// the worst failure a gate can have, because it is indistinguishable from a pass.
-const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
-/** The operations a collection must decide for itself rather than inherit. */
-const COLLECTION_OPERATIONS = ['create', 'read', 'update', 'delete'];
-/** A global has no create or delete: it exists from the moment it is configured. */
-const GLOBAL_OPERATIONS = ['read', 'update'];
-const CONFIG_KINDS = [
-    {
-        label: 'CollectionConfig',
-        declaration: declarationPattern('CollectionConfig'),
-        operations: COLLECTION_OPERATIONS,
-    },
-    {
-        label: 'GlobalConfig',
-        declaration: declarationPattern('GlobalConfig'),
-        operations: GLOBAL_OPERATIONS,
-    },
-];
-const SATISFIES = 'satisfies';
-// EVERY config in the file, not the first. `search` returned one offset, so a module exporting two
-// collections - or a collection beside a global - had its second config judged by nothing at all. The
-// Local API rules already iterated their matches; these did not, and the asymmetry was invisible
-// because a file with one config, which is most of them, behaves identically either way.
-const findConfigs = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
-    const body = configBody(source, match.index, match[1] === SATISFIES);
-    return body === undefined ? [] : [{ marker: match.index, body }];
-});
-const eachConfig = (source, judge) => CONFIG_KINDS.flatMap((kind) => findConfigs(source, kind).flatMap((found) => judge(kind, found)));
+import { NOT_FOUND, topLevelKeys } from './source-text.js';
+const eachConfig = (source, judge) => payloadConfigsIn(source).flatMap((found) => judge(found.kind, found));
 // Payload fills the missing operations in during sanitisation, so a partial access block is invisible
 // the moment the app boots - and its default for a non-auth collection is public read. Checking that
 // the word `access` appears somewhere in the file, which is what this rule used to do, accepted a block
@@ -55,7 +20,7 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-complete-access',
                 reason: `a ${kind.label} must declare access for ${kind.operations.join(', ')}; ` +
                     `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to the Payload ` +
@@ -68,7 +33,11 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
 // the case this rule most needs to catch.
 const AUTH_HARDENING_KEYS = ['maxLoginAttempts', 'lockTime'];
 const COLLECTION = 'CollectionConfig';
-const unhardenedAuthIn = (source, found) => {
+const leadingNumber = (value) => {
+    const match = /^\s*(-?\d[\d_]*(?:\.\d[\d_]*)?)\s*(?=[,}])/.exec(value ?? '');
+    return match === null ? undefined : Number((match[1] ?? '').replaceAll('_', ''));
+};
+const unhardenedAuthIn = (found) => {
     const value = depthOneValue(found.body, 'auth');
     if (value === undefined) {
         return [];
@@ -77,20 +46,25 @@ const unhardenedAuthIn = (source, found) => {
         ? topLevelKeys(value, 0)
         : [];
     const missing = AUTH_HARDENING_KEYS.filter((key) => !declared.includes(key));
-    return missing.length === 0
+    const disabled = AUTH_HARDENING_KEYS.filter((key) => {
+        const numeric = leadingNumber(depthOneValue(value, key));
+        return numeric !== undefined && numeric <= 0;
+    });
+    return missing.length === 0 && disabled.length === 0
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-auth-hardening',
                 reason: `an auth collection must declare ${AUTH_HARDENING_KEYS.join(' and ')}; ` +
-                    `${missing.join(' and ')} left to the Payload defaults means a login attempt is never ` +
-                    'capped and an account is never locked',
+                    (missing.length === 0 ? '' : `${missing.join(' and ')} is missing; `) +
+                    (disabled.length === 0 ? '' : `${disabled.join(' and ')} is not positive; `) +
+                    'without a positive attempt cap and lock time, login guesses are not bounded',
             },
         ];
 };
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
-export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(source, found) : []);
+export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(found) : []);
 // A draft is unpublished content. With versions.drafts enabled, `?draft=true` serves it to whoever the
 // read rule admits - so a read that is unconditionally true publishes every draft to anyone.
 const DRAFTS_ENABLED = /drafts\s*:\s*(?:true|\{)/;
@@ -132,7 +106,7 @@ const isDraftExposed = (body) => {
 export const findAnonymousDraftReads = (source) => eachConfig(source, (kind, found) => isDraftExposed(found.body)
     ? [
         {
-            line: lineOf(source, found.marker),
+            line: found.line,
             rule: 'no-anonymous-draft-reads',
             reason: `a ${kind.label} with drafts enabled must not grant an unconditionally true read; ` +
                 'an unauthenticated client would fetch unpublished drafts through ?draft=true',
@@ -144,7 +118,7 @@ export const findAnonymousDraftReads = (source) => eachConfig(source, (kind, fou
 // as the site, which is why the restriction is required rather than advised. No size cap is asked for
 // here: Payload takes that at the config root rather than on the collection.
 const UPLOAD_RESTRICTION = 'mimeTypes';
-const unrestrictedUploadIn = (source, found) => {
+const unrestrictedUploadIn = (found) => {
     const value = depthOneValue(found.body, 'upload');
     if (value === undefined) {
         return [];
@@ -156,7 +130,7 @@ const unrestrictedUploadIn = (source, found) => {
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-upload-restrictions',
                 reason: `an upload collection must declare ${UPLOAD_RESTRICTION}; left undeclared it accepts ` +
                     'any file, and an SVG served from this origin is script that runs as the site',
@@ -164,5 +138,5 @@ const unrestrictedUploadIn = (source, found) => {
         ];
 };
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
-export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(source, found) : []);
+export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(found) : []);
 //# sourceMappingURL=payload-access.js.map

package/dist/payload-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AACtE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAElE,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,sGAAsG;AACtG,uEAAuE;AACvE,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,sGAAsG;AACtG,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,8EAA8E;AAC9E,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEvF,oFAAoF;AACpF,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAS/D,MAAM,YAAY,GAA0B;IAC1C;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,qBAAqB;KAClC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAA;AAQD,MAAM,SAAS,GAAW,WAAW,CAAA;AAErC,mGAAmG;AACnG,sGAAsG;AACtG,iGAAiG;AACjG,yFAAyF;AACzF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAgB,EAA0B,EAAE,CAC/E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAA0B,EAAE;IACjD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IACxF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC,CACF,CAAA;AAEH,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA4E,EAC/C,EAAE,CAC/B,YAAY,CAAC,OAAO,CAAC,CAAC,IAAgB,EAA+B,EAAE,CACrE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAkB,EAA+B,EAAE,CACpF,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACnB,CACF,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,wGAAwG;AACxG,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE;IACvF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBACnF,mCAAmC;aACtC;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAA+B,EAAE;IAC3F,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+DAA+D;oBACvF,uCAAuC;aAC1C;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACjE,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACP,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAA+B,EAAE;IAC/F,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE,CAAA"}
+{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,wGAAwG;AACxG,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBACnF,mCAAmC;aACtC;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA"}

package/dist/payload-configs.d.ts

@@ -0,0 +1,24 @@
+/** The operations one Payload configuration kind must decide explicitly. */
+export interface PayloadConfigKind {
+    readonly kind: 'collection' | 'global';
+    readonly label: string;
+    readonly operations: readonly string[];
+}
+/** One Payload configuration literal, with the source position its body begins at. */
+export interface FoundPayloadConfig {
+    readonly kind: PayloadConfigKind;
+    readonly marker: number;
+    readonly body: string;
+    readonly bodyStart: number;
+    readonly line: number;
+}
+/** One object written directly as an element of a configuration's `fields` array. */
+export interface FoundFieldLiteral {
+    readonly body: string;
+    readonly line: number;
+}
+/** Every collection and global configuration literal the source declares. */
+export declare const payloadConfigsIn: (source: string) => readonly FoundPayloadConfig[];
+/** The field literals directly visible in one collection/global config. */
+export declare const directFieldsIn: (source: string, config: FoundPayloadConfig) => readonly FoundFieldLiteral[];
+//# sourceMappingURL=payload-configs.d.ts.map

package/dist/payload-configs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAgBA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA2CD,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}

package/dist/payload-configs.js

@@ -0,0 +1,77 @@
+// The shared catalogue of Payload configuration literals.
+//
+// Access policy and field policy ask different questions of the same object: whether a collection or
+// global has declared its operation boundary, and whether a privilege-bearing field has declared its
+// own. The declaration forms must therefore have one owner. A second regex beside the access rule was
+// how generic annotations and `satisfies` configurations previously escaped every Payload check.
+import { configBody, depthOneValue } from './payload-source.js';
+import { balancedArguments, lineOf, NOT_FOUND, scanDelimited, } from './source-text.js';
+const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
+const CONFIG_KINDS = [
+    {
+        kind: 'collection',
+        label: 'CollectionConfig',
+        declaration: declarationPattern('CollectionConfig'),
+        operations: ['create', 'read', 'update', 'delete'],
+    },
+    {
+        kind: 'global',
+        label: 'GlobalConfig',
+        declaration: declarationPattern('GlobalConfig'),
+        operations: ['read', 'update'],
+    },
+];
+const SATISFIES = 'satisfies';
+const bodyStartOf = (source, body, marker, isTrailing) => isTrailing ? source.lastIndexOf(body, marker) : source.indexOf(body, marker);
+const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
+    const isTrailing = match[1] === SATISFIES;
+    const body = configBody(source, match.index, isTrailing);
+    if (body === undefined) {
+        return [];
+    }
+    const bodyStart = bodyStartOf(source, body, match.index, isTrailing);
+    return bodyStart === NOT_FOUND
+        ? []
+        : [{ kind, marker: match.index, body, bodyStart, line: lineOf(source, match.index) }];
+});
+/** Every collection and global configuration literal the source declares. */
+export const payloadConfigsIn = (source) => CONFIG_KINDS.flatMap((kind) => configsOfKind(source, kind));
+const DIRECT_FIELD_DEPTH = 2;
+const closeLastSpan = (spans, close) => {
+    const last = spans.at(-1);
+    return last?.close === NOT_FOUND ? [...spans.slice(0, -1), { open: last.open, close }] : spans;
+};
+const opensDirectField = (step) => step.character === '{' && step.depth === DIRECT_FIELD_DEPTH;
+const endsDirectField = (step) => step.character === '}' && step.depth === 1;
+const endsFieldArray = (step) => step.character === ']' && step.depth === 0;
+const afterFieldDelimiter = (spans, step) => {
+    if (opensDirectField(step)) {
+        return { state: [...spans, { open: step.index, close: NOT_FOUND }], stop: false };
+    }
+    if (endsDirectField(step)) {
+        return { state: closeLastSpan(spans, step.index), stop: false };
+    }
+    return { state: spans, stop: endsFieldArray(step) };
+};
+// Starting on the array opener puts its direct object elements at depth two. A nested object opens at
+// depth three or more and is part of the field rather than another field beside it.
+const directObjectSpans = (source, open) => scanDelimited(source, open, afterFieldDelimiter, []);
+/** The field literals directly visible in one collection/global config. */
+export const directFieldsIn = (source, config) => {
+    const fields = depthOneValue(config.body, 'fields');
+    if (fields === undefined) {
+        return [];
+    }
+    const open = fields.indexOf('[');
+    if (open === NOT_FOUND) {
+        return [];
+    }
+    const fieldsStart = config.bodyStart + config.body.length - fields.length;
+    return directObjectSpans(fields, open).flatMap((span) => {
+        const body = balancedArguments(fields, span.open);
+        return body === undefined
+            ? []
+            : [{ body: `{${body}}`, line: lineOf(source, fieldsStart + span.open) }];
+    });
+};
+//# sourceMappingURL=payload-configs.js.map

package/dist/payload-configs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAwBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACnD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAErC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,UAAmB,EAAU,EAAE,CAChG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAE9E,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,UAAU,GAAY,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAA;IAClD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAW,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}

package/dist/payload-field-access.d.ts

@@ -0,0 +1,4 @@
+import { type PayloadViolation } from './payload-source.js';
+/** Report privilege-bearing auth fields without explicit create and update access. */
+export declare const findUnprotectedPrivilegedFields: (source: string) => readonly PayloadViolation[];
+//# sourceMappingURL=payload-field-access.d.ts.map

package/dist/payload-field-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-field-access.d.ts","sourceRoot":"","sources":["../src/payload-field-access.ts"],"names":[],"mappings":"AASA,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA+C7F,sFAAsF;AACtF,eAAO,MAAM,+BAA+B,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAUrF,CAAA"}

package/dist/payload-field-access.js

@@ -0,0 +1,51 @@
+// Field-level access decisions that protect an account's authority.
+//
+// A collection access rule and a field access rule defend different boundaries. The collection rule
+// decides who may update an account at all; the field rule decides whether that caller may change the
+// part which grants authority. Requiring both prevents a later widening of collection access from
+// silently turning an ordinary profile update into privilege escalation.
+import { directFieldsIn, payloadConfigsIn } from './payload-configs.js';
+import { depthOneBlockKeys, depthOneValue } from './payload-source.js';
+const PRIVILEGED_FIELD_NAMES = new Set([
+    'role',
+    'roles',
+    'isAdmin',
+    'isStaff',
+    'permission',
+    'permissions',
+    'capability',
+    'capabilities',
+]);
+const REQUIRED_OPERATIONS = ['create', 'update'];
+const quotedValue = (value) => /^\s*['"`]([^'"`]+)['"`]/.exec(value ?? '')?.[1];
+const isAuthCollection = (config) => {
+    if (config.kind.kind !== 'collection') {
+        return false;
+    }
+    const auth = depthOneValue(config.body, 'auth');
+    return /^\s*(?:true\b|\{)/.test(auth ?? '');
+};
+const violationFor = (field) => {
+    const name = quotedValue(depthOneValue(field.body, 'name'));
+    if (name === undefined || !PRIVILEGED_FIELD_NAMES.has(name)) {
+        return undefined;
+    }
+    const declared = depthOneBlockKeys(field.body, 'access');
+    const missing = REQUIRED_OPERATIONS.filter((operation) => !declared.includes(operation));
+    return missing.length === 0
+        ? undefined
+        : {
+            line: field.line,
+            rule: 'require-privileged-field-access',
+            reason: `the privilege-bearing field "${name}" must declare field access for create and update; ` +
+                `${missing.join(' and ')} is not protected from assignment by a caller who can write ` +
+                'the auth collection',
+        };
+};
+/** Report privilege-bearing auth fields without explicit create and update access. */
+export const findUnprotectedPrivilegedFields = (source) => payloadConfigsIn(source)
+    .filter((config) => isAuthCollection(config))
+    .flatMap((config) => directFieldsIn(source, config))
+    .map((field) => violationFor(field))
+    .filter((violation) => violation !== undefined);
+//# sourceMappingURL=payload-field-access.js.map

package/dist/payload-field-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-field-access.js","sourceRoot":"","sources":["../src/payload-field-access.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,kGAAkG;AAClG,yEAAyE;AAGzE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAE7F,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,MAAM;IACN,OAAO;IACP,SAAS;IACT,SAAS;IACT,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEnE,MAAM,WAAW,GAAG,CAAC,KAAyB,EAAsB,EAAE,CACpE,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAElD,MAAM,gBAAgB,GAAG,CAAC,MAA0B,EAAW,EAAE;IAC/D,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,OAAO,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;AAC7C,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAwB,EAAgC,EAAE;IAC9E,MAAM,IAAI,GAAuB,WAAW,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,iCAAiC;YACvC,MAAM,EACJ,gCAAgC,IAAI,qDAAqD;gBACzF,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,8DAA8D;gBACtF,qBAAqB;SACxB,CAAA;AACP,CAAC,CAAA;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC7F,gBAAgB,CAAC,MAAM,CAAC;KACrB,MAAM,CAAC,CAAC,MAA0B,EAAW,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;KACzE,OAAO,CAAC,CAAC,MAA0B,EAAgC,EAAE,CACpE,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAC/B;KACA,GAAG,CAAC,CAAC,KAAwB,EAAgC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;KACpF,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CAAA"}

package/dist/payload-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AA6H3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAC/B,CAAA;AAEhD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAY/E,CAAA"}
+{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAqR3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG9E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA"}