@ploaness/governance 1.0.0 → 1.2.0

package/dist/a11y-hit-target.d.ts

@@ -0,0 +1,35 @@
+/** What a browser must report about a control before this module can classify it. */
+export interface HitTargetProbe {
+    /** Border-box width in CSS pixels. */
+    readonly width: number;
+    /** Border-box height in CSS pixels. */
+    readonly height: number;
+    /** The computed `clip-path`, verbatim, or `none`. */
+    readonly clipPath: string;
+    /** The computed `clip`, verbatim, or `auto`. */
+    readonly clip: string;
+    /**
+     * Whether `elementFromPoint` at the box centre returned this element or a descendant of it.
+     *
+     * This is the same question Playwright's actionability check asks, and asking it here is what lets
+     * a clipped element and an obscured one be told apart rather than both reported as a timeout.
+     */
+    readonly ownsCentrePoint: boolean;
+}
+/** How a control can be reached, and therefore which passes of the sweep apply to it. */
+export type HitTargetVerdict = 'hoverable' | 'visually-hidden' | 'obscured';
+/** The verdict together with the sentence a report prints for it. */
+export interface HitTargetClassification {
+    readonly verdict: HitTargetVerdict;
+    readonly reason: string;
+}
+/**
+ * Decide how a control can be reached, so the sweep hovers what it can and explains what it cannot.
+ *
+ * A control that owns its own centre point is hoverable whatever its styling, which is what keeps a
+ * decorative `clip-path` on a real button from being mistaken for a hiding technique.
+ * @param probe what the browser reports about the control.
+ * @returns the verdict and the sentence describing it.
+ */
+export declare const classifyHitTarget: (probe: HitTargetProbe) => HitTargetClassification;
+//# sourceMappingURL=a11y-hit-target.d.ts.map

package/dist/a11y-hit-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a11y-hit-target.d.ts","sourceRoot":"","sources":["../src/a11y-hit-target.ts"],"names":[],"mappings":"AAEA,qFAAqF;AACrF,MAAM,WAAW,cAAc;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,uCAAuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,qDAAqD;IACrD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAA;CAClC;AAED,yFAAyF;AACzF,MAAM,MAAM,gBAAgB,GAAG,WAAW,GAAG,iBAAiB,GAAG,UAAU,CAAA;AAE3E,qEAAqE;AACrE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAyED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,cAAc,KAAG,uBAkBzD,CAAA"}

package/dist/a11y-hit-target.js

@@ -0,0 +1,82 @@
+// Classify whether a control has painted pixels and a pointer target before a hover contrast scan.
+// The legacy visually-hidden pattern draws a 1px box and clips it away, so its box has area and its
+// paint does not. Anything at or under this in either dimension is that pattern rather than a control.
+const HIDDEN_BOX_LIMIT = 1;
+// An `inset()` is empty when its opposing insets meet or cross, which is arithmetic rather than a
+// spelling: `inset(50%)` collapses both axes, and so do `inset(50% 0)` and `inset(60% 10% 60% 10%)`.
+// Matching the literal `inset(50%)` would have covered the one form every visually-hidden helper class
+// ships and quietly missed the rest, so the shorthand is expanded and the pairs are added instead.
+const FULL_EXTENT = 100;
+const INSET_SHORTHAND = /^inset\(([^)]*)\)$/;
+// `inset()` may carry a `round <radius>` clause, which describes corners rather than extent.
+const ROUND_CLAUSE = /\sround\s[\s\S]*$/;
+const PERCENT = '%';
+// A percentage is the only unit that can be reasoned about without knowing the element's size, and it
+// is the unit the pattern is always written in. A pixel inset is left undecided, which classifies the
+// control as reachable and runs the check.
+const asPercentage = (token) => token.endsWith(PERCENT) ? Number(token.slice(0, -PERCENT.length)) : Number.NaN;
+// CSS box shorthand: one value applies to all four sides, two to the vertical and horizontal pairs,
+// three add a distinct bottom, four are top/right/bottom/left in order.
+const expandBoxShorthand = (values) => {
+    const [first, second, third, fourth] = values;
+    if (first === undefined) {
+        return [];
+    }
+    const right = second ?? first;
+    return [first, right, third ?? first, fourth ?? right];
+};
+const isEmptyInset = (argument) => {
+    const values = expandBoxShorthand(argument
+        .replace(ROUND_CLAUSE, '')
+        .split(/[\s,]+/)
+        .filter((token) => token.length > 0)
+        .map((token) => asPercentage(token)));
+    const [top, right, bottom, left] = values;
+    if (top === undefined || right === undefined || bottom === undefined || left === undefined) {
+        return false;
+    }
+    return top + bottom >= FULL_EXTENT || left + right >= FULL_EXTENT;
+};
+// A circle or ellipse of no radius clips everything away. Only an explicit zero counts: a keyword
+// radius such as `closest-side` depends on the box and is left undecided.
+const ZERO_RADIUS_SHAPE = /^(?:circle|ellipse)\(\s*0(?:px|%|em|rem)?[\s,)]/;
+// `clip: rect(...)` with no extent, in the spellings browsers compute it to. The 1px form is the
+// classic `.sr-only` rule, which pairs a 1px box with a rect that keeps none of it.
+const EMPTY_CLIP = /^rect\(\s*[01](?:px)?[\s,]+[01](?:px)?[\s,]+[01](?:px)?[\s,]+[01](?:px)?\s*\)$/;
+const isEmptyClipPath = (clipPath) => {
+    const normalised = clipPath.trim().toLowerCase();
+    const inset = INSET_SHORTHAND.exec(normalised);
+    return inset === null ? ZERO_RADIUS_SHAPE.test(normalised) : isEmptyInset(inset[1] ?? '');
+};
+const isEmptyClip = (clip) => EMPTY_CLIP.test(clip.trim().toLowerCase());
+const hasNoPaintedArea = (probe) => probe.width <= 0 ||
+    probe.height <= 0 ||
+    (probe.width <= HIDDEN_BOX_LIMIT && probe.height <= HIDDEN_BOX_LIMIT) ||
+    isEmptyClipPath(probe.clipPath) ||
+    isEmptyClip(probe.clip);
+/**
+ * Decide how a control can be reached, so the sweep hovers what it can and explains what it cannot.
+ *
+ * A control that owns its own centre point is hoverable whatever its styling, which is what keeps a
+ * decorative `clip-path` on a real button from being mistaken for a hiding technique.
+ * @param probe what the browser reports about the control.
+ * @returns the verdict and the sentence describing it.
+ */
+export const classifyHitTarget = (probe) => {
+    if (probe.ownsCentrePoint) {
+        return { verdict: 'hoverable', reason: 'the control is reachable at its own centre point' };
+    }
+    if (hasNoPaintedArea(probe)) {
+        return {
+            verdict: 'visually-hidden',
+            reason: 'the control is visually hidden (a zero-area box or a clip that removes it), so it has no ' +
+                'hit target and no painted pixels whose contrast could be measured under hover',
+        };
+    }
+    return {
+        verdict: 'obscured',
+        reason: 'the control paints but something else answers at its centre point, so a pointer cannot ' +
+            'reach it; this is a defect in the page rather than in the sweep',
+    };
+};
+//# sourceMappingURL=a11y-hit-target.js.map

package/dist/a11y-hit-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a11y-hit-target.js","sourceRoot":"","sources":["../src/a11y-hit-target.ts"],"names":[],"mappings":"AAAA,mGAAmG;AA8BnG,oGAAoG;AACpG,uGAAuG;AACvG,MAAM,gBAAgB,GAAW,CAAC,CAAA;AAElC,kGAAkG;AAClG,qGAAqG;AACrG,uGAAuG;AACvG,mGAAmG;AACnG,MAAM,WAAW,GAAW,GAAG,CAAA;AAC/B,MAAM,eAAe,GAAW,oBAAoB,CAAA;AACpD,6FAA6F;AAC7F,MAAM,YAAY,GAAW,mBAAmB,CAAA;AAEhD,MAAM,OAAO,GAAW,GAAG,CAAA;AAE3B,sGAAsG;AACtG,sGAAsG;AACtG,2CAA2C;AAC3C,MAAM,YAAY,GAAG,CAAC,KAAa,EAAU,EAAE,CAC7C,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAA;AAEhF,oGAAoG;AACpG,wEAAwE;AACxE,MAAM,kBAAkB,GAAG,CAAC,MAAyB,EAAqB,EAAE;IAC1E,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAoC,MAAM,CAAA;IAC9E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAW,MAAM,IAAI,KAAK,CAAA;IACrC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,KAAK,CAAC,CAAA;AACxD,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAW,EAAE;IACjD,MAAM,MAAM,GAAsB,kBAAkB,CAClD,QAAQ;SACL,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CACvD,CAAA;IACD,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,GAAoC,MAAM,CAAA;IAC1E,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,GAAG,GAAG,MAAM,IAAI,WAAW,IAAI,IAAI,GAAG,KAAK,IAAI,WAAW,CAAA;AACnE,CAAC,CAAA;AAED,kGAAkG;AAClG,0EAA0E;AAC1E,MAAM,iBAAiB,GAAW,iDAAiD,CAAA;AAEnF,iGAAiG;AACjG,oFAAoF;AACpF,MAAM,UAAU,GACd,gFAAgF,CAAA;AAElF,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAW,EAAE;IACpD,MAAM,UAAU,GAAW,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACxD,MAAM,KAAK,GAA2B,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;AAEzF,MAAM,gBAAgB,GAAG,CAAC,KAAqB,EAAW,EAAE,CAC1D,KAAK,CAAC,KAAK,IAAI,CAAC;IAChB,KAAK,CAAC,MAAM,IAAI,CAAC;IACjB,CAAC,KAAK,CAAC,KAAK,IAAI,gBAAgB,IAAI,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IACrE,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC;IAC/B,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AAEzB;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAA2B,EAAE;IAClF,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,kDAAkD,EAAE,CAAA;IAC7F,CAAC;IACD,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,OAAO,EAAE,iBAAiB;YAC1B,MAAM,EACJ,2FAA2F;gBAC3F,+EAA+E;SAClF,CAAA;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,UAAU;QACnB,MAAM,EACJ,yFAAyF;YACzF,iEAAiE;KACpE,CAAA;AACH,CAAC,CAAA"}

package/dist/a11y-incomplete.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The axe `incomplete` message keys that describe a defect rather than a question.
+ *
+ * Exported so a project reading a finding can see the whole of what is enforced, and so a spec can
+ * assert the enforced set rather than a single member of it.
+ */
+export declare const DEFINITE_INCOMPLETE_KEYS: readonly string[];
+/**
+ * Pick the entries of an axe `incomplete` bucket that are defects rather than open questions.
+ *
+ * Takes `unknown` rather than axe's own result type because this package declares no dependencies and
+ * must not acquire one to read a shape it only ever inspects. The caller passes `scan.incomplete`
+ * straight through.
+ * @param incomplete the `incomplete` array of an axe result.
+ * @returns one human-readable finding per definite defect, in the order axe reported them.
+ */
+export declare const findDefiniteIncomplete: (incomplete: unknown) => readonly string[];
+//# sourceMappingURL=a11y-incomplete.d.ts.map

package/dist/a11y-incomplete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"a11y-incomplete.d.ts","sourceRoot":"","sources":["../src/a11y-incomplete.ts"],"names":[],"mappings":"AAGA;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,SAAS,MAAM,EAAmB,CAAA;AAuDzE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,YAAY,OAAO,KAAG,SAAS,MAAM,EAGpE,CAAA"}

package/dist/a11y-incomplete.js

@@ -0,0 +1,65 @@
+// Promote only mechanically decidable axe incomplete results to failures; retain cases requiring visual judgment.
+import { asRecord, asText, isArray } from './json-shapes.js';
+/**
+ * The axe `incomplete` message keys that describe a defect rather than a question.
+ *
+ * Exported so a project reading a finding can see the whole of what is enforced, and so a spec can
+ * assert the enforced set rather than a single member of it.
+ */
+export const DEFINITE_INCOMPLETE_KEYS = ['equalRatio'];
+// A node's checks live under three keys, and which one carries the result depends on how the rule was
+// composed rather than on anything the reader chose. Reading only `any` would miss a rule expressed as
+// `all`, which is a silence of exactly the kind this module exists to remove.
+const CHECK_KEYS = ['any', 'all', 'none'];
+// A node names itself by CSS selector, and axe nests the selector when the node is inside an iframe.
+// Joining rather than taking the first keeps a finding pointing at the element a reader has to open.
+const TARGET_SEPARATOR = ' >>> ';
+const targetOf = (node) => {
+    const target = asRecord(node)['target'];
+    if (!isArray(target)) {
+        return '(unknown element)';
+    }
+    const parts = target.map((part) => asText(part));
+    return parts.length === 0 ? '(unknown element)' : parts.join(TARGET_SEPARATOR);
+};
+const checksOf = (node) => CHECK_KEYS.flatMap((key) => {
+    const checks = asRecord(node)[key];
+    return isArray(checks) ? checks : [];
+});
+// The message axe itself wrote, rather than one restated here. A locale-aware runner returns the
+// translated sentence, and a finding that quoted an English copy would disagree with the report the
+// same run printed.
+const describeCheck = (ruleId, node, check) => {
+    const message = asText(asRecord(check)['message']);
+    const stated = message.length > 0 ? message : 'axe reported no message';
+    return `${ruleId} on ${targetOf(node)}: ${stated}`;
+};
+// axe names the reason it could not decide under `data.messageKey`, which is the only field here that
+// is a stable identifier rather than prose: the message beside it is localised.
+const messageKeyOf = (check) => {
+    const data = asRecord(asRecord(check)['data']);
+    return asText(data['messageKey']);
+};
+const definiteChecks = (ruleId, node) => checksOf(node)
+    .filter((check) => DEFINITE_INCOMPLETE_KEYS.includes(messageKeyOf(check)))
+    .map((check) => describeCheck(ruleId, node, check));
+const definiteNodes = (result) => {
+    const nodes = asRecord(result)['nodes'];
+    const ruleId = asText(asRecord(result)['id']);
+    return isArray(nodes)
+        ? nodes.flatMap((node) => definiteChecks(ruleId, node))
+        : [];
+};
+/**
+ * Pick the entries of an axe `incomplete` bucket that are defects rather than open questions.
+ *
+ * Takes `unknown` rather than axe's own result type because this package declares no dependencies and
+ * must not acquire one to read a shape it only ever inspects. The caller passes `scan.incomplete`
+ * straight through.
+ * @param incomplete the `incomplete` array of an axe result.
+ * @returns one human-readable finding per definite defect, in the order axe reported them.
+ */
+export const findDefiniteIncomplete = (incomplete) => isArray(incomplete)
+    ? incomplete.flatMap((result) => definiteNodes(result))
+    : [];
+//# sourceMappingURL=a11y-incomplete.js.map

package/dist/a11y-incomplete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"a11y-incomplete.js","sourceRoot":"","sources":["../src/a11y-incomplete.ts"],"names":[],"mappings":"AAAA,kHAAkH;AAClH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAsB,CAAC,YAAY,CAAC,CAAA;AAEzE,sGAAsG;AACtG,uGAAuG;AACvG,8EAA8E;AAC9E,MAAM,UAAU,GAAsB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAE5D,qGAAqG;AACrG,qGAAqG;AACrG,MAAM,gBAAgB,GAAW,OAAO,CAAA;AAExC,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAU,EAAE;IACzC,MAAM,MAAM,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,CAAA;IAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,OAAO,mBAAmB,CAAA;IAC5B,CAAC;IACD,MAAM,KAAK,GAAsB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAa,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;IACpF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;AAChF,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAsB,EAAE,CACrD,UAAU,CAAC,OAAO,CAAC,CAAC,GAAW,EAAsB,EAAE;IACrD,MAAM,MAAM,GAAY,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;IAC3C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;AACtC,CAAC,CAAC,CAAA;AAEJ,iGAAiG;AACjG,oGAAoG;AACpG,oBAAoB;AACpB,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,IAAa,EAAE,KAAc,EAAU,EAAE;IAC9E,MAAM,OAAO,GAAW,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;IAC1D,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAA;IAC/E,OAAO,GAAG,MAAM,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,EAAE,CAAA;AACpD,CAAC,CAAA;AAED,sGAAsG;AACtG,gFAAgF;AAChF,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE;IAC9C,MAAM,IAAI,GAA4B,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IACvE,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,IAAa,EAAqB,EAAE,CAC1E,QAAQ,CAAC,IAAI,CAAC;KACX,MAAM,CAAC,CAAC,KAAc,EAAW,EAAE,CAAC,wBAAwB,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;KAC3F,GAAG,CAAC,CAAC,KAAc,EAAU,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAExE,MAAM,aAAa,GAAG,CAAC,MAAe,EAAqB,EAAE;IAC3D,MAAM,KAAK,GAAY,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAA;IAChD,MAAM,MAAM,GAAW,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,OAAO,OAAO,CAAC,KAAK,CAAC;QACnB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAa,EAAqB,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnF,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAmB,EAAqB,EAAE,CAC/E,OAAO,CAAC,UAAU,CAAC;IACjB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,MAAe,EAAqB,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACnF,CAAC,CAAC,EAAE,CAAA"}

package/dist/access-boundary.d.ts

@@ -7,35 +7,91 @@ export type ReportedPermission = boolean | {
     readonly permission?: boolean;
     readonly where?: unknown;
 };
-/** One entity's operations, keyed as Payload keys them. */
-export type ReportedEntity = Readonly<Record<string, ReportedPermission>>;
-/** The body of `/api/access`, read for the operations alone. */
+/**
+ * A `fields` map as Payload sends it, or the bare `true` its sanitisation collapses a fully permitted
+ * one to - which says every field without naming one, and so cannot be enumerated.
+ */
+export type ReportedFields = boolean | Readonly<Record<string, ReportedEntity>>;
+/**
+ * One entity's operations and, beside them, the per-field map Payload reports for it.
+ *
+ * A field is reported in exactly the shape an entity is - its own operations, and its own `fields` when
+ * it is an array or a group - so one type describes both and the walk over them is the same walk.
+ */
+export interface ReportedEntity {
+    readonly fields?: ReportedFields;
+    readonly [operation: string]: ReportedFields | ReportedPermission | undefined;
+}
+/** The body of `/api/access`, read for the operations and the fields beneath them. */
 export interface AccessReport {
     readonly canAccessAdmin?: boolean;
     readonly collections?: Readonly<Record<string, ReportedEntity>>;
     readonly globals?: Readonly<Record<string, ReportedEntity>>;
 }
-/** One permission the running application actually grants. */
+/** One permission the running application actually grants, on an entity or on one field of it. */
 export interface Granted {
     readonly entity: string;
     readonly operation: string;
+    readonly field?: string;
 }
 /**
  * A write is never a default a project should be able to reach by accident: Payload grants none of these
  * to an anonymous caller unless the project's own rule says so. `read` is judged too, but it is the one
  * a public site legitimately grants, which is what `publicAccess` exists to record.
+ *
+ * `readVersions` and `unlock` are judged for the reason `payload-defaults` demands they be decided at
+ * all. A version is the whole document, so a read narrowed to an audience is undone by asking for a
+ * version instead - and `readVersions: theSameHelperAsRead` reads as obviously right while handing a
+ * stranger everything the helper's filter was written to keep back. `unlock` clears the lockout an
+ * attempt cap just set. Payload reports both beside the four, and both were passing unlooked-at.
+ *
+ * Composed from the lists `payload-defaults.ts` already declares rather than restated here, so the two
+ * halves of the harness cannot drift into disagreeing about what an operation is called.
  */
 export declare const JUDGED_OPERATIONS: readonly string[];
 /** Whether Payload reported this operation as permitted, in either of the two shapes it sends. */
-export declare const isPermitted: (permission: ReportedPermission | undefined) => boolean;
+export declare const isPermitted: (permission: ReportedFields | ReportedPermission | undefined) => boolean;
 /** Every permission an access report grants, across collections and globals alike. */
 export declare const grantedPermissions: (report: AccessReport) => readonly Granted[];
 /** How one grant is named, both in a report and in the `publicAccess` entry that would declare it. */
 export declare const describeGrant: (granted: Granted) => string;
+/** The field paths an entity reports but stores nothing behind, keyed by the entity's slug. */
+export type DatalessFields = Readonly<Record<string, readonly string[]>>;
+/**
+ * Every field path a built Payload configuration reports but keeps no data behind.
+ *
+ * Read through the untyped accessors rather than through Payload's types, because this package depends
+ * on nothing: what arrives is the configuration Payload booted, and what is read of it is the same four
+ * keys the response is built from.
+ * @param config the built Payload configuration, as its module's default export.
+ * @returns the dataless paths of each entity that has any, keyed by slug.
+ */
+export declare const datalessFieldsIn: (config: unknown) => DatalessFields;
 /**
  * The grants the running application makes to a stranger that the project has not recorded. Empty is
  * the only passing answer: a project that declares nothing is judged most strictly, and a declaration
  * narrows nothing else.
+ * @param report the body of `/api/access` for an anonymous caller.
+ * @param declared the project's `publicAccess` entries.
+ * @param dataless the field paths the configuration reports but stores nothing behind, from
+ * `datalessFieldsIn`. Defaulted to none, which judges every reported path and so errs strictly.
+ * @returns one finding per undeclared grant, in report order.
+ */
+export declare const undeclaredGrants: (report: AccessReport, declared: readonly PublicAccess[], dataless?: DatalessFields) => readonly string[];
+/**
+ * Every `publicAccess` declaration the running application does not bear out: an entity and operation
+ * it grants nobody, or a field path under a granted operation that no reported field matches.
+ *
+ * The mirror of `undeclaredGrants`, and the access-boundary twin of an exclusion that excludes nothing:
+ * a declaration matching no grant records a decision with no effect, outlives the field it was written
+ * for, and covers that field the day it is exposed again without anyone being asked. A `.**` subtree
+ * counts as borne out while the group or anything beneath it is granted, which keeps the trade that
+ * form makes; a subtree under which nothing is granted is a misspelling like any other.
+ * @param report the body of `/api/access` for an anonymous caller.
+ * @param declared the project's `publicAccess` entries.
+ * @param dataless the field paths the configuration reports but stores nothing behind, from
+ * `datalessFieldsIn`. A declaration naming one is therefore reported stale and can be removed.
+ * @returns one finding per stale entry or field, in declaration order.
  */
-export declare const undeclaredGrants: (report: AccessReport, declared: readonly PublicAccess[]) => readonly string[];
+export declare const staleDeclarations: (report: AccessReport, declared: readonly PublicAccess[], dataless?: DatalessFields) => readonly string[];
 //# sourceMappingURL=access-boundary.d.ts.map

package/dist/access-boundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access-boundary.d.ts","sourceRoot":"","sources":["../src/access-boundary.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE/D,2DAA2D;AAC3D,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAA;AAEzE,gEAAgE;AAChE,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;CAC5D;AAED,8DAA8D;AAC9D,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAA2C,CAAA;AAE1F,kGAAkG;AAClG,eAAO,MAAM,WAAW,GAAI,YAAY,kBAAkB,GAAG,SAAS,KAAG,OACO,CAAA;AAUhF,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,YAAY,KAAG,SAAS,OAAO,EAGzE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,GAAI,SAAS,OAAO,KAAG,MAAkD,CAAA;AAQnG;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,YAAY,EACpB,UAAU,SAAS,YAAY,EAAE,KAChC,SAAS,MAAM,EAG4C,CAAA"}
+{"version":3,"file":"access-boundary.d.ts","sourceRoot":"","sources":["../src/access-boundary.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAEjD;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE/D;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AAE/E;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC,QAAQ,EAAE,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAAA;CAC9E;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;CAC5D;AAED,kGAAkG;AAClG,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAI9C,CAAA;AAOD,kGAAkG;AAClG,eAAO,MAAM,WAAW,GACtB,YAAY,cAAc,GAAG,kBAAkB,GAAG,SAAS,KAC1D,OASF,CAAA;AA0DD,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,YAAY,KAAG,SAAS,OAAO,EAGzE,CAAA;AAED,sGAAsG;AACtG,eAAO,MAAM,aAAa,GAAI,SAAS,OAAO,KAAG,MAG8B,CAAA;AAE/E,+FAA+F;AAC/F,MAAM,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;AA4ExE;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,OAAO,KAAG,cAGjD,CAAA;AAyCF;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,YAAY,EACpB,UAAU,SAAS,YAAY,EAAE,EACjC,WAAU,cAAmB,KAC5B,SAAS,MAAM,EAG4C,CAAA;AA0B9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,YAAY,EACpB,UAAU,SAAS,YAAY,EAAE,EACjC,WAAU,cAAmB,KAC5B,SAAS,MAAM,EAiBjB,CAAA"}

package/dist/access-boundary.js

@@ -1,26 +1,221 @@
+// Compare Payload anonymous grants with explicit entity and field declarations, including stale exceptions.
+import { isArray, readKey } from './json-shapes.js';
+import { COLLECTION_OPERATIONS, READ_VERSIONS_OPERATION, UNLOCK_OPERATION, } from './payload-defaults.js';
 /**
  * A write is never a default a project should be able to reach by accident: Payload grants none of these
  * to an anonymous caller unless the project's own rule says so. `read` is judged too, but it is the one
  * a public site legitimately grants, which is what `publicAccess` exists to record.
+ *
+ * `readVersions` and `unlock` are judged for the reason `payload-defaults` demands they be decided at
+ * all. A version is the whole document, so a read narrowed to an audience is undone by asking for a
+ * version instead - and `readVersions: theSameHelperAsRead` reads as obviously right while handing a
+ * stranger everything the helper's filter was written to keep back. `unlock` clears the lockout an
+ * attempt cap just set. Payload reports both beside the four, and both were passing unlooked-at.
+ *
+ * Composed from the lists `payload-defaults.ts` already declares rather than restated here, so the two
+ * halves of the harness cannot drift into disagreeing about what an operation is called.
  */
-export const JUDGED_OPERATIONS = ['create', 'read', 'update', 'delete'];
+export const JUDGED_OPERATIONS = [
+    ...COLLECTION_OPERATIONS,
+    READ_VERSIONS_OPERATION,
+    UNLOCK_OPERATION,
+];
+/** The path standing in for a `fields` map Payload collapsed, which grants every field at once. */
+const EVERY_FIELD = '*';
+const PATH_SEPARATOR = '.';
 /** Whether Payload reported this operation as permitted, in either of the two shapes it sends. */
-export const isPermitted = (permission) => typeof permission === 'boolean' ? permission : permission?.permission === true;
-const grantsIn = (entities) => Object.entries(entities).flatMap(([entity, permissions]) => JUDGED_OPERATIONS.filter((operation) => isPermitted(permissions[operation])).map((operation) => ({ entity, operation })));
+export const isPermitted = (permission) => {
+    if (permission === undefined || typeof permission === 'boolean') {
+        return permission === true;
+    }
+    // Both remaining shapes carry an index signature or an optional `permission`, so both are readable
+    // through one accessor rather than through a guard that would have to tell them apart by a key a
+    // field could legitimately be named.
+    const constrained = permission;
+    return constrained.permission === true;
+};
+/**
+ * Every field path one operation reaches, joined as Payload nests them.
+ *
+ * Recursive because an array or group field carries a `fields` map of its own, so a leaf is named by
+ * the path that reaches it (`playerFleet.shipKind`) rather than by its own name alone, which would
+ * collide between two arrays sharing a field name.
+ */
+const fieldPathsFor = (fields, operation, prefix) => {
+    if (fields === undefined) {
+        return [];
+    }
+    if (typeof fields === 'boolean') {
+        return fields ? [`${prefix}${EVERY_FIELD}`] : [];
+    }
+    return Object.entries(fields).flatMap(([name, reported]) => [
+        ...(isPermitted(reported[operation]) ? [`${prefix}${name}`] : []),
+        ...fieldPathsFor(reported.fields, operation, `${prefix}${name}${PATH_SEPARATOR}`),
+    ]);
+};
+const grantsForOperation = (entity, permissions, operation) => [
+    { entity, operation },
+    ...fieldPathsFor(permissions.fields, operation, '').map((field) => ({ entity, operation, field })),
+];
+// The field map is walked only for an operation the ENTITY grants, and that is a correctness rule
+// rather than a saving. Payload reports a field's verdict whether or not the operation carrying it is
+// reachable: an auth collection that denies `read` to a stranger still lists fields carrying
+// `read: true`, because the field rule genuinely says yes and the collection rule is what stops the
+// caller. Judging those would name permissions nobody holds, and a project cannot close a finding that
+// describes no exposure - so it would close it by declaring it, which teaches exactly the wrong habit.
+const grantsForEntity = (entity, permissions) => JUDGED_OPERATIONS.filter((operation) => isPermitted(permissions[operation])).flatMap((operation) => grantsForOperation(entity, permissions, operation));
+const grantsIn = (entities) => Object.entries(entities).flatMap(([entity, permissions]) => grantsForEntity(entity, permissions));
 /** Every permission an access report grants, across collections and globals alike. */
 export const grantedPermissions = (report) => [
     ...grantsIn(report.collections ?? {}),
     ...grantsIn(report.globals ?? {}),
 ];
 /** How one grant is named, both in a report and in the `publicAccess` entry that would declare it. */
-export const describeGrant = (granted) => `${granted.entity}.${granted.operation}`;
-const isDeclared = (granted, declared) => declared.some((entry) => entry.entity === granted.entity && entry.operation === granted.operation);
+export const describeGrant = (granted) => granted.field === undefined
+    ? `${granted.entity}.${granted.operation}`
+    : `${granted.entity}.${granted.operation}${PATH_SEPARATOR}${granted.field}`;
+/** The field type Payload renders in the panel and keeps no column for. */
+const UI_FIELD_TYPE = 'ui';
+// A tab set is a container whose children live one level down; each tab hoists or adds a segment of its
+// own, which is why it is walked apart from an ordinary named field.
+const TABS_FIELD_TYPE = 'tabs';
+// Blocks are reported as a map of their own, keyed by block slug, and `fieldPathsFor` never descends
+// into one. Descending here would compose paths the report never sends, which match nothing.
+const BLOCKS_FIELD_TYPE = 'blocks';
+/** A field's or tab's own name, or nothing when it is presentational and hoists its children. */
+const nameOf = (subject) => {
+    const name = readKey(subject, 'name');
+    return typeof name === 'string' && name.length > 0 ? name : undefined;
+};
+// A named container adds its segment; an unnamed one - a row, a collapsible, an unnamed group or tab -
+// stores nothing of its own, and Payload reports its children at the parent's level.
+const prefixUnder = (prefix, name) => name === undefined ? prefix : `${prefix}${name}${PATH_SEPARATOR}`;
+// Stated as the lists to descend into rather than by recursing here, so the walk below recurses into
+// itself alone. A tab set contributes one list per tab, each hoisting or adding its own segment; a UI
+// field and a block set contribute none; everything else contributes its own `fields`, which is absent
+// on a leaf and read as an empty list.
+const childFieldsOf = (field, prefix) => {
+    const type = readKey(field, 'type');
+    if (type === UI_FIELD_TYPE || type === BLOCKS_FIELD_TYPE) {
+        return [];
+    }
+    if (type === TABS_FIELD_TYPE) {
+        const tabs = readKey(field, 'tabs');
+        return (isArray(tabs) ? tabs : []).map((tab) => ({
+            fields: readKey(tab, 'fields'),
+            prefix: prefixUnder(prefix, nameOf(tab)),
+        }));
+    }
+    return [{ fields: readKey(field, 'fields'), prefix: prefixUnder(prefix, nameOf(field)) }];
+};
+// An unnamed UI field is reported by nothing, so it names no path to drop.
+const datalessPathOf = (field, prefix) => {
+    const name = nameOf(field);
+    return name !== undefined && readKey(field, 'type') === UI_FIELD_TYPE ? [`${prefix}${name}`] : [];
+};
+const datalessInFields = (fields, prefix) => (isArray(fields) ? fields : []).flatMap((field) => [
+    ...datalessPathOf(field, prefix),
+    ...childFieldsOf(field, prefix).flatMap((child) => datalessInFields(child.fields, child.prefix)),
+]);
+const datalessInEntities = (entities) => Object.fromEntries((isArray(entities) ? entities : []).flatMap((entity) => {
+    const slug = readKey(entity, 'slug');
+    const paths = datalessInFields(readKey(entity, 'fields'), '');
+    return typeof slug !== 'string' || paths.length === 0 ? [] : [[slug, paths]];
+}));
+/**
+ * Every field path a built Payload configuration reports but keeps no data behind.
+ *
+ * Read through the untyped accessors rather than through Payload's types, because this package depends
+ * on nothing: what arrives is the configuration Payload booted, and what is read of it is the same four
+ * keys the response is built from.
+ * @param config the built Payload configuration, as its module's default export.
+ * @returns the dataless paths of each entity that has any, keyed by slug.
+ */
+export const datalessFieldsIn = (config) => ({
+    ...datalessInEntities(readKey(config, 'collections')),
+    ...datalessInEntities(readKey(config, 'globals')),
+});
+const isDataless = (granted, dataless) => granted.field !== undefined && (dataless[granted.entity] ?? []).includes(granted.field);
+/** Every permission the report grants over something the configuration actually stores. */
+const dataBearingGrants = (report, dataless) => grantedPermissions(report).filter((granted) => !isDataless(granted, dataless));
+// A field is matched by name and never by a wildcard the project could write for itself. An entry
+// listing `*` covers only the grant Payload itself collapsed to `*`, where every field is open and the
+// declaration is therefore exact rather than blanket.
+//
+// The ONE pattern a project may write is a trailing `.**` on a non-empty, star-free prefix: `sizes.**`
+// names the group and everything beneath it - `sizes`, `sizes.thumbnail.url`, and a `sizes.*` Payload
+// collapsed. An upload collection with eight renditions reports fifty-seven paths under `sizes`, and a
+// list that long is a list nobody rereads, which defeats the declaration it exists to be. The trade is
+// stated rather than hidden: a field added under that group later is covered by the same declaration.
+// Every other spelling - `**` alone, `**` mid-path, `*` under a prefix - is a literal name, and a
+// literal Payload never reports covers nothing, which fails in the safe direction. A top-level field
+// therefore still has to be named one by one.
+const SUBTREE_DECLARATION = /^([^*]+)\.\*\*$/;
+const coversPath = (declared, field) => {
+    const prefix = SUBTREE_DECLARATION.exec(declared)?.[1];
+    return prefix === undefined
+        ? declared === field
+        : field === prefix || field.startsWith(`${prefix}${PATH_SEPARATOR}`);
+};
+const coversField = (entry, field) => (entry.fields ?? []).some((declared) => coversPath(declared, field));
+const isDeclared = (granted, declared) => declared.some((entry) => {
+    if (entry.entity !== granted.entity || entry.operation !== granted.operation) {
+        return false;
+    }
+    return granted.field === undefined ? true : coversField(entry, granted.field);
+});
 /**
  * The grants the running application makes to a stranger that the project has not recorded. Empty is
  * the only passing answer: a project that declares nothing is judged most strictly, and a declaration
  * narrows nothing else.
+ * @param report the body of `/api/access` for an anonymous caller.
+ * @param declared the project's `publicAccess` entries.
+ * @param dataless the field paths the configuration reports but stores nothing behind, from
+ * `datalessFieldsIn`. Defaulted to none, which judges every reported path and so errs strictly.
+ * @returns one finding per undeclared grant, in report order.
  */
-export const undeclaredGrants = (report, declared) => grantedPermissions(report)
+export const undeclaredGrants = (report, declared, dataless = {}) => dataBearingGrants(report, dataless)
     .filter((granted) => !isDeclared(granted, declared))
     .map((granted) => describeGrant(granted));
+const isGranted = (entry, granted) => granted.some((grant) => grant.entity === entry.entity && grant.operation === entry.operation);
+const isCovering = (entry, declared, granted) => granted.some((grant) => grant.entity === entry.entity &&
+    grant.operation === entry.operation &&
+    grant.field !== undefined &&
+    coversPath(declared, grant.field));
+const describeDeclaration = (entry, field) => describeGrant({
+    entity: entry.entity,
+    operation: entry.operation,
+    ...(field !== undefined && { field }),
+});
+const NO_MATCHING_GRANT = 'covers no grant the application makes';
+/**
+ * Every `publicAccess` declaration the running application does not bear out: an entity and operation
+ * it grants nobody, or a field path under a granted operation that no reported field matches.
+ *
+ * The mirror of `undeclaredGrants`, and the access-boundary twin of an exclusion that excludes nothing:
+ * a declaration matching no grant records a decision with no effect, outlives the field it was written
+ * for, and covers that field the day it is exposed again without anyone being asked. A `.**` subtree
+ * counts as borne out while the group or anything beneath it is granted, which keeps the trade that
+ * form makes; a subtree under which nothing is granted is a misspelling like any other.
+ * @param report the body of `/api/access` for an anonymous caller.
+ * @param declared the project's `publicAccess` entries.
+ * @param dataless the field paths the configuration reports but stores nothing behind, from
+ * `datalessFieldsIn`. A declaration naming one is therefore reported stale and can be removed.
+ * @returns one finding per stale entry or field, in declaration order.
+ */
+export const staleDeclarations = (report, declared, dataless = {}) => {
+    const granted = dataBearingGrants(report, dataless);
+    return declared.flatMap((entry) => {
+        if (!isGranted(entry, granted)) {
+            return [
+                `publicAccess entry "${describeDeclaration(entry)}" ${NO_MATCHING_GRANT}; the access rule ` +
+                    'was closed or the entity renamed, so remove the entry',
+            ];
+        }
+        return (entry.fields ?? [])
+            .filter((field) => !isCovering(entry, field, granted))
+            .map((field) => `publicAccess entry "${describeDeclaration(entry, field)}" ${NO_MATCHING_GRANT}; the field ` +
+            'was renamed, hidden or misspelt, so correct or remove it');
+    });
+};
 //# sourceMappingURL=access-boundary.js.map

package/dist/access-boundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-boundary.js","sourceRoot":"","sources":["../src/access-boundary.ts"],"names":[],"mappings":"AAyCA;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE1F,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,UAA0C,EAAW,EAAE,CACjF,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,KAAK,IAAI,CAAA;AAEhF,MAAM,QAAQ,GAAG,CAAC,QAAkD,EAAsB,EAAE,CAC1F,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC9B,CAAC,CAAC,MAAM,EAAE,WAAW,CAAoC,EAAsB,EAAE,CAC/E,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAiB,EAAW,EAAE,CACtD,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CACpC,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CACjE,CAAA;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAoB,EAAsB,EAAE,CAAC;IAC9E,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACrC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;CAClC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAU,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAA;AAEnG,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAE,QAAiC,EAAW,EAAE,CAClF,QAAQ,CAAC,IAAI,CACX,CAAC,KAAmB,EAAW,EAAE,CAC/B,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,CAC3E,CAAA;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAoB,EACpB,QAAiC,EACd,EAAE,CACrB,kBAAkB,CAAC,MAAM,CAAC;KACvB,MAAM,CAAC,CAAC,OAAgB,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KACrE,GAAG,CAAC,CAAC,OAAgB,EAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA"}
+{"version":3,"file":"access-boundary.js","sourceRoot":"","sources":["../src/access-boundary.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AACnD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,uBAAuB,CAAA;AA0C9B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,GAAG,qBAAqB;IACxB,uBAAuB;IACvB,gBAAgB;CACjB,CAAA;AAED,mGAAmG;AACnG,MAAM,WAAW,GAAW,GAAG,CAAA;AAE/B,MAAM,cAAc,GAAW,GAAG,CAAA;AAElC,kGAAkG;AAClG,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,UAA2D,EAClD,EAAE;IACX,IAAI,UAAU,KAAK,SAAS,IAAI,OAAO,UAAU,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,UAAU,KAAK,IAAI,CAAA;IAC5B,CAAC;IACD,mGAAmG;IACnG,iGAAiG;IACjG,qCAAqC;IACrC,MAAM,WAAW,GAAsC,UAAU,CAAA;IACjE,OAAO,WAAW,CAAC,UAAU,KAAK,IAAI,CAAA;AACxC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,CACpB,MAAkC,EAClC,SAAiB,EACjB,MAAc,EACK,EAAE;IACrB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CACnC,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAoC,EAAqB,EAAE,CAAC;QAC1E,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,GAAG,IAAI,GAAG,cAAc,EAAE,CAAC;KAClF,CACF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CACzB,MAAc,EACd,WAA2B,EAC3B,SAAiB,EACG,EAAE,CAAC;IACvB,EAAE,MAAM,EAAE,SAAS,EAAE;IACrB,GAAG,aAAa,CAAC,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,GAAG,CACrD,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAC3D;CACF,CAAA;AAED,kGAAkG;AAClG,sGAAsG;AACtG,6FAA6F;AAC7F,oGAAoG;AACpG,uGAAuG;AACvG,uGAAuG;AACvG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,WAA2B,EAAsB,EAAE,CAC1F,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAiB,EAAW,EAAE,CACtD,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CACpC,CAAC,OAAO,CAAC,CAAC,SAAiB,EAAsB,EAAE,CAClD,kBAAkB,CAAC,MAAM,EAAE,WAAW,EAAE,SAAS,CAAC,CACnD,CAAA;AAEH,MAAM,QAAQ,GAAG,CAAC,QAAkD,EAAsB,EAAE,CAC1F,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAC9B,CAAC,CAAC,MAAM,EAAE,WAAW,CAAoC,EAAsB,EAAE,CAC/E,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CACvC,CAAA;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAoB,EAAsB,EAAE,CAAC;IAC9E,GAAG,QAAQ,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IACrC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;CAClC,CAAA;AAED,sGAAsG;AACtG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAgB,EAAU,EAAE,CACxD,OAAO,CAAC,KAAK,KAAK,SAAS;IACzB,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE;IAC1C,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,GAAG,cAAc,GAAG,OAAO,CAAC,KAAK,EAAE,CAAA;AAK/E,2EAA2E;AAC3E,MAAM,aAAa,GAAW,IAAI,CAAA;AAElC,wGAAwG;AACxG,qEAAqE;AACrE,MAAM,eAAe,GAAW,MAAM,CAAA;AAEtC,qGAAqG;AACrG,6FAA6F;AAC7F,MAAM,iBAAiB,GAAW,QAAQ,CAAA;AAE1C,iGAAiG;AACjG,MAAM,MAAM,GAAG,CAAC,OAAgB,EAAsB,EAAE;IACtD,MAAM,IAAI,GAAY,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC9C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACvE,CAAC,CAAA;AAED,uGAAuG;AACvG,qFAAqF;AACrF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAwB,EAAU,EAAE,CACvE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,GAAG,cAAc,EAAE,CAAA;AAQnE,qGAAqG;AACrG,sGAAsG;AACtG,uGAAuG;AACvG,uCAAuC;AACvC,MAAM,aAAa,GAAG,CAAC,KAAc,EAAE,MAAc,EAA0B,EAAE;IAC/E,MAAM,IAAI,GAAY,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;QACzD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAY,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAC5C,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CACpC,CAAC,GAAY,EAAe,EAAE,CAAC,CAAC;YAC9B,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC;YAC9B,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;SACzC,CAAC,CACH,CAAA;IACH,CAAC;IACD,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAA;AAC3F,CAAC,CAAA;AAED,2EAA2E;AAC3E,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,MAAc,EAAqB,EAAE;IAC3E,MAAM,IAAI,GAAuB,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9C,OAAO,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACnG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAE,MAAc,EAAqB,EAAE,CAC9E,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAc,EAAqB,EAAE,CAAC;IAC7E,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC;IAChC,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAkB,EAAqB,EAAE,CAChF,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAC7C;CACF,CAAC,CAAA;AAEJ,MAAM,kBAAkB,GAAG,CAAC,QAAiB,EAAkB,EAAE,CAC/D,MAAM,CAAC,WAAW,CAChB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CACzC,CAAC,MAAe,EAAqD,EAAE;IACrE,MAAM,IAAI,GAAY,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAsB,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAChF,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAC9E,CAAC,CACF,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAe,EAAkB,EAAE,CAAC,CAAC;IACpE,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACrD,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAClD,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAE,QAAwB,EAAW,EAAE,CACzE,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAEzF,2FAA2F;AAC3F,MAAM,iBAAiB,GAAG,CAAC,MAAoB,EAAE,QAAwB,EAAsB,EAAE,CAC/F,kBAAkB,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,OAAgB,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;AAElG,kGAAkG;AAClG,uGAAuG;AACvG,sDAAsD;AACtD,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,sGAAsG;AACtG,kGAAkG;AAClG,qGAAqG;AACrG,8CAA8C;AAC9C,MAAM,mBAAmB,GAAW,iBAAiB,CAAA;AAErD,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAE,KAAa,EAAW,EAAE;IAC9D,MAAM,MAAM,GAAuB,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,QAAQ,KAAK,KAAK;QACpB,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,cAAc,EAAE,CAAC,CAAA;AACxE,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,KAAmB,EAAE,KAAa,EAAW,EAAE,CAClE,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAA;AAEvF,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAE,QAAiC,EAAW,EAAE,CAClF,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAmB,EAAW,EAAE;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;AAC/E,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,MAAoB,EACpB,QAAiC,EACjC,WAA2B,EAAE,EACV,EAAE,CACrB,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC;KAChC,MAAM,CAAC,CAAC,OAAgB,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;KACrE,GAAG,CAAC,CAAC,OAAgB,EAAU,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAA;AAE9D,MAAM,SAAS,GAAG,CAAC,KAAmB,EAAE,OAA2B,EAAW,EAAE,CAC9E,OAAO,CAAC,IAAI,CACV,CAAC,KAAc,EAAW,EAAE,CAC1B,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CACvE,CAAA;AAEH,MAAM,UAAU,GAAG,CAAC,KAAmB,EAAE,QAAgB,EAAE,OAA2B,EAAW,EAAE,CACjG,OAAO,CAAC,IAAI,CACV,CAAC,KAAc,EAAW,EAAE,CAC1B,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;IAC7B,KAAK,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;IACnC,KAAK,CAAC,KAAK,KAAK,SAAS;IACzB,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CACpC,CAAA;AAEH,MAAM,mBAAmB,GAAG,CAAC,KAAmB,EAAE,KAAc,EAAU,EAAE,CAC1E,aAAa,CAAC;IACZ,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;CACtC,CAAC,CAAA;AAEJ,MAAM,iBAAiB,GAAW,uCAAuC,CAAA;AAEzE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,MAAoB,EACpB,QAAiC,EACjC,WAA2B,EAAE,EACV,EAAE;IACrB,MAAM,OAAO,GAAuB,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAmB,EAAqB,EAAE;QACjE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,uBAAuB,mBAAmB,CAAC,KAAK,CAAC,KAAK,iBAAiB,oBAAoB;oBACzF,uDAAuD;aAC1D,CAAA;QACH,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;aACtE,GAAG,CACF,CAAC,KAAa,EAAU,EAAE,CACxB,uBAAuB,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,iBAAiB,cAAc;YAC5F,0DAA0D,CAC7D,CAAA;IACL,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/admin-view-coverage.d.ts

@@ -0,0 +1,25 @@
+import { type SpecSource } from './axe-coverage.js';
+import type { PayloadViolation } from './payload-source.js';
+/** A custom admin view a Payload configuration declares, and where it declares it. */
+export interface DeclaredAdminView {
+    readonly path: string;
+    readonly line: number;
+}
+/**
+ * The custom admin views a Payload configuration declares.
+ *
+ * Both `admin.components.views` and a collection's own are found, because both produce a route the
+ * pinned sweep will not reach and both are the project's markup.
+ * @param source the file's text.
+ * @returns one entry per declared view path, in the order the file declares them.
+ */
+export declare const findDeclaredAdminViews: (source: string) => readonly DeclaredAdminView[];
+/**
+ * The declared views that no specification scans for accessibility.
+ * @param views the views a configuration declares.
+ * @param specs the project's test files, which is where a scan would be written.
+ * @param everyFile every file a spec may import a scan from, the specs included.
+ * @returns one violation per view nothing looks at.
+ */
+export declare const findUnscannedAdminViews: (views: readonly DeclaredAdminView[], specs: readonly SpecSource[], everyFile: readonly SpecSource[]) => readonly PayloadViolation[];
+//# sourceMappingURL=admin-view-coverage.d.ts.map

package/dist/admin-view-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-view-coverage.d.ts","sourceRoot":"","sources":["../src/admin-view-coverage.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAG3D,sFAAsF;AACtF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAsCD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,GAAI,QAAQ,MAAM,KAAG,SAAS,iBAAiB,EAejF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAClC,OAAO,SAAS,iBAAiB,EAAE,EACnC,OAAO,SAAS,UAAU,EAAE,EAC5B,WAAW,SAAS,UAAU,EAAE,KAC/B,SAAS,gBAAgB,EA6BxB,CAAA"}