@ploaness/governance 1.0.0 → 1.2.0

package/dist/payload-policy.js

@@ -1,16 +1,7 @@
-// Payload-specific source policy: the rules that exist only because the project is a Payload CMS
-// application, and therefore the part of ploaness that a generic JavaScript harness cannot supply.
-//
-// ploaness governs a language and a framework; this module is the framework half. The rules here target
-// Payload defects that a type checker and a generic linter both miss: a Local API read that pulls an
-// unbounded relationship graph out of the database, and an access check that is deliberately bypassed.
-// The access-control rules - the ones about a decision left UNWRITTEN rather than written wrongly - are
-// in `payload-access.ts`, and the source reader both halves are decided by is in `payload-source.ts`.
-//
-// These rules were previously five GritQL files run as Biome plugins. Biome resolves a plugin path
-// relative to the config that declares it, which does not survive being extended from node_modules, so
-// they are reimplemented here instead. The move also makes them unit-testable, which they were not.
-import { findAnonymousDraftReads, findUndeclaredAccess, findUnhardenedAuth, findUnrestrictedUploads, } from './payload-access.js';
+// Payload source policy for explicit read bounds, request threading, and access decisions.
+import { findAnonymousDraftReads, findUndecidedSvgHeaders, findUndeclaredAccess, findUndeclaredVersionReads, findUnhardenedAuth, findUnlockableAuth, findUnrestrictedUploads, } from './payload-access.js';
+import { findUnprotectedPrivilegedFields } from './payload-field-access.js';
+import { findFailOpenSecretGuards } from './source-security.js';
 import { balancedArguments, lineOf, occurrences, stripComments, topLevelSlice, } from './source-text.js';
 // The Local API reads that must declare their bound. `find` returns a page, so either `depth` or `limit`
 // bounds it; the single-document and global reads return one document, so only `depth` applies.
@@ -34,26 +25,30 @@ const BOUNDED_CALLS = [
         reason: 'bound payload.findGlobal() with an explicit depth to cap relationship population',
     },
 ];
-// Only a call on an identifier that is recognisably the Payload instance is judged, so an unrelated
-// `array.find(...)` is never touched. `req` may itself be reached through a chain - `ctx.req.payload`
-// inside a hook is as much the Payload instance as `req.payload` - and excluding a preceding dot meant
-// every such call went unjudged. The chain is admitted only in front of `req`, so a property named
-// `payload` on some unrelated object is still left alone.
+// Recognized Payload receivers exclude unrelated collection methods such as array.find().
 const PAYLOAD_RECEIVER = /(?:^|[^\w$.])(?:payload|(?:[\w$]+\.)*req\.payload|this\.payload)$/;
-const declaresKey = (topLevel, key) => new RegExp(String.raw `(^|[\s,])${key}\s*:`).test(topLevel);
-// An unterminated call, an options variable rather than a literal, or an object spread all make the
-// bound impossible to decide statically. Staying silent there keeps the gate free of false positives;
-// the reviewer still sees the call.
-const unboundedCallAt = (source, rule, found) => {
-    if (!PAYLOAD_RECEIVER.test(source.slice(0, found))) {
+// A property boundary keeps a value such as request: req from being read as a req property.
+const declaresProperty = (topLevel, key) => new RegExp(String.raw `(?:^|,)\s*${key}\s*(?::|,|$)`).test(topLevel);
+// The depth-one text of a call's options literal, or undefined when the call is not one to judge.
+const topLevelOptionsAt = (source, call, found, receiver) => {
+    if (!receiver.test(source.slice(0, found))) {
         return undefined;
     }
-    const argumentText = balancedArguments(source, found + rule.call.length - 1);
-    if (argumentText === undefined || !argumentText.includes('{') || argumentText.includes('...')) {
-        return undefined;
-    }
-    const topLevel = topLevelSlice(argumentText);
-    if (rule.required.some((key) => declaresKey(topLevel, key))) {
+    const argumentText = balancedArguments(source, found + call.length - 1);
+    return argumentText?.trim().startsWith('{') === true ? topLevelSlice(argumentText) : undefined;
+};
+// A protected property must follow every spread that could replace it.
+const hasEffectiveProperty = (topLevel, key) => {
+    const properties = [
+        ...topLevel.matchAll(new RegExp(String.raw `(?:^|,)\s*${key}\s*(?::|(?=,|$))`, 'gu')),
+    ];
+    const last = properties.at(-1);
+    return last !== undefined && last.index > topLevel.lastIndexOf('...');
+};
+const unboundedCallAt = (source, rule, found) => {
+    const topLevel = topLevelOptionsAt(source, rule.call, found, PAYLOAD_RECEIVER);
+    if (topLevel === undefined ||
+        rule.required.some((key) => hasEffectiveProperty(topLevel, key))) {
         return undefined;
     }
     return { line: lineOf(source, found), rule: rule.rule, reason: rule.reason };
@@ -61,12 +56,123 @@ const unboundedCallAt = (source, rule, found) => {
 const findUnboundedCalls = (source) => BOUNDED_CALLS.flatMap((rule) => occurrences(source, rule.call)
     .map((found) => unboundedCallAt(source, rule, found))
     .filter((violation) => violation !== undefined));
+// The collection, global, and version operations whose options carry both the caller and the request.
+// One catalogue feeds both rules below: adding a Payload operation to one contract and not the other
+// would leave a call either outside its transaction or running as an administrator with a decorative
+// user value.
+const LOCAL_API_CALLS = [
+    '.count(',
+    '.create(',
+    '.delete(',
+    '.find(',
+    '.findByID(',
+    '.findDistinct(',
+    '.findGlobal(',
+    '.findGlobalVersionByID(',
+    '.findGlobalVersions(',
+    '.findVersionByID(',
+    '.findVersions(',
+    '.restoreGlobalVersion(',
+    '.restoreVersion(',
+    '.update(',
+    '.updateGlobal(',
+];
+// Only the request-scoped instance is judged, which is the whole reason the rule can be trusted. A bare
+// `payload` from `getPayload()` - a script, a seed, a Server Component that opened its own instance -
+// has no request to thread, and demanding one would be asking for a value that does not exist. Reaching
+// the instance THROUGH `req` is the proof that one does, so the omission is never a decision.
+const REQUEST_RECEIVER = /(?:^|[^\w$.])(?:[\w$]+\.)*req\.payload$/;
+const findOpaqueOptions = (source) => LOCAL_API_CALLS.flatMap((call) => occurrences(source, call).flatMap((found) => PAYLOAD_RECEIVER.test(source.slice(0, found)) &&
+    topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER) === undefined
+    ? [
+        {
+            line: lineOf(source, found),
+            rule: 'require-explicit-payload-options',
+            reason: `cannot check ${call.slice(1, -1)}() options; use an object literal and state ` +
+                'the required depth/limit, req, and access settings after any spread',
+        },
+    ]
+    : []));
+const unthreadedCallAt = (source, call, found) => {
+    const topLevel = topLevelOptionsAt(source, call, found, REQUEST_RECEIVER);
+    if (topLevel === undefined || hasEffectiveProperty(topLevel, 'req')) {
+        return undefined;
+    }
+    return {
+        line: lineOf(source, found),
+        rule: 'no-unthreaded-req',
+        reason: `pass req to ${call.slice(1, -1)}() so it joins the caller's transaction; reached through ` +
+            'req.payload without it, the operation opens its own - it cannot see the in-flight write, and ' +
+            'it is not rolled back with it',
+    };
+};
+// The defect this catches is invisible in a passing test suite and in a code review. A hook that reads
+// or writes through `req.payload` without `req` looks identical to one that threads it, runs correctly
+// whenever no transaction is open, and corrupts a document only when one is - which is precisely when a
+// hook runs. Payload's own documentation calls threading it critical, and no type checker can require it
+// because the parameter is optional for the callers that genuinely have no request.
+const findUnthreadedRequests = (source) => LOCAL_API_CALLS.flatMap((call) => occurrences(source, call)
+    .map((found) => unthreadedCallAt(source, call, found))
+    .filter((violation) => violation !== undefined));
+const OVERRIDE_PROPERTY = /(?:^|,)\s*overrideAccess\s*:\s*([^,]*)/g;
+const overrideProperties = (topLevel) => [...topLevel.matchAll(OVERRIDE_PROPERTY)].map((match) => ({
+    index: match.index,
+    value: (match[1] ?? '').trim(),
+}));
+// A later spread can replace an earlier false. A false written after the last spread is the only form
+// whose effective value this text reader can prove without resolving another object.
+const hasEffectiveAccessControl = (topLevel) => {
+    const last = overrideProperties(topLevel).at(-1);
+    return last?.value === 'false' && last.index > topLevel.lastIndexOf('...');
+};
+const userAccessViolationAt = (source, call, found) => {
+    const topLevel = topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER);
+    if (topLevel === undefined ||
+        !(declaresProperty(topLevel, 'user') || topLevel.includes('...')) ||
+        hasEffectiveAccessControl(topLevel) ||
+        overrideProperties(topLevel).some((property) => property.value === 'true')) {
+        return undefined;
+    }
+    return {
+        line: lineOf(source, found),
+        rule: 'require-user-access-control',
+        reason: `set overrideAccess: false on ${call.slice(1, -1)}() after any spread; ` +
+            'a supplied or inherited user otherwise does not enable access control. Payload ' +
+            'runs the operation as an administrator and ignores that user for access control',
+    };
+};
+const findIgnoredUsers = (source) => LOCAL_API_CALLS.flatMap((call) => occurrences(source, call)
+    .map((found) => userAccessViolationAt(source, call, found))
+    .filter((violation) => violation !== undefined));
 const OVERRIDE_ACCESS = /overrideAccess\s*:\s*true/g;
 const findOverrideAccess = (source) => [...source.matchAll(OVERRIDE_ACCESS)].map((match) => ({
     line: lineOf(source, match.index),
     rule: 'no-override-access',
-    reason: 'overrideAccess: true bypasses Payload access control; pass req so the access rules run, or drop the override',
+    reason: 'overrideAccess: true bypasses Payload access control; set overrideAccess: false so the ' +
+        'access rules run against the calling user',
 }));
+// The one layer whose caller is a stranger. Everywhere else a Local API call runs in a context the
+// project already trusts - a hook inside the write that authored it, a scheduled job, a seed - and
+// privilege there is legitimate rather than a mistake. A route handler serves whoever reached the URL,
+// so what it is allowed to read is the one thing it must never inherit by saying nothing.
+const ENDPOINT_PATH = /^src\/(?:endpoints\/|app\/(?:.*\/)?route\.[jt]s$)/u;
+// A route must prove access enforcement rather than inherit Payload's privileged default.
+const endpointAccessViolationAt = (source, call, found) => {
+    if (!PAYLOAD_RECEIVER.test(source.slice(0, found))) {
+        return undefined;
+    }
+    const topLevel = topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER);
+    if (topLevel !== undefined && hasEffectiveAccessControl(topLevel)) {
+        return undefined;
+    }
+    return {
+        line: lineOf(source, found),
+        rule: 'require-endpoint-access',
+        reason: `state overrideAccess: false on ${call.slice(1, -1)}() in a route handler; Payload defaults it to ` +
+            'true, so an omission runs as an administrator and serves the document to whoever called the ' +
+            'route - set overrideAccess: false',
+    };
+};
 // Anchored on the keyword that immediately precedes the specifier rather than on the statement that
 // opens it. Requiring the whole statement to fit on one line missed a multi-line brace list, which is
 // how a long import is normally written, and requiring `from` missed both a side-effect import and the
@@ -102,7 +208,10 @@ const findDeepRelativeImports = (source) => [...source.matchAll(RELATIVE_IMPORT)
  * @param source the file's text.
  * @returns one violation per offending line.
  */
-export const findSourceViolations = (source) => findDeepRelativeImports(stripComments(source));
+export const findSourceViolations = (source) => [
+    ...findDeepRelativeImports(stripComments(source)),
+    ...findFailOpenSecretGuards(source),
+];
 /**
  * The rules that are about Payload itself, which only a Payload package can break.
  * @param source the file's text.
@@ -113,12 +222,42 @@ export const findPayloadViolations = (source) => {
     // order to explain why the code avoids it must not be reported as that construct.
     const code = stripComments(source);
     return [
+        ...findOpaqueOptions(code),
         ...findUnboundedCalls(code),
+        ...findUnthreadedRequests(code),
+        ...findIgnoredUsers(code),
         ...findOverrideAccess(code),
         ...findUndeclaredAccess(code),
         ...findUnhardenedAuth(code),
+        ...findUnlockableAuth(code),
         ...findAnonymousDraftReads(code),
+        ...findUndeclaredVersionReads(code),
         ...findUnrestrictedUploads(code),
+        ...findUndecidedSvgHeaders(code),
+        ...findUnprotectedPrivilegedFields(code),
     ];
 };
+/**
+ * The access decision a route handler has to state rather than inherit.
+ *
+ * The two rules that already read `overrideAccess` judge a value that is written down: one bans `true`,
+ * the other requires `false` beside a `user`. Neither can see an absent property, and absent is the
+ * dangerous spelling - Payload defaults `overrideAccess` to `true`, so the call that says nothing is
+ * the call that runs as an administrator. Under `src/endpoints` the omission is therefore the
+ * violation, which is why this rule reads the path and the others do not.
+ * @param filePath the repository-relative path of the file, which decides whether the rule applies.
+ * @param source the file's text.
+ * @returns one violation per Local API call that leaves the decision to the default.
+ */
+export const findEndpointViolations = (filePath, source) => {
+    if (!ENDPOINT_PATH.test(filePath)) {
+        return [];
+    }
+    // Runs outside `findPayloadViolations`, so it strips its own comments: prose that names a call must
+    // not be read as one.
+    const code = stripComments(source);
+    return LOCAL_API_CALLS.flatMap((call) => occurrences(code, call)
+        .map((found) => endpointAccessViolationAt(code, call, found))
+        .filter((violation) => violation !== undefined));
+};
 //# sourceMappingURL=payload-policy.js.map

package/dist/payload-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-policy.js","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,mGAAmG;AACnG,EAAE;AACF,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,wGAAwG;AACxG,sGAAsG;AACtG,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AASzB,yGAAyG;AACzG,gGAAgG;AAChG,MAAM,aAAa,GAA+B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,uGAAuG;KAC1G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,0DAA0D;AAC1D,MAAM,gBAAgB,GAAW,mEAAmE,CAAA;AAEpG,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,YAAY,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAE5D,oGAAoG;AACpG,sGAAsG;AACtG,oCAAoC;AACpC,MAAM,eAAe,GAAG,CACtB,MAAc,EACd,IAAqB,EACrB,KAAa,EACiB,EAAE;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAuB,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAChG,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAW,aAAa,CAAC,YAAY,CAAC,CAAA;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7E,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAqB,EAA+B,EAAE,CAC3E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;KAC3B,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC1F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,MAAM,eAAe,GAAW,4BAA4B,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CACvC,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EACJ,8GAA8G;CACjH,CAAC,CACH,CAAA;AAEH,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,eAAe,GAAW,uDAAuD,CAAA;AACvF,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,sBAAsB,GAAW,2CAA2C,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC9E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC,KAAsB,EAA+B,EAAE;IACtD,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,kEAAkE,SAAS,GAAG;aACvF;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAA;AAEhD;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAA+B,EAAE;IACnF,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,uBAAuB,CAAC,IAAI,CAAC;KACjC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload-policy.js","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AASzB,yGAAyG;AACzG,gGAAgG;AAChG,MAAM,aAAa,GAA+B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,uGAAuG;KAC1G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA;AAED,0FAA0F;AAC1F,MAAM,gBAAgB,GAAW,mEAAmE,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAErE,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CACxB,MAAc,EACd,IAAY,EACZ,KAAa,EACb,QAAgB,EACI,EAAE;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAuB,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3F,OAAO,YAAY,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAChG,CAAC,CAAA;AAED,uEAAuE;AACvE,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE;IACtE,MAAM,UAAU,GAA+B;QAC7C,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAC;KACrF,CAAA;IACD,MAAM,IAAI,GAAgC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,MAAc,EACd,IAAqB,EACrB,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAClG,IACE,QAAQ,KAAK,SAAS;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EACjF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAqB,EAA+B,EAAE,CAC3E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;KAC3B,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC1F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,cAAc;AACd,MAAM,eAAe,GAAsB;IACzC,SAAS;IACT,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,wBAAwB;IACxB,kBAAkB;IAClB,UAAU;IACV,gBAAgB;CACjB,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,wGAAwG;AACxG,8FAA8F;AAC9F,MAAM,gBAAgB,GAAW,yCAAyC,CAAA;AAE1E,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACxE,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAa,EAA+B,EAAE,CAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,SAAS;IACpE,CAAC,CAAC;QACE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YAC3B,IAAI,EAAE,kCAAkC;YACxC,MAAM,EACJ,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8CAA8C;gBAC/E,qEAAqE;SACxE;KACF;IACH,CAAC,CAAC,EAAE,CACP,CACF,CAAA;AAEH,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IAAI,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2DAA2D;YAC3F,+FAA+F;YAC/F,+BAA+B;KAClC,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,yGAAyG;AACzG,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC7E,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC3F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAOH,MAAM,iBAAiB,GAAW,yCAAyC,CAAA;AAE3E,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAA+B,EAAE,CAC3E,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAC3C,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC/B,CAAC,CACH,CAAA;AAEH,sGAAsG;AACtG,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC9D,MAAM,IAAI,GAAiC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,IAAI,EAAE,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAC5B,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,yBAAyB,CAAC,QAAQ,CAAC;QACnC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC/B,CAAC,QAA0B,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CACnE,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,6BAA6B;QACnC,MAAM,EACJ,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB;YACxE,iFAAiF;YACjF,iFAAiF;KACpF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACvE,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CACnD,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAC3C;KACA,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,MAAM,eAAe,GAAW,4BAA4B,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CACvC,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EACJ,yFAAyF;QACzF,2CAA2C;CAC9C,CAAC,CACH,CAAA;AAEH,mGAAmG;AACnG,mGAAmG;AACnG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,aAAa,GAAW,oDAAoD,CAAA;AAElF,0FAA0F;AAC1F,MAAM,yBAAyB,GAAG,CAChC,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IAAI,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EACJ,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD;YACnG,8FAA8F;YAC9F,mCAAmC;KACtC,CAAA;AACH,CAAC,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,eAAe,GAAW,uDAAuD,CAAA;AACvF,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,sBAAsB,GAAW,2CAA2C,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC9E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC,KAAsB,EAA+B,EAAE;IACtD,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,kEAAkE,SAAS,GAAG;aACvF;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAAC;IACnF,GAAG,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,GAAG,wBAAwB,CAAC,MAAM,CAAC;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAA+B,EAAE;IACnF,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,iBAAiB,CAAC,IAAI,CAAC;QAC1B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAC/B,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,0BAA0B,CAAC,IAAI,CAAC;QACnC,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,+BAA+B,CAAC,IAAI,CAAC;KACzC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAgB,EAChB,MAAc,EACe,EAAE;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,oGAAoG;IACpG,sBAAsB;IACtB,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CAC3E,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;SACpB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CACnD,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAC7C;SACA,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/payload-source.js

@@ -41,8 +41,8 @@ export const depthOneValue = (wrapped, key) => {
  * @returns the block's depth-one keys, or an empty list when the key is absent.
  */
 export const depthOneBlockKeys = (wrapped, key) => {
-    const at = depthOneKeyIndex(wrapped, key);
-    return at === NOT_FOUND ? [] : topLevelKeys(wrapped, at);
+    const value = depthOneValue(wrapped, key);
+    return value?.trimStart().startsWith('{') === true ? topLevelKeys(value, 0) : [];
 };
 const withClose = (spans, close) => {
     const last = spans.at(LAST_CHARACTER);

package/dist/payload-source.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-source.js","sourceRoot":"","sources":["../src/payload-source.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AASzB,wGAAwG;AACxG,yGAAyG;AACzG,sEAAsE;AACtE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,sGAAsG;AACtG,iGAAiG;AACjG,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE;IAC7D,MAAM,OAAO,GAAW,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,GAAG,MAAM,CAAC,CAAA;IAClE,OAAO,aAAa,CAClB,IAAI,EACJ,CAAC,EACD,CAAC,KAAa,EAAE,IAAc,EAAkB,EAAE,CAChD,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,SAAS,CACV,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,GAAW,EAAsB,EAAE;IAChF,MAAM,EAAE,GAAW,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,GAAW,EAAqB,EAAE;IACnF,MAAM,EAAE,GAAW,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjD,OAAO,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AAC1D,CAAC,CAAA;AAQD,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAE,KAAa,EAA0B,EAAE;IACzF,MAAM,IAAI,GAA4B,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAA;IAC9D,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA;AAED,wGAAwG;AACxG,8FAA8F;AAC9F,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,cAAc,GAAG,CAAC,MAAc,EAA0B,EAAE,CAChE,aAAa,CACX,MAAM,EACN,CAAC,EACD,CAAC,KAA6B,EAAE,IAAc,EAAkC,EAAE;IAChF,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAC/C,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC,EACD,EAAE,CACH,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EACd,MAAc,EACd,UAAmB,EACC,EAAE;IACtB,MAAM,IAAI,GAAW,UAAU;QAC7B,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,IAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;aACvF,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAA;AACrD,CAAC,CAAA"}
+{"version":3,"file":"payload-source.js","sourceRoot":"","sources":["../src/payload-source.ts"],"names":[],"mappings":"AAAA,qGAAqG;AACrG,6BAA6B;AAC7B,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,mDAAmD;AACnD,OAAO,EACL,iBAAiB,EAEjB,cAAc,EACd,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AASzB,wGAAwG;AACxG,yGAAyG;AACzG,sEAAsE;AACtE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,sGAAsG;AACtG,iGAAiG;AACjG,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE;IAC7D,MAAM,OAAO,GAAW,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,WAAW,GAAG,MAAM,CAAC,CAAA;IAClE,OAAO,aAAa,CAClB,IAAI,EACJ,CAAC,EACD,CAAC,KAAa,EAAE,IAAc,EAAkB,EAAE,CAChD,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE;QACnC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,SAAS,CACV,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,GAAW,EAAsB,EAAE;IAChF,MAAM,EAAE,GAAW,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACjD,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC9C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,GAAW,EAAqB,EAAE;IACnF,MAAM,KAAK,GAAuB,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAClF,CAAC,CAAA;AAQD,MAAM,SAAS,GAAG,CAAC,KAA6B,EAAE,KAAa,EAA0B,EAAE;IACzF,MAAM,IAAI,GAA4B,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,CAAA;IAC9D,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS;QAC9B,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjE,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA;AAED,wGAAwG;AACxG,8FAA8F;AAC9F,uGAAuG;AACvG,kFAAkF;AAClF,MAAM,cAAc,GAAG,CAAC,MAAc,EAA0B,EAAE,CAChE,aAAa,CACX,MAAM,EACN,CAAC,EACD,CAAC,KAA6B,EAAE,IAAc,EAAkC,EAAE;IAChF,IAAI,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QAC/C,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QACtD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AACnC,CAAC,EACD,EAAE,CACH,CAAA;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAc,EACd,MAAc,EACd,UAAmB,EACC,EAAE;IACtB,MAAM,IAAI,GAAW,UAAU;QAC7B,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC;aACpB,MAAM,CAAC,CAAC,IAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;aACvF,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC/B,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAA;AACrD,CAAC,CAAA"}

package/dist/relationship-cleanup.d.ts

@@ -0,0 +1,18 @@
+import type { SpecSource } from './axe-coverage.js';
+import { type PayloadViolation } from './payload-source.js';
+/** A violation together with the file it was found in, because this rule reads more than one. */
+export interface LocatedViolation {
+    readonly path: string;
+    readonly violation: PayloadViolation;
+}
+/**
+ * Every required single-value relationship whose target collection cannot be deleted because of it.
+ *
+ * Reads the whole candidate set at once, because the collection a `relationTo` names is declared in
+ * another file. A target this set does not declare - a collection a plugin contributes, say - is left
+ * alone rather than reported, since nothing here can see whether it takes its dependants down.
+ * @param files every source file the gate collected, as a path and its text.
+ * @returns one violation per unguarded relationship, located in the file that declares it.
+ */
+export declare const findUnguardedRelationships: (files: readonly SpecSource[]) => readonly LocatedViolation[];
+//# sourceMappingURL=relationship-cleanup.d.ts.map

package/dist/relationship-cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-cleanup.d.ts","sourceRoot":"","sources":["../src/relationship-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAG7F,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;CACrC;AAkGD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACrC,OAAO,SAAS,UAAU,EAAE,KAC3B,SAAS,gBAAgB,EA4B3B,CAAA"}

package/dist/relationship-cleanup.js

@@ -0,0 +1,96 @@
+import { payloadConfigsIn } from './payload-configs.js';
+import { depthOneBlockKeys, depthOneValue } from './payload-source.js';
+import { enclosingLiteral, occurrences, stripComments } from './source-text.js';
+// The two field types that put a foreign key on the table rather than in the join table. `upload` is
+// one of them: it is a relationship to the media collection wearing a different name.
+const KEYED_FIELD_TYPES = ['relationship', 'upload'];
+// Biome normalises a project to single quotes; nothing obliges a project to have run it yet.
+const QUOTE_STYLES = ["'", '"'];
+const TRUE_VALUE = /^\s*true\b/;
+const QUOTED_VALUE = /^\s*['"`]([^'"`]+)['"`]/;
+const DRAFTS_ENABLED = /drafts\s*:\s*(?:true|\{)/;
+const CLEANUP_HOOK = 'beforeDelete';
+const declaresTrue = (field, key) => TRUE_VALUE.test(depthOneValue(field, key) ?? '');
+// The slug a `relationTo` names, and only when it names exactly one. An array is the polymorphic form,
+// which Payload stores in the join table instead and which therefore carries no column to constrain.
+const singleTarget = (field) => QUOTED_VALUE.exec(depthOneValue(field, 'relationTo') ?? '')?.[1];
+const slugOf = (body) => QUOTED_VALUE.exec(depthOneValue(body, 'slug') ?? '')?.[1];
+// A collection with drafts enabled gets no null constraint anywhere, so none of its required fields can
+// reach the contradiction.
+const declaresDrafts = (body) => DRAFTS_ENABLED.test(depthOneValue(body, 'versions') ?? '');
+// Which literal in a file IS a collection is `payload-configs.ts`'s question, and this rule asks it
+// there rather than carrying a second copy of the answer. A global is dropped: it has no relationship
+// column of its own to constrain. A collection with no readable slug is dropped too, because the whole
+// rule is a lookup by slug.
+//
+// Comments are blanked before anything is read, the way every other Payload rule reads a file. The keys
+// this rule looks for sit at depth one, and a depth-one key is recognised by the delimiter in front of
+// it - so a comment between the previous entry and `hooks:` hid the hook, and the rule reported a
+// collection that was guarded. `stripComments` preserves offsets and newlines, so the reported line is
+// still the line of the source.
+const collectionsIn = (file) => payloadConfigsIn(stripComments(file.source))
+    .filter((found) => found.kind.kind === 'collection')
+    .flatMap((found) => {
+    const slug = slugOf(found.body);
+    return slug === undefined
+        ? []
+        : [{ path: file.path, slug, body: found.body, line: found.line }];
+});
+// Every field of one collection that puts a NOT NULL column against another collection's primary key.
+// The field literal is recovered from the offset of its own `type` key, so a relationship nested inside
+// an array or a group is read exactly like one declared at the top: both get a column, on their own
+// table, with the same pair of settings.
+const constrainedTargets = (collection) => {
+    if (declaresDrafts(collection.body)) {
+        return [];
+    }
+    return KEYED_FIELD_TYPES.flatMap((fieldType) => QUOTE_STYLES.flatMap((quote) => occurrences(collection.body, `${quote}${fieldType}${quote}`))
+        .map((at) => {
+        const field = enclosingLiteral(collection.body, at);
+        return field === undefined || !isConstrained(field, fieldType)
+            ? undefined
+            : singleTarget(field);
+    })
+        .filter((slug) => slug !== undefined));
+};
+// The four conditions the adapter itself applies, read back off the field. `hasMany` moves the
+// relationship into the join table; `admin.condition` and an array `relationTo` each drop the null
+// constraint; and without `required` there is nothing to contradict.
+const isConstrained = (field, fieldType) => QUOTED_VALUE.exec(depthOneValue(field, 'type') ?? '')?.[1] === fieldType &&
+    declaresTrue(field, 'required') &&
+    !declaresTrue(field, 'hasMany') &&
+    !depthOneBlockKeys(field, 'admin').includes('condition') &&
+    singleTarget(field) !== undefined;
+const declaresCleanup = (target) => depthOneBlockKeys(target.body, 'hooks').includes(CLEANUP_HOOK);
+const reason = (target) => `a required relationship to \`${target}\` gives this table a NOT NULL column against a foreign key ` +
+    `Payload declares ON DELETE SET NULL, so deleting a ${target} row aborts on this table's ` +
+    `constraint; declare a ${CLEANUP_HOOK} hook on ${target} that removes its dependants first`;
+/**
+ * Every required single-value relationship whose target collection cannot be deleted because of it.
+ *
+ * Reads the whole candidate set at once, because the collection a `relationTo` names is declared in
+ * another file. A target this set does not declare - a collection a plugin contributes, say - is left
+ * alone rather than reported, since nothing here can see whether it takes its dependants down.
+ * @param files every source file the gate collected, as a path and its text.
+ * @returns one violation per unguarded relationship, located in the file that declares it.
+ */
+export const findUnguardedRelationships = (files) => {
+    const collections = files.flatMap((file) => collectionsIn(file));
+    const bySlug = new Map(collections.map((collection) => [
+        collection.slug,
+        collection,
+    ]));
+    return collections.flatMap((collection) => constrainedTargets(collection)
+        .map((slug) => bySlug.get(slug))
+        .filter((target) => target !== undefined)
+        .filter((target) => !declaresCleanup(target))
+        .map((target) => ({
+        path: collection.path,
+        violation: {
+            line: collection.line,
+            rule: 'require-relationship-cleanup',
+            reason: reason(target.slug),
+        },
+    })));
+};
+//# sourceMappingURL=relationship-cleanup.js.map

package/dist/relationship-cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationship-cleanup.js","sourceRoot":"","sources":["../src/relationship-cleanup.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAChF,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAC7F,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAQ/E,qGAAqG;AACrG,sFAAsF;AACtF,MAAM,iBAAiB,GAAsB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;AAEvE,6FAA6F;AAC7F,MAAM,YAAY,GAAsB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AAElD,MAAM,UAAU,GAAW,YAAY,CAAA;AACvC,MAAM,YAAY,GAAW,yBAAyB,CAAA;AACtD,MAAM,cAAc,GAAW,0BAA0B,CAAA;AACzD,MAAM,YAAY,GAAW,cAAc,CAAA;AAU3C,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAW,EAAE,CAC3D,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;AAElD,uGAAuG;AACvG,qGAAqG;AACrG,MAAM,YAAY,GAAG,CAAC,KAAa,EAAsB,EAAE,CACzD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAElE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAsB,EAAE,CAClD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE3D,wGAAwG;AACxG,2BAA2B;AAC3B,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE,CAC/C,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;AAE5D,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,4BAA4B;AAC5B,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,kGAAkG;AAClG,uGAAuG;AACvG,gCAAgC;AAChC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAA8B,EAAE,CACrE,gBAAgB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KACzC,MAAM,CAAC,CAAC,KAAyB,EAAW,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,YAAY,CAAC;KAChF,OAAO,CAAC,CAAC,KAAyB,EAA8B,EAAE;IACjE,MAAM,IAAI,GAAuB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACnD,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;AACrE,CAAC,CAAC,CAAA;AAEN,sGAAsG;AACtG,wGAAwG;AACxG,oGAAoG;AACpG,yCAAyC;AACzC,MAAM,kBAAkB,GAAG,CAAC,UAA2B,EAAqB,EAAE;IAC5E,IAAI,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC,SAAiB,EAAqB,EAAE,CACxE,YAAY,CAAC,OAAO,CAAC,CAAC,KAAa,EAAqB,EAAE,CACxD,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,EAAE,CAAC,CAC7D;SACE,GAAG,CAAC,CAAC,EAAU,EAAsB,EAAE;QACtC,MAAM,KAAK,GAAuB,gBAAgB,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACvE,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;YAC5D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,IAAwB,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAC5E,CAAA;AACH,CAAC,CAAA;AAED,+FAA+F;AAC/F,mGAAmG;AACnG,qEAAqE;AACrE,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,SAAiB,EAAW,EAAE,CAClE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;IACxE,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC;IAC/B,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC;IAC/B,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IACxD,YAAY,CAAC,KAAK,CAAC,KAAK,SAAS,CAAA;AAEnC,MAAM,eAAe,GAAG,CAAC,MAAuB,EAAW,EAAE,CAC3D,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;AAEhE,MAAM,MAAM,GAAG,CAAC,MAAc,EAAU,EAAE,CACxC,gCAAgC,MAAM,8DAA8D;IACpG,sDAAsD,MAAM,8BAA8B;IAC1F,yBAAyB,YAAY,YAAY,MAAM,oCAAoC,CAAA;AAE7F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,KAA4B,EACC,EAAE;IAC/B,MAAM,WAAW,GAA+B,KAAK,CAAC,OAAO,CAC3D,CAAC,IAAgB,EAA8B,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CACtE,CAAA;IACD,MAAM,MAAM,GAAyC,IAAI,GAAG,CAC1D,WAAW,CAAC,GAAG,CAAC,CAAC,UAA2B,EAA6B,EAAE,CAAC;QAC1E,UAAU,CAAC,IAAI;QACf,UAAU;KACX,CAAC,CACH,CAAA;IACD,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,UAA2B,EAA+B,EAAE,CACtF,kBAAkB,CAAC,UAAU,CAAC;SAC3B,GAAG,CAAC,CAAC,IAAY,EAA+B,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SACpE,MAAM,CACL,CAAC,MAAmC,EAA6B,EAAE,CAAC,MAAM,KAAK,SAAS,CACzF;SACA,MAAM,CAAC,CAAC,MAAuB,EAAW,EAAE,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;SACtE,GAAG,CACF,CAAC,MAAuB,EAAoB,EAAE,CAAC,CAAC;QAC9C,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,SAAS,EAAE;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,8BAA8B;YACpC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;SAC5B;KACF,CAAC,CACH,CACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/release-age.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-age.d.ts","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAmBA,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,MAAW,CAAA;AAEjD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,UAAU,KAAG,MAAM,GAAG,SAGW,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,UAAU,KAAG,OAGpD,CAAA"}
+{"version":3,"file":"release-age.d.ts","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAIA,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,EAAE,MAAW,CAAA;AAEjD,wFAAwF;AACxF,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,sDAAsD;IACtD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,GAAI,KAAK,UAAU,KAAG,MAAM,GAAG,SAGW,CAAA;AAErE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,KAAK,UAAU,KAAG,OAGpD,CAAA"}

package/dist/release-age.js

@@ -1,19 +1,4 @@
-// Whether a published release is old enough to be installed at all.
-//
-// pnpm refuses a release younger than a minimum age. That guards against a compromised publish: a
-// malicious version is usually pulled within hours of being noticed, so the wait costs a day and buys
-// the window in which the registry corrects itself. The freshness report has to know about it, because
-// an update named without it sends a reader to an install pnpm will refuse, and the reader then either
-// waits without knowing why or spends the guard on an exclusion to get past it.
-//
-// The floor is pnpm's rather than ploaness's, and pnpm neither documents the default nor answers
-// `pnpm config get minimumReleaseAge` for it. The value below was established by observation - refused
-// at 13h and again at 23h58m, taken at 33h and at six days - so it is stated as a named constant a
-// reader can check and a maintainer can correct, rather than buried inside a comparison.
-//
-// Held is a third thing the report can say, not a fourth verdict the gate can reach. Nothing here
-// fails a build: a release too young to install is a fact about the registry, never a defect in the
-// project reading it.
+// Classify whether a published release satisfies the install-age floor.
 const MILLISECONDS_PER_HOUR = 3_600_000;
 /** Hours a published release must have existed before pnpm will install it. */
 export const RELEASE_AGE_FLOOR_HOURS = 24;

package/dist/release-age.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,gFAAgF;AAChF,EAAE;AACF,iGAAiG;AACjG,uGAAuG;AACvG,mGAAmG;AACnG,yFAAyF;AACzF,EAAE;AACF,kGAAkG;AAClG,oGAAoG;AACpG,sBAAsB;AAEtB,MAAM,qBAAqB,GAAW,SAAS,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAA;AAUjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAsB,EAAE,CACpE,GAAG,CAAC,WAAW,KAAK,SAAS;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAe,EAAW,EAAE;IAC7D,MAAM,KAAK,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,CAAA;AAC/D,CAAC,CAAA"}
+{"version":3,"file":"release-age.js","sourceRoot":"","sources":["../src/release-age.ts"],"names":[],"mappings":"AAAA,wEAAwE;AAExE,MAAM,qBAAqB,GAAW,SAAS,CAAA;AAE/C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAA;AAUjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,GAAe,EAAsB,EAAE,CACpE,GAAG,CAAC,WAAW,KAAK,SAAS;IAC3B,CAAC,CAAC,SAAS;IACX,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,qBAAqB,CAAC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAe,EAAW,EAAE;IAC7D,MAAM,KAAK,GAAuB,cAAc,CAAC,GAAG,CAAC,CAAA;IACrD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,uBAAuB,CAAA;AAC/D,CAAC,CAAA"}

package/dist/request-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-limits.d.ts","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAYA;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAe,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAgB,CAAA;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAU,IAAI,EAAE,MAAM,EACnD,OAAO,SAAS,IAAI,EAAE,EACtB,OAAO,MAAM,EACb,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,KACpC,OAAO,CAAC,SAAS,MAAM,EAAE,CAS3B,CAAA"}
+{"version":3,"file":"request-limits.d.ts","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAe,CAAA;AAEhD;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE,MAAgB,CAAA;AAExD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAU,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,GAAU,IAAI,EAAE,MAAM,EACnD,OAAO,SAAS,IAAI,EAAE,EACtB,OAAO,MAAM,EACb,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,KACpC,OAAO,CAAC,SAAS,MAAM,EAAE,CAS3B,CAAA"}

package/dist/request-limits.js

@@ -1,14 +1,4 @@
-// The bounds the harness places on its OWN outbound work, and the one combinator that applies them.
-//
-// This is the first async module among the rules, and it is here rather than in the CLI for the reason
-// the split states: what it decides is a policy - how long the harness waits, and how many sockets it
-// will hold open at once - and a policy expressed as a pure function can be asserted against, while the
-// same policy expressed inline in a fetch call can only be observed by hanging. Nothing here performs
-// I/O; the work is supplied by the caller, which is where the I/O stays.
-//
-// The bound that was missing cost more than the bound that was wrong. An unbounded fetch produces no
-// output and no verdict, so on a team's CI a stuck gate is indistinguishable from a stuck build - and
-// unlike a gate failure, nothing says which it is, because nothing ends.
+// Bound the harness outbound work so registry checks finish without unbounded concurrency.
 /**
  * How long any single request to a package or image registry may take.
  *

package/dist/request-limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-limits.js","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,EAAE;AACF,uGAAuG;AACvG,sGAAsG;AACtG,wGAAwG;AACxG,sGAAsG;AACtG,yEAAyE;AACzE,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,yEAAyE;AAEzE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,MAAM,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,OAAO,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAsB,EACtB,KAAa,EACb,IAAqC,EACT,EAAE;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAsB,MAAM,OAAO,CAAC,GAAG,CACnD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAU,EAAmB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CACnF,CAAA;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA"}
+{"version":3,"file":"request-limits.js","sourceRoot":"","sources":["../src/request-limits.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,MAAM,CAAA;AAEhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,OAAO,CAAA;AAExD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAA;AAE7C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,KAAsB,EACtB,KAAa,EACb,IAAqC,EACT,EAAE;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,KAAK,GAAW,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;IACxC,MAAM,QAAQ,GAAsB,MAAM,OAAO,CAAC,GAAG,CACnD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAU,EAAmB,EAAE,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CACnF,CAAA;IACD,OAAO,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,MAAM,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA"}

package/dist/route-coverage.d.ts

@@ -0,0 +1,27 @@
+import { type SpecSource } from './axe-coverage.js';
+import { type DeclaredRoute } from './route-map.js';
+/** Everything the coverage question is answered from. */
+export interface RouteSweep {
+    readonly declaredRoutes: readonly DeclaredRoute[];
+    /** The addresses the crawl reached AND scanned. */
+    readonly visitedRoutes: readonly string[];
+    /** The addresses that answered, including those that forwarded off the public surface. */
+    readonly answeredRoutes: readonly string[];
+    readonly skippedPrefixes: readonly string[];
+    readonly specs: readonly SpecSource[];
+    readonly everyFile: readonly SpecSource[];
+}
+/** A declared page nothing looked at. */
+export interface UnsweptRoute {
+    readonly file: string;
+    readonly route: string;
+    readonly rule: string;
+    readonly reason: string;
+}
+/**
+ * The declared pages the sweep did not cover and nothing else scans.
+ * @param sweep what the crawl reached, what the project declares, and where a scan would be written.
+ * @returns one violation per page nothing looked at, in the order the routes were declared.
+ */
+export declare const findUnsweptRoutes: (sweep: RouteSweep) => readonly UnsweptRoute[];
+//# sourceMappingURL=route-coverage.d.ts.map

package/dist/route-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-coverage.d.ts","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiD,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAAE,KAAK,aAAa,EAAgC,MAAM,gBAAgB,CAAA;AAqBjF,yDAAyD;AACzD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,cAAc,EAAE,SAAS,aAAa,EAAE,CAAA;IACjD,mDAAmD;IACnD,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAA;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,UAAU,EAAE,CAAA;CAC1C;AAED,yCAAyC;AACzC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AA4DD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,UAAU,KAAG,SAAS,YAAY,EAMvE,CAAA"}

package/dist/route-coverage.js

@@ -0,0 +1,57 @@
+import { containsBuiltRoute, containsRoute, reachesAxe } from './axe-coverage.js';
+import { matchesRoute, staticPrefixOf } from './route-map.js';
+const REMEDIES = 'link it from a page the crawl reaches, scan it in a specification of your own with axe, or ' +
+    'declare it in `ploaness.accessibilitySkipRoutes` with the reason it is out of scope';
+// The same plain prefix test the crawl itself applies in `toRoute`, deliberately. A stricter one -
+// requiring the prefix to end on a segment boundary - would report a route the crawl was told to skip
+// and did skip, which is a finding about the harness disagreeing with itself.
+const isSkipped = (route, prefixes) => prefixes.some((prefix) => route.startsWith(prefix));
+// A page the crawl asked for, that answered, and that forwarded somewhere outside the public surface.
+// There is nothing at that address for axe to judge - what renders is wherever it forwarded to, which
+// has a declaration of its own - so a redirect is covered rather than unswept.
+const isRedirect = (sweep, route) => sweep.answeredRoutes.some((answered) => matchesRoute(route.route, answered)) &&
+    !sweep.visitedRoutes.some((visited) => matchesRoute(route.route, visited));
+const isScanned = (sweep, route) => sweep.visitedRoutes.some((visited) => matchesRoute(route.route, visited));
+// What counts as a specification driving this route. A static address can be looked for as itself; a
+// dynamic one cannot, because a spec never contains `/posts/[slug]` - it contains `/posts/` and then a
+// value it computed. See `containsBuiltRoute` for why the prefix alone is not enough.
+const isDrivenBy = (spec, route) => route.isDynamic
+    ? containsBuiltRoute(spec.source, staticPrefixOf(route.route))
+    : containsRoute(spec.source, route.route);
+const unsweptRoute = (sweep, route) => {
+    const driving = sweep.specs.filter((spec) => isDrivenBy(spec, route));
+    if (driving.length === 0) {
+        return [
+            {
+                file: route.file,
+                route: route.route,
+                rule: 'route-unswept',
+                reason: `the accessibility sweep never reached "${route.route}", and no specification drives it ` +
+                    `either, so this page has no accessibility coverage at all: ${REMEDIES}`,
+            },
+        ];
+    }
+    return driving.some((spec) => reachesAxe(spec, sweep.everyFile))
+        ? []
+        : [
+            {
+                file: route.file,
+                route: route.route,
+                rule: 'route-unscanned',
+                reason: `the accessibility sweep never reached "${route.route}". A specification drives it but ` +
+                    `nothing scans it with axe, so this page has no accessibility coverage: ${REMEDIES}`,
+            },
+        ];
+};
+/**
+ * The declared pages the sweep did not cover and nothing else scans.
+ * @param sweep what the crawl reached, what the project declares, and where a scan would be written.
+ * @returns one violation per page nothing looked at, in the order the routes were declared.
+ */
+export const findUnsweptRoutes = (sweep) => sweep.declaredRoutes.flatMap((route) => {
+    if (isSkipped(route.route, sweep.skippedPrefixes) || isScanned(sweep, route)) {
+        return [];
+    }
+    return isRedirect(sweep, route) ? [] : unsweptRoute(sweep, route);
+});
+//# sourceMappingURL=route-coverage.js.map

package/dist/route-coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"route-coverage.js","sourceRoot":"","sources":["../src/route-coverage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAmB,MAAM,mBAAmB,CAAA;AAClG,OAAO,EAAsB,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAyCjF,MAAM,QAAQ,GACZ,6FAA6F;IAC7F,qFAAqF,CAAA;AAEvF,mGAAmG;AACnG,sGAAsG;AACtG,8EAA8E;AAC9E,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,QAA2B,EAAW,EAAE,CACxE,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAc,EAAW,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAA;AAEtE,sGAAsG;AACtG,sGAAsG;AACtG,+EAA+E;AAC/E,MAAM,UAAU,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACtE,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAgB,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7F,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE7F,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAA;AAE5F,qGAAqG;AACrG,uGAAuG;AACvG,sFAAsF;AACtF,MAAM,UAAU,GAAG,CAAC,IAAgB,EAAE,KAAoB,EAAW,EAAE,CACrE,KAAK,CAAC,SAAS;IACb,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;AAE7C,MAAM,YAAY,GAAG,CAAC,KAAiB,EAAE,KAAoB,EAAkB,EAAE;IAC/E,MAAM,OAAO,GAA0B,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CACtF,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CACxB,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,eAAe;gBACrB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,oCAAoC;oBACzF,8DAA8D,QAAQ,EAAE;aAC3E;SACF,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnF,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EACJ,0CAA0C,KAAK,CAAC,KAAK,mCAAmC;oBACxF,0EAA0E,QAAQ,EAAE;aACvF;SACF,CAAA;AACP,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAiB,EAA2B,EAAE,CAC9E,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,KAAoB,EAAkB,EAAE;IACpE,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AACnE,CAAC,CAAC,CAAA"}