@ploaness/governance 1.0.0 → 1.2.0

package/dist/payload-access.d.ts

@@ -2,8 +2,14 @@ import { type PayloadViolation } from './payload-source.js';
 export declare const findUndeclaredAccess: (source: string) => readonly PayloadViolation[];
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
 export declare const findUnhardenedAuth: (source: string) => readonly PayloadViolation[];
+/** Report an auth collection that leaves who may clear a lockout to Payload's default. */
+export declare const findUnlockableAuth: (source: string) => readonly PayloadViolation[];
 /** Report a config whose drafts are readable by an unauthenticated client. */
 export declare const findAnonymousDraftReads: (source: string) => readonly PayloadViolation[];
+/** Report a config that keeps versions and leaves who may read them to Payload's fall-through. */
+export declare const findUndeclaredVersionReads: (source: string) => readonly PayloadViolation[];
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
 export declare const findUnrestrictedUploads: (source: string) => readonly PayloadViolation[];
+/** Report an upload collection that admits SVG, or may, without deciding the headers it is served with. */
+export declare const findUndecidedSvgHeaders: (source: string) => readonly PayloadViolation[];
 //# sourceMappingURL=payload-access.d.ts.map

package/dist/payload-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AA4E5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAkB3E,CAAA;AAkCJ,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG1E,CAAA;AA2CH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAa/E,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG/E,CAAA"}
+{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAsB5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAqB5E,CAAA;AA8CH,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AA6BH,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AAgDH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA;AAiBH,kGAAkG;AAClG,eAAO,MAAM,0BAA0B,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAkBlF,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA;AAsIH,2GAA2G;AAC3G,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA"}

package/dist/payload-access.js

@@ -5,49 +5,14 @@
 // question the others do not ask - "which object literal IS this config" - and because together the two
 // halves passed the file size cap. Every one of them is a security decision that Payload will silently
 // make on the project's behalf if the project does not make it first.
+import { payloadConfigsIn, } from './payload-configs.js';
 import { configBody, depthOneBlockKeys, depthOneValue, } from './payload-source.js';
-import { lineOf, NOT_FOUND, topLevelKeys } from './source-text.js';
-// The three ways a Payload config is declared, all of them idiomatic:
-//
-//   const Users: CollectionConfig = { ... }          the annotation
-//   const Users: CollectionConfig<'users'> = { ... } the annotation, with the slug as a type argument
-//   const Users = { ... } satisfies CollectionConfig the inferred form
-//
-// Only the first was matched for a long time, because the lookahead that stopped `CollectionConfigs`
-// from matching also excluded `<`, and nothing looked for `satisfies` at all. A collection written
-// either of the other two ways passed every rule below without one of them ever reading it - which is
-// the worst failure a gate can have, because it is indistinguishable from a pass.
-const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
-/** The operations a collection must decide for itself rather than inherit. */
-const COLLECTION_OPERATIONS = ['create', 'read', 'update', 'delete'];
-/** A global has no create or delete: it exists from the moment it is configured. */
-const GLOBAL_OPERATIONS = ['read', 'update'];
-const CONFIG_KINDS = [
-    {
-        label: 'CollectionConfig',
-        declaration: declarationPattern('CollectionConfig'),
-        operations: COLLECTION_OPERATIONS,
-    },
-    {
-        label: 'GlobalConfig',
-        declaration: declarationPattern('GlobalConfig'),
-        operations: GLOBAL_OPERATIONS,
-    },
-];
-const SATISFIES = 'satisfies';
-// EVERY config in the file, not the first. `search` returned one offset, so a module exporting two
-// collections - or a collection beside a global - had its second config judged by nothing at all. The
-// Local API rules already iterated their matches; these did not, and the asymmetry was invisible
-// because a file with one config, which is most of them, behaves identically either way.
-const findConfigs = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
-    const body = configBody(source, match.index, match[1] === SATISFIES);
-    return body === undefined ? [] : [{ marker: match.index, body }];
-});
-const eachConfig = (source, judge) => CONFIG_KINDS.flatMap((kind) => findConfigs(source, kind).flatMap((found) => judge(kind, found)));
+import { balancedArguments, NOT_FOUND, scanDelimited, topLevelKeys, } from './source-text.js';
+const eachConfig = (source, judge) => payloadConfigsIn(source).flatMap((found) => judge(found.kind, found));
 // Payload fills the missing operations in during sanitisation, so a partial access block is invisible
-// the moment the app boots - and its default for a non-auth collection is public read. Checking that
-// the word `access` appears somewhere in the file, which is what this rule used to do, accepted a block
-// that declared one operation out of four.
+// the moment the app boots - and its default admits every signed-in user to every operation. Checking
+// that the word `access` appears somewhere in the file, which is what this rule used to do, accepted a
+// block that declared one operation out of four.
 export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found) => {
     const declared = depthOneBlockKeys(found.body, 'access');
     const missing = kind.operations.filter((operation) => !declared.includes(operation));
@@ -55,11 +20,11 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-complete-access',
                 reason: `a ${kind.label} must declare access for ${kind.operations.join(', ')}; ` +
-                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to the Payload ` +
-                    'defaults, which allow public read',
+                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to Payload's ` +
+                    'default, which admits every signed-in user',
             },
         ];
 });
@@ -68,7 +33,11 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
 // the case this rule most needs to catch.
 const AUTH_HARDENING_KEYS = ['maxLoginAttempts', 'lockTime'];
 const COLLECTION = 'CollectionConfig';
-const unhardenedAuthIn = (source, found) => {
+const leadingNumber = (value) => {
+    const match = /^\s*(-?\d[\d_]*(?:\.\d[\d_]*)?)\s*(?=[,}])/.exec(value ?? '');
+    return match === null ? undefined : Number((match[1] ?? '').replaceAll('_', ''));
+};
+const unhardenedAuthIn = (found) => {
     const value = depthOneValue(found.body, 'auth');
     if (value === undefined) {
         return [];
@@ -77,20 +46,51 @@ const unhardenedAuthIn = (source, found) => {
         ? topLevelKeys(value, 0)
         : [];
     const missing = AUTH_HARDENING_KEYS.filter((key) => !declared.includes(key));
-    return missing.length === 0
+    const disabled = AUTH_HARDENING_KEYS.filter((key) => {
+        const numeric = leadingNumber(depthOneValue(value, key));
+        return numeric !== undefined && numeric <= 0;
+    });
+    return missing.length === 0 && disabled.length === 0
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-auth-hardening',
                 reason: `an auth collection must declare ${AUTH_HARDENING_KEYS.join(' and ')}; ` +
-                    `${missing.join(' and ')} left to the Payload defaults means a login attempt is never ` +
-                    'capped and an account is never locked',
+                    (missing.length === 0 ? '' : `${missing.join(' and ')} is missing; `) +
+                    (disabled.length === 0 ? '' : `${disabled.join(' and ')} is not positive; `) +
+                    'without a positive attempt cap and lock time, login guesses are not bounded',
             },
         ];
 };
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
-export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(source, found) : []);
+export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(found) : []);
+// The cap above, undone from inside. `unlock` is one of the operations Payload fills the access block
+// with during sanitisation, so a collection that decides create, read, update and delete has still said
+// nothing about who may clear a locked account - and the default admits every signed-in user. One
+// ordinary account can therefore lift the lockout on another as fast as the attempts accrue, which
+// leaves the attempt cap and lock time enforced by the rule above protecting nothing. Advisory
+// GHSA-jg8r-5jh2-v2xj is this default, reported against Payload itself.
+const UNLOCK_OPERATION = 'unlock';
+const unlockableAuthIn = (found) => {
+    if (depthOneValue(found.body, 'auth') === undefined) {
+        return [];
+    }
+    const declared = depthOneBlockKeys(found.body, 'access');
+    return declared.includes(UNLOCK_OPERATION)
+        ? []
+        : [
+            {
+                line: found.line,
+                rule: 'require-unlock-access',
+                reason: `an auth collection must declare access for ${UNLOCK_OPERATION}; Payload fills it with ` +
+                    'a default that admits every signed-in user, so one account can clear the lockout on ' +
+                    'another and undo the attempt cap',
+            },
+        ];
+};
+/** Report an auth collection that leaves who may clear a lockout to Payload's default. */
+export const findUnlockableAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unlockableAuthIn(found) : []);
 // A draft is unpublished content. With versions.drafts enabled, `?draft=true` serves it to whoever the
 // read rule admits - so a read that is unconditionally true publishes every draft to anyone.
 const DRAFTS_ENABLED = /drafts\s*:\s*(?:true|\{)/;
@@ -113,9 +113,14 @@ const blockEnd = (access, open) => {
 // collection itself were open to anyone.
 //
 // Only the inline form is decidable here, and the lint pass forbids that form in a config file, so a
-// conforming project writes `read: anyone` and this rule stays silent on it. What covers the conforming
-// case is the managed access-boundary sweep, which asks the running application what it grants rather
-// than reading the source. This rule reaches a config declared outside the linted directories.
+// conforming project writes `read: anyone` and this rule stays silent on it. This rule therefore
+// reaches only a config declared outside the linted directories.
+//
+// What covers the conforming case is `findUnconstrainedDraftReads` in payload-defaults.ts, which asks
+// the built configuration's own read rule what it answers a stranger and reads the constraint it hands
+// back. The anonymous sweep does NOT cover it: the sweep separates a grant carrying a query constraint
+// from one that does not, and never opens the constraint, so a read filtered by audience and not by
+// status passed it. That gap was open for as long as this comment claimed the sweep closed it.
 const isDraftExposed = (body) => {
     const versions = depthOneValue(body, 'versions');
     if (versions === undefined || !DRAFTS_ENABLED.test(versions)) {
@@ -132,19 +137,45 @@ const isDraftExposed = (body) => {
 export const findAnonymousDraftReads = (source) => eachConfig(source, (kind, found) => isDraftExposed(found.body)
     ? [
         {
-            line: lineOf(source, found.marker),
+            line: found.line,
             rule: 'no-anonymous-draft-reads',
             reason: `a ${kind.label} with drafts enabled must not grant an unconditionally true read; ` +
                 'an unauthenticated client would fetch unpublished drafts through ?draft=true',
         },
     ]
     : []);
+// The read rule, bypassed by asking a different question. A version carries the whole document, and
+// `readVersions` is the one access operation Payload never fills in - for a collection or a global - so
+// an undeclared rule is not absent but open: `executeAccess` falls through to "any signed-in user" when
+// it is handed nothing. A read narrowed to an audience by a `Where` filter therefore still hands every
+// stored version of every document to anyone signed in. This is asked wherever versions are kept rather
+// than only where drafts are, because the versions route exists either way.
+const VERSIONS_DISABLED = /^\s*false\s*(?=[,}])/;
+const READ_VERSIONS_OPERATION = 'readVersions';
+const carriesVersions = (body) => {
+    const versions = depthOneValue(body, 'versions');
+    return versions !== undefined && !VERSIONS_DISABLED.test(versions);
+};
+/** Report a config that keeps versions and leaves who may read them to Payload's fall-through. */
+export const findUndeclaredVersionReads = (source) => eachConfig(source, (kind, found) => carriesVersions(found.body) &&
+    !depthOneBlockKeys(found.body, 'access').includes(READ_VERSIONS_OPERATION)
+    ? [
+        {
+            line: found.line,
+            rule: 'require-version-read-access',
+            reason: `a ${kind.label} that keeps versions must declare access for ` +
+                `${READ_VERSIONS_OPERATION}; Payload leaves it undeclared and then admits every ` +
+                'signed-in user, so a scoped read is bypassed by asking for a version of a document ' +
+                'instead of the document',
+        },
+    ]
+    : []);
 // `mimeTypes` defaults to undefined, so an upload collection takes whatever a client sends until the
 // project says otherwise. Served from the application's own origin, an uploaded SVG is script that runs
 // as the site, which is why the restriction is required rather than advised. No size cap is asked for
 // here: Payload takes that at the config root rather than on the collection.
 const UPLOAD_RESTRICTION = 'mimeTypes';
-const unrestrictedUploadIn = (source, found) => {
+const unrestrictedUploadIn = (found) => {
     const value = depthOneValue(found.body, 'upload');
     if (value === undefined) {
         return [];
@@ -156,7 +187,7 @@ const unrestrictedUploadIn = (source, found) => {
         ? []
         : [
             {
-                line: lineOf(source, found.marker),
+                line: found.line,
                 rule: 'require-upload-restrictions',
                 reason: `an upload collection must declare ${UPLOAD_RESTRICTION}; left undeclared it accepts ` +
                     'any file, and an SVG served from this origin is script that runs as the site',
@@ -164,5 +195,105 @@ const unrestrictedUploadIn = (source, found) => {
         ];
 };
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
-export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(source, found) : []);
+export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(found) : []);
+// An upload collection that admits SVG and has not decided how the file is served.
+//
+// Payload adds `Content-Security-Policy: script-src 'none'` to an SVG file response, and refuses an SVG
+// whose text carries a script - but only on the branch where content detection found nothing and fell
+// back to the extension. An SVG that opens with an XML declaration is detected as XML, retyped as SVG,
+// and skips that check entirely. So a collection that admits SVG must decide the headers itself, through
+// `modifyResponseHeaders`, or through a `handlers` entry, which answers before the headers hook runs and
+// is therefore the same decision. Admission is read the way Payload reads it in `validateMimeType`: an
+// entry loses its first `*` and must be a prefix of the file's type, and an empty list admits everything.
+//
+// A list this reader cannot see - an imported constant, a spread, a call, a template with a
+// substitution - is treated as admitting SVG, because a rule whose silence means "safe" cannot be silent
+// where it cannot read. The repair is cheap either way: write the list inline, or declare the headers,
+// which cost an image nothing.
+const SVG_MIME_TYPE = 'image/svg+xml';
+const RESPONSE_HEADER_KEYS = ['modifyResponseHeaders', 'handlers'];
+const ARRAY_OPEN = '[';
+const EMPTY_LIST = '[]';
+// A quoted string with nothing that could be a substitution inside it; a MIME type carries no quote.
+const STRING_LITERAL = /^(['"`])([^'"`$]*)\1$/;
+// The upload block alone, cut where its own braces close. `depthOneValue` runs to the end of the
+// collection literal, so a depth-one key looked for in that slice would also be found in the NEXT
+// block: `admin: { mimeTypes: ... }` would answer for `upload`.
+const uploadBlockOf = (found) => {
+    const value = depthOneValue(found.body, 'upload');
+    if (value === undefined) {
+        return undefined;
+    }
+    const open = value.indexOf('{');
+    return value.trimStart().startsWith('{') ? value.slice(open, blockEnd(value, open)) : undefined;
+};
+const coversSvg = (entry) => SVG_MIME_TYPE.startsWith(entry.replace('*', ''));
+// The depth-zero elements of an array's inner text. `topLevelSlice` cannot serve here: the scanner
+// jumps a string literal whole, so that slice drops exactly the characters this rule reads.
+const arrayElements = (inner) => {
+    const commas = scanDelimited(inner, 0, (found, step) => step.character === ',' && step.depth === 0
+        ? { state: [...found, step.index], stop: false }
+        : { state: found, stop: false }, []);
+    const bounds = [-1, ...commas, inner.length];
+    return bounds
+        .slice(0, -1)
+        .map((start, position) => inner.slice(start + 1, bounds[position + 1] ?? inner.length).trim())
+        .filter((element) => element.length > 0);
+};
+const literalOf = (element) => STRING_LITERAL.exec(element)?.[2];
+// A provable admission outranks an unreadable neighbour, so `[...IMAGE_TYPES, 'image/svg+xml']` is
+// reported for the entry that can be named rather than for the spread that cannot.
+const svgAdmissionOf = (raw) => {
+    if (!raw.trimStart().startsWith(ARRAY_OPEN)) {
+        return { verdict: 'unreadable' };
+    }
+    const inner = balancedArguments(raw, raw.indexOf(ARRAY_OPEN));
+    if (inner === undefined) {
+        return { verdict: 'unreadable' };
+    }
+    const elements = arrayElements(inner);
+    if (elements.length === 0) {
+        return { verdict: 'admitted', entry: EMPTY_LIST };
+    }
+    const literals = elements.map((element) => literalOf(element));
+    const admitting = literals.find((literal) => literal !== undefined && coversSvg(literal));
+    if (admitting !== undefined) {
+        return { verdict: 'admitted', entry: admitting };
+    }
+    return literals.every((literal) => literal !== undefined)
+        ? { verdict: 'excluded' }
+        : { verdict: 'unreadable' };
+};
+const SVG_REPAIR = 'set Content-Disposition: attachment and Content-Security-Policy: sandbox in modifyResponseHeaders';
+const SVG_HAZARD = 'an SVG served from this origin is script that runs as the site';
+const svgReason = (admission) => {
+    const preamble = `an upload collection admitting SVG must declare ${RESPONSE_HEADER_KEYS.join(' or ')}; `;
+    if (admission.verdict === 'unreadable') {
+        return (`${preamble}mimeTypes here is not an inline list of string literals, so whether it admits ` +
+            `${SVG_MIME_TYPE} cannot be read from this file, and ${SVG_HAZARD}; write the list inline, or ${SVG_REPAIR}`);
+    }
+    const admits = admission.entry === EMPTY_LIST
+        ? `the empty mimeTypes list admits every type, ${SVG_MIME_TYPE} included`
+        : `the mimeTypes entry '${admission.entry}' admits ${SVG_MIME_TYPE}`;
+    return (`${preamble}${admits}, ${SVG_HAZARD}, and Payload's own scripted-SVG check skips a file that ` +
+        `opens with an XML declaration; ${SVG_REPAIR}, or drop the entry`);
+};
+const undecidedSvgHeadersIn = (found) => {
+    const block = uploadBlockOf(found);
+    if (block === undefined) {
+        return [];
+    }
+    const keys = topLevelKeys(block, 0);
+    // An absent list is the restriction rule's finding, so one collection never carries both.
+    if (!keys.includes(UPLOAD_RESTRICTION) ||
+        RESPONSE_HEADER_KEYS.some((key) => keys.includes(key))) {
+        return [];
+    }
+    const admission = svgAdmissionOf(depthOneValue(block, UPLOAD_RESTRICTION) ?? '');
+    return admission.verdict === 'excluded'
+        ? []
+        : [{ line: found.line, rule: 'require-svg-response-headers', reason: svgReason(admission) }];
+};
+/** Report an upload collection that admits SVG, or may, without deciding the headers it is served with. */
+export const findUndecidedSvgHeaders = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? undecidedSvgHeadersIn(found) : []);
 //# sourceMappingURL=payload-access.js.map

package/dist/payload-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AACtE,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAElE,sEAAsE;AACtE,EAAE;AACF,oEAAoE;AACpE,sGAAsG;AACtG,uEAAuE;AACvE,EAAE;AACF,qGAAqG;AACrG,mGAAmG;AACnG,sGAAsG;AACtG,kFAAkF;AAClF,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,8EAA8E;AAC9E,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAEvF,oFAAoF;AACpF,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAS/D,MAAM,YAAY,GAA0B;IAC1C;QACE,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,qBAAqB;KAClC;IACD;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAA;AAQD,MAAM,SAAS,GAAW,WAAW,CAAA;AAErC,mGAAmG;AACnG,sGAAsG;AACtG,iGAAiG;AACjG,yFAAyF;AACzF,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAgB,EAA0B,EAAE,CAC/E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAA0B,EAAE;IACjD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IACxF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAClE,CAAC,CACF,CAAA;AAEH,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA4E,EAC/C,EAAE,CAC/B,YAAY,CAAC,OAAO,CAAC,CAAC,IAAgB,EAA+B,EAAE,CACrE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAkB,EAA+B,EAAE,CACpF,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACnB,CACF,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,wGAAwG;AACxG,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE;IACvF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBACnF,mCAAmC;aACtC;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAA+B,EAAE;IAC3F,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,+DAA+D;oBACvF,uCAAuC;aAC1C;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACjE,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACP,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,KAAkB,EAA+B,EAAE;IAC/F,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;gBAClC,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CAAC,MAAM,EAAE,CAAC,IAAgB,EAAE,KAAkB,EAA+B,EAAE,CACvF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACrE,CAAA"}
+{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,iBAAiB,EAEjB,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,qBAAqB;oBACjF,4CAA4C;aAC/C;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,sGAAsG;AACtG,wGAAwG;AACxG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,wEAAwE;AACxE,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEzC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,8CAA8C,gBAAgB,0BAA0B;oBACxF,sFAAsF;oBACtF,kCAAkC;aACrC;SACF,CAAA;AACP,CAAC,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,iGAAiG;AACjG,iEAAiE;AACjE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,oGAAoG;AACpG,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,wGAAwG;AACxG,4EAA4E;AAC5E,MAAM,iBAAiB,GAAW,sBAAsB,CAAA;AAExD,MAAM,uBAAuB,GAAW,cAAc,CAAA;AAEtD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE;IAChD,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAc,EAA+B,EAAE,CACxF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3B,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxE,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,+CAA+C;gBAC9D,GAAG,uBAAuB,uDAAuD;gBACjF,qFAAqF;gBACrF,yBAAyB;SAC5B;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA;AAEH,mFAAmF;AACnF,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,yGAAyG;AACzG,yGAAyG;AACzG,uGAAuG;AACvG,0GAA0G;AAC1G,EAAE;AACF,4FAA4F;AAC5F,yGAAyG;AACzG,uGAAuG;AACvG,+BAA+B;AAC/B,MAAM,aAAa,GAAW,eAAe,CAAA;AAC7C,MAAM,oBAAoB,GAAsB,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAA;AACrF,MAAM,UAAU,GAAW,GAAG,CAAA;AAC9B,MAAM,UAAU,GAAW,IAAI,CAAA;AAC/B,qGAAqG;AACrG,MAAM,cAAc,GAAW,uBAAuB,CAAA;AAOtD,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAE9F,mGAAmG;AACnG,4FAA4F;AAC5F,MAAM,aAAa,GAAG,CAAC,KAAa,EAAqB,EAAE;IACzD,MAAM,MAAM,GAAsB,aAAa,CAC7C,KAAK,EACL,CAAC,EACD,CAAC,KAAwB,EAAE,IAAc,EAA6B,EAAE,CACtE,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QACxC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QAChD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,EAAE,CACH,CAAA;IACD,MAAM,MAAM,GAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,MAAM;SACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,GAAG,CAAC,CAAC,KAAa,EAAE,QAAgB,EAAU,EAAE,CAC/C,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CACpE;SACA,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,OAAe,EAAsB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE5F,mGAAmG;AACnG,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,GAAW,EAAgB,EAAE;IACnD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAsB,aAAa,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,QAAQ,GAAoC,QAAQ,CAAC,GAAG,CAC5D,CAAC,OAAe,EAAsB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAC5D,CAAA;IACD,MAAM,SAAS,GAAuB,QAAQ,CAAC,IAAI,CACjD,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,CACtF,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;QACpF,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;QACzB,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,UAAU,GACd,mGAAmG,CAAA;AACrG,MAAM,UAAU,GAAW,gEAAgE,CAAA;AAE3F,MAAM,SAAS,GAAG,CAAC,SAAkE,EAAU,EAAE;IAC/F,MAAM,QAAQ,GAAW,mDAAmD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACjH,IAAI,SAAS,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,CACL,GAAG,QAAQ,gFAAgF;YAC3F,GAAG,aAAa,uCAAuC,UAAU,+BAA+B,UAAU,EAAE,CAC7G,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,SAAS,CAAC,KAAK,KAAK,UAAU;QAC5B,CAAC,CAAC,+CAA+C,aAAa,WAAW;QACzE,CAAC,CAAC,wBAAwB,SAAS,CAAC,KAAK,YAAY,aAAa,EAAE,CAAA;IACxE,OAAO,CACL,GAAG,QAAQ,GAAG,MAAM,KAAK,UAAU,2DAA2D;QAC9F,kCAAkC,UAAU,qBAAqB,CAClE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACvF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,CAAA;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtD,0FAA0F;IAC1F,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACvE,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAiB,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AAChG,CAAC,CAAA;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAChE,CAAA"}

package/dist/payload-configs.d.ts

@@ -0,0 +1,23 @@
+/** The operations one Payload configuration kind must decide explicitly. */
+export interface PayloadConfigKind {
+    readonly kind: 'collection' | 'global';
+    readonly label: string;
+    readonly operations: readonly string[];
+}
+/** One Payload configuration literal, with the source position its body begins at. */
+export interface FoundPayloadConfig {
+    readonly kind: PayloadConfigKind;
+    readonly body: string;
+    readonly bodyStart: number;
+    readonly line: number;
+}
+/** One object written directly as an element of a configuration's `fields` array. */
+export interface FoundFieldLiteral {
+    readonly body: string;
+    readonly line: number;
+}
+/** Every collection and global configuration literal the source declares. */
+export declare const payloadConfigsIn: (source: string) => readonly FoundPayloadConfig[];
+/** The field literals directly visible in one collection/global config. */
+export declare const directFieldsIn: (source: string, config: FoundPayloadConfig) => readonly FoundFieldLiteral[];
+//# sourceMappingURL=payload-configs.d.ts.map

package/dist/payload-configs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA0ED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}

package/dist/payload-configs.js

@@ -0,0 +1,96 @@
+// Share the vocabulary of Payload configuration literals across source-policy checks.
+import { COLLECTION_OPERATIONS, GLOBAL_OPERATIONS } from './payload-defaults.js';
+import { configBody, depthOneValue } from './payload-source.js';
+import { balancedArguments, lineOf, NOT_FOUND, scanDelimited, } from './source-text.js';
+const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
+const CONFIG_KINDS = [
+    {
+        kind: 'collection',
+        label: 'CollectionConfig',
+        declaration: declarationPattern('CollectionConfig'),
+        operations: COLLECTION_OPERATIONS,
+    },
+    {
+        kind: 'global',
+        label: 'GlobalConfig',
+        declaration: declarationPattern('GlobalConfig'),
+        operations: GLOBAL_OPERATIONS,
+    },
+];
+const SATISFIES = 'satisfies';
+// What may stand between a leading type reference and the literal it types. Every form a config is
+// really written in puts one of four things there: `= {`, a generic argument and then `= {`, `=> ({`,
+// or the opening brace of a function body. Taking "the next brace anywhere after the type name"
+// instead crossed statement boundaries and read an unrelated literal further down the file as the
+// configuration. A call argument (`= jobsAccess({ ... })`), a parameter annotation
+// (`(config: CollectionConfig): void => { ... }`), an interface member and a type-alias member each
+// put an identifier, a `)` or a `}` in this gap, and each was judged as though it were a collection -
+// so the very code a project writes to GIVE a generated collection its access block was reported as a
+// collection with none.
+const GOVERNED_BODY = /^\s*(?:<[^;{}]*>\s*)?(?:=>?\s*(?:\(\s*)?)?\{/;
+/** The literal a leading annotation governs, or nothing when the annotation types something else. */
+const governedLiteral = (source, afterType) => {
+    const gap = GOVERNED_BODY.exec(source.slice(afterType));
+    if (gap === null) {
+        return undefined;
+    }
+    const bodyStart = afterType + gap[0].length - 1;
+    const inner = balancedArguments(source, bodyStart);
+    return inner === undefined ? undefined : { body: `{${inner}}`, bodyStart };
+};
+/** The literal a trailing `satisfies` types: the one that closed just before it. */
+const precedingLiteral = (source, marker) => {
+    const body = configBody(source, marker, true);
+    if (body === undefined) {
+        return undefined;
+    }
+    const bodyStart = source.lastIndexOf(body, marker);
+    return bodyStart === NOT_FOUND ? undefined : { body, bodyStart };
+};
+const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
+    const literal = match[1] === SATISFIES
+        ? precedingLiteral(source, match.index)
+        : governedLiteral(source, match.index + match[0].length);
+    return literal === undefined ? [] : [{ kind, ...literal, line: lineOf(source, match.index) }];
+});
+/** Every collection and global configuration literal the source declares. */
+export const payloadConfigsIn = (source) => CONFIG_KINDS.flatMap((kind) => configsOfKind(source, kind));
+const DIRECT_FIELD_DEPTH = 2;
+const closeLastSpan = (spans, close) => {
+    const last = spans.at(-1);
+    return last?.close === NOT_FOUND ? [...spans.slice(0, -1), { open: last.open, close }] : spans;
+};
+const opensDirectField = (step) => step.character === '{' && step.depth === DIRECT_FIELD_DEPTH;
+const endsDirectField = (step) => step.character === '}' && step.depth === 1;
+const endsFieldArray = (step) => step.character === ']' && step.depth === 0;
+const afterFieldDelimiter = (spans, step) => {
+    if (opensDirectField(step)) {
+        return { state: [...spans, { open: step.index, close: NOT_FOUND }], stop: false };
+    }
+    if (endsDirectField(step)) {
+        return { state: closeLastSpan(spans, step.index), stop: false };
+    }
+    return { state: spans, stop: endsFieldArray(step) };
+};
+// Starting on the array opener puts its direct object elements at depth two. A nested object opens at
+// depth three or more and is part of the field rather than another field beside it.
+const directObjectSpans = (source, open) => scanDelimited(source, open, afterFieldDelimiter, []);
+/** The field literals directly visible in one collection/global config. */
+export const directFieldsIn = (source, config) => {
+    const fields = depthOneValue(config.body, 'fields');
+    if (fields === undefined) {
+        return [];
+    }
+    const open = fields.indexOf('[');
+    if (open === NOT_FOUND) {
+        return [];
+    }
+    const fieldsStart = config.bodyStart + config.body.length - fields.length;
+    return directObjectSpans(fields, open).flatMap((span) => {
+        const body = balancedArguments(fields, span.open);
+        return body === undefined
+            ? []
+            : [{ body: `{${body}}`, line: lineOf(source, fieldsStart + span.open) }];
+    });
+};
+//# sourceMappingURL=payload-configs.js.map

package/dist/payload-configs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAuBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,qBAAqB;KAClC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAQrC,mGAAmG;AACnG,sGAAsG;AACtG,gGAAgG;AAChG,kGAAkG;AAClG,mFAAmF;AACnF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,wBAAwB;AACxB,MAAM,aAAa,GAAW,8CAA8C,CAAA;AAE5E,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAA6B,EAAE;IACvF,MAAM,GAAG,GAA2B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACvD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,GAAG,EAAE,SAAS,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,MAAc,EAA6B,EAAE;IACrF,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1D,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,OAAO,GACX,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC/F,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}