@ploaness/governance 1.1.0 → 1.2.0

package/dist/payload-access.js

@@ -7,12 +7,12 @@
 // make on the project's behalf if the project does not make it first.
 import { payloadConfigsIn, } from './payload-configs.js';
 import { configBody, depthOneBlockKeys, depthOneValue, } from './payload-source.js';
-import { NOT_FOUND, topLevelKeys } from './source-text.js';
+import { balancedArguments, NOT_FOUND, scanDelimited, topLevelKeys, } from './source-text.js';
 const eachConfig = (source, judge) => payloadConfigsIn(source).flatMap((found) => judge(found.kind, found));
 // Payload fills the missing operations in during sanitisation, so a partial access block is invisible
-// the moment the app boots - and its default for a non-auth collection is public read. Checking that
-// the word `access` appears somewhere in the file, which is what this rule used to do, accepted a block
-// that declared one operation out of four.
+// the moment the app boots - and its default admits every signed-in user to every operation. Checking
+// that the word `access` appears somewhere in the file, which is what this rule used to do, accepted a
+// block that declared one operation out of four.
 export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found) => {
     const declared = depthOneBlockKeys(found.body, 'access');
     const missing = kind.operations.filter((operation) => !declared.includes(operation));
@@ -23,8 +23,8 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
                 line: found.line,
                 rule: 'require-complete-access',
                 reason: `a ${kind.label} must declare access for ${kind.operations.join(', ')}; ` +
-                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to the Payload ` +
-                    'defaults, which allow public read',
+                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to Payload's ` +
+                    'default, which admits every signed-in user',
             },
         ];
 });
@@ -65,6 +65,32 @@ const unhardenedAuthIn = (found) => {
 };
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
 export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(found) : []);
+// The cap above, undone from inside. `unlock` is one of the operations Payload fills the access block
+// with during sanitisation, so a collection that decides create, read, update and delete has still said
+// nothing about who may clear a locked account - and the default admits every signed-in user. One
+// ordinary account can therefore lift the lockout on another as fast as the attempts accrue, which
+// leaves the attempt cap and lock time enforced by the rule above protecting nothing. Advisory
+// GHSA-jg8r-5jh2-v2xj is this default, reported against Payload itself.
+const UNLOCK_OPERATION = 'unlock';
+const unlockableAuthIn = (found) => {
+    if (depthOneValue(found.body, 'auth') === undefined) {
+        return [];
+    }
+    const declared = depthOneBlockKeys(found.body, 'access');
+    return declared.includes(UNLOCK_OPERATION)
+        ? []
+        : [
+            {
+                line: found.line,
+                rule: 'require-unlock-access',
+                reason: `an auth collection must declare access for ${UNLOCK_OPERATION}; Payload fills it with ` +
+                    'a default that admits every signed-in user, so one account can clear the lockout on ' +
+                    'another and undo the attempt cap',
+            },
+        ];
+};
+/** Report an auth collection that leaves who may clear a lockout to Payload's default. */
+export const findUnlockableAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unlockableAuthIn(found) : []);
 // A draft is unpublished content. With versions.drafts enabled, `?draft=true` serves it to whoever the
 // read rule admits - so a read that is unconditionally true publishes every draft to anyone.
 const DRAFTS_ENABLED = /drafts\s*:\s*(?:true|\{)/;
@@ -87,9 +113,14 @@ const blockEnd = (access, open) => {
 // collection itself were open to anyone.
 //
 // Only the inline form is decidable here, and the lint pass forbids that form in a config file, so a
-// conforming project writes `read: anyone` and this rule stays silent on it. What covers the conforming
-// case is the managed access-boundary sweep, which asks the running application what it grants rather
-// than reading the source. This rule reaches a config declared outside the linted directories.
+// conforming project writes `read: anyone` and this rule stays silent on it. This rule therefore
+// reaches only a config declared outside the linted directories.
+//
+// What covers the conforming case is `findUnconstrainedDraftReads` in payload-defaults.ts, which asks
+// the built configuration's own read rule what it answers a stranger and reads the constraint it hands
+// back. The anonymous sweep does NOT cover it: the sweep separates a grant carrying a query constraint
+// from one that does not, and never opens the constraint, so a read filtered by audience and not by
+// status passed it. That gap was open for as long as this comment claimed the sweep closed it.
 const isDraftExposed = (body) => {
     const versions = depthOneValue(body, 'versions');
     if (versions === undefined || !DRAFTS_ENABLED.test(versions)) {
@@ -113,6 +144,32 @@ export const findAnonymousDraftReads = (source) => eachConfig(source, (kind, fou
         },
     ]
     : []);
+// The read rule, bypassed by asking a different question. A version carries the whole document, and
+// `readVersions` is the one access operation Payload never fills in - for a collection or a global - so
+// an undeclared rule is not absent but open: `executeAccess` falls through to "any signed-in user" when
+// it is handed nothing. A read narrowed to an audience by a `Where` filter therefore still hands every
+// stored version of every document to anyone signed in. This is asked wherever versions are kept rather
+// than only where drafts are, because the versions route exists either way.
+const VERSIONS_DISABLED = /^\s*false\s*(?=[,}])/;
+const READ_VERSIONS_OPERATION = 'readVersions';
+const carriesVersions = (body) => {
+    const versions = depthOneValue(body, 'versions');
+    return versions !== undefined && !VERSIONS_DISABLED.test(versions);
+};
+/** Report a config that keeps versions and leaves who may read them to Payload's fall-through. */
+export const findUndeclaredVersionReads = (source) => eachConfig(source, (kind, found) => carriesVersions(found.body) &&
+    !depthOneBlockKeys(found.body, 'access').includes(READ_VERSIONS_OPERATION)
+    ? [
+        {
+            line: found.line,
+            rule: 'require-version-read-access',
+            reason: `a ${kind.label} that keeps versions must declare access for ` +
+                `${READ_VERSIONS_OPERATION}; Payload leaves it undeclared and then admits every ` +
+                'signed-in user, so a scoped read is bypassed by asking for a version of a document ' +
+                'instead of the document',
+        },
+    ]
+    : []);
 // `mimeTypes` defaults to undefined, so an upload collection takes whatever a client sends until the
 // project says otherwise. Served from the application's own origin, an uploaded SVG is script that runs
 // as the site, which is why the restriction is required rather than advised. No size cap is asked for
@@ -139,4 +196,104 @@ const unrestrictedUploadIn = (found) => {
 };
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
 export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(found) : []);
+// An upload collection that admits SVG and has not decided how the file is served.
+//
+// Payload adds `Content-Security-Policy: script-src 'none'` to an SVG file response, and refuses an SVG
+// whose text carries a script - but only on the branch where content detection found nothing and fell
+// back to the extension. An SVG that opens with an XML declaration is detected as XML, retyped as SVG,
+// and skips that check entirely. So a collection that admits SVG must decide the headers itself, through
+// `modifyResponseHeaders`, or through a `handlers` entry, which answers before the headers hook runs and
+// is therefore the same decision. Admission is read the way Payload reads it in `validateMimeType`: an
+// entry loses its first `*` and must be a prefix of the file's type, and an empty list admits everything.
+//
+// A list this reader cannot see - an imported constant, a spread, a call, a template with a
+// substitution - is treated as admitting SVG, because a rule whose silence means "safe" cannot be silent
+// where it cannot read. The repair is cheap either way: write the list inline, or declare the headers,
+// which cost an image nothing.
+const SVG_MIME_TYPE = 'image/svg+xml';
+const RESPONSE_HEADER_KEYS = ['modifyResponseHeaders', 'handlers'];
+const ARRAY_OPEN = '[';
+const EMPTY_LIST = '[]';
+// A quoted string with nothing that could be a substitution inside it; a MIME type carries no quote.
+const STRING_LITERAL = /^(['"`])([^'"`$]*)\1$/;
+// The upload block alone, cut where its own braces close. `depthOneValue` runs to the end of the
+// collection literal, so a depth-one key looked for in that slice would also be found in the NEXT
+// block: `admin: { mimeTypes: ... }` would answer for `upload`.
+const uploadBlockOf = (found) => {
+    const value = depthOneValue(found.body, 'upload');
+    if (value === undefined) {
+        return undefined;
+    }
+    const open = value.indexOf('{');
+    return value.trimStart().startsWith('{') ? value.slice(open, blockEnd(value, open)) : undefined;
+};
+const coversSvg = (entry) => SVG_MIME_TYPE.startsWith(entry.replace('*', ''));
+// The depth-zero elements of an array's inner text. `topLevelSlice` cannot serve here: the scanner
+// jumps a string literal whole, so that slice drops exactly the characters this rule reads.
+const arrayElements = (inner) => {
+    const commas = scanDelimited(inner, 0, (found, step) => step.character === ',' && step.depth === 0
+        ? { state: [...found, step.index], stop: false }
+        : { state: found, stop: false }, []);
+    const bounds = [-1, ...commas, inner.length];
+    return bounds
+        .slice(0, -1)
+        .map((start, position) => inner.slice(start + 1, bounds[position + 1] ?? inner.length).trim())
+        .filter((element) => element.length > 0);
+};
+const literalOf = (element) => STRING_LITERAL.exec(element)?.[2];
+// A provable admission outranks an unreadable neighbour, so `[...IMAGE_TYPES, 'image/svg+xml']` is
+// reported for the entry that can be named rather than for the spread that cannot.
+const svgAdmissionOf = (raw) => {
+    if (!raw.trimStart().startsWith(ARRAY_OPEN)) {
+        return { verdict: 'unreadable' };
+    }
+    const inner = balancedArguments(raw, raw.indexOf(ARRAY_OPEN));
+    if (inner === undefined) {
+        return { verdict: 'unreadable' };
+    }
+    const elements = arrayElements(inner);
+    if (elements.length === 0) {
+        return { verdict: 'admitted', entry: EMPTY_LIST };
+    }
+    const literals = elements.map((element) => literalOf(element));
+    const admitting = literals.find((literal) => literal !== undefined && coversSvg(literal));
+    if (admitting !== undefined) {
+        return { verdict: 'admitted', entry: admitting };
+    }
+    return literals.every((literal) => literal !== undefined)
+        ? { verdict: 'excluded' }
+        : { verdict: 'unreadable' };
+};
+const SVG_REPAIR = 'set Content-Disposition: attachment and Content-Security-Policy: sandbox in modifyResponseHeaders';
+const SVG_HAZARD = 'an SVG served from this origin is script that runs as the site';
+const svgReason = (admission) => {
+    const preamble = `an upload collection admitting SVG must declare ${RESPONSE_HEADER_KEYS.join(' or ')}; `;
+    if (admission.verdict === 'unreadable') {
+        return (`${preamble}mimeTypes here is not an inline list of string literals, so whether it admits ` +
+            `${SVG_MIME_TYPE} cannot be read from this file, and ${SVG_HAZARD}; write the list inline, or ${SVG_REPAIR}`);
+    }
+    const admits = admission.entry === EMPTY_LIST
+        ? `the empty mimeTypes list admits every type, ${SVG_MIME_TYPE} included`
+        : `the mimeTypes entry '${admission.entry}' admits ${SVG_MIME_TYPE}`;
+    return (`${preamble}${admits}, ${SVG_HAZARD}, and Payload's own scripted-SVG check skips a file that ` +
+        `opens with an XML declaration; ${SVG_REPAIR}, or drop the entry`);
+};
+const undecidedSvgHeadersIn = (found) => {
+    const block = uploadBlockOf(found);
+    if (block === undefined) {
+        return [];
+    }
+    const keys = topLevelKeys(block, 0);
+    // An absent list is the restriction rule's finding, so one collection never carries both.
+    if (!keys.includes(UPLOAD_RESTRICTION) ||
+        RESPONSE_HEADER_KEYS.some((key) => keys.includes(key))) {
+        return [];
+    }
+    const admission = svgAdmissionOf(depthOneValue(block, UPLOAD_RESTRICTION) ?? '');
+    return admission.verdict === 'excluded'
+        ? []
+        : [{ line: found.line, rule: 'require-svg-response-headers', reason: svgReason(admission) }];
+};
+/** Report an upload collection that admits SVG, or may, without deciding the headers it is served with. */
+export const findUndecidedSvgHeaders = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? undecidedSvgHeadersIn(found) : []);
 //# sourceMappingURL=payload-access.js.map

package/dist/payload-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,wGAAwG;AACxG,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBACnF,mCAAmC;aACtC;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA"}
+{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,iBAAiB,EAEjB,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,qBAAqB;oBACjF,4CAA4C;aAC/C;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,sGAAsG;AACtG,wGAAwG;AACxG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,wEAAwE;AACxE,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEzC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,8CAA8C,gBAAgB,0BAA0B;oBACxF,sFAAsF;oBACtF,kCAAkC;aACrC;SACF,CAAA;AACP,CAAC,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,iGAAiG;AACjG,iEAAiE;AACjE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,oGAAoG;AACpG,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,wGAAwG;AACxG,4EAA4E;AAC5E,MAAM,iBAAiB,GAAW,sBAAsB,CAAA;AAExD,MAAM,uBAAuB,GAAW,cAAc,CAAA;AAEtD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE;IAChD,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAc,EAA+B,EAAE,CACxF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3B,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxE,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,+CAA+C;gBAC9D,GAAG,uBAAuB,uDAAuD;gBACjF,qFAAqF;gBACrF,yBAAyB;SAC5B;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA;AAEH,mFAAmF;AACnF,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,yGAAyG;AACzG,yGAAyG;AACzG,uGAAuG;AACvG,0GAA0G;AAC1G,EAAE;AACF,4FAA4F;AAC5F,yGAAyG;AACzG,uGAAuG;AACvG,+BAA+B;AAC/B,MAAM,aAAa,GAAW,eAAe,CAAA;AAC7C,MAAM,oBAAoB,GAAsB,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAA;AACrF,MAAM,UAAU,GAAW,GAAG,CAAA;AAC9B,MAAM,UAAU,GAAW,IAAI,CAAA;AAC/B,qGAAqG;AACrG,MAAM,cAAc,GAAW,uBAAuB,CAAA;AAOtD,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAE9F,mGAAmG;AACnG,4FAA4F;AAC5F,MAAM,aAAa,GAAG,CAAC,KAAa,EAAqB,EAAE;IACzD,MAAM,MAAM,GAAsB,aAAa,CAC7C,KAAK,EACL,CAAC,EACD,CAAC,KAAwB,EAAE,IAAc,EAA6B,EAAE,CACtE,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QACxC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QAChD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,EAAE,CACH,CAAA;IACD,MAAM,MAAM,GAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,MAAM;SACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,GAAG,CAAC,CAAC,KAAa,EAAE,QAAgB,EAAU,EAAE,CAC/C,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CACpE;SACA,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,OAAe,EAAsB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE5F,mGAAmG;AACnG,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,GAAW,EAAgB,EAAE;IACnD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAsB,aAAa,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,QAAQ,GAAoC,QAAQ,CAAC,GAAG,CAC5D,CAAC,OAAe,EAAsB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAC5D,CAAA;IACD,MAAM,SAAS,GAAuB,QAAQ,CAAC,IAAI,CACjD,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,CACtF,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;QACpF,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;QACzB,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,UAAU,GACd,mGAAmG,CAAA;AACrG,MAAM,UAAU,GAAW,gEAAgE,CAAA;AAE3F,MAAM,SAAS,GAAG,CAAC,SAAkE,EAAU,EAAE;IAC/F,MAAM,QAAQ,GAAW,mDAAmD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACjH,IAAI,SAAS,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,CACL,GAAG,QAAQ,gFAAgF;YAC3F,GAAG,aAAa,uCAAuC,UAAU,+BAA+B,UAAU,EAAE,CAC7G,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,SAAS,CAAC,KAAK,KAAK,UAAU;QAC5B,CAAC,CAAC,+CAA+C,aAAa,WAAW;QACzE,CAAC,CAAC,wBAAwB,SAAS,CAAC,KAAK,YAAY,aAAa,EAAE,CAAA;IACxE,OAAO,CACL,GAAG,QAAQ,GAAG,MAAM,KAAK,UAAU,2DAA2D;QAC9F,kCAAkC,UAAU,qBAAqB,CAClE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACvF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,CAAA;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtD,0FAA0F;IAC1F,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACvE,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAiB,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AAChG,CAAC,CAAA;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAChE,CAAA"}

package/dist/payload-configs.d.ts

@@ -7,7 +7,6 @@ export interface PayloadConfigKind {
 /** One Payload configuration literal, with the source position its body begins at. */
 export interface FoundPayloadConfig {
     readonly kind: PayloadConfigKind;
-    readonly marker: number;
     readonly body: string;
     readonly bodyStart: number;
     readonly line: number;

package/dist/payload-configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAgBA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA2CD,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}
+{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA0ED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}

package/dist/payload-configs.js

@@ -1,9 +1,5 @@
-// The shared catalogue of Payload configuration literals.
-//
-// Access policy and field policy ask different questions of the same object: whether a collection or
-// global has declared its operation boundary, and whether a privilege-bearing field has declared its
-// own. The declaration forms must therefore have one owner. A second regex beside the access rule was
-// how generic annotations and `satisfies` configurations previously escaped every Payload check.
+// Share the vocabulary of Payload configuration literals across source-policy checks.
+import { COLLECTION_OPERATIONS, GLOBAL_OPERATIONS } from './payload-defaults.js';
 import { configBody, depthOneValue } from './payload-source.js';
 import { balancedArguments, lineOf, NOT_FOUND, scanDelimited, } from './source-text.js';
 const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
@@ -12,27 +8,50 @@ const CONFIG_KINDS = [
         kind: 'collection',
         label: 'CollectionConfig',
         declaration: declarationPattern('CollectionConfig'),
-        operations: ['create', 'read', 'update', 'delete'],
+        operations: COLLECTION_OPERATIONS,
     },
     {
         kind: 'global',
         label: 'GlobalConfig',
         declaration: declarationPattern('GlobalConfig'),
-        operations: ['read', 'update'],
+        operations: GLOBAL_OPERATIONS,
     },
 ];
 const SATISFIES = 'satisfies';
-const bodyStartOf = (source, body, marker, isTrailing) => isTrailing ? source.lastIndexOf(body, marker) : source.indexOf(body, marker);
-const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
-    const isTrailing = match[1] === SATISFIES;
-    const body = configBody(source, match.index, isTrailing);
+// What may stand between a leading type reference and the literal it types. Every form a config is
+// really written in puts one of four things there: `= {`, a generic argument and then `= {`, `=> ({`,
+// or the opening brace of a function body. Taking "the next brace anywhere after the type name"
+// instead crossed statement boundaries and read an unrelated literal further down the file as the
+// configuration. A call argument (`= jobsAccess({ ... })`), a parameter annotation
+// (`(config: CollectionConfig): void => { ... }`), an interface member and a type-alias member each
+// put an identifier, a `)` or a `}` in this gap, and each was judged as though it were a collection -
+// so the very code a project writes to GIVE a generated collection its access block was reported as a
+// collection with none.
+const GOVERNED_BODY = /^\s*(?:<[^;{}]*>\s*)?(?:=>?\s*(?:\(\s*)?)?\{/;
+/** The literal a leading annotation governs, or nothing when the annotation types something else. */
+const governedLiteral = (source, afterType) => {
+    const gap = GOVERNED_BODY.exec(source.slice(afterType));
+    if (gap === null) {
+        return undefined;
+    }
+    const bodyStart = afterType + gap[0].length - 1;
+    const inner = balancedArguments(source, bodyStart);
+    return inner === undefined ? undefined : { body: `{${inner}}`, bodyStart };
+};
+/** The literal a trailing `satisfies` types: the one that closed just before it. */
+const precedingLiteral = (source, marker) => {
+    const body = configBody(source, marker, true);
     if (body === undefined) {
-        return [];
+        return undefined;
     }
-    const bodyStart = bodyStartOf(source, body, match.index, isTrailing);
-    return bodyStart === NOT_FOUND
-        ? []
-        : [{ kind, marker: match.index, body, bodyStart, line: lineOf(source, match.index) }];
+    const bodyStart = source.lastIndexOf(body, marker);
+    return bodyStart === NOT_FOUND ? undefined : { body, bodyStart };
+};
+const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
+    const literal = match[1] === SATISFIES
+        ? precedingLiteral(source, match.index)
+        : governedLiteral(source, match.index + match[0].length);
+    return literal === undefined ? [] : [{ kind, ...literal, line: lineOf(source, match.index) }];
 });
 /** Every collection and global configuration literal the source declares. */
 export const payloadConfigsIn = (source) => CONFIG_KINDS.flatMap((kind) => configsOfKind(source, kind));

package/dist/payload-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAwBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACnD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAErC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,UAAmB,EAAU,EAAE,CAChG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAE9E,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,UAAU,GAAY,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAA;IAClD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAW,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAuBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,qBAAqB;KAClC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAQrC,mGAAmG;AACnG,sGAAsG;AACtG,gGAAgG;AAChG,kGAAkG;AAClG,mFAAmF;AACnF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,wBAAwB;AACxB,MAAM,aAAa,GAAW,8CAA8C,CAAA;AAE5E,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAA6B,EAAE;IACvF,MAAM,GAAG,GAA2B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACvD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,GAAG,EAAE,SAAS,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,MAAc,EAA6B,EAAE;IACrF,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1D,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,OAAO,GACX,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC/F,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}

package/dist/payload-defaults.d.ts

@@ -0,0 +1,128 @@
+/** The operations a collection must decide; the static rule holds a written config to the same list. */
+export declare const COLLECTION_OPERATIONS: readonly string[];
+/** The operations a global must decide. */
+export declare const GLOBAL_OPERATIONS: readonly string[];
+/** The operation an auth collection decides on top of the four: who may clear a locked account. */
+export declare const UNLOCK_OPERATION: string;
+/** The operation a versioned collection or global decides: who may read a stored version. */
+export declare const READ_VERSIONS_OPERATION: string;
+/** What an entity of the built configuration is, as far as the operations it owes depend on it. */
+export interface PayloadSubjectTraits {
+    readonly kind: PayloadSubjectKind;
+    readonly hasAuth: boolean;
+    readonly hasVersions: boolean;
+}
+/**
+ * The access operations one entity owes a decision on. Two of them are conditional, and neither may be
+ * added to the lists above: Payload writes `unlock` onto EVERY collection during sanitisation, auth or
+ * not, so demanding it unconditionally would report the whole configuration, and `readVersions` means
+ * nothing on an entity that keeps no versions.
+ * @param traits what the entity is: its kind, and whether it authenticates or keeps versions.
+ * @returns the operations that entity must decide, in the order they are reported.
+ */
+export declare const accessOperationsFor: (traits: PayloadSubjectTraits) => readonly string[];
+/**
+ * The prefix the probe prints its report behind. A plugin may log on import, and a line the parser can
+ * name is what separates the report from that chatter.
+ */
+export declare const INHERITED_ACCESS_REPORT_MARKER: string;
+/** One entity of the built configuration and the operations it left to Payload's default. */
+export interface InheritedAccessEntry {
+    readonly slug: string;
+    readonly inherited: readonly string[];
+}
+/**
+ * What a read rule answered an anonymous caller, as the probe observed it. `filtered` carries the
+ * query constraint the rule returned, which is the half `/api/access` reports and the anonymous sweep
+ * never opens; `undecidable` is a rule that threw when asked, which is reported rather than assumed
+ * safe.
+ */
+export type AnonymousRead = {
+    readonly kind: 'denied';
+} | {
+    readonly kind: 'filtered';
+    readonly where: unknown;
+} | {
+    readonly kind: 'open';
+} | {
+    readonly kind: 'undecidable';
+    readonly reason: string;
+};
+/** One entity that keeps drafts, and what its read rule answers a caller with no credentials. */
+export interface DraftReadEntry {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly anonymousRead: AnonymousRead;
+}
+/** What the probe reports: every collection and every global, decided ones included. */
+export interface InheritedAccessReport {
+    readonly collections: readonly InheritedAccessEntry[];
+    readonly draftReads: readonly DraftReadEntry[];
+    readonly globals: readonly InheritedAccessEntry[];
+}
+/** The two kinds of entity a Payload configuration holds. */
+export type PayloadSubjectKind = 'collection' | 'global';
+/** One entity Payload builds for its own bookkeeping, which keeps the default access by design. */
+export interface ExemptPayloadSubject {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly reason: string;
+}
+/** The entities exempt from the rule, each with the reason. Nothing a project declares extends this. */
+export declare const EXEMPT_PAYLOAD_SUBJECTS: readonly ExemptPayloadSubject[];
+/**
+ * The saved-filter collection Payload builds behind `enableQueryPresets`.
+ *
+ * It is named here because the probe has to read its access from somewhere other than the collection.
+ * `getAccess` wraps EVERY operation of this one collection in a closure that calls the project's rule
+ * where there is one and Payload's own default where there is not, so the built collection carries four
+ * functions that match neither the default by reference nor its source text. Read there, a project that
+ * decided nothing is indistinguishable from one that decided everything - and undecided means an
+ * unconstrained `create` for any signed-in user, and a preset shared as `everyone` readable by every
+ * role that can log in, the ones a project keeps outside its editorial staff included.
+ */
+export declare const QUERY_PRESETS_SLUG: string;
+/**
+ * Every entity of the built configuration that still carries Payload's default access on a judged
+ * operation, in configuration order, each naming where the project decides it.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when every entity decides its access.
+ */
+export declare const findInheritedAccess: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Whether a read filter admits published documents alone.
+ *
+ * A clause under `and` is enough on its own, because every conjunct holds. A clause under `or` counts
+ * only when EVERY branch carries one, because a single branch without it is a way in - which is the
+ * shape of the defect this rule exists for.
+ * @param where the query constraint the read rule returned.
+ * @returns whether every document the filter admits is a published one.
+ */
+export declare const requiresPublishedStatus: (where: unknown) => boolean;
+/**
+ * Every entity that keeps drafts and lets a stranger read something that was never approved, in
+ * configuration order.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when no drafts read admits an unapproved document.
+ */
+export declare const findUnconstrainedDraftReads: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Read the probe's report out of everything the probe wrote to standard output.
+ *
+ * The LAST marker line is the report, so a plugin that logs during import cannot hide it, and a report
+ * that fails to parse or has the wrong shape is undefined rather than empty: a probe that printed a
+ * stack trace must fail the gate, never pass it as "no findings".
+ * @param text the probe's standard output.
+ * @returns the report, or undefined when no well-formed report was printed.
+ */
+export declare const parseInheritedAccessReport: (text: string) => InheritedAccessReport | undefined;
+/** Where a Payload member keeps its configuration when its tsconfig says nothing else. */
+export declare const DEFAULT_PAYLOAD_CONFIG_PATH: string;
+/**
+ * The path of the Payload configuration a member's tsconfig aliases as `@payload-config`, which is the
+ * alias `ploaness init` writes and Payload's own CLI resolves through.
+ * @param tsconfig the parsed tsconfig, or anything when it could not be read.
+ * @returns the configured path relative to the member root, or the default path.
+ */
+export declare const payloadConfigPathOf: (tsconfig: unknown) => string;
+//# sourceMappingURL=payload-defaults.d.ts.map

package/dist/payload-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.d.ts","sourceRoot":"","sources":["../src/payload-defaults.ts"],"names":[],"mappings":"AAgBA,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2C,CAAA;AAE9F,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEtE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,EAAE,MAAiB,CAAA;AAEhD,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,EAAE,MAAuB,CAAA;AAE7D,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,oBAAoB,KAAG,SAAS,MAAM,EAIjF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAqC,CAAA;AAElF,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAClD;AAED,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EA4BlE,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAgC,CAAA;AAyCjE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAGlF,CAAA;AA2BD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,OAAO,KAAG,OAoBxD,CAAA;AA8BD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAIvF,CAAA;AA4EJ;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,SAoBjF,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,EAAE,MAAgC,CAAA;AAI1E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,KAAG,MAYvD,CAAA"}