@ploaness/governance 1.1.0 → 1.2.0

package/dist/payload-defaults.js

@@ -0,0 +1,295 @@
+// Whether every collection and global in a BUILT Payload configuration decides its own access.
+//
+// The static rule in payload-access.ts reads the access block a project wrote, and it can only read what
+// the project wrote. Payload builds collections the project never writes: the folder tree behind
+// `folders`, the job queue behind `jobs`, the saved filters behind `queryPresets`, and whatever a plugin
+// adds. Each arrives with the access Payload gives an undeclared operation, `defaultAccess`, which admits
+// every signed-in user to every operation. The anonymous sweep cannot see that either, because a
+// signed-in stakeholder is not anonymous. So a probe imports the built configuration and reports, per
+// entity, which operations still carry that function; this module decides what the report means.
+//
+// Payload's own bookkeeping keeps the default on purpose, and those entities are exempt by name here,
+// with the reason each. No project setting widens the list: a rule a project can edit is not a rule, and
+// the repair is always available - write the access explicitly, through the override the framework
+// offers for the entity it built.
+import { asRecord, asText, isArray, isRecord, readKey } from './json-shapes.js';
+/** The operations a collection must decide; the static rule holds a written config to the same list. */
+export const COLLECTION_OPERATIONS = ['create', 'read', 'update', 'delete'];
+/** The operations a global must decide. */
+export const GLOBAL_OPERATIONS = ['read', 'update'];
+/** The operation an auth collection decides on top of the four: who may clear a locked account. */
+export const UNLOCK_OPERATION = 'unlock';
+/** The operation a versioned collection or global decides: who may read a stored version. */
+export const READ_VERSIONS_OPERATION = 'readVersions';
+/**
+ * The access operations one entity owes a decision on. Two of them are conditional, and neither may be
+ * added to the lists above: Payload writes `unlock` onto EVERY collection during sanitisation, auth or
+ * not, so demanding it unconditionally would report the whole configuration, and `readVersions` means
+ * nothing on an entity that keeps no versions.
+ * @param traits what the entity is: its kind, and whether it authenticates or keeps versions.
+ * @returns the operations that entity must decide, in the order they are reported.
+ */
+export const accessOperationsFor = (traits) => [
+    ...(traits.kind === 'collection' ? COLLECTION_OPERATIONS : GLOBAL_OPERATIONS),
+    ...(traits.kind === 'collection' && traits.hasAuth ? [UNLOCK_OPERATION] : []),
+    ...(traits.hasVersions ? [READ_VERSIONS_OPERATION] : []),
+];
+/**
+ * The prefix the probe prints its report behind. A plugin may log on import, and a line the parser can
+ * name is what separates the report from that chatter.
+ */
+export const INHERITED_ACCESS_REPORT_MARKER = 'ploaness-inherited-access:';
+/** The entities exempt from the rule, each with the reason. Nothing a project declares extends this. */
+export const EXEMPT_PAYLOAD_SUBJECTS = [
+    {
+        kind: 'collection',
+        slug: 'payload-locked-documents',
+        reason: 'the document-lock ledger, which declares the default deliberately so that any signed-in editor ' +
+            'can hold and release a lock',
+    },
+    {
+        kind: 'collection',
+        slug: 'payload-preferences',
+        reason: 'per-user admin preferences; Payload scopes read and delete to the owner, and leaves create and ' +
+            'update to the default on purpose',
+    },
+    {
+        kind: 'collection',
+        slug: 'payload-migrations',
+        reason: 'the migration ledger, with no endpoint and no GraphQL surface; only the framework writes it',
+    },
+    {
+        kind: 'global',
+        slug: 'payload-jobs-stats',
+        reason: 'the scheduling counters Payload keeps beside the job queue; the framework offers no override ' +
+            'for it, so no explicit access can be written, and the queue it counts is judged',
+    },
+];
+/**
+ * The saved-filter collection Payload builds behind `enableQueryPresets`.
+ *
+ * It is named here because the probe has to read its access from somewhere other than the collection.
+ * `getAccess` wraps EVERY operation of this one collection in a closure that calls the project's rule
+ * where there is one and Payload's own default where there is not, so the built collection carries four
+ * functions that match neither the default by reference nor its source text. Read there, a project that
+ * decided nothing is indistinguishable from one that decided everything - and undecided means an
+ * unconstrained `create` for any signed-in user, and a preset shared as `everyone` readable by every
+ * role that can log in, the ones a project keeps outside its editorial staff included.
+ */
+export const QUERY_PRESETS_SLUG = 'payload-query-presets';
+// Where the framework lets a project decide the access of an entity it built. Anything else is either
+// the project's own collection, which has an access block, or a plugin's, which has an override option.
+const FRAMEWORK_REPAIRS = {
+    'payload-folders': 'folders.collectionOverrides',
+    'payload-jobs': 'jobs.jobsCollectionOverrides',
+    [QUERY_PRESETS_SLUG]: 'queryPresets.access',
+};
+const isExempt = (kind, slug) => EXEMPT_PAYLOAD_SUBJECTS.some((subject) => subject.kind === kind && subject.slug === slug);
+const repairFor = (slug, pronoun) => {
+    const framework = FRAMEWORK_REPAIRS[slug];
+    return framework === undefined
+        ? `decide ${pronoun} in its access block, or in the override its plugin offers`
+        : `decide ${pronoun} in ${framework}`;
+};
+const describeInherited = (kind, entry) => {
+    const pronoun = entry.inherited.length === 1 ? 'it' : 'them';
+    return (`${kind} "${entry.slug}" leaves ${entry.inherited.join(', ')} to Payload's default access, ` +
+        `which admits every signed-in user; ${repairFor(entry.slug, pronoun)}`);
+};
+const judge = (kind, entries) => entries
+    .filter((entry) => entry.inherited.length > 0 && !isExempt(kind, entry.slug))
+    .map((entry) => describeInherited(kind, entry));
+/**
+ * Every entity of the built configuration that still carries Payload's default access on a judged
+ * operation, in configuration order, each naming where the project decides it.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when every entity decides its access.
+ */
+export const findInheritedAccess = (report) => [
+    ...judge('collection', report.collections),
+    ...judge('global', report.globals),
+];
+// The read a drafts-enabled entity grants a stranger.
+//
+// A draft is a document nobody has approved. Payload writes an unpublished save to the versions table
+// and leaves the main row alone, so a document that has never been published carries `_status: 'draft'`
+// in the row a plain list reads - which means an unconstrained read serves unapproved content through
+// the ordinary endpoint, not only through `?draft=true`.
+//
+// The static rule in payload-access.ts can only catch the inline spelling `read: (): boolean => true`,
+// and the shipped ESLint config forbids exactly that spelling in a config file, so a conforming project
+// writes `read: someHelper` and the static rule is blind to it. The anonymous sweep is blind too: it
+// separates a grant that carries a query constraint from one that does not, and never opens the
+// constraint to see what it constrains. Between the two, a read filtered by audience but not by status
+// passed everything. This is the rule that reads the constraint.
+/** The status Payload stamps on the version that is live. */
+const PUBLISHED_STATUS = 'published';
+/** The field Payload adds to an entity that keeps drafts. */
+const STATUS_FIELD = '_status';
+const declaresPublished = (where) => {
+    const status = where[STATUS_FIELD];
+    return isRecord(status) && status['equals'] === PUBLISHED_STATUS;
+};
+/**
+ * Whether a read filter admits published documents alone.
+ *
+ * A clause under `and` is enough on its own, because every conjunct holds. A clause under `or` counts
+ * only when EVERY branch carries one, because a single branch without it is a way in - which is the
+ * shape of the defect this rule exists for.
+ * @param where the query constraint the read rule returned.
+ * @returns whether every document the filter admits is a published one.
+ */
+export const requiresPublishedStatus = (where) => {
+    if (!isRecord(where)) {
+        return false;
+    }
+    if (declaresPublished(where)) {
+        return true;
+    }
+    const conjuncts = where['and'];
+    if (isArray(conjuncts) &&
+        conjuncts.some((one) => requiresPublishedStatus(one))) {
+        return true;
+    }
+    const disjuncts = where['or'];
+    return (isArray(disjuncts) &&
+        disjuncts.length > 0 &&
+        disjuncts.every((one) => requiresPublishedStatus(one)));
+};
+const DRAFT_READ_REPAIR = 'a read that keeps unapproved work from a stranger either refuses them outright or filters on ' +
+    `${STATUS_FIELD} equals ${PUBLISHED_STATUS}`;
+const describeDraftRead = (entry) => {
+    const subject = `${entry.kind} "${entry.slug}" keeps drafts and`;
+    const read = entry.anonymousRead;
+    if (read.kind === 'open') {
+        return (`${subject} grants an unconditional anonymous read, so every unapproved document in it is ` +
+            `served to anyone; ${DRAFT_READ_REPAIR}`);
+    }
+    if (read.kind === 'undecidable') {
+        return (`${subject} its read rule could not be decided from the request alone (${read.reason}); an ` +
+            'access rule is a pure decision over the caller it is handed, so the harness can read it');
+    }
+    if (read.kind === 'filtered' && !requiresPublishedStatus(read.where)) {
+        return (`${subject} filters its anonymous read without constraining ${STATUS_FIELD}, so an ` +
+            `unapproved document is served to anyone the filter admits; ${DRAFT_READ_REPAIR}`);
+    }
+    return undefined;
+};
+/**
+ * Every entity that keeps drafts and lets a stranger read something that was never approved, in
+ * configuration order.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when no drafts read admits an unapproved document.
+ */
+export const findUnconstrainedDraftReads = (report) => report.draftReads.flatMap((entry) => {
+    const finding = describeDraftRead(entry);
+    return finding === undefined ? [] : [finding];
+});
+const asEntry = (raw) => {
+    if (!isRecord(raw)) {
+        return undefined;
+    }
+    const slug = raw['slug'];
+    const inherited = raw['inherited'];
+    if (typeof slug !== 'string' || !isArray(inherited)) {
+        return undefined;
+    }
+    return inherited.every((operation) => typeof operation === 'string')
+        ? { slug, inherited: inherited.map((operation) => asText(operation)) }
+        : undefined;
+};
+const asEntries = (raw) => {
+    if (!isArray(raw)) {
+        return undefined;
+    }
+    const entries = raw.map((entry) => asEntry(entry));
+    return entries.every((entry) => entry !== undefined)
+        ? entries
+        : undefined;
+};
+const asAnonymousRead = (raw) => {
+    const kind = readKey(raw, 'kind');
+    if (kind === 'denied') {
+        return { kind };
+    }
+    if (kind === 'open') {
+        return { kind };
+    }
+    if (kind === 'filtered') {
+        return { kind, where: readKey(raw, 'where') };
+    }
+    return kind === 'undecidable' ? { kind, reason: asText(readKey(raw, 'reason')) } : undefined;
+};
+const asDraftRead = (raw) => {
+    const slug = readKey(raw, 'slug');
+    const kind = readKey(raw, 'kind');
+    const anonymousRead = asAnonymousRead(readKey(raw, 'anonymousRead'));
+    if (typeof slug !== 'string' || anonymousRead === undefined) {
+        return undefined;
+    }
+    return kind === 'collection' || kind === 'global' ? { kind, slug, anonymousRead } : undefined;
+};
+const asDraftReads = (raw) => {
+    if (!isArray(raw)) {
+        return undefined;
+    }
+    const entries = raw.map((entry) => asDraftRead(entry));
+    return entries.every((entry) => entry !== undefined)
+        ? entries
+        : undefined;
+};
+const parseJson = (text) => {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+};
+/**
+ * Read the probe's report out of everything the probe wrote to standard output.
+ *
+ * The LAST marker line is the report, so a plugin that logs during import cannot hide it, and a report
+ * that fails to parse or has the wrong shape is undefined rather than empty: a probe that printed a
+ * stack trace must fail the gate, never pass it as "no findings".
+ * @param text the probe's standard output.
+ * @returns the report, or undefined when no well-formed report was printed.
+ */
+export const parseInheritedAccessReport = (text) => {
+    const line = text
+        .split('\n')
+        .map((candidate) => candidate.trim())
+        .findLast((candidate) => candidate.startsWith(INHERITED_ACCESS_REPORT_MARKER));
+    if (line === undefined) {
+        return undefined;
+    }
+    const parsed = parseJson(line.slice(INHERITED_ACCESS_REPORT_MARKER.length));
+    const collections = asEntries(readKey(parsed, 'collections'));
+    const globals = asEntries(readKey(parsed, 'globals'));
+    const draftReads = asDraftReads(readKey(parsed, 'draftReads'));
+    if (collections === undefined || globals === undefined || draftReads === undefined) {
+        return undefined;
+    }
+    return { collections, draftReads, globals };
+};
+/** Where a Payload member keeps its configuration when its tsconfig says nothing else. */
+export const DEFAULT_PAYLOAD_CONFIG_PATH = 'src/payload.config.ts';
+const CURRENT_DIRECTORY_PREFIX = './';
+/**
+ * The path of the Payload configuration a member's tsconfig aliases as `@payload-config`, which is the
+ * alias `ploaness init` writes and Payload's own CLI resolves through.
+ * @param tsconfig the parsed tsconfig, or anything when it could not be read.
+ * @returns the configured path relative to the member root, or the default path.
+ */
+export const payloadConfigPathOf = (tsconfig) => {
+    const paths = asRecord(readKey(readKey(tsconfig, 'compilerOptions'), 'paths'));
+    const alias = paths['@payload-config'];
+    const first = isArray(alias) ? alias[0] : undefined;
+    if (typeof first !== 'string' || first.length === 0) {
+        return DEFAULT_PAYLOAD_CONFIG_PATH;
+    }
+    return first.startsWith(CURRENT_DIRECTORY_PREFIX)
+        ? first.slice(CURRENT_DIRECTORY_PREFIX.length)
+        : first;
+};
+//# sourceMappingURL=payload-defaults.js.map

package/dist/payload-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.js","sourceRoot":"","sources":["../src/payload-defaults.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,EAAE;AACF,yGAAyG;AACzG,iGAAiG;AACjG,yGAAyG;AACzG,0GAA0G;AAC1G,iGAAiG;AACjG,sGAAsG;AACtG,iGAAiG;AACjG,EAAE;AACF,sGAAsG;AACtG,yGAAyG;AACzG,mGAAmG;AACnG,kCAAkC;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAE/E,wGAAwG;AACxG,MAAM,CAAC,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE9F,2CAA2C;AAC3C,MAAM,CAAC,MAAM,iBAAiB,GAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;AAEtE,mGAAmG;AACnG,MAAM,CAAC,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEhD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,uBAAuB,GAAW,cAAc,CAAA;AAS7D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA4B,EAAqB,EAAE,CAAC;IACtF,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC7E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;CACzD,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAW,4BAA4B,CAAA;AA4ClF,wGAAwG;AACxG,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,0BAA0B;QAChC,MAAM,EACJ,iGAAiG;YACjG,6BAA6B;KAChC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EACJ,iGAAiG;YACjG,kCAAkC;KACrC;IACD;QACE,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EACJ,6FAA6F;KAChG;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,oBAAoB;QAC1B,MAAM,EACJ,+FAA+F;YAC/F,iFAAiF;KACpF;CACF,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAW,uBAAuB,CAAA;AAEjE,sGAAsG;AACtG,wGAAwG;AACxG,MAAM,iBAAiB,GAAqC;IAC1D,iBAAiB,EAAE,6BAA6B;IAChD,cAAc,EAAE,8BAA8B;IAC9C,CAAC,kBAAkB,CAAC,EAAE,qBAAqB;CAC5C,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,IAAwB,EAAE,IAAY,EAAW,EAAE,CACnE,uBAAuB,CAAC,IAAI,CAC1B,CAAC,OAA6B,EAAW,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAC3F,CAAA;AAEH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAU,EAAE;IAC1D,MAAM,SAAS,GAAuB,iBAAiB,CAAC,IAAI,CAAC,CAAA;IAC7D,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,UAAU,OAAO,4DAA4D;QAC/E,CAAC,CAAC,UAAU,OAAO,OAAO,SAAS,EAAE,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,IAAwB,EAAE,KAA2B,EAAU,EAAE;IAC1F,MAAM,OAAO,GAAW,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAA;IACpE,OAAO,CACL,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,gCAAgC;QAC5F,sCAAsC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CACvE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CACZ,IAAwB,EACxB,OAAwC,EACrB,EAAE,CACrB,OAAO;KACJ,MAAM,CACL,CAAC,KAA2B,EAAW,EAAE,CACvC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAC5D;KACA,GAAG,CAAC,CAAC,KAA2B,EAAU,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,MAA6B,EAAqB,EAAE,CAAC;IACvF,GAAG,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC;IAC1C,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;CACnC,CAAA;AAED,sDAAsD;AACtD,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,sGAAsG;AACtG,yDAAyD;AACzD,EAAE;AACF,uGAAuG;AACvG,wGAAwG;AACxG,qGAAqG;AACrG,gGAAgG;AAChG,uGAAuG;AACvG,iEAAiE;AAEjE,6DAA6D;AAC7D,MAAM,gBAAgB,GAAW,WAAW,CAAA;AAE5C,6DAA6D;AAC7D,MAAM,YAAY,GAAW,SAAS,CAAA;AAEtC,MAAM,iBAAiB,GAAG,CAAC,KAA8B,EAAW,EAAE;IACpE,MAAM,MAAM,GAAY,KAAK,CAAC,YAAY,CAAC,CAAA;IAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,gBAAgB,CAAA;AAClE,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IACjE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAY,KAAK,CAAC,KAAK,CAAC,CAAA;IACvC,IACE,OAAO,CAAC,SAAS,CAAC;QAClB,SAAS,CAAC,IAAI,CAAC,CAAC,GAAY,EAAW,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,EACvE,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,SAAS,GAAY,KAAK,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC;QAClB,SAAS,CAAC,MAAM,GAAG,CAAC;QACpB,SAAS,CAAC,KAAK,CAAC,CAAC,GAAY,EAAW,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,CACzE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,iBAAiB,GACrB,+FAA+F;IAC/F,GAAG,YAAY,WAAW,gBAAgB,EAAE,CAAA;AAE9C,MAAM,iBAAiB,GAAG,CAAC,KAAqB,EAAsB,EAAE;IACtE,MAAM,OAAO,GAAW,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,oBAAoB,CAAA;IACxE,MAAM,IAAI,GAAkB,KAAK,CAAC,aAAa,CAAA;IAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACzB,OAAO,CACL,GAAG,OAAO,iFAAiF;YAC3F,qBAAqB,iBAAiB,EAAE,CACzC,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QAChC,OAAO,CACL,GAAG,OAAO,+DAA+D,IAAI,CAAC,MAAM,QAAQ;YAC5F,yFAAyF,CAC1F,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrE,OAAO,CACL,GAAG,OAAO,oDAAoD,YAAY,UAAU;YACpF,8DAA8D,iBAAiB,EAAE,CAClF,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,MAA6B,EAAqB,EAAE,CAC9F,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAqB,EAAqB,EAAE;IACrE,MAAM,OAAO,GAAuB,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEJ,MAAM,OAAO,GAAG,CAAC,GAAY,EAAoC,EAAE;IACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAY,GAAG,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,SAAS,GAAY,GAAG,CAAC,WAAW,CAAC,CAAA;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,SAAkB,EAAW,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC;QACpF,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,SAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE;QACvF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,GAAY,EAA+C,EAAE;IAC9E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAkD,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CACxF,OAAO,CAAC,KAAK,CAAC,CACf,CAAA;IACD,OAAO,OAAO,CAAC,KAAK,CAClB,CAAC,KAAuC,EAAiC,EAAE,CAAC,KAAK,KAAK,SAAS,CAChG;QACC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CAAC,GAAY,EAA6B,EAAE;IAClE,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAA;IAC/C,CAAC;IACD,OAAO,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9F,CAAC,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,GAAY,EAA8B,EAAE;IAC/D,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAY,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,aAAa,GAA8B,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAA;IAC/F,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/F,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,GAAY,EAAyC,EAAE;IAC3E,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAA4C,GAAG,CAAC,GAAG,CAAC,CAAC,KAAc,EAAE,EAAE,CAClF,WAAW,CAAC,KAAK,CAAC,CACnB,CAAA;IACD,OAAO,OAAO,CAAC,KAAK,CAClB,CAAC,KAAiC,EAA2B,EAAE,CAAC,KAAK,KAAK,SAAS,CACpF;QACC,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAW,EAAE;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,IAAY,EAAqC,EAAE;IAC5F,MAAM,IAAI,GAAuB,IAAI;SAClC,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;SACpD,QAAQ,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,8BAA8B,CAAC,CAAC,CAAA;IACjG,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,MAAM,GAAY,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC,CAAA;IACpF,MAAM,WAAW,GAAgD,SAAS,CACxE,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAC/B,CAAA;IACD,MAAM,OAAO,GAAgD,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;IAClG,MAAM,UAAU,GAA0C,YAAY,CACpE,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAC9B,CAAA;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACnF,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,CAAA;AAC7C,CAAC,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAW,uBAAuB,CAAA;AAE1E,MAAM,wBAAwB,GAAW,IAAI,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAiB,EAAU,EAAE;IAC/D,MAAM,KAAK,GAA4B,QAAQ,CAC7C,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CACvD,CAAA;IACD,MAAM,KAAK,GAAY,KAAK,CAAC,iBAAiB,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,2BAA2B,CAAA;IACpC,CAAC;IACD,OAAO,KAAK,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAC/C,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAA;AACX,CAAC,CAAA"}

package/dist/payload-policy.d.ts

@@ -15,4 +15,17 @@ export declare const findSourceViolations: (source: string) => readonly PayloadV
  * @returns one violation per offending line.
  */
 export declare const findPayloadViolations: (source: string) => readonly PayloadViolation[];
+/**
+ * The access decision a route handler has to state rather than inherit.
+ *
+ * The two rules that already read `overrideAccess` judge a value that is written down: one bans `true`,
+ * the other requires `false` beside a `user`. Neither can see an absent property, and absent is the
+ * dangerous spelling - Payload defaults `overrideAccess` to `true`, so the call that says nothing is
+ * the call that runs as an administrator. Under `src/endpoints` the omission is therefore the
+ * violation, which is why this rule reads the path and the others do not.
+ * @param filePath the repository-relative path of the file, which decides whether the rule applies.
+ * @param source the file's text.
+ * @returns one violation per Local API call that leaves the decision to the default.
+ */
+export declare const findEndpointViolations: (filePath: string, source: string) => readonly PayloadViolation[];
 //# sourceMappingURL=payload-policy.d.ts.map

package/dist/payload-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAqR3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG9E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA"}
+{"version":3,"file":"payload-policy.d.ts","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAqT3D;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAG9E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAmB/E,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,MAAM,EAChB,QAAQ,MAAM,KACb,SAAS,gBAAgB,EAiB3B,CAAA"}

package/dist/payload-policy.js

@@ -1,16 +1,5 @@
-// Payload-specific source policy: the rules that exist only because the project is a Payload CMS
-// application, and therefore the part of ploaness that a generic JavaScript harness cannot supply.
-//
-// ploaness governs a language and a framework; this module is the framework half. The rules here target
-// Payload defects that a type checker and a generic linter both miss: a Local API read that pulls an
-// unbounded relationship graph out of the database, and an access check that is deliberately bypassed.
-// The access-control rules - the ones about a decision left UNWRITTEN rather than written wrongly - are
-// in `payload-access.ts`, and the source reader both halves are decided by is in `payload-source.ts`.
-//
-// These rules were previously five GritQL files run as Biome plugins. Biome resolves a plugin path
-// relative to the config that declares it, which does not survive being extended from node_modules, so
-// they are reimplemented here instead. The move also makes them unit-testable, which they were not.
-import { findAnonymousDraftReads, findUndeclaredAccess, findUnhardenedAuth, findUnrestrictedUploads, } from './payload-access.js';
+// Payload source policy for explicit read bounds, request threading, and access decisions.
+import { findAnonymousDraftReads, findUndecidedSvgHeaders, findUndeclaredAccess, findUndeclaredVersionReads, findUnhardenedAuth, findUnlockableAuth, findUnrestrictedUploads, } from './payload-access.js';
 import { findUnprotectedPrivilegedFields } from './payload-field-access.js';
 import { findFailOpenSecretGuards } from './source-security.js';
 import { balancedArguments, lineOf, occurrences, stripComments, topLevelSlice, } from './source-text.js';
@@ -36,16 +25,9 @@ const BOUNDED_CALLS = [
         reason: 'bound payload.findGlobal() with an explicit depth to cap relationship population',
     },
 ];
-// Only a call on an identifier that is recognisably the Payload instance is judged, so an unrelated
-// `array.find(...)` is never touched. `req` may itself be reached through a chain - `ctx.req.payload`
-// inside a hook is as much the Payload instance as `req.payload` - and excluding a preceding dot meant
-// every such call went unjudged. The chain is admitted only in front of `req`, so a property named
-// `payload` on some unrelated object is still left alone.
+// Recognized Payload receivers exclude unrelated collection methods such as array.find().
 const PAYLOAD_RECEIVER = /(?:^|[^\w$.])(?:payload|(?:[\w$]+\.)*req\.payload|this\.payload)$/;
-const declaresKey = (topLevel, key) => new RegExp(String.raw `(?:^|,)\s*${key}\s*:`).test(topLevel);
-// A shorthand property has no colon, so `declaresKey` cannot see it. The property boundary must be the
-// start of the literal or a comma: admitting arbitrary whitespace made the `req` VALUE in
-// `request: req` look like a `req` PROPERTY and vouched for a transaction the call never received.
+// A property boundary keeps a value such as request: req from being read as a req property.
 const declaresProperty = (topLevel, key) => new RegExp(String.raw `(?:^|,)\s*${key}\s*(?::|,|$)`).test(topLevel);
 // The depth-one text of a call's options literal, or undefined when the call is not one to judge.
 const topLevelOptionsAt = (source, call, found, receiver) => {
@@ -53,23 +35,20 @@ const topLevelOptionsAt = (source, call, found, receiver) => {
         return undefined;
     }
     const argumentText = balancedArguments(source, found + call.length - 1);
-    return argumentText?.includes('{') === true ? topLevelSlice(argumentText) : undefined;
+    return argumentText?.trim().startsWith('{') === true ? topLevelSlice(argumentText) : undefined;
 };
-// A top-level spread makes an absent key unknowable, so the rules that ask only whether a key exists
-// stay silent. A spread nested inside `data` is elided by `topLevelSlice` and changes none of the
-// options these rules judge.
-//
-// Shared by the two rules that read an options object. They ask different questions - is the read
-// bounded, is the request threaded - of the same three facts, and a second copy of the three guards is a
-// second place for the receiver pattern to fall out of step with this one.
-const optionKeysAt = (source, call, found, receiver) => {
-    const topLevel = topLevelOptionsAt(source, call, found, receiver);
-    return topLevel === undefined || topLevel.includes('...') ? undefined : topLevel;
+// A protected property must follow every spread that could replace it.
+const hasEffectiveProperty = (topLevel, key) => {
+    const properties = [
+        ...topLevel.matchAll(new RegExp(String.raw `(?:^|,)\s*${key}\s*(?::|(?=,|$))`, 'gu')),
+    ];
+    const last = properties.at(-1);
+    return last !== undefined && last.index > topLevel.lastIndexOf('...');
 };
 const unboundedCallAt = (source, rule, found) => {
-    const topLevel = optionKeysAt(source, rule.call, found, PAYLOAD_RECEIVER);
+    const topLevel = topLevelOptionsAt(source, rule.call, found, PAYLOAD_RECEIVER);
     if (topLevel === undefined ||
-        rule.required.some((key) => declaresKey(topLevel, key))) {
+        rule.required.some((key) => hasEffectiveProperty(topLevel, key))) {
         return undefined;
     }
     return { line: lineOf(source, found), rule: rule.rule, reason: rule.reason };
@@ -103,9 +82,20 @@ const LOCAL_API_CALLS = [
 // has no request to thread, and demanding one would be asking for a value that does not exist. Reaching
 // the instance THROUGH `req` is the proof that one does, so the omission is never a decision.
 const REQUEST_RECEIVER = /(?:^|[^\w$.])(?:[\w$]+\.)*req\.payload$/;
+const findOpaqueOptions = (source) => LOCAL_API_CALLS.flatMap((call) => occurrences(source, call).flatMap((found) => PAYLOAD_RECEIVER.test(source.slice(0, found)) &&
+    topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER) === undefined
+    ? [
+        {
+            line: lineOf(source, found),
+            rule: 'require-explicit-payload-options',
+            reason: `cannot check ${call.slice(1, -1)}() options; use an object literal and state ` +
+                'the required depth/limit, req, and access settings after any spread',
+        },
+    ]
+    : []));
 const unthreadedCallAt = (source, call, found) => {
-    const topLevel = optionKeysAt(source, call, found, REQUEST_RECEIVER);
-    if (topLevel === undefined || declaresProperty(topLevel, 'req')) {
+    const topLevel = topLevelOptionsAt(source, call, found, REQUEST_RECEIVER);
+    if (topLevel === undefined || hasEffectiveProperty(topLevel, 'req')) {
         return undefined;
     }
     return {
@@ -138,7 +128,7 @@ const hasEffectiveAccessControl = (topLevel) => {
 const userAccessViolationAt = (source, call, found) => {
     const topLevel = topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER);
     if (topLevel === undefined ||
-        !declaresProperty(topLevel, 'user') ||
+        !(declaresProperty(topLevel, 'user') || topLevel.includes('...')) ||
         hasEffectiveAccessControl(topLevel) ||
         overrideProperties(topLevel).some((property) => property.value === 'true')) {
         return undefined;
@@ -146,7 +136,8 @@ const userAccessViolationAt = (source, call, found) => {
     return {
         line: lineOf(source, found),
         rule: 'require-user-access-control',
-        reason: `set overrideAccess: false on ${call.slice(1, -1)}() when passing user; Payload otherwise ` +
+        reason: `set overrideAccess: false on ${call.slice(1, -1)}() after any spread; ` +
+            'a supplied or inherited user otherwise does not enable access control. Payload ' +
             'runs the operation as an administrator and ignores that user for access control',
     };
 };
@@ -157,8 +148,31 @@ const OVERRIDE_ACCESS = /overrideAccess\s*:\s*true/g;
 const findOverrideAccess = (source) => [...source.matchAll(OVERRIDE_ACCESS)].map((match) => ({
     line: lineOf(source, match.index),
     rule: 'no-override-access',
-    reason: 'overrideAccess: true bypasses Payload access control; pass req so the access rules run, or drop the override',
+    reason: 'overrideAccess: true bypasses Payload access control; set overrideAccess: false so the ' +
+        'access rules run against the calling user',
 }));
+// The one layer whose caller is a stranger. Everywhere else a Local API call runs in a context the
+// project already trusts - a hook inside the write that authored it, a scheduled job, a seed - and
+// privilege there is legitimate rather than a mistake. A route handler serves whoever reached the URL,
+// so what it is allowed to read is the one thing it must never inherit by saying nothing.
+const ENDPOINT_PATH = /^src\/(?:endpoints\/|app\/(?:.*\/)?route\.[jt]s$)/u;
+// A route must prove access enforcement rather than inherit Payload's privileged default.
+const endpointAccessViolationAt = (source, call, found) => {
+    if (!PAYLOAD_RECEIVER.test(source.slice(0, found))) {
+        return undefined;
+    }
+    const topLevel = topLevelOptionsAt(source, call, found, PAYLOAD_RECEIVER);
+    if (topLevel !== undefined && hasEffectiveAccessControl(topLevel)) {
+        return undefined;
+    }
+    return {
+        line: lineOf(source, found),
+        rule: 'require-endpoint-access',
+        reason: `state overrideAccess: false on ${call.slice(1, -1)}() in a route handler; Payload defaults it to ` +
+            'true, so an omission runs as an administrator and serves the document to whoever called the ' +
+            'route - set overrideAccess: false',
+    };
+};
 // Anchored on the keyword that immediately precedes the specifier rather than on the statement that
 // opens it. Requiring the whole statement to fit on one line missed a multi-line brace list, which is
 // how a long import is normally written, and requiring `from` missed both a side-effect import and the
@@ -208,15 +222,42 @@ export const findPayloadViolations = (source) => {
     // order to explain why the code avoids it must not be reported as that construct.
     const code = stripComments(source);
     return [
+        ...findOpaqueOptions(code),
         ...findUnboundedCalls(code),
         ...findUnthreadedRequests(code),
         ...findIgnoredUsers(code),
         ...findOverrideAccess(code),
         ...findUndeclaredAccess(code),
         ...findUnhardenedAuth(code),
+        ...findUnlockableAuth(code),
         ...findAnonymousDraftReads(code),
+        ...findUndeclaredVersionReads(code),
         ...findUnrestrictedUploads(code),
+        ...findUndecidedSvgHeaders(code),
         ...findUnprotectedPrivilegedFields(code),
     ];
 };
+/**
+ * The access decision a route handler has to state rather than inherit.
+ *
+ * The two rules that already read `overrideAccess` judge a value that is written down: one bans `true`,
+ * the other requires `false` beside a `user`. Neither can see an absent property, and absent is the
+ * dangerous spelling - Payload defaults `overrideAccess` to `true`, so the call that says nothing is
+ * the call that runs as an administrator. Under `src/endpoints` the omission is therefore the
+ * violation, which is why this rule reads the path and the others do not.
+ * @param filePath the repository-relative path of the file, which decides whether the rule applies.
+ * @param source the file's text.
+ * @returns one violation per Local API call that leaves the decision to the default.
+ */
+export const findEndpointViolations = (filePath, source) => {
+    if (!ENDPOINT_PATH.test(filePath)) {
+        return [];
+    }
+    // Runs outside `findPayloadViolations`, so it strips its own comments: prose that names a call must
+    // not be read as one.
+    const code = stripComments(source);
+    return LOCAL_API_CALLS.flatMap((call) => occurrences(code, call)
+        .map((found) => endpointAccessViolationAt(code, call, found))
+        .filter((violation) => violation !== undefined));
+};
 //# sourceMappingURL=payload-policy.js.map

package/dist/payload-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-policy.js","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,mGAAmG;AACnG,EAAE;AACF,wGAAwG;AACxG,qGAAqG;AACrG,uGAAuG;AACvG,wGAAwG;AACxG,sGAAsG;AACtG,EAAE;AACF,mGAAmG;AACnG,uGAAuG;AACvG,oGAAoG;AACpG,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AASzB,yGAAyG;AACzG,gGAAgG;AAChG,MAAM,aAAa,GAA+B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,uGAAuG;KAC1G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,mGAAmG;AACnG,0DAA0D;AAC1D,MAAM,gBAAgB,GAAW,mEAAmE,CAAA;AAEpG,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAE7D,uGAAuG;AACvG,0FAA0F;AAC1F,mGAAmG;AACnG,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAErE,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CACxB,MAAc,EACd,IAAY,EACZ,KAAa,EACb,QAAgB,EACI,EAAE;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAuB,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3F,OAAO,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACvF,CAAC,CAAA;AAED,qGAAqG;AACrG,kGAAkG;AAClG,6BAA6B;AAC7B,EAAE;AACF,kGAAkG;AAClG,yGAAyG;AACzG,2EAA2E;AAC3E,MAAM,YAAY,GAAG,CACnB,MAAc,EACd,IAAY,EACZ,KAAa,EACb,QAAgB,EACI,EAAE;IACtB,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;IACrF,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,MAAc,EACd,IAAqB,EACrB,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IACE,QAAQ,KAAK,SAAS;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAqB,EAA+B,EAAE,CAC3E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;KAC3B,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC1F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,cAAc;AACd,MAAM,eAAe,GAAsB;IACzC,SAAS;IACT,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,wBAAwB;IACxB,kBAAkB;IAClB,UAAU;IACV,gBAAgB;CACjB,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,wGAAwG;AACxG,8FAA8F;AAC9F,MAAM,gBAAgB,GAAW,yCAAyC,CAAA;AAE1E,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IACxF,IAAI,QAAQ,KAAK,SAAS,IAAI,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2DAA2D;YAC3F,+FAA+F;YAC/F,+BAA+B;KAClC,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,yGAAyG;AACzG,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC7E,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC3F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAOH,MAAM,iBAAiB,GAAW,yCAAyC,CAAA;AAE3E,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAA+B,EAAE,CAC3E,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAC3C,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC/B,CAAC,CACH,CAAA;AAEH,sGAAsG;AACtG,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC9D,MAAM,IAAI,GAAiC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,IAAI,EAAE,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAC5B,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,yBAAyB,CAAC,QAAQ,CAAC;QACnC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC/B,CAAC,QAA0B,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CACnE,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,6BAA6B;QACnC,MAAM,EACJ,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;YAC3F,iFAAiF;KACpF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACvE,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CACnD,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAC3C;KACA,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,MAAM,eAAe,GAAW,4BAA4B,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CACvC,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EACJ,8GAA8G;CACjH,CAAC,CACH,CAAA;AAEH,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,eAAe,GAAW,uDAAuD,CAAA;AACvF,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,sBAAsB,GAAW,2CAA2C,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC9E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC,KAAsB,EAA+B,EAAE;IACtD,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,kEAAkE,SAAS,GAAG;aACvF;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAAC;IACnF,GAAG,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,GAAG,wBAAwB,CAAC,MAAM,CAAC;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAA+B,EAAE;IACnF,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAC/B,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,+BAA+B,CAAC,IAAI,CAAC;KACzC,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload-policy.js","sourceRoot":"","sources":["../src/payload-policy.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,oBAAoB,EACpB,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,+BAA+B,EAAE,MAAM,2BAA2B,CAAA;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EACjB,MAAM,EACN,WAAW,EACX,aAAa,EACb,aAAa,GACd,MAAM,kBAAkB,CAAA;AASzB,yGAAyG;AACzG,gGAAgG;AAChG,MAAM,aAAa,GAA+B;IAChD;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC;QAC5B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,uGAAuG;KAC1G;IACD;QACE,IAAI,EAAE,YAAY;QAClB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,gFAAgF;KACzF;IACD;QACE,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,CAAC,OAAO,CAAC;QACnB,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA;AAED,0FAA0F;AAC1F,MAAM,gBAAgB,GAAW,mEAAmE,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE,CAClE,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAErE,kGAAkG;AAClG,MAAM,iBAAiB,GAAG,CACxB,MAAc,EACd,IAAY,EACZ,KAAa,EACb,QAAgB,EACI,EAAE;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,YAAY,GAAuB,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3F,OAAO,YAAY,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAChG,CAAC,CAAA;AAED,uEAAuE;AACvE,MAAM,oBAAoB,GAAG,CAAC,QAAgB,EAAE,GAAW,EAAW,EAAE;IACtE,MAAM,UAAU,GAA+B;QAC7C,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,aAAa,GAAG,kBAAkB,EAAE,IAAI,CAAC,CAAC;KACrF,CAAA;IACD,MAAM,IAAI,GAAgC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC3D,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC,CAAA;AAED,MAAM,eAAe,GAAG,CACtB,MAAc,EACd,IAAqB,EACrB,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAClG,IACE,QAAQ,KAAK,SAAS;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EACjF,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;AAC9E,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,aAAa,CAAC,OAAO,CAAC,CAAC,IAAqB,EAA+B,EAAE,CAC3E,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;KAC3B,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC1F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,qGAAqG;AACrG,cAAc;AACd,MAAM,eAAe,GAAsB;IACzC,SAAS;IACT,UAAU;IACV,UAAU;IACV,QAAQ;IACR,YAAY;IACZ,gBAAgB;IAChB,cAAc;IACd,yBAAyB;IACzB,sBAAsB;IACtB,mBAAmB;IACnB,gBAAgB;IAChB,wBAAwB;IACxB,kBAAkB;IAClB,UAAU;IACV,gBAAgB;CACjB,CAAA;AAED,wGAAwG;AACxG,sGAAsG;AACtG,wGAAwG;AACxG,8FAA8F;AAC9F,MAAM,gBAAgB,GAAW,yCAAyC,CAAA;AAE1E,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACxE,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAa,EAA+B,EAAE,CAC/E,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,SAAS;IACpE,CAAC,CAAC;QACE;YACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;YAC3B,IAAI,EAAE,kCAAkC;YACxC,MAAM,EACJ,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,8CAA8C;gBAC/E,qEAAqE;SACxE;KACF;IACH,CAAC,CAAC,EAAE,CACP,CACF,CAAA;AAEH,MAAM,gBAAgB,GAAG,CACvB,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IAAI,QAAQ,KAAK,SAAS,IAAI,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACpE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,mBAAmB;QACzB,MAAM,EACJ,eAAe,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,2DAA2D;YAC3F,+FAA+F;YAC/F,+BAA+B;KAClC,CAAA;AACH,CAAC,CAAA;AAED,uGAAuG;AACvG,uGAAuG;AACvG,wGAAwG;AACxG,yGAAyG;AACzG,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC7E,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;KAC3F,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAOH,MAAM,iBAAiB,GAAW,yCAAyC,CAAA;AAE3E,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAA+B,EAAE,CAC3E,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAC3C,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;CAC/B,CAAC,CACH,CAAA;AAEH,sGAAsG;AACtG,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,CAAC,QAAgB,EAAW,EAAE;IAC9D,MAAM,IAAI,GAAiC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAC9E,OAAO,IAAI,EAAE,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;AAC5E,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAC5B,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjE,yBAAyB,CAAC,QAAQ,CAAC;QACnC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC/B,CAAC,QAA0B,EAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,KAAK,MAAM,CACnE,EACD,CAAC;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,6BAA6B;QACnC,MAAM,EACJ,gCAAgC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB;YACxE,iFAAiF;YACjF,iFAAiF;KACpF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACvE,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CACpE,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC;KACtB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CACnD,qBAAqB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAC3C;KACA,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AAEH,MAAM,eAAe,GAAW,4BAA4B,CAAA;AAE5D,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACzE,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CACvC,CAAC,KAAsB,EAAoB,EAAE,CAAC,CAAC;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;IACjC,IAAI,EAAE,oBAAoB;IAC1B,MAAM,EACJ,yFAAyF;QACzF,2CAA2C;CAC9C,CAAC,CACH,CAAA;AAEH,mGAAmG;AACnG,mGAAmG;AACnG,uGAAuG;AACvG,0FAA0F;AAC1F,MAAM,aAAa,GAAW,oDAAoD,CAAA;AAElF,0FAA0F;AAC1F,MAAM,yBAAyB,GAAG,CAChC,MAAc,EACd,IAAY,EACZ,KAAa,EACiB,EAAE;IAChC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACnD,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,QAAQ,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAA;IAC7F,IAAI,QAAQ,KAAK,SAAS,IAAI,yBAAyB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClE,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;QAC3B,IAAI,EAAE,yBAAyB;QAC/B,MAAM,EACJ,kCAAkC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gDAAgD;YACnG,8FAA8F;YAC9F,mCAAmC;KACtC,CAAA;AACH,CAAC,CAAA;AAED,oGAAoG;AACpG,sGAAsG;AACtG,uGAAuG;AACvG,iGAAiG;AACjG,MAAM,eAAe,GAAW,uDAAuD,CAAA;AACvF,oGAAoG;AACpG,iGAAiG;AACjG,EAAE;AACF,uGAAuG;AACvG,gGAAgG;AAChG,sGAAsG;AACtG,uGAAuG;AACvG,wGAAwG;AACxG,MAAM,sBAAsB,GAAW,2CAA2C,CAAA;AAElF,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAC9E,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAC,KAAsB,EAA+B,EAAE;IACtD,MAAM,SAAS,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,kEAAkE,SAAS,GAAG;aACvF;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAAC;IACnF,GAAG,uBAAuB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,GAAG,wBAAwB,CAAC,MAAM,CAAC;CACpC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAc,EAA+B,EAAE;IACnF,mGAAmG;IACnG,kFAAkF;IAClF,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO;QACL,GAAG,iBAAiB,CAAC,IAAI,CAAC;QAC1B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,sBAAsB,CAAC,IAAI,CAAC;QAC/B,GAAG,gBAAgB,CAAC,IAAI,CAAC;QACzB,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,oBAAoB,CAAC,IAAI,CAAC;QAC7B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,kBAAkB,CAAC,IAAI,CAAC;QAC3B,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,0BAA0B,CAAC,IAAI,CAAC;QACnC,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,uBAAuB,CAAC,IAAI,CAAC;QAChC,GAAG,+BAA+B,CAAC,IAAI,CAAC;KACzC,CAAA;AACH,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,QAAgB,EAChB,MAAc,EACe,EAAE;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,oGAAoG;IACpG,sBAAsB;IACtB,MAAM,IAAI,GAAW,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,OAAO,eAAe,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE,CAC3E,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;SACpB,GAAG,CAAC,CAAC,KAAa,EAAgC,EAAE,CACnD,yBAAyB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAC7C;SACA,MAAM,CACL,CAAC,SAAuC,EAAiC,EAAE,CACzE,SAAS,KAAK,SAAS,CAC1B,CACJ,CAAA;AACH,CAAC,CAAA"}

package/dist/relationship-cleanup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relationship-cleanup.d.ts","sourceRoot":"","sources":["../src/relationship-cleanup.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAG5B,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;CACrC;AAqGD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACrC,OAAO,SAAS,UAAU,EAAE,KAC3B,SAAS,gBAAgB,EA4B3B,CAAA"}
+{"version":3,"file":"relationship-cleanup.d.ts","sourceRoot":"","sources":["../src/relationship-cleanup.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAoC,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAG7F,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAA;CACrC;AAkGD;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACrC,OAAO,SAAS,UAAU,EAAE,KAC3B,SAAS,gBAAgB,EA4B3B,CAAA"}

package/dist/relationship-cleanup.js

@@ -1,9 +1,6 @@
-import { configBody, depthOneBlockKeys, depthOneValue, } from './payload-source.js';
-import { enclosingLiteral, lineOf, occurrences, stripComments } from './source-text.js';
-// Only the annotation and `satisfies` forms a collection is actually written in, matching
-// `payload-access.ts`. A global has no relationship column of its own to constrain.
-const COLLECTION_DECLARATION = /(:|satisfies)\s*CollectionConfig(?=[<=,)\s]|$)/g;
-const SATISFIES = 'satisfies';
+import { payloadConfigsIn } from './payload-configs.js';
+import { depthOneBlockKeys, depthOneValue } from './payload-source.js';
+import { enclosingLiteral, occurrences, stripComments } from './source-text.js';
 // The two field types that put a foreign key on the table rather than in the join table. `upload` is
 // one of them: it is a relationship to the media collection wearing a different name.
 const KEYED_FIELD_TYPES = ['relationship', 'upload'];
@@ -21,21 +18,24 @@ const slugOf = (body) => QUOTED_VALUE.exec(depthOneValue(body, 'slug') ?? '')?.[
 // A collection with drafts enabled gets no null constraint anywhere, so none of its required fields can
 // reach the contradiction.
 const declaresDrafts = (body) => DRAFTS_ENABLED.test(depthOneValue(body, 'versions') ?? '');
+// Which literal in a file IS a collection is `payload-configs.ts`'s question, and this rule asks it
+// there rather than carrying a second copy of the answer. A global is dropped: it has no relationship
+// column of its own to constrain. A collection with no readable slug is dropped too, because the whole
+// rule is a lookup by slug.
+//
 // Comments are blanked before anything is read, the way every other Payload rule reads a file. The keys
 // this rule looks for sit at depth one, and a depth-one key is recognised by the delimiter in front of
 // it - so a comment between the previous entry and `hooks:` hid the hook, and the rule reported a
 // collection that was guarded. `stripComments` preserves offsets and newlines, so the reported line is
 // still the line of the source.
-const collectionsIn = (file) => {
-    const source = stripComments(file.source);
-    return [...source.matchAll(COLLECTION_DECLARATION)].flatMap((match) => {
-        const body = configBody(source, match.index, match[1] === SATISFIES);
-        const slug = body === undefined ? undefined : slugOf(body);
-        return body === undefined || slug === undefined
-            ? []
-            : [{ path: file.path, slug, body, line: lineOf(source, match.index) }];
-    });
-};
+const collectionsIn = (file) => payloadConfigsIn(stripComments(file.source))
+    .filter((found) => found.kind.kind === 'collection')
+    .flatMap((found) => {
+    const slug = slugOf(found.body);
+    return slug === undefined
+        ? []
+        : [{ path: file.path, slug, body: found.body, line: found.line }];
+});
 // Every field of one collection that puts a NOT NULL column against another collection's primary key.
 // The field literal is recovered from the offset of its own `type` key, so a relationship nested inside
 // an array or a group is read exactly like one declared at the top: both get a column, on their own