@ploaness/governance 1.1.0 → 1.3.0

package/dist/oxlint-suppressions.js

@@ -0,0 +1,72 @@
+import { OXLINT_ACCESSIBILITY_NAMES, oxlintRuleNames, oxlintRules } from './oxlint-policy.js';
+const NATIVE = 'oxlint';
+const LEGACY = 'eslint';
+const DISABLE = 'disable';
+const CLAUSE_COUNT = 2;
+const RULES = oxlintRuleNames(oxlintRules(true));
+const LEGACY_RULES = new Set([...RULES].flatMap((rule) => [
+    rule,
+    rule.slice(rule.indexOf('/') + 1),
+]));
+const commentBody = (text) => text
+    .replace(/^\/\/?\*?/u, '')
+    .replace(/\*\/$/u, '')
+    .trim();
+/** Whether a native directive opens a suppression and therefore spends the existing budget. */
+export const isOxlintSuppression = (comment) => commentBody(comment.text).startsWith(`${NATIVE}-${DISABLE}`);
+const directiveProblems = (body, applicable) => {
+    const [declaration = '', explanation = ''] = body.split(' -- ', CLAUSE_COUNT);
+    const [form = '', ...names] = declaration.split(/\s+/u);
+    const rules = names
+        .join(' ')
+        .split(/[\s,]+/u)
+        .filter(Boolean);
+    return [
+        ...([`${NATIVE}-${DISABLE}-next-line`, `${NATIVE}-${DISABLE}-line`].includes(form)
+            ? []
+            : ['use a line or next-line Oxlint suppression, never a file-wide directive']),
+        ...(rules.length > 0 && rules.every((rule) => applicable.includes(rule))
+            ? []
+            : ['name the exact governed rule(s) active for this file']),
+        ...(explanation.trim().length > 0 ? [] : ['provide a suppression reason after --']),
+    ];
+};
+const isLegacySuppression = (body) => {
+    const isLegacy = body.startsWith(`${LEGACY}-${DISABLE}`) || body.startsWith(`${LEGACY}-enable`);
+    const declaration = (body.split('--', CLAUSE_COUNT)[0] ?? '').trim();
+    const isBlanket = [
+        `${LEGACY}-enable`,
+        `${LEGACY}-${DISABLE}`,
+        `${LEGACY}-${DISABLE}-next-line`,
+        `${LEGACY}-${DISABLE}-line`,
+    ].includes(declaration);
+    const hasNativeRule = declaration
+        .split(/[\s,:]+/u)
+        .some((name) => LEGACY_RULES.has(name) || name.startsWith('jsx-a11y/'));
+    const isInline = body.startsWith(`${LEGACY} `) && hasNativeRule;
+    return isInline || (isLegacy && (isBlanket || hasNativeRule));
+};
+/** A narrow directive for another ESLint rule remains that analyzer's responsibility. */
+export const isEslintOwnedSuppression = (comment) => {
+    const body = commentBody(comment.text);
+    return ((body.startsWith(`${LEGACY}-${DISABLE}`) || body.startsWith(`${LEGACY}-enable`)) &&
+        !isLegacySuppression(body));
+};
+/**
+ * Validate suppressions before the tool can obey them.
+ * @param comments parser-recognized source comments.
+ * @param applicable the canonical rules actually enabled for this file.
+ * @returns line-numbered findings for broad, stale-namespace, or unexplained directives.
+ */
+export const oxlintSuppressionProblems = (comments, applicable = OXLINT_ACCESSIBILITY_NAMES) => comments.flatMap((comment) => {
+    const body = commentBody(comment.text);
+    if (body.startsWith(`${NATIVE}-`)) {
+        return directiveProblems(body, applicable).map((problem) => `line ${String(comment.line)}: ${problem}`);
+    }
+    return isLegacySuppression(body)
+        ? [
+            `line ${String(comment.line)}: use a named, explained Oxlint line suppression for native-owned rules`,
+        ]
+        : [];
+});
+//# sourceMappingURL=oxlint-suppressions.js.map

package/dist/oxlint-suppressions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oxlint-suppressions.js","sourceRoot":"","sources":["../src/oxlint-suppressions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAQ7F,MAAM,MAAM,GAAW,QAAQ,CAAA;AAC/B,MAAM,MAAM,GAAW,QAAQ,CAAA;AAC/B,MAAM,OAAO,GAAW,SAAS,CAAA;AACjC,MAAM,YAAY,GAAW,CAAC,CAAA;AAC9B,MAAM,KAAK,GAAsB,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAA;AAEnE,MAAM,YAAY,GAAwB,IAAI,GAAG,CAC/C,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE,CAAC;IACtD,IAAI;IACJ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CAClC,CAAC,CACH,CAAA;AAED,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAC3C,IAAI;KACD,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;KACzB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;KACrB,IAAI,EAAE,CAAA;AAEX,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAsB,EAAW,EAAE,CACrE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,CAAA;AAE9D,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAE,UAA6B,EAAqB,EAAE;IAC3F,MAAM,CAAC,WAAW,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,CAAC,GAAsB,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IAChG,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,GAAG,KAAK,CAAC,GAAsB,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1E,MAAM,KAAK,GAAsB,KAAK;SACnC,IAAI,CAAC,GAAG,CAAC;SACT,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,OAAO,CAAC,CAAA;IAClB,OAAO;QACL,GAAG,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,YAAY,EAAE,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,yEAAyE,CAAC,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACvF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,sDAAsD,CAAC,CAAC;QAC7D,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,uCAAuC,CAAC,CAAC;KACpF,CAAA;AACH,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAW,EAAE;IACpD,MAAM,QAAQ,GACZ,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,SAAS,CAAC,CAAA;IAChF,MAAM,WAAW,GAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAC5E,MAAM,SAAS,GAAY;QACzB,GAAG,MAAM,SAAS;QAClB,GAAG,MAAM,IAAI,OAAO,EAAE;QACtB,GAAG,MAAM,IAAI,OAAO,YAAY;QAChC,GAAG,MAAM,IAAI,OAAO,OAAO;KAC5B,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;IACvB,MAAM,aAAa,GAAY,WAAW;SACvC,KAAK,CAAC,UAAU,CAAC;SACjB,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAA;IAC1F,MAAM,QAAQ,GAAY,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,aAAa,CAAA;IACxE,OAAO,QAAQ,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC,CAAA;AAC/D,CAAC,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,OAAsB,EAAW,EAAE;IAC1E,MAAM,IAAI,GAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,OAAO,CACL,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC;QAChF,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAC3B,CAAA;AACH,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CACvC,QAAkC,EAClC,aAAgC,0BAA0B,EACvC,EAAE,CACrB,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAsB,EAAqB,EAAE;IAC7D,MAAM,IAAI,GAAW,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAC5C,CAAC,OAAe,EAAU,EAAE,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CACxE,CAAA;IACH,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC;YACE,QAAQ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,yEAAyE;SACtG;QACH,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAC,CAAA"}

package/dist/paired-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paired-assets.d.ts","sourceRoot":"","sources":["../src/paired-assets.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAiCrD,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,4FAA4F;AAC5F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,SAAS,YAAY,EAAE,KAAG,SAAS,WAAW,EAY9E,CAAA;AAkBL;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,SAAS,gBAAgB,EAAE,KAClC,SAAS,gBAAgB,EAIxB,CAAA"}
+{"version":3,"file":"paired-assets.d.ts","sourceRoot":"","sources":["../src/paired-assets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAiCrD,0DAA0D;AAC1D,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,+DAA+D;IAC/D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,4FAA4F;AAC5F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1C;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,QAAQ,SAAS,YAAY,EAAE,KAAG,SAAS,WAAW,EAY9E,CAAA;AAkBL;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,SAAS,gBAAgB,EAAE,KAClC,SAAS,gBAAgB,EAIxB,CAAA"}

package/dist/paired-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"paired-assets.js","sourceRoot":"","sources":["../src/paired-assets.ts"],"names":[],"mappings":"AAaA,+FAA+F;AAC/F,MAAM,eAAe,GAAW,OAAO,CAAA;AAEvC,wGAAwG;AACxG,MAAM,YAAY,GAAW,QAAQ,CAAA;AAErC,kGAAkG;AAClG,wCAAwC;AACxC,EAAE;AACF,qGAAqG;AACrG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,uCAAuC;AACvC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,yBAAyB;AACzB,EAAE;AACF,qGAAqG;AACrG,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS;IAChE,0BAA0B;IAC1B,eAAe;IACf,4BAA4B;IAC5B,wCAAwC;IACxC,uCAAuC;IACvC,cAAc;CACf,CAAC,CAAA;AAyBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAA+B,EAA0B,EAAE,CACtF,MAAM;KACH,MAAM,CACL,CAAC,KAAmB,EAAW,EAAE,CAC/B,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;IAChE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CACxC;KACA,GAAG,CACF,CAAC,KAAmB,EAAe,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,KAAK,CAAC,IAAI;IACpB,SAAS,EAAE,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,GAAG,YAAY,EAAE;CAC7D,CAAC,CACH,CAAA;AAEL,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAsB,EAAE;IAClE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CACL,4BAA4B,KAAK,CAAC,IAAI,CAAC,SAAS,4BAA4B;YAC5E,2CAA2C,CAC5C,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,oDAAoD,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,sBAAsB,KAAK,CAAC,IAAI,CAAC,QAAQ,oBAAoB;YAClF,4DAA4D,CAAA;AACpE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAmC,EACN,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAuB,EAA+B,EAAE;IACtE,MAAM,MAAM,GAAuB,WAAW,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AAChF,CAAC,CAAC,CAAA"}
+{"version":3,"file":"paired-assets.js","sourceRoot":"","sources":["../src/paired-assets.ts"],"names":[],"mappings":"AAGA,+FAA+F;AAC/F,MAAM,eAAe,GAAW,OAAO,CAAA;AAEvC,wGAAwG;AACxG,MAAM,YAAY,GAAW,QAAQ,CAAA;AAErC,kGAAkG;AAClG,wCAAwC;AACxC,EAAE;AACF,qGAAqG;AACrG,uGAAuG;AACvG,uGAAuG;AACvG,mGAAmG;AACnG,qGAAqG;AACrG,oGAAoG;AACpG,uCAAuC;AACvC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,yBAAyB;AACzB,EAAE;AACF,qGAAqG;AACrG,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAS;IAChE,0BAA0B;IAC1B,eAAe;IACf,4BAA4B;IAC5B,wCAAwC;IACxC,uCAAuC;IACvC,cAAc;CACf,CAAC,CAAA;AAyBF;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAA+B,EAA0B,EAAE,CACtF,MAAM;KACH,MAAM,CACL,CAAC,KAAmB,EAAW,EAAE,CAC/B,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,CAAC;IAChE,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CACxC;KACA,GAAG,CACF,CAAC,KAAmB,EAAe,EAAE,CAAC,CAAC;IACrC,QAAQ,EAAE,KAAK,CAAC,IAAI;IACpB,SAAS,EAAE,GAAG,eAAe,IAAI,KAAK,CAAC,IAAI,GAAG,YAAY,EAAE;CAC7D,CAAC,CACH,CAAA;AAEL,MAAM,WAAW,GAAG,CAAC,KAAuB,EAAsB,EAAE;IAClE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,CACL,4BAA4B,KAAK,CAAC,IAAI,CAAC,SAAS,4BAA4B;YAC5E,2CAA2C,CAC5C,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,oDAAoD,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,YAAY;QAC7C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,sBAAsB,KAAK,CAAC,IAAI,CAAC,QAAQ,oBAAoB;YAClF,4DAA4D,CAAA;AACpE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAmC,EACN,EAAE,CAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,KAAuB,EAA+B,EAAE;IACtE,MAAM,MAAM,GAAuB,WAAW,CAAC,KAAK,CAAC,CAAA;IACrD,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AAChF,CAAC,CAAC,CAAA"}

package/dist/payload-access.d.ts

@@ -2,8 +2,14 @@ import { type PayloadViolation } from './payload-source.js';
 export declare const findUndeclaredAccess: (source: string) => readonly PayloadViolation[];
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
 export declare const findUnhardenedAuth: (source: string) => readonly PayloadViolation[];
+/** Report an auth collection that leaves who may clear a lockout to Payload's default. */
+export declare const findUnlockableAuth: (source: string) => readonly PayloadViolation[];
 /** Report a config whose drafts are readable by an unauthenticated client. */
 export declare const findAnonymousDraftReads: (source: string) => readonly PayloadViolation[];
+/** Report a config that keeps versions and leaves who may read them to Payload's fall-through. */
+export declare const findUndeclaredVersionReads: (source: string) => readonly PayloadViolation[];
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
 export declare const findUnrestrictedUploads: (source: string) => readonly PayloadViolation[];
+/** Report an upload collection that admits SVG, or may, without deciding the headers it is served with. */
+export declare const findUndecidedSvgHeaders: (source: string) => readonly PayloadViolation[];
 //# sourceMappingURL=payload-access.d.ts.map

package/dist/payload-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAe5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAqB5E,CAAA;AA8CH,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AA2CH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA"}
+{"version":3,"file":"payload-access.d.ts","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAaA,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAA;AAsB5B,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAqB5E,CAAA;AA8CH,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AA6BH,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK1E,CAAA;AAgDH,8EAA8E;AAC9E,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAe/E,CAAA;AAiBH,kGAAkG;AAClG,eAAO,MAAM,0BAA0B,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAkBlF,CAAA;AA6BH,4FAA4F;AAC5F,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA;AAsIH,2GAA2G;AAC3G,eAAO,MAAM,uBAAuB,GAAI,QAAQ,MAAM,KAAG,SAAS,gBAAgB,EAK/E,CAAA"}

package/dist/payload-access.js

@@ -7,12 +7,12 @@
 // make on the project's behalf if the project does not make it first.
 import { payloadConfigsIn, } from './payload-configs.js';
 import { configBody, depthOneBlockKeys, depthOneValue, } from './payload-source.js';
-import { NOT_FOUND, topLevelKeys } from './source-text.js';
+import { balancedArguments, NOT_FOUND, scanDelimited, topLevelKeys, } from './source-text.js';
 const eachConfig = (source, judge) => payloadConfigsIn(source).flatMap((found) => judge(found.kind, found));
 // Payload fills the missing operations in during sanitisation, so a partial access block is invisible
-// the moment the app boots - and its default for a non-auth collection is public read. Checking that
-// the word `access` appears somewhere in the file, which is what this rule used to do, accepted a block
-// that declared one operation out of four.
+// the moment the app boots - and its default admits every signed-in user to every operation. Checking
+// that the word `access` appears somewhere in the file, which is what this rule used to do, accepted a
+// block that declared one operation out of four.
 export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found) => {
     const declared = depthOneBlockKeys(found.body, 'access');
     const missing = kind.operations.filter((operation) => !declared.includes(operation));
@@ -23,8 +23,8 @@ export const findUndeclaredAccess = (source) => eachConfig(source, (kind, found)
                 line: found.line,
                 rule: 'require-complete-access',
                 reason: `a ${kind.label} must declare access for ${kind.operations.join(', ')}; ` +
-                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to the Payload ` +
-                    'defaults, which allow public read',
+                    `${missing.join(', ')} ${missing.length === 1 ? 'is' : 'are'} left to Payload's ` +
+                    'default, which admits every signed-in user',
             },
         ];
 });
@@ -65,6 +65,32 @@ const unhardenedAuthIn = (found) => {
 };
 /** Report an auth collection that leaves the login-attempt cap and lock time to Payload's defaults. */
 export const findUnhardenedAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unhardenedAuthIn(found) : []);
+// The cap above, undone from inside. `unlock` is one of the operations Payload fills the access block
+// with during sanitisation, so a collection that decides create, read, update and delete has still said
+// nothing about who may clear a locked account - and the default admits every signed-in user. One
+// ordinary account can therefore lift the lockout on another as fast as the attempts accrue, which
+// leaves the attempt cap and lock time enforced by the rule above protecting nothing. Advisory
+// GHSA-jg8r-5jh2-v2xj is this default, reported against Payload itself.
+const UNLOCK_OPERATION = 'unlock';
+const unlockableAuthIn = (found) => {
+    if (depthOneValue(found.body, 'auth') === undefined) {
+        return [];
+    }
+    const declared = depthOneBlockKeys(found.body, 'access');
+    return declared.includes(UNLOCK_OPERATION)
+        ? []
+        : [
+            {
+                line: found.line,
+                rule: 'require-unlock-access',
+                reason: `an auth collection must declare access for ${UNLOCK_OPERATION}; Payload fills it with ` +
+                    'a default that admits every signed-in user, so one account can clear the lockout on ' +
+                    'another and undo the attempt cap',
+            },
+        ];
+};
+/** Report an auth collection that leaves who may clear a lockout to Payload's default. */
+export const findUnlockableAuth = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unlockableAuthIn(found) : []);
 // A draft is unpublished content. With versions.drafts enabled, `?draft=true` serves it to whoever the
 // read rule admits - so a read that is unconditionally true publishes every draft to anyone.
 const DRAFTS_ENABLED = /drafts\s*:\s*(?:true|\{)/;
@@ -87,9 +113,14 @@ const blockEnd = (access, open) => {
 // collection itself were open to anyone.
 //
 // Only the inline form is decidable here, and the lint pass forbids that form in a config file, so a
-// conforming project writes `read: anyone` and this rule stays silent on it. What covers the conforming
-// case is the managed access-boundary sweep, which asks the running application what it grants rather
-// than reading the source. This rule reaches a config declared outside the linted directories.
+// conforming project writes `read: anyone` and this rule stays silent on it. This rule therefore
+// reaches only a config declared outside the linted directories.
+//
+// What covers the conforming case is `findUnconstrainedDraftReads` in payload-defaults.ts, which asks
+// the built configuration's own read rule what it answers a stranger and reads the constraint it hands
+// back. The anonymous sweep does NOT cover it: the sweep separates a grant carrying a query constraint
+// from one that does not, and never opens the constraint, so a read filtered by audience and not by
+// status passed it. That gap was open for as long as this comment claimed the sweep closed it.
 const isDraftExposed = (body) => {
     const versions = depthOneValue(body, 'versions');
     if (versions === undefined || !DRAFTS_ENABLED.test(versions)) {
@@ -113,6 +144,32 @@ export const findAnonymousDraftReads = (source) => eachConfig(source, (kind, fou
         },
     ]
     : []);
+// The read rule, bypassed by asking a different question. A version carries the whole document, and
+// `readVersions` is the one access operation Payload never fills in - for a collection or a global - so
+// an undeclared rule is not absent but open: `executeAccess` falls through to "any signed-in user" when
+// it is handed nothing. A read narrowed to an audience by a `Where` filter therefore still hands every
+// stored version of every document to anyone signed in. This is asked wherever versions are kept rather
+// than only where drafts are, because the versions route exists either way.
+const VERSIONS_DISABLED = /^\s*false\s*(?=[,}])/;
+const READ_VERSIONS_OPERATION = 'readVersions';
+const carriesVersions = (body) => {
+    const versions = depthOneValue(body, 'versions');
+    return versions !== undefined && !VERSIONS_DISABLED.test(versions);
+};
+/** Report a config that keeps versions and leaves who may read them to Payload's fall-through. */
+export const findUndeclaredVersionReads = (source) => eachConfig(source, (kind, found) => carriesVersions(found.body) &&
+    !depthOneBlockKeys(found.body, 'access').includes(READ_VERSIONS_OPERATION)
+    ? [
+        {
+            line: found.line,
+            rule: 'require-version-read-access',
+            reason: `a ${kind.label} that keeps versions must declare access for ` +
+                `${READ_VERSIONS_OPERATION}; Payload leaves it undeclared and then admits every ` +
+                'signed-in user, so a scoped read is bypassed by asking for a version of a document ' +
+                'instead of the document',
+        },
+    ]
+    : []);
 // `mimeTypes` defaults to undefined, so an upload collection takes whatever a client sends until the
 // project says otherwise. Served from the application's own origin, an uploaded SVG is script that runs
 // as the site, which is why the restriction is required rather than advised. No size cap is asked for
@@ -139,4 +196,104 @@ const unrestrictedUploadIn = (found) => {
 };
 /** Report an upload collection that accepts whatever file type Payload's defaults allow. */
 export const findUnrestrictedUploads = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? unrestrictedUploadIn(found) : []);
+// An upload collection that admits SVG and has not decided how the file is served.
+//
+// Payload adds `Content-Security-Policy: script-src 'none'` to an SVG file response, and refuses an SVG
+// whose text carries a script - but only on the branch where content detection found nothing and fell
+// back to the extension. An SVG that opens with an XML declaration is detected as XML, retyped as SVG,
+// and skips that check entirely. So a collection that admits SVG must decide the headers itself, through
+// `modifyResponseHeaders`, or through a `handlers` entry, which answers before the headers hook runs and
+// is therefore the same decision. Admission is read the way Payload reads it in `validateMimeType`: an
+// entry loses its first `*` and must be a prefix of the file's type, and an empty list admits everything.
+//
+// A list this reader cannot see - an imported constant, a spread, a call, a template with a
+// substitution - is treated as admitting SVG, because a rule whose silence means "safe" cannot be silent
+// where it cannot read. The repair is cheap either way: write the list inline, or declare the headers,
+// which cost an image nothing.
+const SVG_MIME_TYPE = 'image/svg+xml';
+const RESPONSE_HEADER_KEYS = ['modifyResponseHeaders', 'handlers'];
+const ARRAY_OPEN = '[';
+const EMPTY_LIST = '[]';
+// A quoted string with nothing that could be a substitution inside it; a MIME type carries no quote.
+const STRING_LITERAL = /^(['"`])([^'"`$]*)\1$/;
+// The upload block alone, cut where its own braces close. `depthOneValue` runs to the end of the
+// collection literal, so a depth-one key looked for in that slice would also be found in the NEXT
+// block: `admin: { mimeTypes: ... }` would answer for `upload`.
+const uploadBlockOf = (found) => {
+    const value = depthOneValue(found.body, 'upload');
+    if (value === undefined) {
+        return undefined;
+    }
+    const open = value.indexOf('{');
+    return value.trimStart().startsWith('{') ? value.slice(open, blockEnd(value, open)) : undefined;
+};
+const coversSvg = (entry) => SVG_MIME_TYPE.startsWith(entry.replace('*', ''));
+// The depth-zero elements of an array's inner text. `topLevelSlice` cannot serve here: the scanner
+// jumps a string literal whole, so that slice drops exactly the characters this rule reads.
+const arrayElements = (inner) => {
+    const commas = scanDelimited(inner, 0, (found, step) => step.character === ',' && step.depth === 0
+        ? { state: [...found, step.index], stop: false }
+        : { state: found, stop: false }, []);
+    const bounds = [-1, ...commas, inner.length];
+    return bounds
+        .slice(0, -1)
+        .map((start, position) => inner.slice(start + 1, bounds[position + 1] ?? inner.length).trim())
+        .filter((element) => element.length > 0);
+};
+const literalOf = (element) => STRING_LITERAL.exec(element)?.[2];
+// A provable admission outranks an unreadable neighbour, so `[...IMAGE_TYPES, 'image/svg+xml']` is
+// reported for the entry that can be named rather than for the spread that cannot.
+const svgAdmissionOf = (raw) => {
+    if (!raw.trimStart().startsWith(ARRAY_OPEN)) {
+        return { verdict: 'unreadable' };
+    }
+    const inner = balancedArguments(raw, raw.indexOf(ARRAY_OPEN));
+    if (inner === undefined) {
+        return { verdict: 'unreadable' };
+    }
+    const elements = arrayElements(inner);
+    if (elements.length === 0) {
+        return { verdict: 'admitted', entry: EMPTY_LIST };
+    }
+    const literals = elements.map((element) => literalOf(element));
+    const admitting = literals.find((literal) => literal !== undefined && coversSvg(literal));
+    if (admitting !== undefined) {
+        return { verdict: 'admitted', entry: admitting };
+    }
+    return literals.every((literal) => literal !== undefined)
+        ? { verdict: 'excluded' }
+        : { verdict: 'unreadable' };
+};
+const SVG_REPAIR = 'set Content-Disposition: attachment and Content-Security-Policy: sandbox in modifyResponseHeaders';
+const SVG_HAZARD = 'an SVG served from this origin is script that runs as the site';
+const svgReason = (admission) => {
+    const preamble = `an upload collection admitting SVG must declare ${RESPONSE_HEADER_KEYS.join(' or ')}; `;
+    if (admission.verdict === 'unreadable') {
+        return (`${preamble}mimeTypes here is not an inline list of string literals, so whether it admits ` +
+            `${SVG_MIME_TYPE} cannot be read from this file, and ${SVG_HAZARD}; write the list inline, or ${SVG_REPAIR}`);
+    }
+    const admits = admission.entry === EMPTY_LIST
+        ? `the empty mimeTypes list admits every type, ${SVG_MIME_TYPE} included`
+        : `the mimeTypes entry '${admission.entry}' admits ${SVG_MIME_TYPE}`;
+    return (`${preamble}${admits}, ${SVG_HAZARD}, and Payload's own scripted-SVG check skips a file that ` +
+        `opens with an XML declaration; ${SVG_REPAIR}, or drop the entry`);
+};
+const undecidedSvgHeadersIn = (found) => {
+    const block = uploadBlockOf(found);
+    if (block === undefined) {
+        return [];
+    }
+    const keys = topLevelKeys(block, 0);
+    // An absent list is the restriction rule's finding, so one collection never carries both.
+    if (!keys.includes(UPLOAD_RESTRICTION) ||
+        RESPONSE_HEADER_KEYS.some((key) => keys.includes(key))) {
+        return [];
+    }
+    const admission = svgAdmissionOf(depthOneValue(block, UPLOAD_RESTRICTION) ?? '');
+    return admission.verdict === 'excluded'
+        ? []
+        : [{ line: found.line, rule: 'require-svg-response-headers', reason: svgReason(admission) }];
+};
+/** Report an upload collection that admits SVG, or may, without deciding the headers it is served with. */
+export const findUndecidedSvgHeaders = (source) => eachConfig(source, (kind, found) => kind.label === COLLECTION ? undecidedSvgHeadersIn(found) : []);
 //# sourceMappingURL=payload-access.js.map

package/dist/payload-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,qGAAqG;AACrG,wGAAwG;AACxG,2CAA2C;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,uBAAuB;oBACnF,mCAAmC;aACtC;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA"}
+{"version":3,"file":"payload-access.js","sourceRoot":"","sources":["../src/payload-access.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,sCAAsC;AACtC,EAAE;AACF,iGAAiG;AACjG,wGAAwG;AACxG,uGAAuG;AACvG,sEAAsE;AAEtE,OAAO,EAGL,gBAAgB,GACjB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,UAAU,EACV,iBAAiB,EACjB,aAAa,GAEd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,iBAAiB,EAEjB,SAAS,EAET,aAAa,EACb,YAAY,GACb,MAAM,kBAAkB,CAAA;AAEzB,MAAM,UAAU,GAAG,CACjB,MAAc,EACd,KAA0F,EAC7D,EAAE,CAC/B,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,KAAyB,EAA+B,EAAE,CAC1F,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CACzB,CAAA;AAEH,sGAAsG;AACtG,sGAAsG;AACtG,uGAAuG;AACvG,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAClF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE;IAClF,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,MAAM,OAAO,GAAsB,IAAI,CAAC,UAAU,CAAC,MAAM,CACvD,CAAC,SAAiB,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC9D,CAAA;IACD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,yBAAyB;gBAC/B,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,4BAA4B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;oBACzE,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,qBAAqB;oBACjF,4CAA4C;aAC/C;SACF,CAAA;AACP,CAAC,CACF,CAAA;AAEH,oGAAoG;AACpG,qGAAqG;AACrG,0CAA0C;AAC1C,MAAM,mBAAmB,GAAsB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAA;AAE/E,MAAM,UAAU,GAAW,kBAAkB,CAAA;AAE7C,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAA2B,4CAA4C,CAAC,IAAI,CACrF,KAAK,IAAI,EAAE,CACZ,CAAA;IACD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAClF,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,OAAO,GAAsB,mBAAmB,CAAC,MAAM,CAC3D,CAAC,GAAW,EAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAClD,CAAA;IACD,MAAM,QAAQ,GAAsB,mBAAmB,CAAC,MAAM,CAAC,CAAC,GAAW,EAAW,EAAE;QACtF,MAAM,OAAO,GAAuB,aAAa,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;QAC5E,OAAO,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;IACF,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAClD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EACJ,mCAAmC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;oBACxE,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;oBACrE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;oBAC5E,6EAA6E;aAChF;SACF,CAAA;AACP,CAAC,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,sGAAsG;AACtG,wGAAwG;AACxG,kGAAkG;AAClG,mGAAmG;AACnG,+FAA+F;AAC/F,wEAAwE;AACxE,MAAM,gBAAgB,GAAW,QAAQ,CAAA;AAEzC,MAAM,gBAAgB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IAClF,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAC3E,OAAO,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QACxC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EACJ,8CAA8C,gBAAgB,0BAA0B;oBACxF,sFAAsF;oBACtF,kCAAkC;aACrC;SACF,CAAA;AACP,CAAC,CAAA;AAED,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,MAAc,EAA+B,EAAE,CAChF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC3D,CAAA;AAEH,uGAAuG;AACvG,6FAA6F;AAC7F,MAAM,cAAc,GAAW,0BAA0B,CAAA;AAEzD,+BAA+B;AAC/B,EAAE;AACF,uGAAuG;AACvG,qGAAqG;AACrG,oGAAoG;AACpG,qGAAqG;AACrG,uFAAuF;AACvF,MAAM,gBAAgB,GAAW,2CAA2C,CAAA;AAE5E,uGAAuG;AACvG,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACxD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IACzE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAA;AAChE,CAAC,CAAA;AAED,oGAAoG;AACpG,2FAA2F;AAC3F,+FAA+F;AAC/F,yCAAyC;AACzC,EAAE;AACF,qGAAqG;AACrG,iGAAiG;AACjG,iEAAiE;AACjE,EAAE;AACF,sGAAsG;AACtG,uGAAuG;AACvG,uGAAuG;AACvG,oGAAoG;AACpG,+FAA+F;AAC/F,MAAM,cAAc,GAAG,CAAC,IAAY,EAAW,EAAE;IAC/C,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,MAAM,GAAuB,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAChE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,IAAI,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC;IACxB,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,0BAA0B;YAChC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,oEAAoE;gBACnF,8EAA8E;SACjF;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,oGAAoG;AACpG,wGAAwG;AACxG,wGAAwG;AACxG,uGAAuG;AACvG,wGAAwG;AACxG,4EAA4E;AAC5E,MAAM,iBAAiB,GAAW,sBAAsB,CAAA;AAExD,MAAM,uBAAuB,GAAW,cAAc,CAAA;AAEtD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE;IAChD,MAAM,QAAQ,GAAuB,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACpE,OAAO,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,MAAc,EAA+B,EAAE,CACxF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3B,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC;IACxE,CAAC,CAAC;QACE;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,6BAA6B;YACnC,MAAM,EACJ,KAAK,IAAI,CAAC,KAAK,+CAA+C;gBAC9D,GAAG,uBAAuB,uDAAuD;gBACjF,qFAAqF;gBACrF,yBAAyB;SAC5B;KACF;IACH,CAAC,CAAC,EAAE,CACT,CAAA;AAEH,qGAAqG;AACrG,wGAAwG;AACxG,sGAAsG;AACtG,6EAA6E;AAC7E,MAAM,kBAAkB,GAAW,WAAW,CAAA;AAE9C,MAAM,oBAAoB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACtF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QACnE,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IACN,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EACJ,qCAAqC,kBAAkB,+BAA+B;oBACtF,8EAA8E;aACjF;SACF,CAAA;AACP,CAAC,CAAA;AAED,4FAA4F;AAC5F,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAC/D,CAAA;AAEH,mFAAmF;AACnF,EAAE;AACF,wGAAwG;AACxG,sGAAsG;AACtG,uGAAuG;AACvG,yGAAyG;AACzG,yGAAyG;AACzG,uGAAuG;AACvG,0GAA0G;AAC1G,EAAE;AACF,4FAA4F;AAC5F,yGAAyG;AACzG,uGAAuG;AACvG,+BAA+B;AAC/B,MAAM,aAAa,GAAW,eAAe,CAAA;AAC7C,MAAM,oBAAoB,GAAsB,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAA;AACrF,MAAM,UAAU,GAAW,GAAG,CAAA;AAC9B,MAAM,UAAU,GAAW,IAAI,CAAA;AAC/B,qGAAqG;AACrG,MAAM,cAAc,GAAW,uBAAuB,CAAA;AAOtD,iGAAiG;AACjG,kGAAkG;AAClG,gEAAgE;AAChE,MAAM,aAAa,GAAG,CAAC,KAAyB,EAAsB,EAAE;IACtE,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,IAAI,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACvC,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,KAAa,EAAW,EAAE,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAA;AAE9F,mGAAmG;AACnG,4FAA4F;AAC5F,MAAM,aAAa,GAAG,CAAC,KAAa,EAAqB,EAAE;IACzD,MAAM,MAAM,GAAsB,aAAa,CAC7C,KAAK,EACL,CAAC,EACD,CAAC,KAAwB,EAAE,IAAc,EAA6B,EAAE,CACtE,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC;QACxC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;QAChD,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EACnC,EAAE,CACH,CAAA;IACD,MAAM,MAAM,GAAsB,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;IAC/D,OAAO,MAAM;SACV,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,GAAG,CAAC,CAAC,KAAa,EAAE,QAAgB,EAAU,EAAE,CAC/C,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CACpE;SACA,MAAM,CAAC,CAAC,OAAe,EAAW,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAC7D,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,OAAe,EAAsB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE5F,mGAAmG;AACnG,mFAAmF;AACnF,MAAM,cAAc,GAAG,CAAC,GAAW,EAAgB,EAAE;IACnD,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAClC,CAAC;IACD,MAAM,QAAQ,GAAsB,aAAa,CAAC,KAAK,CAAC,CAAA;IACxD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;IACnD,CAAC;IACD,MAAM,QAAQ,GAAoC,QAAQ,CAAC,GAAG,CAC5D,CAAC,OAAe,EAAsB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAC5D,CAAA;IACD,MAAM,SAAS,GAAuB,QAAQ,CAAC,IAAI,CACjD,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,CACtF,CAAA;IACD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;IAClD,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,OAA2B,EAAW,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;QACpF,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;QACzB,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AAC/B,CAAC,CAAA;AAED,MAAM,UAAU,GACd,mGAAmG,CAAA;AACrG,MAAM,UAAU,GAAW,gEAAgE,CAAA;AAE3F,MAAM,SAAS,GAAG,CAAC,SAAkE,EAAU,EAAE;IAC/F,MAAM,QAAQ,GAAW,mDAAmD,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IACjH,IAAI,SAAS,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACvC,OAAO,CACL,GAAG,QAAQ,gFAAgF;YAC3F,GAAG,aAAa,uCAAuC,UAAU,+BAA+B,UAAU,EAAE,CAC7G,CAAA;IACH,CAAC;IACD,MAAM,MAAM,GACV,SAAS,CAAC,KAAK,KAAK,UAAU;QAC5B,CAAC,CAAC,+CAA+C,aAAa,WAAW;QACzE,CAAC,CAAC,wBAAwB,SAAS,CAAC,KAAK,YAAY,aAAa,EAAE,CAAA;IACxE,OAAO,CACL,GAAG,QAAQ,GAAG,MAAM,KAAK,UAAU,2DAA2D;QAC9F,kCAAkC,UAAU,qBAAqB,CAClE,CAAA;AACH,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,CAAC,KAAyB,EAA+B,EAAE;IACvF,MAAM,KAAK,GAAuB,aAAa,CAAC,KAAK,CAAC,CAAA;IACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAsB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAA;IACtD,0FAA0F;IAC1F,IACE,CAAC,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAClC,oBAAoB,CAAC,IAAI,CAAC,CAAC,GAAW,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EACvE,CAAC;QACD,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAiB,cAAc,CAAC,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU;QACrC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,8BAA8B,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;AAChG,CAAC,CAAA;AAED,2GAA2G;AAC3G,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAc,EAA+B,EAAE,CACrF,UAAU,CACR,MAAM,EACN,CAAC,IAAuB,EAAE,KAAyB,EAA+B,EAAE,CAClF,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAChE,CAAA"}

package/dist/payload-bootstrap.d.ts

@@ -0,0 +1,52 @@
+import type { SpecSource } from './axe-coverage.js';
+import type { LocatedViolation } from './relationship-cleanup.js';
+/**
+ * The Local API operations that change stored state.
+ *
+ * Derived from the one catalogue rather than written out again: a second list is a second thing to keep
+ * in step, and the two would disagree the first time Payload gained an operation. A read at boot is
+ * legitimate and deliberately absent from this set.
+ */
+export declare const LOCAL_API_MUTATIONS: readonly string[];
+/** The body of a configuration's boot hook, and the line its configuration begins on. */
+export interface BootstrapHook {
+    readonly body: string;
+    readonly line: number;
+}
+/**
+ * The boot hook every root configuration in a source declares.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per configuration that declares `onInit` with a body.
+ */
+export declare const bootstrapHooksIn: (code: string) => readonly BootstrapHook[];
+/**
+ * The module specifier a name is imported from.
+ * @param code the importing file's text.
+ * @param name the imported binding to find.
+ * @returns the specifier, or undefined when the file imports no such name.
+ */
+export declare const moduleOfImport: (code: string, name: string) => string | undefined;
+/**
+ * The repository-relative paths a specifier could name, in the order a resolver would try them.
+ * @param specifier the module specifier as written.
+ * @param fromPath the member-relative path of the importing file.
+ * @returns the candidate paths, empty when the specifier names a package rather than project source.
+ */
+export declare const candidatePathsFor: (specifier: string, fromPath: string) => readonly string[];
+/**
+ * The body of a named export.
+ * @param source the module's text, with comments already stripped.
+ * @param name the exported binding to read.
+ * @returns the body, or undefined when the module exports no such binding with one.
+ */
+export declare const exportedBodyIn: (source: string, name: string) => string | undefined;
+/**
+ * Report every Local API write a boot hook performs, or reaches in one call.
+ *
+ * Reported against the configuration that schedules the write rather than the module that performs it:
+ * the module may be a legitimate seed, and what makes it a defect is being wired into `onInit`.
+ * @param files every source file of the member, as read.
+ * @returns one violation per write, located on the configuration that declares the hook.
+ */
+export declare const findBootstrapWrites: (files: readonly SpecSource[]) => readonly LocatedViolation[];
+//# sourceMappingURL=payload-bootstrap.d.ts.map

package/dist/payload-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-bootstrap.d.ts","sourceRoot":"","sources":["../src/payload-bootstrap.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAajE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAEhD,CAAA;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAaD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,MAAM,MAAM,KAAG,SAAS,aAAa,EAKlE,CAAA;AAkDJ;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAI3D,CAAA;AAkCV;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,WAAW,MAAM,EAAE,UAAU,MAAM,KAAG,SAAS,MAAM,EAQtF,CAAA;AAgBD;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,EAAE,MAAM,MAAM,KAAG,MAAM,GAAG,SAGtE,CAAA;AAiDD;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,SAAS,UAAU,EAAE,KAAG,SAAS,gBAAgB,EAexF,CAAA"}

package/dist/payload-bootstrap.js

@@ -0,0 +1,195 @@
+import { rootConfigsIn } from './payload-database.js';
+import { LOCAL_API_CALLS, PAYLOAD_RECEIVER } from './payload-policy.js';
+import { depthOneValue } from './payload-source.js';
+import { balancedArguments, NOT_FOUND, occurrences, stripComments } from './source-text.js';
+/** The operations that change stored state, named as the catalogue spells them. */
+const MUTATION_NAMES = new Set([
+    'create',
+    'delete',
+    'restoreGlobalVersion',
+    'restoreVersion',
+    'update',
+    'updateGlobal',
+]);
+/**
+ * The Local API operations that change stored state.
+ *
+ * Derived from the one catalogue rather than written out again: a second list is a second thing to keep
+ * in step, and the two would disagree the first time Payload gained an operation. A read at boot is
+ * legitimate and deliberately absent from this set.
+ */
+export const LOCAL_API_MUTATIONS = LOCAL_API_CALLS.filter((call) => MUTATION_NAMES.has(call.slice(1, -1)));
+const ARROW = '=>';
+// The body a hook value opens, found after the arrow rather than at the first brace: a hook written
+// `async ({ payload }) => { ... }` destructures before it opens, and the first brace is that pattern.
+const hookBodyIn = (value) => {
+    const arrow = value.indexOf(ARROW);
+    const from = arrow === NOT_FOUND ? 0 : arrow + ARROW.length;
+    const open = value.indexOf('{', from);
+    return open === NOT_FOUND ? undefined : balancedArguments(value, open);
+};
+/**
+ * The boot hook every root configuration in a source declares.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per configuration that declares `onInit` with a body.
+ */
+export const bootstrapHooksIn = (code) => rootConfigsIn(code).flatMap((config) => {
+    const value = depthOneValue(config.body, 'onInit');
+    const body = value === undefined ? undefined : hookBodyIn(value);
+    return body === undefined ? [] : [{ body, line: config.line }];
+});
+// A Local API mutation performed on a Payload receiver, anywhere in a body.
+//
+// Distinct operations, not occurrences: a seed that writes two globals performs `updateGlobal` twice,
+// and reporting it twice would print the same sentence twice for one repair. What the reader has to act
+// on is that the body writes at all.
+const mutationsIn = (body) => [
+    ...new Set(LOCAL_API_MUTATIONS.flatMap((call) => occurrences(body, call)
+        .filter((found) => PAYLOAD_RECEIVER.test(body.slice(0, found)))
+        .map(() => call.slice(1, -1)))),
+];
+// The names a body calls. The keywords are removed because `if (` and `while (` are indistinguishable
+// from a call by this pattern, and a keyword can never name an import.
+const CALLED_IDENTIFIER = /\b([a-z_$][\w$]*)\s*\(/gi;
+const STATEMENT_KEYWORDS = new Set([
+    'await',
+    'catch',
+    'for',
+    'function',
+    'if',
+    'return',
+    'switch',
+    'typeof',
+    'while',
+]);
+const calledNamesIn = (body) => [
+    ...new Set([...body.matchAll(CALLED_IDENTIFIER)]
+        .map((match) => match[1] ?? '')
+        .filter((name) => !STATEMENT_KEYWORDS.has(name))),
+];
+// Every quantifier here is bounded by a literal that cannot itself match, so the scan is linear: a
+// binding clause runs to the one brace that closes it, and a specifier to the one quote that ends it.
+const IMPORT_BINDING = /\bimport\s+\{([^}]+)\}\s+from\s*['"]([^'"]+)['"]/g;
+const boundNames = (clause) => clause
+    .split(',')
+    .map((binding) => binding.trim().split(/\s+/).at(-1) ?? '')
+    .filter((name) => name.length > 0);
+/**
+ * The module specifier a name is imported from.
+ * @param code the importing file's text.
+ * @param name the imported binding to find.
+ * @returns the specifier, or undefined when the file imports no such name.
+ */
+export const moduleOfImport = (code, name) => [...code.matchAll(IMPORT_BINDING)]
+    .filter((match) => boundNames(match[1] ?? '').includes(name))
+    .map((match) => match[2])
+    .at(0);
+const SOURCE_EXTENSIONS = ['.ts', '.tsx'];
+const ALIAS = '@/';
+const ALIAS_ROOT = 'src/';
+const directoryOf = (filePath) => {
+    const slash = filePath.lastIndexOf('/');
+    return slash === NOT_FOUND ? '' : filePath.slice(0, slash);
+};
+// `.` and `..` resolved without node:path, which keeps this layer free of every runtime module.
+const flattened = (segments) => segments.reduce((kept, segment) => {
+    if (segment === '' || segment === '.') {
+        return kept;
+    }
+    return segment === '..' ? kept.slice(0, -1) : [...kept, segment];
+}, []);
+// The path a specifier names before an extension is tried. A package specifier resolves to nothing,
+// which is what keeps the rule inside the member's own source.
+const resolvedBase = (specifier, fromPath) => {
+    if (specifier.startsWith(ALIAS)) {
+        return `${ALIAS_ROOT}${specifier.slice(ALIAS.length)}`;
+    }
+    return specifier.startsWith('.')
+        ? flattened([...directoryOf(fromPath).split('/'), ...specifier.split('/')]).join('/')
+        : undefined;
+};
+/**
+ * The repository-relative paths a specifier could name, in the order a resolver would try them.
+ * @param specifier the module specifier as written.
+ * @param fromPath the member-relative path of the importing file.
+ * @returns the candidate paths, empty when the specifier names a package rather than project source.
+ */
+export const candidatePathsFor = (specifier, fromPath) => {
+    const base = resolvedBase(specifier, fromPath);
+    return base === undefined
+        ? []
+        : [
+            ...SOURCE_EXTENSIONS.map((extension) => `${base}${extension}`),
+            `${base}/index.ts`,
+        ];
+};
+// The body of one named export, so a module holding an unrelated writer beside the function the hook
+// actually calls is not reported for the writer it never reached.
+const declarationOf = (name) => new RegExp(String.raw `export\s+(?:async\s+)?(?:function\s+|const\s+)${name}\b`);
+const bodyAfter = (source, at) => {
+    const open = source.indexOf('(', at);
+    const parameters = open === NOT_FOUND ? undefined : balancedArguments(source, open);
+    const from = parameters === undefined ? at : open + parameters.length + 1;
+    const brace = source.indexOf('{', from);
+    return brace === NOT_FOUND ? undefined : balancedArguments(source, brace);
+};
+/**
+ * The body of a named export.
+ * @param source the module's text, with comments already stripped.
+ * @param name the exported binding to read.
+ * @returns the body, or undefined when the module exports no such binding with one.
+ */
+export const exportedBodyIn = (source, name) => {
+    const found = declarationOf(name).exec(source);
+    return found === null ? undefined : bodyAfter(source, found.index);
+};
+const RULE = 'no-boot-time-writes';
+const REPAIR = 'move the write behind a command the project runs deliberately, such as a seed script invoked by ' +
+    'its own package script';
+const directReason = (call) => `onInit: must not write through the Local API; ${call}() here runs on every boot of every ` +
+    'container, so a restart, a new replica and a redeploy each overwrite whatever an editor last ' +
+    `saved - ${REPAIR}`;
+const reachedReason = (name, specifier, call) => `onInit: must not reach a Local API write; it calls ${name}() from "${specifier}", which runs ` +
+    `${call}() in its own body, so every boot of every container overwrites whatever an editor last ` +
+    `saved - ${REPAIR}`;
+const sourceAt = (files, paths) => files
+    .filter((file) => paths.includes(file.path))
+    .map((file) => stripComments(file.source))
+    .at(0);
+// One call out of the hook: the name has to be imported, the module has to be one of this member's own
+// files, and the export it names has to perform the write itself.
+const reachedWrites = (code, hook, file, files) => calledNamesIn(hook.body).flatMap((name) => {
+    const specifier = moduleOfImport(code, name);
+    if (specifier === undefined) {
+        return [];
+    }
+    const target = sourceAt(files, candidatePathsFor(specifier, file.path));
+    const body = target === undefined ? undefined : exportedBodyIn(target, name);
+    return body === undefined
+        ? []
+        : mutationsIn(body).map((call) => ({
+            line: hook.line,
+            rule: RULE,
+            reason: reachedReason(name, specifier, call),
+        }));
+});
+/**
+ * Report every Local API write a boot hook performs, or reaches in one call.
+ *
+ * Reported against the configuration that schedules the write rather than the module that performs it:
+ * the module may be a legitimate seed, and what makes it a defect is being wired into `onInit`.
+ * @param files every source file of the member, as read.
+ * @returns one violation per write, located on the configuration that declares the hook.
+ */
+export const findBootstrapWrites = (files) => files.flatMap((file) => {
+    const code = stripComments(file.source);
+    return bootstrapHooksIn(code).flatMap((hook) => [
+        ...mutationsIn(hook.body).map((call) => ({
+            line: hook.line,
+            rule: RULE,
+            reason: directReason(call),
+        })),
+        ...reachedWrites(code, hook, file, files),
+    ].map((violation) => ({ path: file.path, violation })));
+});
+//# sourceMappingURL=payload-bootstrap.js.map