@ploaness/governance 1.1.0 → 1.3.0

package/dist/payload-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-bootstrap.js","sourceRoot":"","sources":["../src/payload-bootstrap.ts"],"names":[],"mappings":"AAYA,OAAO,EAAwB,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC3E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAE1E,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAE3F,mFAAmF;AACnF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC;IAClD,QAAQ;IACR,QAAQ;IACR,sBAAsB;IACtB,gBAAgB;IAChB,QAAQ;IACR,cAAc;CACf,CAAC,CAAA;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAsB,eAAe,CAAC,MAAM,CAC1E,CAAC,IAAY,EAAW,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACjE,CAAA;AAQD,MAAM,KAAK,GAAW,IAAI,CAAA;AAE1B,oGAAoG;AACpG,sGAAsG;AACtG,MAAM,UAAU,GAAG,CAAC,KAAa,EAAsB,EAAE;IACvD,MAAM,KAAK,GAAW,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC1C,MAAM,IAAI,GAAW,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;IACnE,MAAM,IAAI,GAAW,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC7C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AACxE,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAA4B,EAAE,CACzE,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAuB,EAA4B,EAAE;IAChF,MAAM,KAAK,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACtE,MAAM,IAAI,GAAuB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;IACpF,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAChE,CAAC,CAAC,CAAA;AAEJ,4EAA4E;AAC5E,EAAE;AACF,sGAAsG;AACtG,wGAAwG;AACxG,qCAAqC;AACrC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC;IACvD,GAAG,IAAI,GAAG,CACR,mBAAmB,CAAC,OAAO,CAAC,CAAC,IAAY,EAAqB,EAAE,CAC9D,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC;SACpB,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;SAC/E,GAAG,CAAC,GAAW,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CACxC,CACF;CACF,CAAA;AAED,sGAAsG;AACtG,uEAAuE;AACvE,MAAM,iBAAiB,GAAW,0BAA0B,CAAA;AAC5D,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,OAAO;IACP,OAAO;IACP,KAAK;IACL,UAAU;IACV,IAAI;IACJ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,OAAO;CACR,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAqB,EAAE,CAAC;IACzD,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,KAAsB,EAAU,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACvD,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CACpE;CACF,CAAA;AAED,mGAAmG;AACnG,sGAAsG;AACtG,MAAM,cAAc,GAAW,mDAAmD,CAAA;AAElF,MAAM,UAAU,GAAG,CAAC,MAAc,EAAqB,EAAE,CACvD,MAAM;KACH,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KAC1E,MAAM,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE,CAC/E,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;KAC/B,MAAM,CAAC,CAAC,KAAsB,EAAW,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;KACtF,GAAG,CAAC,CAAC,KAAsB,EAAsB,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC7D,EAAE,CAAC,CAAC,CAAC,CAAA;AAEV,MAAM,iBAAiB,GAAsB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC5D,MAAM,KAAK,GAAW,IAAI,CAAA;AAC1B,MAAM,UAAU,GAAW,MAAM,CAAA;AAEjC,MAAM,WAAW,GAAG,CAAC,QAAgB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAW,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED,gGAAgG;AAChG,MAAM,SAAS,GAAG,CAAC,QAA2B,EAAqB,EAAE,CACnE,QAAQ,CAAC,MAAM,CACb,CAAC,IAAuB,EAAE,OAAe,EAAqB,EAAE;IAC9D,IAAI,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;AAClE,CAAC,EACD,EAAE,CACH,CAAA;AAEH,oGAAoG;AACpG,+DAA+D;AAC/D,MAAM,YAAY,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAsB,EAAE;IAC/E,IAAI,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,GAAG,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAA;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACrF,CAAC,CAAC,SAAS,CAAA;AACf,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,QAAgB,EAAqB,EAAE;IAC1F,MAAM,IAAI,GAAuB,YAAY,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAClE,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAiB,EAAU,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;YAC9E,GAAG,IAAI,WAAW;SACnB,CAAA;AACP,CAAC,CAAA;AAED,qGAAqG;AACrG,kEAAkE;AAClE,MAAM,aAAa,GAAG,CAAC,IAAY,EAAU,EAAE,CAC7C,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,iDAAiD,IAAI,IAAI,CAAC,CAAA;AAEjF,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,EAAU,EAAsB,EAAE;IACnE,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAC5C,MAAM,UAAU,GACd,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAClE,MAAM,IAAI,GAAW,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAA;IACjF,MAAM,KAAK,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAC/C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAC3E,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,IAAY,EAAsB,EAAE;IACjF,MAAM,KAAK,GAA2B,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC,CAAA;AAED,MAAM,IAAI,GAAW,qBAAqB,CAAA;AAC1C,MAAM,MAAM,GACV,kGAAkG;IAClG,wBAAwB,CAAA;AAE1B,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE,CAC5C,iDAAiD,IAAI,sCAAsC;IAC3F,+FAA+F;IAC/F,WAAW,MAAM,EAAE,CAAA;AAErB,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,IAAY,EAAU,EAAE,CAC9E,sDAAsD,IAAI,YAAY,SAAS,gBAAgB;IAC/F,GAAG,IAAI,0FAA0F;IACjG,WAAW,MAAM,EAAE,CAAA;AAErB,MAAM,QAAQ,GAAG,CAAC,KAA4B,EAAE,KAAwB,EAAsB,EAAE,CAC9F,KAAK;KACF,MAAM,CAAC,CAAC,IAAgB,EAAW,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAChE,GAAG,CAAC,CAAC,IAAgB,EAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;KAC7D,EAAE,CAAC,CAAC,CAAC,CAAA;AAEV,uGAAuG;AACvG,kEAAkE;AAClE,MAAM,aAAa,GAAG,CACpB,IAAY,EACZ,IAAmB,EACnB,IAAgB,EAChB,KAA4B,EACC,EAAE,CAC/B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAA+B,EAAE;IAC7E,MAAM,SAAS,GAAuB,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,MAAM,GAAuB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IAC3F,MAAM,IAAI,GAAuB,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAChG,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,CACnB,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;SAC7C,CAAC,CACH,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAA4B,EAA+B,EAAE,CAC/F,KAAK,CAAC,OAAO,CAAC,CAAC,IAAgB,EAA+B,EAAE;IAC9D,MAAM,IAAI,GAAW,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAmB,EAA+B,EAAE,CACzF;QACE,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAC3B,CAAC,IAAY,EAAoB,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;SAC3B,CAAC,CACH;QACD,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC;KAC1C,CAAC,GAAG,CAAC,CAAC,SAA2B,EAAoB,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAC3F,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/payload-configs.d.ts

@@ -7,7 +7,6 @@ export interface PayloadConfigKind {
 /** One Payload configuration literal, with the source position its body begins at. */
 export interface FoundPayloadConfig {
     readonly kind: PayloadConfigKind;
-    readonly marker: number;
     readonly body: string;
     readonly bodyStart: number;
     readonly line: number;

package/dist/payload-configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAgBA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA2CD,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}
+{"version":3,"file":"payload-configs.d.ts","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAaA,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,QAAQ,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA0ED,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,SAAS,kBAAkB,EAI1E,CAAA;AAwCH,2EAA2E;AAC3E,eAAO,MAAM,cAAc,GACzB,QAAQ,MAAM,EACd,QAAQ,kBAAkB,KACzB,SAAS,iBAAiB,EAkB5B,CAAA"}

package/dist/payload-configs.js

@@ -1,9 +1,5 @@
-// The shared catalogue of Payload configuration literals.
-//
-// Access policy and field policy ask different questions of the same object: whether a collection or
-// global has declared its operation boundary, and whether a privilege-bearing field has declared its
-// own. The declaration forms must therefore have one owner. A second regex beside the access rule was
-// how generic annotations and `satisfies` configurations previously escaped every Payload check.
+// Share the vocabulary of Payload configuration literals across source-policy checks.
+import { COLLECTION_OPERATIONS, GLOBAL_OPERATIONS } from './payload-defaults.js';
 import { configBody, depthOneValue } from './payload-source.js';
 import { balancedArguments, lineOf, NOT_FOUND, scanDelimited, } from './source-text.js';
 const declarationPattern = (typeName) => new RegExp(String.raw `(:|satisfies)\s*${typeName}(?=[<=,)\s]|$)`, 'g');
@@ -12,27 +8,50 @@ const CONFIG_KINDS = [
         kind: 'collection',
         label: 'CollectionConfig',
         declaration: declarationPattern('CollectionConfig'),
-        operations: ['create', 'read', 'update', 'delete'],
+        operations: COLLECTION_OPERATIONS,
     },
     {
         kind: 'global',
         label: 'GlobalConfig',
         declaration: declarationPattern('GlobalConfig'),
-        operations: ['read', 'update'],
+        operations: GLOBAL_OPERATIONS,
     },
 ];
 const SATISFIES = 'satisfies';
-const bodyStartOf = (source, body, marker, isTrailing) => isTrailing ? source.lastIndexOf(body, marker) : source.indexOf(body, marker);
-const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
-    const isTrailing = match[1] === SATISFIES;
-    const body = configBody(source, match.index, isTrailing);
+// What may stand between a leading type reference and the literal it types. Every form a config is
+// really written in puts one of four things there: `= {`, a generic argument and then `= {`, `=> ({`,
+// or the opening brace of a function body. Taking "the next brace anywhere after the type name"
+// instead crossed statement boundaries and read an unrelated literal further down the file as the
+// configuration. A call argument (`= jobsAccess({ ... })`), a parameter annotation
+// (`(config: CollectionConfig): void => { ... }`), an interface member and a type-alias member each
+// put an identifier, a `)` or a `}` in this gap, and each was judged as though it were a collection -
+// so the very code a project writes to GIVE a generated collection its access block was reported as a
+// collection with none.
+const GOVERNED_BODY = /^\s*(?:<[^;{}]*>\s*)?(?:=>?\s*(?:\(\s*)?)?\{/;
+/** The literal a leading annotation governs, or nothing when the annotation types something else. */
+const governedLiteral = (source, afterType) => {
+    const gap = GOVERNED_BODY.exec(source.slice(afterType));
+    if (gap === null) {
+        return undefined;
+    }
+    const bodyStart = afterType + gap[0].length - 1;
+    const inner = balancedArguments(source, bodyStart);
+    return inner === undefined ? undefined : { body: `{${inner}}`, bodyStart };
+};
+/** The literal a trailing `satisfies` types: the one that closed just before it. */
+const precedingLiteral = (source, marker) => {
+    const body = configBody(source, marker, true);
     if (body === undefined) {
-        return [];
+        return undefined;
     }
-    const bodyStart = bodyStartOf(source, body, match.index, isTrailing);
-    return bodyStart === NOT_FOUND
-        ? []
-        : [{ kind, marker: match.index, body, bodyStart, line: lineOf(source, match.index) }];
+    const bodyStart = source.lastIndexOf(body, marker);
+    return bodyStart === NOT_FOUND ? undefined : { body, bodyStart };
+};
+const configsOfKind = (source, kind) => [...source.matchAll(kind.declaration)].flatMap((match) => {
+    const literal = match[1] === SATISFIES
+        ? precedingLiteral(source, match.index)
+        : governedLiteral(source, match.index + match[0].length);
+    return literal === undefined ? [] : [{ kind, ...literal, line: lineOf(source, match.index) }];
 });
 /** Every collection and global configuration literal the source declares. */
 export const payloadConfigsIn = (source) => CONFIG_KINDS.flatMap((kind) => configsOfKind(source, kind));

package/dist/payload-configs.js.map

@@ -1 +1 @@
-{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,EAAE;AACF,qGAAqG;AACrG,qGAAqG;AACrG,sGAAsG;AACtG,iGAAiG;AACjG,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAwBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;KACnD;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC;KAC/B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAErC,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,IAAY,EAAE,MAAc,EAAE,UAAmB,EAAU,EAAE,CAChG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAE9E,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,UAAU,GAAY,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAA;IAClD,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,SAAS,GAAW,WAAW,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAC5E,OAAO,SAAS,KAAK,SAAS;QAC5B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACzF,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"payload-configs.js","sourceRoot":"","sources":["../src/payload-configs.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC/D,OAAO,EACL,iBAAiB,EAEjB,MAAM,EACN,SAAS,EAET,aAAa,GACd,MAAM,kBAAkB,CAAA;AAuBzB,MAAM,kBAAkB,GAAG,CAAC,QAAgB,EAAU,EAAE,CACtD,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,mBAAmB,QAAQ,gBAAgB,EAAE,GAAG,CAAC,CAAA;AAExE,MAAM,YAAY,GAAsE;IACtF;QACE,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,UAAU,EAAE,qBAAqB;KAClC;IACD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,kBAAkB,CAAC,cAAc,CAAC;QAC/C,UAAU,EAAE,iBAAiB;KAC9B;CACF,CAAA;AAED,MAAM,SAAS,GAAW,WAAW,CAAA;AAQrC,mGAAmG;AACnG,sGAAsG;AACtG,gGAAgG;AAChG,kGAAkG;AAClG,mFAAmF;AACnF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,wBAAwB;AACxB,MAAM,aAAa,GAAW,8CAA8C,CAAA;AAE5E,qGAAqG;AACrG,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAA6B,EAAE;IACvF,MAAM,GAAG,GAA2B,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAA;IAC/E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAA;IACvD,MAAM,KAAK,GAAuB,iBAAiB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IACtE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,GAAG,EAAE,SAAS,EAAE,CAAA;AAC5E,CAAC,CAAA;AAED,oFAAoF;AACpF,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAE,MAAc,EAA6B,EAAE;IACrF,MAAM,IAAI,GAAuB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;IACjE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,SAAS,GAAW,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC1D,OAAO,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,aAAa,GAAG,CACpB,MAAc,EACd,IAA0D,EAC3B,EAAE,CACjC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAC5C,CAAC,KAAsB,EAAiC,EAAE;IACxD,MAAM,OAAO,GACX,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;QACpB,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC;QACvC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC5D,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AAC/F,CAAC,CACF,CAAA;AAEH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAAiC,EAAE,CAChF,YAAY,CAAC,OAAO,CAClB,CAAC,IAA0D,EAAiC,EAAE,CAC5F,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAC9B,CAAA;AAQH,MAAM,kBAAkB,GAAW,CAAC,CAAA;AAEpC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAE,KAAa,EAAwB,EAAE;IACzF,MAAM,IAAI,GAA0B,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AAChG,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAG,CAAC,IAAc,EAAW,EAAE,CACnD,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,kBAAkB,CAAA;AAE7D,MAAM,eAAe,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE/F,MAAM,cAAc,GAAG,CAAC,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,GAAG,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,CAAA;AAE9F,MAAM,mBAAmB,GAAG,CAC1B,KAA2B,EAC3B,IAAc,EACgB,EAAE;IAChC,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACnF,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IACjE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAA;AACrD,CAAC,CAAA;AAED,sGAAsG;AACtG,oFAAoF;AACpF,MAAM,iBAAiB,GAAG,CAAC,MAAc,EAAE,IAAY,EAAwB,EAAE,CAC/E,aAAa,CAAuB,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAA;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAc,EACd,MAA0B,EACI,EAAE;IAChC,MAAM,MAAM,GAAuB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,IAAI,GAAW,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,WAAW,GAAW,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IACjF,OAAO,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,OAAO,CAC5C,CAAC,IAAe,EAAgC,EAAE;QAChD,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC5E,CAAC,CACF,CAAA;AACH,CAAC,CAAA"}

package/dist/payload-database.d.ts

@@ -0,0 +1,80 @@
+import { type PayloadViolation } from './payload-source.js';
+/** One `buildConfig({ ... })` literal: its brace-wrapped body, and the line the call begins on. */
+export interface FoundRootConfig {
+    readonly body: string;
+    readonly line: number;
+}
+/**
+ * Every root configuration literal the source declares.
+ *
+ * The collection and global readers key on a type marker, which the root configuration does not carry:
+ * it is an argument to a call rather than an annotated declaration. So this reads the call instead.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per `buildConfig` call whose argument is an object literal.
+ */
+export declare const rootConfigsIn: (code: string) => readonly FoundRootConfig[];
+/**
+ * The database adapters whose schema Payload can apply by pushing it.
+ *
+ * Only the adapter whose behaviour is established belongs here. Naming one that does not carry the
+ * option would report a project for failing to disable something it never had, and an adapter left out
+ * is merely unreported - the safe direction of the two.
+ */
+export declare const PUSHING_ADAPTERS: readonly string[];
+/** The rule name a schema-push finding carries. */
+export declare const SCHEMA_PUSH_RULE: string;
+/**
+ * Report a root configuration whose database adapter does not disable schema push.
+ * @param code the file's text, with comments already stripped.
+ * @returns one violation per configuration that pushes, declared or by omission.
+ */
+export declare const findUnreviewedSchemaPush: (code: string) => readonly PayloadViolation[];
+/**
+ * Whether a source declares a database adapter whose schema is applied by push.
+ * @param code the file's text, with comments already stripped.
+ * @returns true when at least one root configuration names such an adapter.
+ */
+export declare const declaresPushingAdapter: (code: string) => boolean;
+/**
+ * The migration directory a configuration names, when it names one.
+ * @param code the file's text, with comments already stripped.
+ * @returns the declared directory, or undefined when the adapter leaves it to Payload's default.
+ */
+export declare const declaredMigrationDirectoryIn: (code: string) => string | undefined;
+/** The directories Payload looks in, in the order its own resolver tries them. */
+export declare const MIGRATION_DIRECTORY_CANDIDATES: readonly string[];
+/**
+ * Whether a file name is one Payload reads as a migration.
+ *
+ * Taken from Payload's own reader rather than invented here: a `.ts` or `.js` file that is not the
+ * barrel. An empty directory, or one holding only a barrel, records no schema - and that is exactly the
+ * distinction a project would otherwise satisfy the rule with.
+ * @param name the file's base name.
+ * @returns true when Payload would read it as a migration.
+ */
+export declare const isMigrationFile: (name: string) => boolean;
+/**
+ * The directories to read for a member, the declared one first.
+ * @param declared the directory the configuration names, when it names one.
+ * @returns the candidate paths, relative to the member root.
+ */
+export declare const migrationDirectoriesFor: (declared: string | undefined) => readonly string[];
+/** One candidate directory as the gate found it: its path, and the entries it holds. */
+export interface MigrationDirectory {
+    readonly path: string;
+    readonly names: readonly string[];
+}
+/** What the gate read about where a member's schema would come from. */
+export interface MigrationEvidence {
+    readonly declaresPushingAdapter: boolean;
+    readonly directories: readonly MigrationDirectory[];
+}
+/** The rule name a missing-migration finding carries. */
+export declare const RECORDED_MIGRATIONS_RULE: string;
+/**
+ * Report a member that records no migration for the schema it expects.
+ * @param evidence the adapter it declares, and the candidate directories as they were read.
+ * @returns one finding when the member pushes and records nothing, or none.
+ */
+export declare const findMissingMigrations: (evidence: MigrationEvidence) => readonly string[];
+//# sourceMappingURL=payload-database.d.ts.map

package/dist/payload-database.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-database.d.ts","sourceRoot":"","sources":["../src/payload-database.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAG1E,mGAAmG;AACnG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,SAAS,eAAe,EASjE,CAAA;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAAwB,CAAA;AAiCtE,mDAAmD;AACnD,eAAO,MAAM,gBAAgB,EAAE,MAAoC,CAAA;AAuBnE;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,MAAM,KAAG,SAAS,gBAAgB,EAgB7E,CAAA;AAEJ;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,KAAG,OAGnD,CAAA;AAEH;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,GAAI,MAAM,MAAM,KAAG,MAAM,GAAG,SAMkB,CAAA;AAEvF,kFAAkF;AAClF,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAI3D,CAAA;AAKD;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,KAAG,OAE3B,CAAA;AAEpB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,SAAS,MAAM,EAGnC,CAAA;AAEnD,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,wEAAwE;AACxE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAA;IACxC,QAAQ,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,CAAA;CACpD;AAED,yDAAyD;AACzD,eAAO,MAAM,wBAAwB,EAAE,MAAsC,CAAA;AAQ7E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,GAAI,UAAU,iBAAiB,KAAG,SAAS,MAAM,EASlF,CAAA"}

package/dist/payload-database.js

@@ -0,0 +1,164 @@
+// Whether a project's schema changes are recorded where a reader can review them.
+//
+// Payload's Postgres adapter can apply a schema by pushing it: at boot, it diffs the configuration
+// against the live database and issues whatever closes the gap. Nothing is written down, so there is no
+// artefact to review before it runs and none to roll back after. The guard Payload applies is
+// `this.push !== false`, which is why an UNDECLARED push is the dangerous spelling rather than a neutral
+// one, and why this rule reports it.
+//
+// Push is also skipped where `NODE_ENV` is production, and a production boot then falls to
+// `prodMigrations`. A project that pushes instead of migrating therefore has no mechanism that creates
+// its schema in production at all, which is the second rule here.
+//
+// The value is read from SOURCE rather than from the built configuration. `postgresAdapter()` returns a
+// factory whose `init` closure carries `push`, and Payload calls that closure at `payload.init()`, not
+// during `buildConfig`. A probe that imports the built configuration reads `undefined` for every project
+// and would pass every defect.
+import { depthOneValue } from './payload-source.js';
+import { balancedArguments, lineOf, occurrences, topLevelSlice } from './source-text.js';
+const BUILD_CONFIG_CALL = 'buildConfig(';
+/**
+ * Every root configuration literal the source declares.
+ *
+ * The collection and global readers key on a type marker, which the root configuration does not carry:
+ * it is an argument to a call rather than an annotated declaration. So this reads the call instead.
+ * @param code the file's text, with comments already stripped.
+ * @returns one entry per `buildConfig` call whose argument is an object literal.
+ */
+export const rootConfigsIn = (code) => occurrences(code, BUILD_CONFIG_CALL).flatMap((found) => {
+    const argumentText = balancedArguments(code, found + BUILD_CONFIG_CALL.length - 1);
+    return argumentText?.trimStart().startsWith('{') === true
+        ? [{ body: argumentText, line: lineOf(code, found) }]
+        : [];
+});
+/**
+ * The database adapters whose schema Payload can apply by pushing it.
+ *
+ * Only the adapter whose behaviour is established belongs here. Naming one that does not carry the
+ * option would report a project for failing to disable something it never had, and an adapter left out
+ * is merely unreported - the safe direction of the two.
+ */
+export const PUSHING_ADAPTERS = ['postgresAdapter'];
+const ADAPTER_CALL = /^\s*([a-z_$][\w$]*)\s*\(/i;
+const adapterCallIn = (databaseValue) => {
+    const matched = ADAPTER_CALL.exec(databaseValue);
+    if (matched === null) {
+        return undefined;
+    }
+    const options = balancedArguments(databaseValue, matched[0].length - 1);
+    return options === undefined ? undefined : { name: matched[1] ?? '', options };
+};
+// `push` is read from the depth-one text of the adapter's own options, so a key nested inside `pool`
+// cannot be mistaken for the adapter's own - the protection `topLevelSlice` exists to give.
+//
+// `migrationDir` cannot be read the same way, and that is a property of the scan rather than an
+// oversight: the walk jumps a string literal whole, so the fold never sees the quoted value and the
+// slice a quoted value would land in comes back empty. It is therefore read from the raw options, where
+// the key boundary alone separates it from a value nested beneath. `push` is unaffected because `false`
+// is not a string literal and survives the slice intact.
+const PUSH_PROPERTY = /(?:^|,)\s*push\s*:\s*([^,]*)/;
+const MIGRATION_DIR_PROPERTY = /(?:^|[{,])\s*migrationDir\s*:\s*['"]([^'"]*)['"]/;
+const declaredPushIn = (options) => PUSH_PROPERTY.exec(topLevelSlice(options))?.[1]?.trim();
+/** The rule name a schema-push finding carries. */
+export const SCHEMA_PUSH_RULE = 'no-unreviewed-schema-push';
+const REPAIR = 'set push: false and record the schema with `payload migrate:create`';
+const pushReason = (adapter, declared) => declared === undefined
+    ? `${adapter} declares no push; Payload treats an undeclared push as on, so it rewrites the ` +
+        'schema at every boot outside production and no committed artefact records what the schema ' +
+        `became - ${REPAIR}`
+    : `${adapter} sets push: ${declared}; Payload rewrites the schema at every boot outside ` +
+        `production and no committed artefact records what the schema became - ${REPAIR}`;
+// The adapter a configuration's `db` names, when it is one that can push. Shared by every rule here, so
+// the question "does this project push?" is answered in one place.
+const pushingAdapterIn = (body) => {
+    const databaseValue = depthOneValue(body, 'db');
+    if (databaseValue === undefined) {
+        return undefined;
+    }
+    const adapter = adapterCallIn(databaseValue);
+    return adapter !== undefined && PUSHING_ADAPTERS.includes(adapter.name) ? adapter : undefined;
+};
+/**
+ * Report a root configuration whose database adapter does not disable schema push.
+ * @param code the file's text, with comments already stripped.
+ * @returns one violation per configuration that pushes, declared or by omission.
+ */
+export const findUnreviewedSchemaPush = (code) => rootConfigsIn(code).flatMap((config) => {
+    const adapter = pushingAdapterIn(config.body);
+    if (adapter === undefined) {
+        return [];
+    }
+    const declared = declaredPushIn(adapter.options);
+    return declared === 'false'
+        ? []
+        : [
+            {
+                line: config.line,
+                rule: SCHEMA_PUSH_RULE,
+                reason: pushReason(adapter.name, declared),
+            },
+        ];
+});
+/**
+ * Whether a source declares a database adapter whose schema is applied by push.
+ * @param code the file's text, with comments already stripped.
+ * @returns true when at least one root configuration names such an adapter.
+ */
+export const declaresPushingAdapter = (code) => rootConfigsIn(code).some((config) => pushingAdapterIn(config.body) !== undefined);
+/**
+ * The migration directory a configuration names, when it names one.
+ * @param code the file's text, with comments already stripped.
+ * @returns the declared directory, or undefined when the adapter leaves it to Payload's default.
+ */
+export const declaredMigrationDirectoryIn = (code) => rootConfigsIn(code)
+    .map((config) => {
+    const adapter = pushingAdapterIn(config.body);
+    return adapter === undefined ? undefined : MIGRATION_DIR_PROPERTY.exec(adapter.options)?.[1];
+})
+    .find((declared) => declared !== undefined);
+/** The directories Payload looks in, in the order its own resolver tries them. */
+export const MIGRATION_DIRECTORY_CANDIDATES = [
+    'src/migrations',
+    'dist/migrations',
+    'migrations',
+];
+const MIGRATION_EXTENSIONS = ['.ts', '.js'];
+const BARRELS = new Set(['index.ts', 'index.js']);
+/**
+ * Whether a file name is one Payload reads as a migration.
+ *
+ * Taken from Payload's own reader rather than invented here: a `.ts` or `.js` file that is not the
+ * barrel. An empty directory, or one holding only a barrel, records no schema - and that is exactly the
+ * distinction a project would otherwise satisfy the rule with.
+ * @param name the file's base name.
+ * @returns true when Payload would read it as a migration.
+ */
+export const isMigrationFile = (name) => MIGRATION_EXTENSIONS.some((extension) => name.endsWith(extension)) &&
+    !BARRELS.has(name);
+/**
+ * The directories to read for a member, the declared one first.
+ * @param declared the directory the configuration names, when it names one.
+ * @returns the candidate paths, relative to the member root.
+ */
+export const migrationDirectoriesFor = (declared) => declared === undefined
+    ? MIGRATION_DIRECTORY_CANDIDATES
+    : [declared, ...MIGRATION_DIRECTORY_CANDIDATES];
+/** The rule name a missing-migration finding carries. */
+export const RECORDED_MIGRATIONS_RULE = 'require-recorded-migrations';
+const MISSING_MIGRATIONS = `[${RECORDED_MIGRATIONS_RULE}] no migration is recorded; this member declares a database adapter ` +
+    'whose schema is applied by push, and push is skipped where NODE_ENV is production - so a ' +
+    'production boot creates nothing and no file in the repository states what the schema should be. ' +
+    'Run `payload migrate:create` and commit the file it writes';
+/**
+ * Report a member that records no migration for the schema it expects.
+ * @param evidence the adapter it declares, and the candidate directories as they were read.
+ * @returns one finding when the member pushes and records nothing, or none.
+ */
+export const findMissingMigrations = (evidence) => {
+    if (!evidence.declaresPushingAdapter) {
+        return [];
+    }
+    const carriesMigration = evidence.directories.some((directory) => directory.names.some((name) => isMigrationFile(name)));
+    return carriesMigration ? [] : [MISSING_MIGRATIONS];
+};
+//# sourceMappingURL=payload-database.js.map

package/dist/payload-database.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-database.js","sourceRoot":"","sources":["../src/payload-database.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,mGAAmG;AACnG,wGAAwG;AACxG,8FAA8F;AAC9F,yGAAyG;AACzG,qCAAqC;AACrC,EAAE;AACF,2FAA2F;AAC3F,uGAAuG;AACvG,kEAAkE;AAClE,EAAE;AACF,wGAAwG;AACxG,uGAAuG;AACvG,yGAAyG;AACzG,+BAA+B;AAC/B,OAAO,EAAE,aAAa,EAAyB,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAQxF,MAAM,iBAAiB,GAAW,cAAc,CAAA;AAEhD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAA8B,EAAE,CACxE,WAAW,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,KAAa,EAA8B,EAAE;IACzF,MAAM,YAAY,GAAuB,iBAAiB,CACxD,IAAI,EACJ,KAAK,GAAG,iBAAiB,CAAC,MAAM,GAAG,CAAC,CACrC,CAAA;IACD,OAAO,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,IAAI;QACvD,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC,CAAC,EAAE,CAAA;AACR,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAsB,CAAC,iBAAiB,CAAC,CAAA;AAQtE,MAAM,YAAY,GAAW,2BAA2B,CAAA;AAExD,MAAM,aAAa,GAAG,CAAC,aAAqB,EAA2B,EAAE;IACvE,MAAM,OAAO,GAA2B,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAAuB,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC3F,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAA;AAChF,CAAC,CAAA;AAED,qGAAqG;AACrG,4FAA4F;AAC5F,EAAE;AACF,gGAAgG;AAChG,oGAAoG;AACpG,wGAAwG;AACxG,wGAAwG;AACxG,yDAAyD;AACzD,MAAM,aAAa,GAAW,8BAA8B,CAAA;AAC5D,MAAM,sBAAsB,GAAW,kDAAkD,CAAA;AAEzF,MAAM,cAAc,GAAG,CAAC,OAAe,EAAsB,EAAE,CAC7D,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAA;AAEzD,mDAAmD;AACnD,MAAM,CAAC,MAAM,gBAAgB,GAAW,2BAA2B,CAAA;AAEnE,MAAM,MAAM,GAAW,qEAAqE,CAAA;AAE5F,MAAM,UAAU,GAAG,CAAC,OAAe,EAAE,QAA4B,EAAU,EAAE,CAC3E,QAAQ,KAAK,SAAS;IACpB,CAAC,CAAC,GAAG,OAAO,iFAAiF;QAC3F,4FAA4F;QAC5F,YAAY,MAAM,EAAE;IACtB,CAAC,CAAC,GAAG,OAAO,eAAe,QAAQ,sDAAsD;QACvF,yEAAyE,MAAM,EAAE,CAAA;AAEvF,wGAAwG;AACxG,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,CAAC,IAAY,EAA2B,EAAE;IACjE,MAAM,aAAa,GAAuB,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;IACnE,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,OAAO,GAA4B,aAAa,CAAC,aAAa,CAAC,CAAA;IACrE,OAAO,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAY,EAA+B,EAAE,CACpF,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,MAAuB,EAA+B,EAAE;IACnF,MAAM,OAAO,GAA4B,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,QAAQ,GAAuB,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACpE,OAAO,QAAQ,KAAK,OAAO;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;YACE;gBACE,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EAAE,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;aAC3C;SACF,CAAA;AACP,CAAC,CAAC,CAAA;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,IAAY,EAAW,EAAE,CAC9D,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CACtB,CAAC,MAAuB,EAAW,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CAClF,CAAA;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,IAAY,EAAsB,EAAE,CAC/E,aAAa,CAAC,IAAI,CAAC;KAChB,GAAG,CAAC,CAAC,MAAuB,EAAsB,EAAE;IACnD,MAAM,OAAO,GAA4B,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC9F,CAAC,CAAC;KACD,IAAI,CAAC,CAAC,QAA4B,EAAsB,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAA;AAEvF,kFAAkF;AAClF,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;CACb,CAAA;AAED,MAAM,oBAAoB,GAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;AAC9D,MAAM,OAAO,GAAwB,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAA;AAEtE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAW,EAAE,CACvD,oBAAoB,CAAC,IAAI,CAAC,CAAC,SAAiB,EAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnF,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAEpB;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,QAA4B,EAAqB,EAAE,CACzF,QAAQ,KAAK,SAAS;IACpB,CAAC,CAAC,8BAA8B;IAChC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,8BAA8B,CAAC,CAAA;AAcnD,yDAAyD;AACzD,MAAM,CAAC,MAAM,wBAAwB,GAAW,6BAA6B,CAAA;AAE7E,MAAM,kBAAkB,GACtB,IAAI,wBAAwB,sEAAsE;IAClG,2FAA2F;IAC3F,kGAAkG;IAClG,4DAA4D,CAAA;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAA2B,EAAqB,EAAE;IACtF,IAAI,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;QACrC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,gBAAgB,GAAY,QAAQ,CAAC,WAAW,CAAC,IAAI,CACzD,CAAC,SAA6B,EAAW,EAAE,CACzC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAY,EAAW,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CACzE,CAAA;IACD,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAA;AACrD,CAAC,CAAA"}

package/dist/payload-defaults.d.ts

@@ -0,0 +1,128 @@
+/** The operations a collection must decide; the static rule holds a written config to the same list. */
+export declare const COLLECTION_OPERATIONS: readonly string[];
+/** The operations a global must decide. */
+export declare const GLOBAL_OPERATIONS: readonly string[];
+/** The operation an auth collection decides on top of the four: who may clear a locked account. */
+export declare const UNLOCK_OPERATION: string;
+/** The operation a versioned collection or global decides: who may read a stored version. */
+export declare const READ_VERSIONS_OPERATION: string;
+/** What an entity of the built configuration is, as far as the operations it owes depend on it. */
+export interface PayloadSubjectTraits {
+    readonly kind: PayloadSubjectKind;
+    readonly hasAuth: boolean;
+    readonly hasVersions: boolean;
+}
+/**
+ * The access operations one entity owes a decision on. Two of them are conditional, and neither may be
+ * added to the lists above: Payload writes `unlock` onto EVERY collection during sanitisation, auth or
+ * not, so demanding it unconditionally would report the whole configuration, and `readVersions` means
+ * nothing on an entity that keeps no versions.
+ * @param traits what the entity is: its kind, and whether it authenticates or keeps versions.
+ * @returns the operations that entity must decide, in the order they are reported.
+ */
+export declare const accessOperationsFor: (traits: PayloadSubjectTraits) => readonly string[];
+/**
+ * The prefix the probe prints its report behind. A plugin may log on import, and a line the parser can
+ * name is what separates the report from that chatter.
+ */
+export declare const INHERITED_ACCESS_REPORT_MARKER: string;
+/** One entity of the built configuration and the operations it left to Payload's default. */
+export interface InheritedAccessEntry {
+    readonly slug: string;
+    readonly inherited: readonly string[];
+}
+/**
+ * What a read rule answered an anonymous caller, as the probe observed it. `filtered` carries the
+ * query constraint the rule returned, which is the half `/api/access` reports and the anonymous sweep
+ * never opens; `undecidable` is a rule that threw when asked, which is reported rather than assumed
+ * safe.
+ */
+export type AnonymousRead = {
+    readonly kind: 'denied';
+} | {
+    readonly kind: 'filtered';
+    readonly where: unknown;
+} | {
+    readonly kind: 'open';
+} | {
+    readonly kind: 'undecidable';
+    readonly reason: string;
+};
+/** One entity that keeps drafts, and what its read rule answers a caller with no credentials. */
+export interface DraftReadEntry {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly anonymousRead: AnonymousRead;
+}
+/** What the probe reports: every collection and every global, decided ones included. */
+export interface InheritedAccessReport {
+    readonly collections: readonly InheritedAccessEntry[];
+    readonly draftReads: readonly DraftReadEntry[];
+    readonly globals: readonly InheritedAccessEntry[];
+}
+/** The two kinds of entity a Payload configuration holds. */
+export type PayloadSubjectKind = 'collection' | 'global';
+/** One entity Payload builds for its own bookkeeping, which keeps the default access by design. */
+export interface ExemptPayloadSubject {
+    readonly kind: PayloadSubjectKind;
+    readonly slug: string;
+    readonly reason: string;
+}
+/** The entities exempt from the rule, each with the reason. Nothing a project declares extends this. */
+export declare const EXEMPT_PAYLOAD_SUBJECTS: readonly ExemptPayloadSubject[];
+/**
+ * The saved-filter collection Payload builds behind `enableQueryPresets`.
+ *
+ * It is named here because the probe has to read its access from somewhere other than the collection.
+ * `getAccess` wraps EVERY operation of this one collection in a closure that calls the project's rule
+ * where there is one and Payload's own default where there is not, so the built collection carries four
+ * functions that match neither the default by reference nor its source text. Read there, a project that
+ * decided nothing is indistinguishable from one that decided everything - and undecided means an
+ * unconstrained `create` for any signed-in user, and a preset shared as `everyone` readable by every
+ * role that can log in, the ones a project keeps outside its editorial staff included.
+ */
+export declare const QUERY_PRESETS_SLUG: string;
+/**
+ * Every entity of the built configuration that still carries Payload's default access on a judged
+ * operation, in configuration order, each naming where the project decides it.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when every entity decides its access.
+ */
+export declare const findInheritedAccess: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Whether a read filter admits published documents alone.
+ *
+ * A clause under `and` is enough on its own, because every conjunct holds. A clause under `or` counts
+ * only when EVERY branch carries one, because a single branch without it is a way in - which is the
+ * shape of the defect this rule exists for.
+ * @param where the query constraint the read rule returned.
+ * @returns whether every document the filter admits is a published one.
+ */
+export declare const requiresPublishedStatus: (where: unknown) => boolean;
+/**
+ * Every entity that keeps drafts and lets a stranger read something that was never approved, in
+ * configuration order.
+ * @param report what the probe read from the built configuration.
+ * @returns one finding per entity, or nothing when no drafts read admits an unapproved document.
+ */
+export declare const findUnconstrainedDraftReads: (report: InheritedAccessReport) => readonly string[];
+/**
+ * Read the probe's report out of everything the probe wrote to standard output.
+ *
+ * The LAST marker line is the report, so a plugin that logs during import cannot hide it, and a report
+ * that fails to parse or has the wrong shape is undefined rather than empty: a probe that printed a
+ * stack trace must fail the gate, never pass it as "no findings".
+ * @param text the probe's standard output.
+ * @returns the report, or undefined when no well-formed report was printed.
+ */
+export declare const parseInheritedAccessReport: (text: string) => InheritedAccessReport | undefined;
+/** Where a Payload member keeps its configuration when its tsconfig says nothing else. */
+export declare const DEFAULT_PAYLOAD_CONFIG_PATH: string;
+/**
+ * The path of the Payload configuration a member's tsconfig aliases as `@payload-config`, which is the
+ * alias `ploaness init` writes and Payload's own CLI resolves through.
+ * @param tsconfig the parsed tsconfig, or anything when it could not be read.
+ * @returns the configured path relative to the member root, or the default path.
+ */
+export declare const payloadConfigPathOf: (tsconfig: unknown) => string;
+//# sourceMappingURL=payload-defaults.d.ts.map

package/dist/payload-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-defaults.d.ts","sourceRoot":"","sources":["../src/payload-defaults.ts"],"names":[],"mappings":"AAgBA,wGAAwG;AACxG,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAA2C,CAAA;AAE9F,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAAuB,CAAA;AAEtE,mGAAmG;AACnG,eAAO,MAAM,gBAAgB,EAAE,MAAiB,CAAA;AAEhD,6FAA6F;AAC7F,eAAO,MAAM,uBAAuB,EAAE,MAAuB,CAAA;AAE7D,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;CAC9B;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,oBAAoB,KAAG,SAAS,MAAM,EAIjF,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,MAAqC,CAAA;AAElF,6FAA6F;AAC7F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAA;CACtC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7D,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;CACtC;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,WAAW,EAAE,SAAS,oBAAoB,EAAE,CAAA;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAA;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,oBAAoB,EAAE,CAAA;CAClD;AAED,6DAA6D;AAC7D,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,CAAA;AAExD,mGAAmG;AACnG,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAA;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,wGAAwG;AACxG,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EA4BlE,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,MAAgC,CAAA;AAyCjE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAGlF,CAAA;AA2BD;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,OAAO,OAAO,KAAG,OAoBxD,CAAA;AA8BD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,GAAI,QAAQ,qBAAqB,KAAG,SAAS,MAAM,EAIvF,CAAA;AA4EJ;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GAAI,MAAM,MAAM,KAAG,qBAAqB,GAAG,SAoBjF,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,2BAA2B,EAAE,MAAgC,CAAA;AAI1E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,UAAU,OAAO,KAAG,MAYvD,CAAA"}