@captiveorigins/payload-plugin-onephylogeny 0.0.0-stage → 0.1.0-alpha.1

package/LICENSE

@@ -0,0 +1,75 @@
+Required Notice: Copyright 2026 Captive Origins (https://captiveorigins.com)
+
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose.  However, you may only distribute the software according to [Distribution License](#distribution-license) and make changes or new works based on the software according to [Changes and New Works License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license to distribute copies of the software.  Your license to distribute covers distributing the software with changes and new works permitted by [Changes and New Works License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you also gets a copy of these terms or the URL for them above, as well as copies of any plain-text lines beginning with `Required Notice:` that the licensor provided with the software.  For example:
+
+> Required Notice: Copyright Yoyodyne, Inc. (http://example.com)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to make changes and new works based on the software for any permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization.  **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.

package/README.md

@@ -1,3 +1,5 @@
-# Temporary Holding Version
+# @captiveorigins/payload-plugin-onephylogeny
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+OnePhylogeny for Payload: immutable reference panels and released results on your own collections, with server-enforced review, safe endpoints and no coordinates.
+
+See the [repository](https://github.com/CaptiveOrigins/onephylogeny) for documentation.

package/dist/index.d.ts

@@ -0,0 +1,37 @@
+import { Access, Plugin } from 'payload';
+
+type OnePhylogenyPluginOptions = {
+    /** Slugs of the collections this plugin adds. */
+    slugs?: {
+        panels?: string;
+        assignments?: string;
+    };
+    /** Host collections to relate to. Leave one out and its field isn't added, so the plugin works in any site. */
+    relations?: {
+        subject?: string;
+        sequence?: string;
+        taxa?: string;
+        files?: string;
+        importRuns?: string;
+    };
+    /** Who may create panels and results, and activate panels. Default: nobody but trusted local scripts. Activating also needs a signed-in user, who is recorded. */
+    manageAccess?: Access;
+    /** Who may approve or reject results. Default: same as manageAccess. */
+    reviewAccess?: Access;
+    /** Extra rule for reading released results, such as the host's own animal permissions. Default: signed-in users. */
+    readReleasedAccess?: Access;
+    /** Field added to assignments for multi-tenant hosts' isolation plugins to find. */
+    group?: string;
+    /**
+     * Which panels results may be made against. `activeOrShown` also allows a `candidate` a maintainer ticked "shown as
+     * exploratory", and lets readers see such candidates. Default: `active`.
+     */
+    resultsAgainst?: 'active' | 'activeOrShown';
+};
+/**
+ * OnePhylogeny for Payload. Adds immutable panels and reviewed results, relating to whatever collections a site already
+ * has. It holds no species knowledge. Compute happens elsewhere: this stores what was computed and controls release.
+ */
+declare const onePhylogeny: (options?: OnePhylogenyPluginOptions) => Plugin;
+
+export { type OnePhylogenyPluginOptions, onePhylogeny };

package/dist/index.js

@@ -0,0 +1,188 @@
+// src/index.ts
+import { validateResult } from "@captiveorigins/onephylogeny-core";
+import { APIError } from "payload";
+var PANEL_TRANSITIONS = { candidate: ["active", "withdrawn"], active: ["superseded", "withdrawn"], superseded: ["withdrawn"], withdrawn: [] };
+var LOCKED_PANEL_FIELDS = ["key", "version", "marker", "checksum", "artifact", "importRun", "taxa", "groups", "notCovered", "validatedScope"];
+var REVIEW_TRANSITIONS = { pending: ["approved", "rejected"], approved: ["withdrawn"], rejected: [], withdrawn: [] };
+var COORDINATES = /^(lat|lon|lng|latitude|longitude|latlon|lat_lon|coordinates?)$/i;
+var hasCoordinates = (value) => {
+  if (Array.isArray(value)) return value.some(hasCoordinates);
+  if (!value || typeof value !== "object") return false;
+  return Object.entries(value).some(([k, v]) => COORDINATES.test(k) || hasCoordinates(v));
+};
+var fail = (message) => {
+  throw new APIError(message, 400, void 0, true);
+};
+var idOf = (v) => v && typeof v === "object" ? String(v.id) : v == null ? void 0 : String(v);
+var same = (a, b) => JSON.stringify(a ?? null) === JSON.stringify(b ?? null);
+var stripIds = (rows) => Array.isArray(rows) ? rows.map((r) => {
+  const { id: _id, ...rest } = r;
+  return rest;
+}) : rows;
+var stamp = (v) => v == null || v === "" ? "" : v instanceof Date ? v.toISOString() : String(v);
+var ACTIVATION_FIELDS = ["activatedBy", "activatedAt"];
+var panelBeforeChange = ({ data, originalDoc, operation, req }) => {
+  const leaving = operation === "update" && String(data.status ?? originalDoc.status) !== "candidate";
+  if (leaving) {
+    if (data.shownAsExploratory === true && String(originalDoc.status) !== "candidate") fail("Only a candidate panel can be shown as exploratory.");
+    data.shownAsExploratory = false;
+  }
+  if (hasCoordinates(data.groups)) fail("Panels use generalized regions and never hold coordinates.");
+  if (operation === "create") {
+    if ((data.status ?? "candidate") !== "candidate") fail("A new panel starts as a candidate.");
+    if (ACTIVATION_FIELDS.some((f) => stamp(data[f]))) fail("Who activated a panel, and when, are set by activating.");
+    return data;
+  }
+  const from = String(originalDoc.status);
+  const to = String(data.status ?? from);
+  if (to !== from && !PANEL_TRANSITIONS[from]?.includes(to)) fail(`A panel can't go from ${from} to ${to}.`);
+  if (from === "candidate" && to === "active") {
+    if (!(data.validatedScope ?? originalDoc.validatedScope)?.length) fail("A panel with no validated claims can't become active.");
+    if (!req.user) fail("Activating a panel needs a signed-in person, who is recorded.");
+    data.activatedBy = String(req.user.id);
+    data.activatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  } else if (ACTIVATION_FIELDS.some((f) => f in data && stamp(data[f]) !== stamp(originalDoc[f]))) {
+    fail("Who activated a panel, and when, are set by activating.");
+  }
+  if (from !== "candidate") {
+    for (const f of LOCKED_PANEL_FIELDS) {
+      if (!(f in data)) continue;
+      const changed = f === "groups" ? !same(stripIds(data[f]), stripIds(originalDoc[f])) : Array.isArray(data[f]) ? !same(data[f].map(idOf), (originalDoc[f] ?? []).map(idOf)) : idOf(data[f]) !== idOf(originalDoc[f]);
+      if (changed) fail(`A ${from} panel can't be edited. Build a new version instead.`);
+    }
+  }
+  return data;
+};
+var supersedeOthers = (panels) => async ({ doc, previousDoc, req }) => {
+  if (doc.status !== "active" || previousDoc?.status === "active") return doc;
+  const others = await req.payload.find({ collection: panels, where: { and: [{ key: { equals: doc.key } }, { status: { equals: "active" } }, { id: { not_equals: doc.id } }] }, limit: 100, depth: 0, req, overrideAccess: true });
+  for (const other of others.docs) await req.payload.update({ collection: panels, id: other.id, data: { status: "superseded" }, req, overrideAccess: true });
+  return doc;
+};
+var assignmentBeforeChange = (panels, againstShown) => async ({ data, originalDoc, operation, req }) => {
+  if (operation === "create") {
+    if ((data.reviewStatus ?? "pending") !== "pending") fail("A new result starts as pending review.");
+    const panel = await req.payload.findByID({ collection: panels, id: idOf(data.panel), depth: 0, req, overrideAccess: true });
+    const shown = panel.status === "candidate" && panel.shownAsExploratory === true;
+    if (panel.status !== "active" && !(againstShown && shown)) fail(againstShown ? "Results can only be made against an active panel, or a candidate shown as exploratory." : "Results can only be made against an active panel.");
+    data.panelStatus = panel.status;
+    data.panelShownAsExploratory = shown;
+    const result = data.result;
+    const problems = validateResult(result).filter((d) => d.severity === "error");
+    if (problems.length) fail(problems.map((p) => p.message).join("; "));
+    if (result.panel.version !== panel.version || result.panel.checksum !== panel.checksum) fail("This result was not made with this panel version.");
+    const found = new Set(result.findings.map((f) => f.group));
+    const missing = (panel.groups ?? []).filter((g) => !found.has(g.groupId)).map((g) => g.groupId);
+    if (missing.length) fail(`Every group must be reported. Missing: ${missing.join(", ")}.`);
+    if (hasCoordinates(result)) fail("Results never hold coordinates.");
+    return data;
+  }
+  const from = String(originalDoc.reviewStatus);
+  const to = String(data.reviewStatus ?? from);
+  for (const f of ["result", "panel", "sequence", "subject", "summary", "importRun"]) {
+    if (f in data && (f === "result" || f === "summary" ? !same(data[f], originalDoc[f]) : idOf(data[f]) !== idOf(originalDoc[f]))) fail("A result can't be edited. Make a new one instead.");
+  }
+  for (const f of ["panelStatus", "panelShownAsExploratory"]) {
+    if (f in data && !same(data[f], originalDoc[f])) fail("The panel status a result was made against is set when it is made.");
+  }
+  if (to !== from) {
+    if (!REVIEW_TRANSITIONS[from]?.includes(to)) fail(`A result can't go from ${from} to ${to}.`);
+    if (to === "approved") {
+      if (!req.user) fail("Approving a result needs a signed-in reviewer.");
+      data.reviewer = String(req.user.id);
+      data.releasedAt = (/* @__PURE__ */ new Date()).toISOString();
+    }
+  } else {
+    if ("reviewer" in data && data.reviewer !== originalDoc.reviewer) fail("The reviewer is set by approving.");
+    if ("releasedAt" in data && String(data.releasedAt) !== String(originalDoc.releasedAt)) fail("The release date is set by approving.");
+  }
+  return data;
+};
+var relation = (name, relationTo, extra = {}) => relationTo ? [{ name, type: "relationship", relationTo, index: true, ...extra }] : [];
+var onePhylogeny = (options = {}) => (config) => {
+  const panels = options.slugs?.panels ?? "panels";
+  const assignments = options.slugs?.assignments ?? "assignments";
+  const r = options.relations ?? {};
+  const group = options.group ?? "Genetics";
+  const manage = options.manageAccess ?? (() => false);
+  const review = options.reviewAccess ?? manage;
+  const readReleased = options.readReleasedAccess ?? (({ req }) => Boolean(req.user));
+  const againstShown = options.resultsAgainst === "activeOrShown";
+  const panelCollection = {
+    slug: panels,
+    labels: { singular: "Reference panel", plural: "Reference panels" },
+    admin: { group, useAsTitle: "key", defaultColumns: ["key", "version", "status", "marker"] },
+    access: {
+      read: async (args) => {
+        if (await manage(args)) return true;
+        const published = { status: { in: ["active", "superseded"] } };
+        return againstShown ? { or: [published, { and: [{ status: { equals: "candidate" } }, { shownAsExploratory: { equals: true } }] }] } : published;
+      },
+      create: manage,
+      update: manage,
+      delete: () => false
+    },
+    fields: [
+      { name: "key", type: "text", required: true, index: true, admin: { description: "Stays the same across versions of one panel." } },
+      { name: "version", type: "text", required: true },
+      { name: "status", type: "select", required: true, defaultValue: "candidate", index: true, options: ["candidate", "active", "superseded", "withdrawn"] },
+      { name: "shownAsExploratory", type: "checkbox", defaultValue: false, index: true, admin: { description: "Show this candidate as exploratory, before review. Only candidates; cleared when it moves on." } },
+      { name: "marker", type: "text", required: true },
+      { name: "checksum", type: "text", required: true, index: true },
+      ...relation("taxa", r.taxa, { hasMany: true }),
+      ...relation("artifact", r.files, { admin: { description: "The full panel: JSON manifest and sequences." } }),
+      ...relation("importRun", r.importRuns),
+      { name: "validatedScope", type: "text", hasMany: true, admin: { description: "The claims this panel is validated for. Pages show only these." } },
+      { name: "notCovered", type: "text", hasMany: true },
+      { name: "groups", type: "array", fields: [{ name: "groupId", type: "text", required: true }, { name: "label", type: "text", required: true }, { name: "regionName", type: "text", admin: { description: "A general region, never coordinates." } }] },
+      { name: "activatedBy", type: "text", admin: { readOnly: true, description: "The signed-in user who activated this panel. Set by activating." } },
+      { name: "activatedAt", type: "date", admin: { readOnly: true } }
+    ],
+    hooks: { beforeChange: [panelBeforeChange], afterChange: [supersedeOthers(panels)] }
+  };
+  const assignmentCollection = {
+    slug: assignments,
+    labels: { singular: "Lineage result", plural: "Lineage results" },
+    admin: { group, useAsTitle: "summary", defaultColumns: ["summary", "panel", "reviewStatus", "releasedAt"] },
+    access: {
+      read: async (args) => {
+        if (await manage(args) || await review(args)) return true;
+        const allowed = await readReleased(args);
+        if (!allowed) return false;
+        const released2 = { reviewStatus: { equals: "approved" } };
+        return allowed === true ? released2 : { and: [released2, allowed] };
+      },
+      create: manage,
+      update: review,
+      delete: () => false
+    },
+    fields: [
+      ...relation("subject", r.subject),
+      ...relation("sequence", r.sequence),
+      { name: "panel", type: "relationship", relationTo: panels, required: true, index: true },
+      { name: "summary", type: "text", required: true },
+      { name: "result", type: "json", required: true, admin: { description: "The OnePhylogeny result, stored exactly as computed." } },
+      ...relation("importRun", r.importRuns),
+      { name: "reviewStatus", type: "select", required: true, defaultValue: "pending", index: true, options: ["pending", "approved", "rejected", "withdrawn"] },
+      { name: "reviewer", type: "text", admin: { readOnly: true } },
+      { name: "releasedAt", type: "date", admin: { readOnly: true } },
+      { name: "panelStatus", type: "text", admin: { readOnly: true, description: "The panel's status when this result was made." } },
+      { name: "panelShownAsExploratory", type: "checkbox", admin: { readOnly: true } }
+    ],
+    hooks: { beforeChange: [assignmentBeforeChange(panels, againstShown)] }
+  };
+  const released = {
+    path: "/onephylogeny/released",
+    method: "get",
+    handler: async (req) => {
+      const subject = new URL(req.url ?? "", "http://x").searchParams.get("subject");
+      if (!subject || !r.subject) return Response.json({ error: "A subject is required" }, { status: 400 });
+      const found = await req.payload.find({ collection: assignments, where: { and: [{ subject: { equals: subject } }, { reviewStatus: { equals: "approved" } }] }, sort: "-releasedAt", limit: 20, depth: 1, req, overrideAccess: false });
+      return Response.json({ docs: found.docs });
+    }
+  };
+  return { ...config, collections: [...config.collections ?? [], panelCollection, assignmentCollection], endpoints: [...config.endpoints ?? [], released] };
+};
+export {
+  onePhylogeny
+};

package/package.json

@@ -1,6 +1,55 @@
 {
   "name": "@captiveorigins/payload-plugin-onephylogeny",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0-alpha.1",
+  "description": "OnePhylogeny for Payload: immutable reference panels and released results on your own collections, with server-enforced review, safe endpoints and no coordinates.",
+  "keywords": [
+    "phylogenetics",
+    "reference-panel"
+  ],
+  "homepage": "https://github.com/CaptiveOrigins/onephylogeny#readme",
+  "bugs": {
+    "url": "https://github.com/CaptiveOrigins/onephylogeny/issues"
+  },
+  "license": "PolyForm-Noncommercial-1.0.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/CaptiveOrigins/onephylogeny.git",
+    "directory": "packages/payload"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "dependencies": {
+    "@captiveorigins/onephylogeny-core": "^0.1.0-alpha.1"
+  },
+  "peerDependencies": {
+    "payload": "^3.80.0"
+  },
+  "devDependencies": {
+    "@payloadcms/db-mongodb": "3.92.1",
+    "graphql": "^16.14.2",
+    "mongodb-memory-server": "^11.3.0",
+    "payload": "^3.92.1",
+    "@types/node": "^24.19.2"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts --clean --target es2022",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
 }