@forumone/throughline-approvals 0.0.1 → 0.2.1

package/dist/options.d.ts

@@ -0,0 +1,50 @@
+import type { Inngest } from 'inngest';
+import type { BaseCorePluginOptions } from '@forumone/throughline-plugin-contract';
+export interface ApproverGroup {
+    /** Group slug, referenced by the policy.approverGroups field on requests. */
+    slug: string;
+    /** Human-readable group name shown in admin UI. */
+    name: string;
+    /** Optional description shown in admin. */
+    description?: string;
+}
+export interface ResolvedApprover {
+    id: string;
+    email: string;
+    name?: string;
+}
+export interface GroupResolver {
+    /**
+     * Given a list of group slugs, returns the users in those groups. Used
+     * when an approval is requested to materialize the actual approver list
+     * and again if the action endpoint needs to confirm a token-bearing user
+     * belongs to one of the request's groups.
+     */
+    resolveUsers: (groupSlugs: string[]) => Promise<ResolvedApprover[]>;
+}
+export interface ApprovalsPluginOptions extends BaseCorePluginOptions {
+    /** Approver groups available in this deployment. */
+    groups: ApproverGroup[];
+    /** Resolver mapping group slugs to users. Required. */
+    groupResolver: GroupResolver;
+    /** Inngest client for firing approval/* events. Required. */
+    inngest: Inngest;
+    /** HMAC signing secret for action tokens. Falls back to APPROVAL_TOKEN_SECRET env var. */
+    tokenSecret?: string;
+    /** Days before a pending approval expires. Default: 7. */
+    expirationDays?: number;
+    /** Override the approvals collection slug. Default: 'approvals'. */
+    collectionSlug?: string;
+    /** Override the users collection slug used for approver/requester relationships. Default: 'users'. */
+    usersSlug?: string;
+    /** Public base URL used to build inline action links. Defaults to NEXT_PUBLIC_SERVER_URL. */
+    publicUrl?: string;
+}
+/**
+ * Validates options at load time and resolves the token secret. Throws with
+ * a targeted error on each obvious misconfiguration.
+ */
+export declare function validateOptions(options: ApprovalsPluginOptions): ApprovalsPluginOptions & {
+    tokenSecret: string;
+};
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAElF,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAA;IACZ,mDAAmD;IACnD,IAAI,EAAE,MAAM,CAAA;IACZ,2CAA2C;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAA;CACpE;AAED,MAAM,WAAW,sBAAuB,SAAQ,qBAAqB;IACnE,oDAAoD;IACpD,MAAM,EAAE,aAAa,EAAE,CAAA;IACvB,uDAAuD;IACvD,aAAa,EAAE,aAAa,CAAA;IAC5B,6DAA6D;IAC7D,OAAO,EAAE,OAAO,CAAA;IAChB,0FAA0F;IAC1F,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,0DAA0D;IAC1D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6FAA6F;IAC7F,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,GAC9B,sBAAsB,GAAG;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CA2BlD"}

package/dist/options.js

@@ -0,0 +1,28 @@
+const MIN_TOKEN_SECRET_LENGTH = 32;
+/**
+ * Validates options at load time and resolves the token secret. Throws with
+ * a targeted error on each obvious misconfiguration.
+ */
+export function validateOptions(options) {
+    if (!options.groups || options.groups.length === 0) {
+        throw new Error('approvalsPlugin requires at least one group in options.groups');
+    }
+    if (!options.groupResolver) {
+        throw new Error('approvalsPlugin requires a groupResolver in options');
+    }
+    if (!options.inngest) {
+        throw new Error('approvalsPlugin requires an Inngest client in options.inngest');
+    }
+    const secret = options.tokenSecret ?? process.env['APPROVAL_TOKEN_SECRET'];
+    if (!secret || secret.length < MIN_TOKEN_SECRET_LENGTH) {
+        throw new Error(`approvalsPlugin requires a tokenSecret in options or an APPROVAL_TOKEN_SECRET env var (${MIN_TOKEN_SECRET_LENGTH}+ characters)`);
+    }
+    // Group slugs must be unique.
+    const slugs = options.groups.map((g) => g.slug);
+    const dupes = slugs.filter((s, i) => slugs.indexOf(s) !== i);
+    if (dupes.length > 0) {
+        throw new Error(`approvalsPlugin: duplicate group slug${dupes.length === 1 ? '' : 's'}: ${dupes.join(', ')}`);
+    }
+    return { ...options, tokenSecret: secret };
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AA+CA,MAAM,uBAAuB,GAAG,EAAE,CAAA;AAElC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA+B;IAE/B,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAA;IAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,0FAA0F,uBAAuB,eAAe,CACjI,CAAA;IACH,CAAC;IAED,8BAA8B;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,wCAAwC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7F,CAAA;IACH,CAAC;IAED,OAAO,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAA;AAC5C,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,4 @@
+import type { CorePlugin } from '@forumone/throughline-plugin-contract';
+import { type ApprovalsPluginOptions } from './options.js';
+export declare const approvalsPlugin: CorePlugin<ApprovalsPluginOptions>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uCAAuC,CAAA;AAQvE,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,cAAc,CAAA;AAmB3E,eAAO,MAAM,eAAe,EAAE,UAAU,CAAC,sBAAsB,CA2G5D,CAAA"}

package/dist/plugin.js

@@ -0,0 +1,103 @@
+import { getPluginRegistry } from '@forumone/throughline-plugin-contract';
+import { createMcpHandler, createNamedLogger, defaultLogger, getAuditWriter, } from '@forumone/throughline-core';
+import { validateOptions } from './options.js';
+import { createApprovalsCollection } from './collection.js';
+import { attachApprovalResolver, createApprovalResolver } from './resolver.js';
+import { createActionEndpoint } from './endpoints/action.js';
+import { createGetApprovalStatusTool, createListMyRequestsTool, createListPendingApprovalsTool, createRequestApprovalTool, createRespondToApprovalTool, } from './tools/index.js';
+const PLUGIN_ID = '@forumone/throughline-approvals';
+const PLUGIN_VERSION = '0.1.0';
+const MCP_HANDLER_SYMBOL = Symbol.for('@forumone/throughline/approvals-mcp-handler');
+const ACTION_HANDLER_SYMBOL = Symbol.for('@forumone/throughline/approvals-action-handler');
+export const approvalsPlugin = (rawOptions) => (incomingConfig) => {
+    if (rawOptions.enabled === false)
+        return incomingConfig;
+    const options = validateOptions(rawOptions);
+    const routePrefix = options.routePrefix ?? '/approvals';
+    const logger = createNamedLogger('approvals', options.logger ?? defaultLogger);
+    const collection = createApprovalsCollection({
+        ...(options.collectionSlug ? { slug: options.collectionSlug } : {}),
+        ...(options.usersSlug ? { usersSlug: options.usersSlug } : {}),
+        groupSlugs: options.groups.map((g) => g.slug),
+    });
+    return {
+        ...incomingConfig,
+        collections: [...(incomingConfig.collections ?? []), collection],
+        endpoints: [
+            ...(incomingConfig.endpoints ?? []),
+            {
+                path: `${routePrefix}/mcp`,
+                method: 'post',
+                handler: async (req) => {
+                    const handler = req.payload[MCP_HANDLER_SYMBOL];
+                    if (!handler) {
+                        return new Response(JSON.stringify({ error: 'Approvals MCP not initialized' }), { status: 503, headers: { 'content-type': 'application/json' } });
+                    }
+                    return handler(req);
+                },
+            },
+            {
+                path: `${routePrefix}/action`,
+                method: 'get',
+                handler: async (req) => {
+                    const actionHandler = req.payload[ACTION_HANDLER_SYMBOL];
+                    if (!actionHandler) {
+                        return new Response('Approvals action handler not initialized', { status: 503 });
+                    }
+                    return actionHandler(req);
+                },
+            },
+        ],
+        onInit: async (payload) => {
+            if (incomingConfig.onInit) {
+                await incomingConfig.onInit(payload);
+            }
+            const registry = getPluginRegistry(payload);
+            registry.requireCapability('audit-log', PLUGIN_ID);
+            const auditWriter = getAuditWriter(payload);
+            const collectionSlug = options.collectionSlug;
+            const resolver = createApprovalResolver(collectionSlug ? { payload, collectionSlug } : { payload });
+            attachApprovalResolver(payload, resolver);
+            const actionEndpoint = createActionEndpoint({ options, auditWriter });
+            Object.defineProperty(payload, ACTION_HANDLER_SYMBOL, {
+                value: actionEndpoint.handler,
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            const tools = [
+                createRequestApprovalTool({ payload, options, auditWriter }),
+                createRespondToApprovalTool({ payload, options, auditWriter }),
+                createGetApprovalStatusTool({ payload, options }),
+                createListPendingApprovalsTool({ payload, options }),
+                createListMyRequestsTool({ payload, options }),
+            ];
+            const handler = createMcpHandler({
+                payload,
+                serverName: 'approvals',
+                tools,
+                logger,
+            });
+            Object.defineProperty(payload, MCP_HANDLER_SYMBOL, {
+                value: handler,
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            registry.register({
+                id: PLUGIN_ID,
+                version: PLUGIN_VERSION,
+                capabilities: ['approvals', 'approval-resolver'],
+            });
+            logger.info('Approvals server ready', {
+                groups: options.groups.map((g) => g.slug),
+                expirationDays: options.expirationDays ?? 7,
+            });
+        },
+    };
+};
+// `createActionEndpoint` is exported from src/index.ts for clients who want
+// to expose the action handler separately (e.g. behind a branded router).
+// Most consumers won't need it — the plugin already registers the action
+// endpoint at `${routePrefix}/action`.
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAA+B,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,EACL,2BAA2B,EAC3B,wBAAwB,EACxB,8BAA8B,EAC9B,yBAAyB,EACzB,2BAA2B,GAC5B,MAAM,kBAAkB,CAAA;AAEzB,MAAM,SAAS,GAAG,iCAAiC,CAAA;AACnD,MAAM,cAAc,GAAG,OAAO,CAAA;AAC9B,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAA;AACpF,MAAM,qBAAqB,GAAG,MAAM,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAA;AAI1F,MAAM,CAAC,MAAM,eAAe,GAC1B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IACjC,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEvD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAA;IACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAA;IAE9E,MAAM,UAAU,GAAG,yBAAyB,CAAC;QAC3C,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;KAC9C,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,cAAc;QACjB,WAAW,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;QAChE,SAAS,EAAE;YACT,GAAG,CAAC,cAAc,CAAC,SAAS,IAAI,EAAE,CAAC;YACnC;gBACE,IAAI,EAAE,GAAG,WAAW,MAAM;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,OAAO,GAAI,GAAG,CAAC,OAA8C,CACjE,kBAAkB,CACO,CAAA;oBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,EAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;oBACH,CAAC;oBACD,OAAO,OAAO,CAAC,GAAyB,CAAC,CAAA;gBAC3C,CAAC;aACF;YACD;gBACE,IAAI,EAAE,GAAG,WAAW,SAAS;gBAC7B,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,aAAa,GAAI,GAAG,CAAC,OAA8C,CACvE,qBAAqB,CACgC,CAAA;oBACvD,IAAI,CAAC,aAAa,EAAE,CAAC;wBACnB,OAAO,IAAI,QAAQ,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;oBAClF,CAAC;oBACD,OAAO,aAAa,CAAC,GAAG,CAAC,CAAA;gBAC3B,CAAC;aACF;SACF;QACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,cAAc,CAAC,MAAM,EAAE,CAAC;gBAC1B,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YACtC,CAAC;YAED,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAElD,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;YAE3C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,CAAA;YAC7C,MAAM,QAAQ,GAAG,sBAAsB,CACrC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAC3D,CAAA;YACD,sBAAsB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAEzC,MAAM,cAAc,GAAG,oBAAoB,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,qBAAqB,EAAE;gBACpD,KAAK,EAAE,cAAc,CAAC,OAAO;gBAC7B,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG;gBACZ,yBAAyB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;gBAC5D,2BAA2B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;gBAC9D,2BAA2B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACjD,8BAA8B,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;gBACpD,wBAAwB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;aAC/C,CAAA;YAED,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAC/B,OAAO;gBACP,UAAU,EAAE,WAAW;gBACvB,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YAEF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE;gBACjD,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,QAAQ,CAAC,QAAQ,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;aACjD,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBACpC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBACzC,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;aAC5C,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA;AAEH,4EAA4E;AAC5E,0EAA0E;AAC1E,yEAAyE;AACzE,uCAAuC"}

package/dist/resolver.d.ts

@@ -0,0 +1,25 @@
+import type { Payload } from 'payload';
+import type { ApprovalResolver } from '@forumone/throughline-publishing';
+/**
+ * Symbol under which the resolver is attached to the Payload instance.
+ * Publishing's `approvalStep` looks here when its `options.approvalResolver`
+ * is not set; this is the wiring point that lets clients add the approvals
+ * plugin without re-configuring publishing.
+ */
+export declare const APPROVALS_RESOLVER_SYMBOL: unique symbol;
+export interface CreateApprovalResolverOptions {
+    payload: Payload;
+    /** Override the approvals collection slug. Default: 'approvals'. */
+    collectionSlug?: string;
+}
+/**
+ * Builds the resolver that the publishing server consumes. Looks up the
+ * latest granted approval whose `targetVersion` matches the document
+ * version under consideration. Multiple decisions are sorted by `decidedAt`
+ * descending; first-decision-wins semantics mean the latest grant for a
+ * given version is what counts.
+ */
+export declare function createApprovalResolver(options: CreateApprovalResolverOptions): ApprovalResolver;
+/** Attaches the resolver to a Payload instance under the agreed symbol. */
+export declare function attachApprovalResolver(payload: object, resolver: ApprovalResolver): void;
+//# sourceMappingURL=resolver.d.ts.map

package/dist/resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAkB,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAGxF;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,eAErC,CAAA;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,OAAO,CAAA;IAChB,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,gBAAgB,CAyClB;AAED,2EAA2E;AAC3E,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAON"}

package/dist/resolver.js

@@ -0,0 +1,63 @@
+import { DEFAULT_APPROVALS_SLUG } from './collection.js';
+/**
+ * Symbol under which the resolver is attached to the Payload instance.
+ * Publishing's `approvalStep` looks here when its `options.approvalResolver`
+ * is not set; this is the wiring point that lets clients add the approvals
+ * plugin without re-configuring publishing.
+ */
+export const APPROVALS_RESOLVER_SYMBOL = Symbol.for('@forumone/throughline/approvals-resolver');
+/**
+ * Builds the resolver that the publishing server consumes. Looks up the
+ * latest granted approval whose `targetVersion` matches the document
+ * version under consideration. Multiple decisions are sorted by `decidedAt`
+ * descending; first-decision-wins semantics mean the latest grant for a
+ * given version is what counts.
+ */
+export function createApprovalResolver(options) {
+    const { payload, collectionSlug = DEFAULT_APPROVALS_SLUG } = options;
+    return {
+        async getActiveApproval(collection, id, version) {
+            const result = await payload.find({
+                collection: collectionSlug,
+                where: {
+                    and: [
+                        { targetCollection: { equals: collection } },
+                        { targetId: { equals: id } },
+                        { targetVersion: { equals: version } },
+                        { status: { equals: 'granted' } },
+                    ],
+                },
+                limit: 1,
+                sort: '-decidedAt',
+            });
+            const approval = result.docs[0];
+            if (!approval)
+                return null;
+            const decidedAt = approval['decidedAt'];
+            if (typeof decidedAt !== 'string')
+                return null;
+            const decidedByRaw = approval['decidedBy'];
+            const decidedBy = typeof decidedByRaw === 'string'
+                ? decidedByRaw
+                : decidedByRaw && typeof decidedByRaw === 'object' && 'id' in decidedByRaw
+                    ? String(decidedByRaw.id)
+                    : '';
+            return {
+                id: String(approval['id']),
+                grantedAt: decidedAt,
+                grantedBy: decidedBy,
+                version: String(approval['targetVersion']),
+            };
+        },
+    };
+}
+/** Attaches the resolver to a Payload instance under the agreed symbol. */
+export function attachApprovalResolver(payload, resolver) {
+    Object.defineProperty(payload, APPROVALS_RESOLVER_SYMBOL, {
+        value: resolver,
+        enumerable: false,
+        writable: false,
+        configurable: false,
+    });
+}
+//# sourceMappingURL=resolver.js.map

package/dist/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../src/resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAExD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC,GAAG,CACjD,0CAA0C,CAC3C,CAAA;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAsC;IAEtC,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,sBAAsB,EAAE,GAAG,OAAO,CAAA;IAEpE,OAAO;QACL,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO;YAC7C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,cAAc;gBAC1B,KAAK,EAAE;oBACL,GAAG,EAAE;wBACH,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE;wBAC5C,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE;wBAC5B,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;wBACtC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;qBAClC;iBACF;gBACD,KAAK,EAAE,CAAC;gBACR,IAAI,EAAE,YAAY;aACnB,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAwC,CAAA;YACtE,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAE1B,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;YACvC,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAE9C,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAA;YAC1C,MAAM,SAAS,GACb,OAAO,YAAY,KAAK,QAAQ;gBAC9B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,IAAI,IAAI,YAAY;oBACxE,CAAC,CAAC,MAAM,CAAE,YAAgC,CAAC,EAAE,CAAC;oBAC9C,CAAC,CAAC,EAAE,CAAA;YAEV,OAAO;gBACL,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAC1B,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;aAC3C,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,QAA0B;IAE1B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,yBAAyB,EAAE;QACxD,KAAK,EAAE,QAAQ;QACf,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,KAAK;KACpB,CAAC,CAAA;AACJ,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,48 @@
+/**
+ * HMAC-signed action tokens used in inline action emails (Approve / Decline /
+ * Request changes / Discuss). Each token is bound to one approval, one
+ * action, and one approver. Tokens are valid for a configurable window
+ * (default 14 days) and consumed via the `consumedTokens` array on the
+ * approval record so they can't be replayed.
+ *
+ * Crypto uses the Web Crypto API (`crypto.subtle`) so the same code runs
+ * in Node and edge runtimes.
+ */
+export type ActionTokenAction = 'approve' | 'decline' | 'changes' | 'discuss';
+export interface ActionToken {
+    approvalId: string;
+    action: ActionTokenAction;
+    approverId: string;
+    /** Issued-at timestamp in milliseconds since epoch. */
+    issuedAt: number;
+}
+/**
+ * Mints an action token. Returns a base64url-encoded payload with the
+ * format `<approvalId>:<action>:<approverId>:<issuedAt>:<signature>`.
+ */
+export declare function generateActionToken(token: ActionToken, secret: string): Promise<string>;
+export interface VerifyOptions {
+    /** Override the default 14-day token lifetime. */
+    maxAgeMs?: number;
+    /** Override "now" — useful in tests. Defaults to `Date.now()`. */
+    now?: number;
+}
+export type VerifyResult = {
+    ok: true;
+    token: ActionToken;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Verifies a base64url-encoded action token with constant-time signature
+ * comparison. Returns either the parsed token or a structured error.
+ */
+export declare function verifyActionToken(encoded: string, secret: string, options?: VerifyOptions): Promise<VerifyResult>;
+/**
+ * Returns the absolute URL an approver visits to invoke the action. The
+ * server-side endpoint (added by the plugin) verifies the token and
+ * presents a confirmation page before recording the decision.
+ */
+export declare function buildActionUrl(publicUrl: string, token: string): string;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAA;AAE7E,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,iBAAiB,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAA;CACjB;AAOD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,MAAM,WAAW,aAAa;IAC5B,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhC;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAiDvB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGvE"}

package/dist/tokens.js

@@ -0,0 +1,103 @@
+/**
+ * HMAC-signed action tokens used in inline action emails (Approve / Decline /
+ * Request changes / Discuss). Each token is bound to one approval, one
+ * action, and one approver. Tokens are valid for a configurable window
+ * (default 14 days) and consumed via the `consumedTokens` array on the
+ * approval record so they can't be replayed.
+ *
+ * Crypto uses the Web Crypto API (`crypto.subtle`) so the same code runs
+ * in Node and edge runtimes.
+ */
+const DEFAULT_MAX_AGE_MS = 14 * 24 * 60 * 60 * 1000;
+const TOKEN_PARTS = 5;
+const VALID_ACTIONS = new Set(['approve', 'decline', 'changes', 'discuss']);
+const ENCODER = new TextEncoder();
+/**
+ * Mints an action token. Returns a base64url-encoded payload with the
+ * format `<approvalId>:<action>:<approverId>:<issuedAt>:<signature>`.
+ */
+export async function generateActionToken(token, secret) {
+    ensureSafeForEncoding(token);
+    const payload = `${token.approvalId}:${token.action}:${token.approverId}:${token.issuedAt}`;
+    const signature = await hmacSignHex(payload, secret);
+    return base64UrlEncode(`${payload}:${signature}`);
+}
+/**
+ * Verifies a base64url-encoded action token with constant-time signature
+ * comparison. Returns either the parsed token or a structured error.
+ */
+export async function verifyActionToken(encoded, secret, options = {}) {
+    let decoded;
+    try {
+        decoded = base64UrlDecode(encoded);
+    }
+    catch {
+        return { ok: false, error: 'Token decode failed' };
+    }
+    const parts = decoded.split(':');
+    if (parts.length !== TOKEN_PARTS)
+        return { ok: false, error: 'Invalid token format' };
+    const [approvalId, action, approverId, issuedAtRaw, providedSignature] = parts;
+    if (!approvalId || !action || !approverId || !issuedAtRaw || !providedSignature) {
+        return { ok: false, error: 'Invalid token format' };
+    }
+    const issuedAt = Number.parseInt(issuedAtRaw, 10);
+    if (!Number.isFinite(issuedAt)) {
+        return { ok: false, error: 'Invalid token timestamp' };
+    }
+    if (!VALID_ACTIONS.has(action)) {
+        return { ok: false, error: 'Invalid action' };
+    }
+    const expectedSignature = await hmacSignHex(`${approvalId}:${action}:${approverId}:${issuedAt}`, secret);
+    if (!constantTimeEqual(providedSignature, expectedSignature)) {
+        return { ok: false, error: 'Invalid token signature' };
+    }
+    const maxAge = options.maxAgeMs ?? DEFAULT_MAX_AGE_MS;
+    const now = options.now ?? Date.now();
+    if (now - issuedAt > maxAge) {
+        return { ok: false, error: 'Token has expired' };
+    }
+    return {
+        ok: true,
+        token: { approvalId, action: action, approverId, issuedAt },
+    };
+}
+/**
+ * Returns the absolute URL an approver visits to invoke the action. The
+ * server-side endpoint (added by the plugin) verifies the token and
+ * presents a confirmation page before recording the decision.
+ */
+export function buildActionUrl(publicUrl, token) {
+    const base = publicUrl.replace(/\/$/, '');
+    return `${base}/api/approvals/action?token=${encodeURIComponent(token)}`;
+}
+async function hmacSignHex(payload, secret) {
+    const key = await crypto.subtle.importKey('raw', ENCODER.encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const signature = await crypto.subtle.sign('HMAC', key, ENCODER.encode(payload));
+    return Array.from(new Uint8Array(signature))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+        result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return result === 0;
+}
+function ensureSafeForEncoding(token) {
+    if (token.approvalId.includes(':') ||
+        token.approverId.includes(':') ||
+        token.action.includes(':')) {
+        throw new Error('Token field contains a reserved colon character');
+    }
+}
+function base64UrlEncode(input) {
+    return Buffer.from(input, 'utf-8').toString('base64url');
+}
+function base64UrlDecode(encoded) {
+    return Buffer.from(encoded, 'base64url').toString('utf-8');
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AACnD,MAAM,WAAW,GAAG,CAAC,CAAA;AACrB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAoB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;AAC9F,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkB,EAClB,MAAc;IAEd,qBAAqB,CAAC,KAAK,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAA;IAC3F,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACpD,OAAO,eAAe,CAAC,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC,CAAA;AACnD,CAAC;AAaD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,MAAc,EACd,UAAyB,EAAE;IAE3B,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAA;IACpD,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IAErF,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,CAAC,GAAG,KAMxE,CAAA;IACD,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAChF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAA;IACrD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IACxD,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAA2B,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;IAC/C,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,WAAW,CACzC,GAAG,UAAU,IAAI,MAAM,IAAI,UAAU,IAAI,QAAQ,EAAE,EACnD,MAAM,CACP,CAAA;IACD,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAA;IACxD,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACrC,IAAI,GAAG,GAAG,QAAQ,GAAG,MAAM,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAA;IAClD,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAA2B,EAAE,UAAU,EAAE,QAAQ,EAAE;KACjF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,KAAa;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACzC,OAAO,GAAG,IAAI,+BAA+B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1E,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;IAChF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACvC,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7C,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAkB;IAC/C,IACE,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAC5D,CAAC"}

package/dist/tools/get-approval-status.d.ts

@@ -0,0 +1,11 @@
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+import type { ApprovalsPluginOptions } from '../options.js';
+export interface GetApprovalStatusDeps {
+    payload: Payload;
+    options: ApprovalsPluginOptions & {
+        tokenSecret: string;
+    };
+}
+export declare function createGetApprovalStatusTool(deps: GetApprovalStatusDeps): McpToolDefinition;
+//# sourceMappingURL=get-approval-status.d.ts.map

package/dist/tools/get-approval-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-approval-status.d.ts","sourceRoot":"","sources":["../../src/tools/get-approval-status.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAE3D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CAkC1F"}

package/dist/tools/get-approval-status.js

@@ -0,0 +1,47 @@
+import { z } from 'zod';
+import { withMeta } from '@forumone/throughline-core';
+import { DEFAULT_APPROVALS_SLUG } from '../collection.js';
+export function createGetApprovalStatusTool(deps) {
+    const inputSchema = withMeta({
+        approvalId: z.string(),
+    });
+    return {
+        name: 'get_approval_status',
+        description: "Returns the current status of an approval request including who decided, when, and any notes. Read-only; no audit record is written.",
+        inputSchema,
+        handler: async (input) => {
+            const approval = (await deps.payload.findByID({
+                collection: deps.options.collectionSlug ?? DEFAULT_APPROVALS_SLUG,
+                id: input.approvalId,
+            }));
+            if (!approval)
+                return { error: 'Approval not found' };
+            return {
+                approvalId: String(approval['id']),
+                status: approval['status'],
+                targetCollection: approval['targetCollection'],
+                targetId: approval['targetId'],
+                targetTitle: approval['targetTitle'],
+                targetVersion: approval['targetVersion'],
+                requestedBy: unwrapRelationshipId(approval['requestedBy']),
+                requestedAt: approval['requestedAt'],
+                approverGroups: approval['approverGroups'],
+                decidedBy: unwrapRelationshipId(approval['decidedBy']),
+                decidedAt: approval['decidedAt'],
+                decisionNotes: approval['decisionNotes'],
+                expiresAt: approval['expiresAt'],
+            };
+        },
+    };
+}
+function unwrapRelationshipId(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'object' && 'id' in value) {
+        return String(value.id);
+    }
+    return null;
+}
+//# sourceMappingURL=get-approval-status.js.map

package/dist/tools/get-approval-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-approval-status.js","sourceRoot":"","sources":["../../src/tools/get-approval-status.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAErD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAQzD,MAAM,UAAU,2BAA2B,CAAC,IAA2B;IACrE,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC,CAAA;IAEF,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,sIAAsI;QACxI,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC5C,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,sBAAsB;gBACjE,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC,CAAmC,CAAA;YACrC,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;YAErD,OAAO;gBACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAClC,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC;gBAC1B,gBAAgB,EAAE,QAAQ,CAAC,kBAAkB,CAAC;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC;gBAC9B,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC;gBACpC,aAAa,EAAE,QAAQ,CAAC,eAAe,CAAC;gBACxC,WAAW,EAAE,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBAC1D,WAAW,EAAE,QAAQ,CAAC,aAAa,CAAC;gBACpC,cAAc,EAAE,QAAQ,CAAC,gBAAgB,CAAC;gBAC1C,SAAS,EAAE,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtD,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC;gBAChC,aAAa,EAAE,QAAQ,CAAC,eAAe,CAAC;gBACxC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC;aACjC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAE,KAAyB,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,6 @@
+export { createRequestApprovalTool, type RequestApprovalDeps, } from './request-approval.js';
+export { createRespondToApprovalTool, type RespondToApprovalDeps, } from './respond-to-approval.js';
+export { createGetApprovalStatusTool, type GetApprovalStatusDeps, } from './get-approval-status.js';
+export { createListPendingApprovalsTool, type ListPendingApprovalsDeps, } from './list-pending-approvals.js';
+export { createListMyRequestsTool, type ListMyRequestsDeps, } from './list-my-requests.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,GACzB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,2BAA2B,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,wBAAwB,EACxB,KAAK,kBAAkB,GACxB,MAAM,uBAAuB,CAAA"}

package/dist/tools/index.js

@@ -0,0 +1,6 @@
+export { createRequestApprovalTool, } from './request-approval.js';
+export { createRespondToApprovalTool, } from './respond-to-approval.js';
+export { createGetApprovalStatusTool, } from './get-approval-status.js';
+export { createListPendingApprovalsTool, } from './list-pending-approvals.js';
+export { createListMyRequestsTool, } from './list-my-requests.js';
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,GAE1B,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,2BAA2B,GAE5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,2BAA2B,GAE5B,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,8BAA8B,GAE/B,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,wBAAwB,GAEzB,MAAM,uBAAuB,CAAA"}

package/dist/tools/list-my-requests.d.ts

@@ -0,0 +1,11 @@
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+import type { ApprovalsPluginOptions } from '../options.js';
+export interface ListMyRequestsDeps {
+    payload: Payload;
+    options: ApprovalsPluginOptions & {
+        tokenSecret: string;
+    };
+}
+export declare function createListMyRequestsTool(deps: ListMyRequestsDeps): McpToolDefinition;
+//# sourceMappingURL=list-my-requests.d.ts.map

package/dist/tools/list-my-requests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-my-requests.d.ts","sourceRoot":"","sources":["../../src/tools/list-my-requests.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAE3D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAqDpF"}