@forumone/throughline-core 0.0.1 → 0.2.0

package/dist/audit/writer.js

@@ -0,0 +1,101 @@
+/**
+ * Returns a fire-and-forget audit writer. The writer never throws — failures
+ * log via `options.logger` (or `console`). Audit failures must not break
+ * the originating action.
+ *
+ * If `inngest` is provided the writer also fires an `audit/event.recorded`
+ * event so subscribers (email, integrations, healthchecks) can react.
+ */
+export function createAuditWriter(options) {
+    const { payload, inngest, collectionSlug = 'audit-events', logger } = options;
+    return async function recordAuditEvent(event) {
+        try {
+            const summary = event.summary ?? generateSummary(event);
+            const created = await payload.create({
+                collection: collectionSlug,
+                data: stripUndefined({
+                    createdAt: new Date().toISOString(),
+                    actor: stripUndefined({ ...event.actor }),
+                    action: event.action,
+                    mcpServer: event.mcpServer,
+                    mcpTool: event.mcpTool,
+                    targetCollection: event.targetCollection,
+                    targetId: event.targetId,
+                    targetTitle: event.targetTitle,
+                    prompt: event.prompt,
+                    reasoning: event.reasoning,
+                    changesSummary: event.changesSummary,
+                    summary,
+                    diff: event.diff ?? null,
+                    success: event.success ?? true,
+                    errorMessage: event.errorMessage,
+                    approvalRequestId: event.approvalRequestId,
+                    integrationId: event.integrationId,
+                }),
+            });
+            if (inngest) {
+                try {
+                    await inngest.send({
+                        name: 'audit/event.recorded',
+                        data: stripUndefined({
+                            auditEventId: String(created.id),
+                            action: event.action,
+                            actorId: event.actor.userId,
+                            targetCollection: event.targetCollection,
+                            targetId: event.targetId,
+                            approvalRequestId: event.approvalRequestId,
+                            integrationId: event.integrationId,
+                        }),
+                    });
+                }
+                catch (eventError) {
+                    logger?.warn('Audit Inngest event send failed', { error: String(eventError) });
+                }
+            }
+        }
+        catch (writeError) {
+            logger?.error('Audit event write failed', {
+                error: String(writeError),
+                action: event.action,
+                targetCollection: event.targetCollection,
+                targetId: event.targetId,
+            });
+            // Intentionally swallowed: never let audit failures break the original action.
+        }
+    };
+}
+const SUMMARY_TEMPLATES = {
+    'content.update': (e) => `Updated ${e.targetTitle ?? e.targetId ?? '(unknown)'} in ${e.targetCollection ?? '(unknown)'}`,
+    'content.create': (e) => `Created ${e.targetTitle ?? e.targetId ?? '(unknown)'} in ${e.targetCollection ?? '(unknown)'}`,
+    'content.delete': (e) => `Deleted ${e.targetTitle ?? e.targetId ?? '(unknown)'} from ${e.targetCollection ?? '(unknown)'}`,
+    'content.find': (e) => `Queried ${e.targetCollection ?? '(unknown)'}`,
+    'design.suggest': (e) => `Searched for components matching: ${e.prompt?.slice(0, 80) ?? 'an intent'}`,
+    'design.validate': () => 'Validated a composition',
+    'design.get_contract': (e) => `Fetched contract for ${e.targetTitle ?? '(a component)'}`,
+    'publishing.publish': (e) => `Published ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'publishing.unpublish': (e) => `Unpublished ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'publishing.schedule': (e) => `Scheduled publish for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'publishing.rollback': (e) => `Rolled back ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'approval.requested': (e) => `Requested approval for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'approval.granted': (e) => `Granted approval for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'approval.declined': (e) => `Declined approval for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'approval.expired': (e) => `Approval expired for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'form.submission_received': (e) => `Form submission received for ${e.targetTitle ?? e.targetId ?? '(unknown)'}`,
+    'integration.synced': (e) => `Synced ${e.integrationId ?? '(unknown integration)'}`,
+    'integration.failed': (e) => `Integration failed: ${e.integrationId ?? '(unknown integration)'}`,
+};
+function generateSummary(event) {
+    const template = SUMMARY_TEMPLATES[event.action];
+    if (template)
+        return template(event);
+    return `${event.action} (${event.mcpServer}:${event.mcpTool})`;
+}
+function stripUndefined(obj) {
+    const out = {};
+    for (const [key, value] of Object.entries(obj)) {
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=writer.js.map

package/dist/audit/writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writer.js","sourceRoot":"","sources":["../../src/audit/writer.ts"],"names":[],"mappings":"AA0CA;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA2B;IAC3D,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAA;IAE7E,OAAO,KAAK,UAAU,gBAAgB,CAAC,KAAsB;QAC3D,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,CAAA;YAEvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnC,UAAU,EAAE,cAAc;gBAC1B,IAAI,EAAE,cAAc,CAAC;oBACnB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,KAAK,EAAE,cAAc,CAAC,EAAE,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC;oBACzC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;oBACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,OAAO;oBACP,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;oBAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;iBACnC,CAAC;aACH,CAAC,CAAA;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,IAAI,CAAC;wBACjB,IAAI,EAAE,sBAAsB;wBAC5B,IAAI,EAAE,cAAc,CAAC;4BACnB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;4BAChC,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;4BAC3B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;4BACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;4BACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;4BAC1C,aAAa,EAAE,KAAK,CAAC,aAAa;yBACnC,CAAC;qBACH,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,MAAM,EAAE,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,EAAE,KAAK,CAAC,0BAA0B,EAAE;gBACxC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;gBACzB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;aACzB,CAAC,CAAA;YACF,+EAA+E;QACjF,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAED,MAAM,iBAAiB,GAAiE;IACtF,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,OAAO,CAAC,CAAC,gBAAgB,IAAI,WAAW,EAAE;IACxH,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,OAAO,CAAC,CAAC,gBAAgB,IAAI,WAAW,EAAE;IACxH,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,SAAS,CAAC,CAAC,gBAAgB,IAAI,WAAW,EAAE;IAC1H,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,gBAAgB,IAAI,WAAW,EAAE;IACrE,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,CACtB,qCAAqC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE;IAC9E,iBAAiB,EAAE,GAAG,EAAE,CAAC,yBAAyB;IAClD,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,WAAW,IAAI,eAAe,EAAE;IACxF,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IACtF,sBAAsB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IAC1F,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IACnG,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IACzF,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IACnG,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IAC/F,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IACjG,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IAC/F,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,gCAAgC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,QAAQ,IAAI,WAAW,EAAE;IAC9E,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,aAAa,IAAI,uBAAuB,EAAE;IACnF,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,aAAa,IAAI,uBAAuB,EAAE;CACjG,CAAA;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpC,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,GAAG,CAAA;AAChE,CAAC;AAED,SAAS,cAAc,CAAoC,GAAM;IAC/D,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;IAC3C,CAAC;IACD,OAAO,GAAQ,CAAA;AACjB,CAAC"}

package/dist/auth/api-keys.d.ts

@@ -0,0 +1,21 @@
+import type { CollectionConfig } from 'payload';
+export interface ApiKeysCollectionOptions {
+    /** Override the collection slug. Default: `'mcp-api-keys'`. */
+    slug?: string;
+    /** Slug of the users collection the key links to. Default: `'users'`. */
+    usersSlug?: string;
+    /** Allowed scope strings shown in the admin UI. */
+    availableScopes?: string[];
+}
+export declare const DEFAULT_API_KEYS_SLUG = "mcp-api-keys";
+/**
+ * Builds the API-keys collection config. Stores keys as SHA-256 hashes;
+ * raw keys are surfaced one-time via the `keyDisplay` field on create
+ * so the admin UI can show them to the operator.
+ */
+export declare function createApiKeysCollection(options?: ApiKeysCollectionOptions): CollectionConfig;
+/** Generates a random API key prefixed with `tl_`. */
+export declare function generateApiKey(): string;
+/** Hashes a string with SHA-256 using the Web Crypto API; returns lowercase hex. */
+export declare function sha256Hex(input: string): Promise<string>;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/auth/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAU,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAEvD,MAAM,WAAW,wBAAwB;IACvC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,eAAO,MAAM,qBAAqB,iBAAiB,CAAA;AAwBnD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,wBAA6B,GACrC,gBAAgB,CAyElB;AAED,sDAAsD;AACtD,wBAAgB,cAAc,IAAI,MAAM,CAOvC;AAED,oFAAoF;AACpF,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D"}

package/dist/auth/api-keys.js

@@ -0,0 +1,115 @@
+export const DEFAULT_API_KEYS_SLUG = 'mcp-api-keys';
+const DEFAULT_SCOPES = [
+    'content.read',
+    'content.write',
+    'design.read',
+    'publishing.execute',
+    'approvals.request',
+    'approvals.decide',
+    'forms.manage',
+    'integrations.trigger',
+    'audit.read',
+];
+/**
+ * Returns true when the requesting user has the `admin` role. Used as the
+ * default access check for the keys collection — keys grant capability,
+ * so creating/reading them must be tightly scoped.
+ */
+const adminOnly = ({ req }) => {
+    const roles = req.user?.['roles'] ?? [];
+    return roles.includes('admin');
+};
+/**
+ * Builds the API-keys collection config. Stores keys as SHA-256 hashes;
+ * raw keys are surfaced one-time via the `keyDisplay` field on create
+ * so the admin UI can show them to the operator.
+ */
+export function createApiKeysCollection(options = {}) {
+    const slug = options.slug ?? DEFAULT_API_KEYS_SLUG;
+    const usersSlug = options.usersSlug ?? 'users';
+    const availableScopes = options.availableScopes ?? [...DEFAULT_SCOPES];
+    return {
+        slug,
+        admin: {
+            useAsTitle: 'name',
+            defaultColumns: ['name', 'linkedUser', 'enabled', 'lastUsedAt'],
+            description: 'API keys for MCP clients. Each key inherits the linked user\'s access control; keys are stored as SHA-256 hashes.',
+        },
+        access: {
+            read: adminOnly,
+            create: adminOnly,
+            update: adminOnly,
+            delete: adminOnly,
+        },
+        fields: [
+            { name: 'name', type: 'text', required: true },
+            {
+                name: 'linkedUser',
+                type: 'relationship',
+                relationTo: usersSlug,
+                required: true,
+                admin: { description: 'The user whose access control this key inherits.' },
+            },
+            {
+                name: 'scopes',
+                type: 'select',
+                hasMany: true,
+                required: true,
+                options: availableScopes.map((value) => ({ label: value, value })),
+            },
+            { name: 'enabled', type: 'checkbox', defaultValue: true, required: true },
+            {
+                name: 'keyHash',
+                type: 'text',
+                required: true,
+                admin: {
+                    readOnly: true,
+                    description: 'SHA-256 hash of the key. The raw key is never stored.',
+                },
+            },
+            {
+                name: 'keyDisplay',
+                type: 'text',
+                admin: {
+                    readOnly: true,
+                    description: 'First and last 4 characters of the key for identification.',
+                },
+            },
+            { name: 'expiresAt', type: 'date' },
+            { name: 'lastUsedAt', type: 'date', admin: { readOnly: true } },
+        ],
+        hooks: {
+            beforeChange: [
+                async ({ data, operation }) => {
+                    if (operation !== 'create')
+                        return data;
+                    if (data['keyHash'])
+                        return data;
+                    const rawKey = generateApiKey();
+                    data['keyHash'] = await sha256Hex(rawKey);
+                    data['keyDisplay'] = `${rawKey.slice(0, 8)}...${rawKey.slice(-4)}`;
+                    data.__rawKey = rawKey;
+                    return data;
+                },
+            ],
+        },
+    };
+}
+/** Generates a random API key prefixed with `tl_`. */
+export function generateApiKey() {
+    const bytes = new Uint8Array(32);
+    crypto.getRandomValues(bytes);
+    const hex = Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+    return `tl_${hex}`;
+}
+/** Hashes a string with SHA-256 using the Web Crypto API; returns lowercase hex. */
+export async function sha256Hex(input) {
+    const data = new TextEncoder().encode(input);
+    const buffer = await crypto.subtle.digest('SHA-256', data);
+    return Array.from(new Uint8Array(buffer))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/auth/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/auth/api-keys.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,qBAAqB,GAAG,cAAc,CAAA;AAEnD,MAAM,cAAc,GAAG;IACrB,cAAc;IACd,eAAe;IACf,aAAa;IACb,oBAAoB;IACpB,mBAAmB;IACnB,kBAAkB;IAClB,cAAc;IACd,sBAAsB;IACtB,YAAY;CACJ,CAAA;AAEV;;;;GAIG;AACH,MAAM,SAAS,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACpC,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;IACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;AAChC,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,qBAAqB,CAAA;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAA;IAC9C,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,GAAG,cAAc,CAAC,CAAA;IAEtE,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,UAAU,EAAE,MAAM;YAClB,cAAc,EAAE,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,CAAC;YAC/D,WAAW,EACT,mHAAmH;SACtH;QACD,MAAM,EAAE;YACN,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;SAClB;QACD,MAAM,EAAE;YACN,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,cAAc;gBACpB,UAAU,EAAE,SAAS;gBACrB,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE;aAC3E;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI;gBACb,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACnE;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;YACzE;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,uDAAuD;iBACrE;aACF;YACD;gBACE,IAAI,EAAE,YAAY;gBAClB,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,QAAQ,EAAE,IAAI;oBACd,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;YACnC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;SAChE;QACD,KAAK,EAAE;YACL,YAAY,EAAE;gBACZ,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE;oBAC5B,IAAI,SAAS,KAAK,QAAQ;wBAAE,OAAO,IAAI,CAAA;oBACvC,IAAI,IAAI,CAAC,SAAS,CAAC;wBAAE,OAAO,IAAI,CAAA;oBAEhC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;oBAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;oBACzC,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAGjE;oBAAC,IAAgC,CAAC,QAAQ,GAAG,MAAM,CAAA;oBACpD,OAAO,IAAI,CAAA;gBACb,CAAC;aACF;SACF;KACF,CAAA;AACH,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAChC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SAC1B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;IACX,OAAO,MAAM,GAAG,EAAE,CAAA;AACpB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}

package/dist/auth/authenticator.d.ts

@@ -0,0 +1,15 @@
+import type { Payload } from 'payload';
+import type { McpAuthenticator } from '@forumone/throughline-plugin-contract';
+export interface BearerTokenAuthenticatorOptions {
+    payload: Payload;
+    /** Slug for the API-keys collection. Default: `'mcp-api-keys'`. */
+    collectionSlug?: string;
+}
+/**
+ * Authenticates incoming MCP requests by looking up the bearer token's hash
+ * against the API-keys collection. Returns the linked user plus key metadata
+ * on success, `null` on any failure (no token, unknown token, disabled key,
+ * key without linked user, expired key).
+ */
+export declare function createBearerTokenAuthenticator(options: BearerTokenAuthenticatorOptions): McpAuthenticator;
+//# sourceMappingURL=authenticator.d.ts.map

package/dist/auth/authenticator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAGV,gBAAgB,EACjB,MAAM,uCAAuC,CAAA;AAG9C,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAA;IAChB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,+BAA+B,GACvC,gBAAgB,CAwClB"}

package/dist/auth/authenticator.js

@@ -0,0 +1,63 @@
+import { DEFAULT_API_KEYS_SLUG, sha256Hex } from './api-keys.js';
+/**
+ * Authenticates incoming MCP requests by looking up the bearer token's hash
+ * against the API-keys collection. Returns the linked user plus key metadata
+ * on success, `null` on any failure (no token, unknown token, disabled key,
+ * key without linked user, expired key).
+ */
+export function createBearerTokenAuthenticator(options) {
+    const { payload, collectionSlug = DEFAULT_API_KEYS_SLUG } = options;
+    return {
+        async authenticate(request) {
+            const token = extractBearerToken(request);
+            if (!token)
+                return null;
+            const hash = await sha256Hex(token);
+            const result = await payload.find({
+                collection: collectionSlug,
+                where: {
+                    and: [{ keyHash: { equals: hash } }, { enabled: { equals: true } }],
+                },
+                limit: 1,
+                depth: 1,
+            });
+            const apiKey = result.docs[0];
+            if (!apiKey)
+                return null;
+            const expiresAt = apiKey['expiresAt'];
+            if (typeof expiresAt === 'string' && Date.parse(expiresAt) <= Date.now()) {
+                return null;
+            }
+            const linkedUser = apiKey['linkedUser'];
+            if (!linkedUser || typeof linkedUser !== 'object')
+                return null;
+            const user = toAuthenticatedUser(linkedUser);
+            if (!user)
+                return null;
+            return {
+                user,
+                apiKeyName: String(apiKey['name'] ?? ''),
+                apiKeyId: String(apiKey['id']),
+            };
+        },
+    };
+}
+function extractBearerToken(request) {
+    const header = request.headers.get('authorization');
+    if (!header)
+        return null;
+    const match = /^Bearer\s+(.+)$/i.exec(header);
+    return match?.[1]?.trim() || null;
+}
+function toAuthenticatedUser(raw) {
+    if (raw['id'] === undefined || raw['email'] === undefined)
+        return null;
+    return {
+        id: String(raw['id']),
+        email: String(raw['email']),
+        name: String(raw['name'] ?? raw['email']),
+        roles: raw['roles'] ?? [],
+        groups: raw['groups'] ?? [],
+    };
+}
+//# sourceMappingURL=authenticator.js.map

package/dist/auth/authenticator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAQhE;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAwC;IAExC,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,qBAAqB,EAAE,GAAG,OAAO,CAAA;IAEnE,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAgB;YACjC,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAA;YAEvB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YAEnC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAChC,UAAU,EAAE,cAAc;gBAC1B,KAAK,EAAE;oBACL,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;iBACpE;gBACD,KAAK,EAAE,CAAC;gBACR,KAAK,EAAE,CAAC;aACT,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC7B,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAA;YAExB,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;YACrC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzE,OAAO,IAAI,CAAA;YACb,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,CAAA;YACvC,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAA;YAE9D,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAqC,CAAC,CAAA;YACvE,IAAI,CAAC,IAAI;gBAAE,OAAO,IAAI,CAAA;YAEtB,OAAO;gBACL,IAAI;gBACJ,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACxC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;aAC/B,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC7C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAA;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,GAA4B;IACvD,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtE,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACzC,KAAK,EAAG,GAAG,CAAC,OAAO,CAA0B,IAAI,EAAE;QACnD,MAAM,EAAG,GAAG,CAAC,QAAQ,CAA0B,IAAI,EAAE;KACtD,CAAA;AACH,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,5 @@
+export { createBearerTokenAuthenticator } from './authenticator.js';
+export type { BearerTokenAuthenticatorOptions } from './authenticator.js';
+export { createApiKeysCollection, generateApiKey, sha256Hex, DEFAULT_API_KEYS_SLUG, } from './api-keys.js';
+export type { ApiKeysCollectionOptions } from './api-keys.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AACnE,YAAY,EAAE,+BAA+B,EAAE,MAAM,oBAAoB,CAAA;AAEzE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,qBAAqB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+export { createBearerTokenAuthenticator } from './authenticator.js';
+export { createApiKeysCollection, generateApiKey, sha256Hex, DEFAULT_API_KEYS_SLUG, } from './api-keys.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAA;AAGnE,OAAO,EACL,uBAAuB,EACvB,cAAc,EACd,SAAS,EACT,qBAAqB,GACtB,MAAM,eAAe,CAAA"}

package/dist/env/index.d.ts

@@ -0,0 +1,51 @@
+import { z } from 'zod';
+/**
+ * Canonical env-var names used across Throughline packages. Plugins read
+ * `process.env[ENV_VARS.X]` rather than hard-coding strings so renames stay
+ * coordinated.
+ */
+export declare const ENV_VARS: {
+    readonly PAYLOAD_SECRET: "PAYLOAD_SECRET";
+    readonly DATABASE_URI: "DATABASE_URI";
+    readonly NEXT_PUBLIC_SERVER_URL: "NEXT_PUBLIC_SERVER_URL";
+    readonly INNGEST_EVENT_KEY: "INNGEST_EVENT_KEY";
+    readonly INNGEST_SIGNING_KEY: "INNGEST_SIGNING_KEY";
+    readonly RESEND_API_KEY: "RESEND_API_KEY";
+    readonly EMAIL_FROM_ADDRESS: "EMAIL_FROM_ADDRESS";
+    readonly EMAIL_FROM_NAME: "EMAIL_FROM_NAME";
+    readonly EMAIL_REPLY_TO: "EMAIL_REPLY_TO";
+    readonly APPROVAL_TOKEN_SECRET: "APPROVAL_TOKEN_SECRET";
+    readonly COMPONENT_SERVER_API_KEY: "COMPONENT_SERVER_API_KEY";
+    readonly PUBLISHING_SERVER_API_KEY: "PUBLISHING_SERVER_API_KEY";
+    readonly APPROVALS_SERVER_API_KEY: "APPROVALS_SERVER_API_KEY";
+    readonly AUDIT_SERVER_API_KEY: "AUDIT_SERVER_API_KEY";
+    readonly FORMS_SERVER_API_KEY: "FORMS_SERVER_API_KEY";
+    readonly INTEGRATIONS_SERVER_API_KEY: "INTEGRATIONS_SERVER_API_KEY";
+};
+export type EnvVarName = (typeof ENV_VARS)[keyof typeof ENV_VARS];
+declare const BaseEnvSchema: z.ZodObject<{
+    PAYLOAD_SECRET: z.ZodString;
+    DATABASE_URI: z.ZodString;
+    NEXT_PUBLIC_SERVER_URL: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    PAYLOAD_SECRET: string;
+    DATABASE_URI: string;
+    NEXT_PUBLIC_SERVER_URL: string;
+}, {
+    PAYLOAD_SECRET: string;
+    DATABASE_URI: string;
+    NEXT_PUBLIC_SERVER_URL: string;
+}>;
+export type BaseEnv = z.infer<typeof BaseEnvSchema>;
+/**
+ * Validates the base env vars every Throughline deployment requires.
+ * Plugins extend with their own checks. Throws on validation failure with
+ * a multi-line, path-qualified message.
+ */
+export declare function validateBaseEnv(env?: NodeJS.ProcessEnv): BaseEnv;
+/** Returns an env var, throwing with a clear error if missing or empty. */
+export declare function requireEnv(name: string, message?: string): string;
+/** Returns an optional env var or a fallback. */
+export declare function optionalEnv(name: string, fallback?: string): string | undefined;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/env/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/env/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;CAiBX,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,QAAQ,CAAC,CAAC,MAAM,OAAO,QAAQ,CAAC,CAAA;AAEjE,QAAA,MAAM,aAAa;;;;;;;;;;;;EAMjB,CAAA;AAEF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAA;AAEnD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAS7E;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAMjE;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE/E"}

package/dist/env/index.js

@@ -0,0 +1,59 @@
+import { z } from 'zod';
+/**
+ * Canonical env-var names used across Throughline packages. Plugins read
+ * `process.env[ENV_VARS.X]` rather than hard-coding strings so renames stay
+ * coordinated.
+ */
+export const ENV_VARS = {
+    PAYLOAD_SECRET: 'PAYLOAD_SECRET',
+    DATABASE_URI: 'DATABASE_URI',
+    NEXT_PUBLIC_SERVER_URL: 'NEXT_PUBLIC_SERVER_URL',
+    INNGEST_EVENT_KEY: 'INNGEST_EVENT_KEY',
+    INNGEST_SIGNING_KEY: 'INNGEST_SIGNING_KEY',
+    RESEND_API_KEY: 'RESEND_API_KEY',
+    EMAIL_FROM_ADDRESS: 'EMAIL_FROM_ADDRESS',
+    EMAIL_FROM_NAME: 'EMAIL_FROM_NAME',
+    EMAIL_REPLY_TO: 'EMAIL_REPLY_TO',
+    APPROVAL_TOKEN_SECRET: 'APPROVAL_TOKEN_SECRET',
+    COMPONENT_SERVER_API_KEY: 'COMPONENT_SERVER_API_KEY',
+    PUBLISHING_SERVER_API_KEY: 'PUBLISHING_SERVER_API_KEY',
+    APPROVALS_SERVER_API_KEY: 'APPROVALS_SERVER_API_KEY',
+    AUDIT_SERVER_API_KEY: 'AUDIT_SERVER_API_KEY',
+    FORMS_SERVER_API_KEY: 'FORMS_SERVER_API_KEY',
+    INTEGRATIONS_SERVER_API_KEY: 'INTEGRATIONS_SERVER_API_KEY',
+};
+const BaseEnvSchema = z.object({
+    [ENV_VARS.PAYLOAD_SECRET]: z
+        .string()
+        .min(32, `${ENV_VARS.PAYLOAD_SECRET} must be at least 32 characters`),
+    [ENV_VARS.DATABASE_URI]: z.string().min(1, `${ENV_VARS.DATABASE_URI} must be set`),
+    [ENV_VARS.NEXT_PUBLIC_SERVER_URL]: z.string().url(),
+});
+/**
+ * Validates the base env vars every Throughline deployment requires.
+ * Plugins extend with their own checks. Throws on validation failure with
+ * a multi-line, path-qualified message.
+ */
+export function validateBaseEnv(env = process.env) {
+    const result = BaseEnvSchema.safeParse(env);
+    if (!result.success) {
+        const issues = result.error.issues
+            .map((i) => `  - ${String(i.path[0] ?? '(root)')}: ${i.message}`)
+            .join('\n');
+        throw new Error(`Invalid environment:\n${issues}`);
+    }
+    return result.data;
+}
+/** Returns an env var, throwing with a clear error if missing or empty. */
+export function requireEnv(name, message) {
+    const value = process.env[name];
+    if (!value) {
+        throw new Error(message ?? `Environment variable ${name} is required but not set`);
+    }
+    return value;
+}
+/** Returns an optional env var or a fallback. */
+export function optionalEnv(name, fallback) {
+    return process.env[name] ?? fallback;
+}
+//# sourceMappingURL=index.js.map

package/dist/env/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/env/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,cAAc,EAAE,gBAAgB;IAChC,YAAY,EAAE,cAAc;IAC5B,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,mBAAmB,EAAE,qBAAqB;IAC1C,cAAc,EAAE,gBAAgB;IAChC,kBAAkB,EAAE,oBAAoB;IACxC,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,qBAAqB,EAAE,uBAAuB;IAC9C,wBAAwB,EAAE,0BAA0B;IACpD,yBAAyB,EAAE,2BAA2B;IACtD,wBAAwB,EAAE,0BAA0B;IACpD,oBAAoB,EAAE,sBAAsB;IAC5C,oBAAoB,EAAE,sBAAsB;IAC5C,2BAA2B,EAAE,6BAA6B;CAClD,CAAA;AAIV,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;SACzB,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,EAAE,GAAG,QAAQ,CAAC,cAAc,iCAAiC,CAAC;IACvE,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,QAAQ,CAAC,YAAY,cAAc,CAAC;IAClF,CAAC,QAAQ,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CACpD,CAAC,CAAA;AAIF;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IAClE,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;aAC/B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;aAChE,IAAI,CAAC,IAAI,CAAC,CAAA;QACb,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,OAAgB;IACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,OAAO,IAAI,wBAAwB,IAAI,0BAA0B,CAAC,CAAA;IACpF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,QAAiB;IACzD,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAA;AACtC,CAAC"}

package/dist/events/index.d.ts

@@ -0,0 +1,4 @@
+export { createInngestClient } from './inngest.js';
+export type { InngestClientOptions } from './inngest.js';
+export type { CoreEvents, FrameworkEvents } from './taxonomy.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/events/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,YAAY,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AACxD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA"}

package/dist/events/index.js

@@ -0,0 +1,2 @@
+export { createInngestClient } from './inngest.js';
+//# sourceMappingURL=index.js.map

package/dist/events/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA"}

package/dist/events/inngest.d.ts

@@ -0,0 +1,24 @@
+import { Inngest } from 'inngest';
+export interface InngestClientOptions {
+    /** App identifier used in Inngest's UI; should be stable across deployments. */
+    id: string;
+    /** Inngest event key. Falls back to `process.env.INNGEST_EVENT_KEY`. */
+    eventKey?: string;
+    /** Base URL for self-hosted Inngest deployments. */
+    baseUrl?: string;
+    /** Override the environment ("development", "preview", "production", or a branch name). */
+    env?: string;
+    /** Force development mode regardless of environment. */
+    isDev?: boolean;
+}
+/**
+ * Creates an Inngest client preconfigured for Throughline. Plugins and the
+ * audit writer accept this client to fire events; client apps construct it
+ * once at module load and pass it everywhere.
+ *
+ * The signing key (used to verify incoming Inngest webhook calls) is read
+ * from `INNGEST_SIGNING_KEY` by the framework's serve handler — it is not
+ * a constructor option in Inngest 4.
+ */
+export declare function createInngestClient(options: InngestClientOptions): Inngest;
+//# sourceMappingURL=inngest.d.ts.map

package/dist/events/inngest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inngest.d.ts","sourceRoot":"","sources":["../../src/events/inngest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEjC,MAAM,WAAW,oBAAoB;IACnC,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,wDAAwD;IACxD,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAQ1E"}

package/dist/events/inngest.js

@@ -0,0 +1,24 @@
+import { Inngest } from 'inngest';
+/**
+ * Creates an Inngest client preconfigured for Throughline. Plugins and the
+ * audit writer accept this client to fire events; client apps construct it
+ * once at module load and pass it everywhere.
+ *
+ * The signing key (used to verify incoming Inngest webhook calls) is read
+ * from `INNGEST_SIGNING_KEY` by the framework's serve handler — it is not
+ * a constructor option in Inngest 4.
+ */
+export function createInngestClient(options) {
+    const eventKey = options.eventKey ?? process.env['INNGEST_EVENT_KEY'];
+    const clientOptions = { id: options.id };
+    if (eventKey !== undefined)
+        clientOptions.eventKey = eventKey;
+    if (options.baseUrl !== undefined)
+        clientOptions.baseUrl = options.baseUrl;
+    if (options.env !== undefined)
+        clientOptions.env = options.env;
+    if (options.isDev !== undefined)
+        clientOptions.isDev = options.isDev;
+    return new Inngest(clientOptions);
+}
+//# sourceMappingURL=inngest.js.map

package/dist/events/inngest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inngest.js","sourceRoot":"","sources":["../../src/events/inngest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAejC;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IACrE,MAAM,aAAa,GAA6C,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAA;IAClF,IAAI,QAAQ,KAAK,SAAS;QAAE,aAAa,CAAC,QAAQ,GAAG,QAAQ,CAAA;IAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS;QAAE,aAAa,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;IAC1E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;QAAE,aAAa,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IAC9D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,aAAa,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IACpE,OAAO,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;AACnC,CAAC"}