@forumone/throughline-core 0.9.1 → 0.10.0

package/dist/testing/anonymousAccess.js

@@ -0,0 +1,185 @@
+/**
+ * The anonymous request an access rule is handed.
+ *
+ * `req.payload` is a stub that throws on use rather than a mock that answers:
+ * a read rule that looks something up to decide is one this cannot evaluate
+ * without a database, and it should say so here rather than pass on a guess.
+ */
+export function anonymousAccessArgs() {
+    const payload = new Proxy({}, {
+        get(_target, property) {
+            // Not thenable: an `await req.payload` must not hang on a stub.
+            if (property === 'then' || typeof property === 'symbol')
+                return undefined;
+            return () => {
+                throw new Error(`An access rule called payload.${property} for an anonymous request. ` +
+                    'A rule that needs the database cannot be checked as a value; test it against one.');
+            };
+        },
+    });
+    return {
+        req: { user: null, headers: new Headers(), payload },
+    };
+}
+/**
+ * What a read rule answers an anonymous request: `true`, `false`, a `where`
+ * query, or `undefined` when there is no rule at all.
+ */
+export async function anonymousRead(entity) {
+    const read = entity.access?.read;
+    if (typeof read !== 'function')
+        return undefined;
+    return read(anonymousAccessArgs());
+}
+/** Whether an entity keeps drafts, so an anonymous read must be narrowed to published. */
+export function hasDrafts(entity) {
+    const versions = entity.versions;
+    return typeof versions === 'object' && versions !== null && Boolean(versions.drafts);
+}
+/**
+ * Why a render-path entity fails, or `undefined` when it passes.
+ *
+ * `undefined` is a failure here and not in `privateProblem`, deliberately. A
+ * collection with no `read` rule gets Payload's default, which requires a user
+ * — so leaving one off is the same outage as writing an editors-only rule, and
+ * reads in review as though no decision were needed.
+ */
+export async function renderPathProblem(entity) {
+    const answer = await anonymousRead(entity);
+    if (answer === undefined) {
+        return {
+            kind: 'render-path-refused',
+            message: `${entity.slug} has no read rule, so Payload's default applies and an anonymous read is refused.`,
+        };
+    }
+    if (answer === false) {
+        return {
+            kind: 'render-path-refused',
+            message: `${entity.slug} refuses an anonymous read, so the render path sees nothing.`,
+        };
+    }
+    /*
+    A bare `true` on a collection with drafts serves an unpublished document to
+    anybody who guesses its slug. A query is what narrows it — usually
+    `{ _status: { equals: 'published' } }` — and which query is the site's call.
+    */
+    if (answer === true && hasDrafts(entity)) {
+        return {
+            kind: 'drafts-unfiltered',
+            message: `${entity.slug} keeps drafts and answers an anonymous read with \`true\`, so drafts reach the internet. Answer with a query that narrows to published documents.`,
+        };
+    }
+    return undefined;
+}
+/**
+ * Why a private entity fails, or `undefined` when it passes.
+ *
+ * `undefined` passes: Payload's default refuses an anonymous read, so a plugin
+ * collection with no rule of its own is already closed. What must not happen is
+ * `true`, or a query — a query is a successful read of some subset.
+ */
+export async function privateProblem(entity) {
+    const answer = await anonymousRead(entity);
+    if (answer === true) {
+        return { kind: 'private-readable', message: `${entity.slug} is readable by anyone.` };
+    }
+    if (answer !== null && typeof answer === 'object') {
+        return {
+            kind: 'private-readable',
+            message: `${entity.slug} answers an anonymous read with a query, so it succeeds for whatever matches.`,
+        };
+    }
+    return undefined;
+}
+/** Slugs of a bucket, whichever shape it was written in. */
+export function bucketSlugs(bucket) {
+    if (!bucket)
+        return [];
+    return Array.isArray(bucket) ? [...bucket] : Object.keys(bucket);
+}
+/**
+ * Every entity in exactly one bucket, and every bucket entry in the config.
+ */
+export function classificationFindings(entity, inConfig, renderPath, closed) {
+    const findings = [];
+    const slugs = new Set(inConfig.map((item) => item.slug));
+    const classified = [...renderPath, ...closed];
+    const seen = new Set();
+    for (const slug of classified) {
+        if (seen.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'classified-twice',
+                message: `${slug} is listed more than once. Each ${entity} belongs in exactly one bucket.`,
+            });
+        }
+        seen.add(slug);
+    }
+    for (const slug of slugs) {
+        if (!seen.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'unclassified',
+                message: `${slug} is in the config and in no bucket. Decide whether a published page reads it ` +
+                    `with nobody signed in (renderPath, with where) or the internet must not (private).`,
+            });
+        }
+    }
+    for (const slug of seen) {
+        if (!slugs.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'not-in-config',
+                message: `${slug} is in a bucket and not in the config. Remove it, or fix the slug.`,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Every finding for a config and its buckets, empty when it is sound.
+ *
+ * The pure form of `describeAnonymousAccess`, for a script or a test that
+ * wants the list rather than one test per collection.
+ */
+export async function checkAnonymousAccess(config, buckets) {
+    const resolved = await config;
+    const findings = [];
+    const sides = [
+        {
+            entity: 'collection',
+            items: resolved.collections ?? [],
+            renderPath: bucketSlugs(buckets.renderPath),
+            closed: bucketSlugs(buckets.private),
+        },
+    ];
+    if (buckets.globals) {
+        sides.push({
+            entity: 'global',
+            items: resolved.globals ?? [],
+            renderPath: bucketSlugs(buckets.globals.renderPath),
+            closed: bucketSlugs(buckets.globals.private),
+        });
+    }
+    for (const side of sides) {
+        findings.push(...classificationFindings(side.entity, side.items, side.renderPath, side.closed));
+        const bySlug = new Map(side.items.map((item) => [item.slug, item]));
+        for (const slug of side.renderPath) {
+            const item = bySlug.get(slug);
+            const problem = item && (await renderPathProblem(item));
+            if (problem)
+                findings.push({ entity: side.entity, slug, ...problem });
+        }
+        for (const slug of side.closed) {
+            const item = bySlug.get(slug);
+            const problem = item && (await privateProblem(item));
+            if (problem)
+                findings.push({ entity: side.entity, slug, ...problem });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=anonymousAccess.js.map

package/dist/testing/anonymousAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymousAccess.js","sourceRoot":"","sources":["../../src/testing/anonymousAccess.ts"],"names":[],"mappings":"AAsFA;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,EAAE,EACF;QACE,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,gEAAgE;YAChE,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACzE,OAAO,GAAG,EAAE;gBACV,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,6BAA6B;oBACpE,mFAAmF,CACtF,CAAA;YACH,CAAC,CAAA;QACH,CAAC;KACF,CACF,CAAA;IACD,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,EAAE;KACjB,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA2B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAA;IAChC,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAChD,OAAQ,IAAe,CAAC,mBAAmB,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAsD,CAAA;IAC9E,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,mFAAmF;SAC3G,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,8DAA8D;SACtF,CAAA;IACH,CAAC;IACD;;;;MAIE;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,mJAAmJ;SAC3K,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,yBAAyB,EAAE,CAAA;IACvF,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,+EAA+E;SACvG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CACzB,MAAwE;IAExE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAI,MAA4B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACzF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA+B,EAC/B,QAAwC,EACxC,UAA6B,EAC7B,MAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAA;IAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,IAAI,mCAAmC,MAAM,iCAAiC;aAC3F,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,GAAG,IAAI,+EAA+E;oBACtF,oFAAoF;aACvF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,GAAG,IAAI,oEAAoE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAmB,EACnB,OAA+B;IAE/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,MAAM,KAAK,GAKN;QACH;YACE,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;YACjC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC;KACF,CAAA;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;YAC7B,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAEnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAA;YACvD,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;YACpD,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/testing/describeAnonymousAccess.d.ts

@@ -0,0 +1,26 @@
+import { type AnonymousAccessBuckets, type ConfigInput } from './anonymousAccess.js';
+export interface DescribeAnonymousAccessOptions {
+    /** The suite's name. Defaults to "anonymous access". */
+    title?: string;
+}
+/**
+ * Registers a vitest suite asserting what an anonymous request may read.
+ *
+ * Call it at the top level of a test file with the site's `payload.config.ts`
+ * and its bucket map:
+ *
+ * ```ts
+ * import config from '../payload.config'
+ * describeAnonymousAccess(config, {
+ *   renderPath: { pages: 'the [...slug] route', media: 'every populated upload' },
+ *   private: ['users', 'audit-events', 'payload-preferences'],
+ * })
+ * ```
+ *
+ * One test classifies every collection (and every global, when `globals` is
+ * given) into exactly one bucket; then one test per entry checks the rule
+ * itself, so a failure names the collection. No database: the config is
+ * imported, never connected.
+ */
+export declare function describeAnonymousAccess(config: ConfigInput, buckets: AnonymousAccessBuckets, options?: DescribeAnonymousAccessOptions): void;
+//# sourceMappingURL=describeAnonymousAccess.d.ts.map

package/dist/testing/describeAnonymousAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeAnonymousAccess.d.ts","sourceRoot":"","sources":["../../src/testing/describeAnonymousAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,8BAA8B;IAC7C,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,GAAE,8BAAmC,GAC3C,IAAI,CAqEN"}

package/dist/testing/describeAnonymousAccess.js

@@ -0,0 +1,76 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+import { bucketSlugs, classificationFindings, privateProblem, renderPathProblem, } from './anonymousAccess.js';
+/**
+ * Registers a vitest suite asserting what an anonymous request may read.
+ *
+ * Call it at the top level of a test file with the site's `payload.config.ts`
+ * and its bucket map:
+ *
+ * ```ts
+ * import config from '../payload.config'
+ * describeAnonymousAccess(config, {
+ *   renderPath: { pages: 'the [...slug] route', media: 'every populated upload' },
+ *   private: ['users', 'audit-events', 'payload-preferences'],
+ * })
+ * ```
+ *
+ * One test classifies every collection (and every global, when `globals` is
+ * given) into exactly one bucket; then one test per entry checks the rule
+ * itself, so a failure names the collection. No database: the config is
+ * imported, never connected.
+ */
+export function describeAnonymousAccess(config, buckets, options = {}) {
+    describe(options.title ?? 'anonymous access', () => {
+        let resolved;
+        beforeAll(async () => {
+            // `buildConfig` is async, and awaiting it is the only way to see the
+            // collections the plugins add on top of the site's own.
+            resolved = await config;
+        });
+        const find = (entity, slug) => {
+            const items = (entity === 'collection' ? resolved.collections : resolved.globals) ?? [];
+            const item = items.find((candidate) => candidate.slug === slug);
+            // Reported by the classification test as `not-in-config`; failing here
+            // too keeps this entry's own result honest.
+            expect(item, `${slug} is not in the config`).toBeDefined();
+            return item;
+        };
+        const sides = [{ entity: 'collection', renderPath: buckets.renderPath, closed: buckets.private }];
+        if (buckets.globals) {
+            sides.push({
+                entity: 'global',
+                renderPath: buckets.globals.renderPath ?? {},
+                closed: buckets.globals.private,
+            });
+        }
+        for (const side of sides) {
+            const plural = `${side.entity}s`;
+            it(`puts every ${side.entity} in exactly one bucket`, () => {
+                const items = (side.entity === 'collection' ? resolved.collections : resolved.globals) ?? [];
+                // A config with nothing in it makes every assertion below vacuous.
+                expect(items.length, `the config has no ${plural}`).toBeGreaterThan(0);
+                const findings = classificationFindings(side.entity, items, Object.keys(side.renderPath), bucketSlugs(side.closed));
+                expect(findings.map((finding) => finding.message)).toEqual([]);
+            });
+            const renderEntries = Object.entries(side.renderPath);
+            if (renderEntries.length > 0) {
+                describe(`${plural} the render path reads`, () => {
+                    it.each(renderEntries)('%s — read by %s', async (slug) => {
+                        const problem = await renderPathProblem(find(side.entity, slug));
+                        expect(problem?.message).toBeUndefined();
+                    });
+                });
+            }
+            const closedSlugs = bucketSlugs(side.closed);
+            if (closedSlugs.length > 0) {
+                describe(`${plural} the internet must not read`, () => {
+                    it.each(closedSlugs)('%s refuses an anonymous read', async (slug) => {
+                        const problem = await privateProblem(find(side.entity, slug));
+                        expect(problem?.message).toBeUndefined();
+                    });
+                });
+            }
+        }
+    });
+}
+//# sourceMappingURL=describeAnonymousAccess.js.map

package/dist/testing/describeAnonymousAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeAnonymousAccess.js","sourceRoot":"","sources":["../../src/testing/describeAnonymousAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAKlB,MAAM,sBAAsB,CAAA;AAO7B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,OAA+B,EAC/B,UAA0C,EAAE;IAE5C,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,kBAAkB,EAAE,GAAG,EAAE;QACjD,IAAI,QAA6B,CAAA;QAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,qEAAqE;YACrE,wDAAwD;YACxD,QAAQ,GAAG,MAAM,MAAM,CAAA;QACzB,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAE,IAAY,EAAuB,EAAE;YAClF,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACvF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/D,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1D,OAAO,IAA2B,CAAA;QACpC,CAAC,CAAA;QAED,MAAM,KAAK,GAIN,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE;gBAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAA;YAEhC,EAAE,CAAC,cAAc,IAAI,CAAC,MAAM,wBAAwB,EAAE,GAAG,EAAE;gBACzD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC5F,mEAAmE;gBACnE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;gBACtE,MAAM,QAAQ,GAAG,sBAAsB,CACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAC5B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CACzB,CAAA;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAChE,CAAC,CAAC,CAAA;YAEF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACrD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,GAAG,MAAM,wBAAwB,EAAE,GAAG,EAAE;oBAC/C,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACvD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;wBAChE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;oBAC1C,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,MAAM,6BAA6B,EAAE,GAAG,EAAE;oBACpD,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,8BAA8B,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBAClE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;wBAC7D,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;oBAC1C,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Test helpers for a Throughline site, as `@forumone/throughline-core/testing`.
+ *
+ * Kept off the package root — which re-exports every other subpath — because
+ * these import `vitest`, an optional peer that a running site never loads.
+ */
+export { anonymousAccessArgs, anonymousRead, checkAnonymousAccess, hasDrafts, } from './anonymousAccess.js';
+export type { AccessCheckedConfig, AccessCheckedEntity, AccessFinding, AccessFindingKind, AnonymousAccessBuckets, ConfigInput, } from './anonymousAccess.js';
+export { describeAnonymousAccess } from './describeAnonymousAccess.js';
+export type { DescribeAnonymousAccessOptions } from './describeAnonymousAccess.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,GACZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,YAAY,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/testing/index.js

@@ -0,0 +1,9 @@
+/**
+ * Test helpers for a Throughline site, as `@forumone/throughline-core/testing`.
+ *
+ * Kept off the package root — which re-exports every other subpath — because
+ * these import `vitest`, an optional peer that a running site never loads.
+ */
+export { anonymousAccessArgs, anonymousRead, checkAnonymousAccess, hasDrafts, } from './anonymousAccess.js';
+export { describeAnonymousAccess } from './describeAnonymousAccess.js';
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAA;AAS7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA"}

package/package.json

@@ -1,10 +1,13 @@
 {
   "name": "@forumone/throughline-core",
-  "version": "0.9.1",
+  "version": "0.10.0",
   "description": "Core plumbing for Throughline: audit log, MCP authentication and handler, event taxonomy + Inngest client factory, logger, shared utilities.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
+  "bin": {
+    "throughline-payload": "./bin/throughline-payload.mjs"
+  },
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -18,6 +21,10 @@
       "types": "./dist/auth/index.d.ts",
       "default": "./dist/auth/index.js"
     },
+    "./env": {
+      "types": "./dist/env/index.d.ts",
+      "default": "./dist/env/index.js"
+    },
     "./events": {
       "types": "./dist/events/index.d.ts",
       "default": "./dist/events/index.js"
@@ -25,10 +32,19 @@
     "./mcp": {
       "types": "./dist/mcp/index.d.ts",
       "default": "./dist/mcp/index.js"
+    },
+    "./observability": {
+      "types": "./dist/observability/index.d.ts",
+      "default": "./dist/observability/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "default": "./dist/testing/index.js"
     }
   },
   "files": [
     "dist",
+    "bin/*.mjs",
     "README.md",
     "CHANGELOG.md"
   ],
@@ -36,7 +52,8 @@
     "throughline",
     "payload",
     "mcp",
-    "audit"
+    "audit",
+    "cli"
   ],
   "license": "MIT",
   "repository": {
@@ -52,17 +69,23 @@
     "access": "public"
   },
   "peerDependencies": {
-    "payload": "^3.0.0",
-    "inngest": "^4.0.0"
+    "payload": "^3.89.0",
+    "inngest": "^4.0.0",
+    "vitest": "^3.0.0 || ^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "vitest": {
+      "optional": true
+    }
   },
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-plugin-contract": "0.4.1"
+    "@forumone/throughline-plugin-contract": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "^24.13.2",
-    "eslint": "^9.15.0",
+    "eslint": "^10.11.0",
     "inngest": "^4.2.0",
     "payload": "^3.83.0",
     "typescript": "^5.6.0",
@@ -75,7 +98,7 @@
     "dev": "tsc -b -w",
     "clean": "rm -rf dist .turbo *.tsbuildinfo",
     "typecheck": "tsc --noEmit",
-    "lint": "eslint src",
+    "lint": "eslint src bin",
     "test": "vitest run"
   }
 }