@forumone/throughline-workflows 0.0.1 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @forumone/throughline-workflows
+
+## 0.2.0
+
+### Minor Changes
+
+- 28f5af4: Initial release of the workflows package. Five composable Inngest function factories for the common async work in the framework: `createRevalidateOnPublishFunction` (Next.js cache invalidation on publish), `createExecuteScheduledPublishesFunction` (cron-driven scheduled publishes that go through the Publishing Server's MCP for full pipeline coverage), `createExpireStaleApprovalsFunction` (daily approval expiration with audit + `approval/expired` event), `createAuditEventEchoFunction` (fan-out for approval lifecycle plus pluggable custom handlers), `createHealthcheckFunction` (configurable checks with `onFailure` routing and a `system/healthcheck` heartbeat). Plus reusable `createPayloadReachableCheck` and `createManifestReachableCheck` helpers. No Payload plugin — factories only; client apps merge the functions into their Inngest endpoint. `next` is an optional peer dependency.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Forum One Communications Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,45 +1,140 @@
 # @forumone/throughline-workflows
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+Composable Inngest function factories for the Throughline framework. Client apps import the factories they need and merge the functions into their Inngest endpoint.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+This package has **no Payload plugin** — it exports factories only. Workflows subscribe to events the server packages emit; they don't modify Payload configuration.
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+## What this package provides
 
-## Purpose
-
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@forumone/throughline-workflows`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
-
-## What is OIDC Trusted Publishing?
-
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
-
-## Setup Instructions
-
-To properly configure OIDC trusted publishing for this package:
-
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
-
-## DO NOT USE THIS PACKAGE
-
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
-
-## More Information
-
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
-
----
-
-**Maintained for OIDC setup purposes only**
+| Factory | What it does |
+|---|---|
+| `createRevalidateOnPublishFunction` | Invalidates Next.js caches for the page, listings, and sitemap when content publishes |
+| `createExecuteScheduledPublishesFunction` | Cron-driven scheduled publish executor that calls through the Publishing Server's MCP |
+| `createExpireStaleApprovalsFunction` | Daily cron that flips pending approvals past `expiresAt` to `expired` and fires an `approval/expired` event |
+| `createAuditEventEchoFunction` | Fan-out point: turns `audit/event.recorded` into `notification/send-approval-*` events plus custom handlers |
+| `createHealthcheckFunction` | Periodic health monitoring with configurable checks |
+
+Plus two reusable check helpers used with the healthcheck factory:
+
+- `createPayloadReachableCheck(slug?)` — verifies Payload can `find` from a collection
+- `createManifestReachableCheck(url)` — verifies an HTTPS manifest URL responds 2xx
+
+## Installation
+
+```bash
+pnpm add @forumone/throughline-workflows
+```
+
+Peers: `payload@^3.0.0`, `inngest@^4.0.0`. `next` is an **optional** peer — install it only if you use `createRevalidateOnPublishFunction` with the default revalidator.
+
+## Usage
+
+In your Next.js app's Inngest endpoint:
+
+```typescript
+// src/app/api/inngest/route.ts
+import { serve } from 'inngest/next'
+import { getPayload } from 'payload'
+import config from '@payload-config'
+import { inngest } from '@/lib/inngest'
+import {
+  createRevalidateOnPublishFunction,
+  createExecuteScheduledPublishesFunction,
+  createExpireStaleApprovalsFunction,
+  createAuditEventEchoFunction,
+  createHealthcheckFunction,
+  createPayloadReachableCheck,
+} from '@forumone/throughline-workflows'
+
+const payload = await getPayload({ config })
+
+export const { GET, POST, PUT } = serve({
+  client: inngest,
+  functions: [
+    createRevalidateOnPublishFunction({ inngest, payload }),
+    createExecuteScheduledPublishesFunction({
+      inngest,
+      payload,
+      collections: [{ slug: 'pages' }, { slug: 'posts' }],
+      publishingServerUrl: process.env.NEXT_PUBLIC_SERVER_URL!,
+      // PUBLISHING_SYSTEM_API_KEY env var carries the api key
+    }),
+    createExpireStaleApprovalsFunction({ inngest, payload }),
+    createAuditEventEchoFunction({ inngest }),
+    createHealthcheckFunction({
+      inngest,
+      payload,
+      checks: [createPayloadReachableCheck()],
+    }),
+  ],
+})
+```
+
+## Why this lives outside the server packages
+
+By C10, every server package fires Inngest events when consequential things happen. This package is the **subscriber side** — the functions that react to those events. Splitting the subscriber side from the publisher packages keeps the server packages from accumulating "and also runs this revalidation logic" appendices, and it lets clients pick which workflows they want without dragging in everything.
+
+The factories-only shape (no Payload plugin) is the same reasoning. A workflow that wants to revalidate Next.js pages doesn't need to register a Payload collection. A scheduled-publish executor doesn't need a Payload hook. They're cron / event handlers that happen to read from Payload.
+
+## Non-Next.js frontends
+
+The default `revalidate` function dynamically imports `next/cache` and is a no-op anywhere `revalidatePath` / `revalidateTag` aren't available. For other frameworks supply your own:
+
+```typescript
+createRevalidateOnPublishFunction({
+  inngest,
+  payload,
+  revalidate: async ({ path, tags }) => {
+    if (path) await myCdn.purge(path)
+    for (const tag of tags) await myCdn.purgeTag(tag)
+  },
+})
+```
+
+`next` is declared as an optional peer (`peerDependenciesMeta.next.optional = true`) so non-Next consumers don't see a missing-peer warning.
+
+## Why scheduled publishes call through the MCP
+
+`createExecuteScheduledPublishesFunction` calls `POST /api/publishing/mcp` with a Bearer token rather than calling `payload.update` directly. That means scheduled publishes go through the same composition / accessibility / approval pipeline as Claude-initiated publishes — a composition error in a scheduled publish gets the same treatment as one caught interactively.
+
+A composition error fails the publish loudly (audit log + `lastError`) instead of silently writing through.
+
+## Customizing audit fan-out
+
+The audit echo function wires the approval workflow by default. Add custom handlers for any other action:
+
+```typescript
+createAuditEventEchoFunction({
+  inngest,
+  handlers: [
+    {
+      match: (e) => e.action === 'integration.failed',
+      handle: async (e) => {
+        await inngest.send({
+          name: 'notification/send-alert',
+          data: { severity: 'error', summary: 'Integration failure', ...e.data },
+        })
+      },
+    },
+  ],
+})
+```
+
+Each handler runs in its own `step.run`, so failures isolate.
+
+## Options reference
+
+Every factory takes a typed options object. See `src/types.ts` for the full surface — defaults documented there:
+
+- `RevalidateOnPublishOptions` — `revalidate?`, `urlBuilders?`, `collectionTags?`, `id?`
+- `ExecuteScheduledPublishesOptions` — `collections[]`, `publishingServerUrl`, `publishingApiKey?` (env fallback), `schedule?` (default `*/5 * * * *`), `id?`
+- `ExpireStaleApprovalsOptions` — `collectionSlug?` (default `approvals`), `schedule?` (default `0 2 * * *`), `id?`
+- `AuditEventEchoOptions` — `handlers?`, `id?`
+- `HealthcheckOptions` — `checks[]`, `schedule?` (default `*/15 * * * *`), `onFailure?`, `id?`
+
+## Related packages
+
+- `@forumone/throughline-core` — required peer; provides the audit writer the approval-expiration cron uses
+- `@forumone/throughline-publishing` — emits the publishing events the revalidation cron subscribes to
+- `@forumone/throughline-approvals` — owns the approvals collection the expiration cron reads
+- `@forumone/throughline-email` (C11) — will subscribe to `notification/send-approval-*`

package/dist/audit-event-echo.d.ts

@@ -0,0 +1,14 @@
+import type { InngestFunction } from 'inngest';
+import type { AuditEventEchoOptions } from './types.js';
+/**
+ * Subscribes to `audit/event.recorded` and fans out to notification
+ * workflows. The built-in handlers cover the approval lifecycle (which
+ * the email package in C11 subscribes to); custom handlers in
+ * `options.handlers` add other fan-outs (e.g. "post integration.failed
+ * to a #alerts Slack channel").
+ *
+ * Each handler runs in its own `step.run` so a failure in one fan-out
+ * does not affect the others.
+ */
+export declare function createAuditEventEchoFunction(options: AuditEventEchoOptions): InngestFunction.Any;
+//# sourceMappingURL=audit-event-echo.d.ts.map

package/dist/audit-event-echo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event-echo.d.ts","sourceRoot":"","sources":["../src/audit-event-echo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAiBvD;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,qBAAqB,GAAG,eAAe,CAAC,GAAG,CA0ChG"}

package/dist/audit-event-echo.js

@@ -0,0 +1,53 @@
+const APPROVAL_DECISION_ACTIONS = new Set([
+    'approval.granted',
+    'approval.declined',
+    'approval.changes_requested',
+]);
+/**
+ * Subscribes to `audit/event.recorded` and fans out to notification
+ * workflows. The built-in handlers cover the approval lifecycle (which
+ * the email package in C11 subscribes to); custom handlers in
+ * `options.handlers` add other fan-outs (e.g. "post integration.failed
+ * to a #alerts Slack channel").
+ *
+ * Each handler runs in its own `step.run` so a failure in one fan-out
+ * does not affect the others.
+ */
+export function createAuditEventEchoFunction(options) {
+    return options.inngest.createFunction({
+        id: options.id ?? 'audit-event-echo',
+        triggers: [{ event: 'audit/event.recorded' }],
+    }, async ({ event, step, logger }) => {
+        const data = (event.data ?? {});
+        logger.info('Audit event echoed', { action: data.action });
+        await step.run('handle-approval-requested', async () => {
+            if (data.action === 'approval.requested' && data.approvalRequestId) {
+                await options.inngest.send({
+                    name: 'notification/send-approval-request',
+                    data: { approvalId: data.approvalRequestId },
+                });
+            }
+        });
+        await step.run('handle-approval-decided', async () => {
+            if (APPROVAL_DECISION_ACTIONS.has(data.action) && data.approvalRequestId) {
+                await options.inngest.send({
+                    name: 'notification/send-approval-decision',
+                    data: { approvalId: data.approvalRequestId, decision: data.action },
+                });
+            }
+        });
+        const handlers = options.handlers ?? [];
+        for (let index = 0; index < handlers.length; index += 1) {
+            const handler = handlers[index];
+            await step.run(`custom-handler-${index}`, async () => {
+                if (handler.match({ action: data.action })) {
+                    await handler.handle({
+                        action: data.action,
+                        data: data,
+                    });
+                }
+            });
+        }
+    });
+}
+//# sourceMappingURL=audit-event-echo.js.map

package/dist/audit-event-echo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event-echo.js","sourceRoot":"","sources":["../src/audit-event-echo.ts"],"names":[],"mappings":"AAYA,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;CAC7B,CAAC,CAAA;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAA8B;IACzE,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CACnC;QACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,kBAAkB;QACpC,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;KAC9C,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAsB,CAAA;QACpD,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;QAE1D,MAAM,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAoB,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACnE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzB,IAAI,EAAE,oCAAoC;oBAC1C,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE;iBAC7C,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;YACnD,IAAI,yBAAyB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzE,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzB,IAAI,EAAE,qCAAqC;oBAC3C,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE;iBACpE,CAAC,CAAA;YACJ,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAA;QACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAE,CAAA;YAChC,MAAM,IAAI,CAAC,GAAG,CAAC,kBAAkB,KAAK,EAAE,EAAE,KAAK,IAAI,EAAE;gBACnD,IAAI,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;oBAC3C,MAAM,OAAO,CAAC,MAAM,CAAC;wBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,IAAI,EAAE,IAA0C;qBACjD,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CACF,CAAA;AACH,CAAC"}

package/dist/execute-scheduled-publishes.d.ts

@@ -0,0 +1,23 @@
+import type { InngestFunction } from 'inngest';
+import type { ExecuteScheduledPublishesOptions } from './types.js';
+/**
+ * Cron-driven scheduled publish executor. Every tick (default: every 5
+ * minutes) the function looks for documents in any of the configured
+ * collections whose `_status` is still `draft` and whose
+ * `scheduledPublishAt` has passed. For each, it calls the publishing
+ * server's MCP `publish` tool — going through the full publishing pipeline
+ * means scheduled publishes get the same composition / accessibility /
+ * approval checks as interactive publishes.
+ *
+ * The `publishingApiKey` (or `PUBLISHING_SYSTEM_API_KEY` env var) must
+ * carry `publishing.execute` scope. The factory throws at construction if
+ * neither is present so misconfigurations surface immediately.
+ *
+ * Failures from the publishing MCP are logged but do not throw; the
+ * unpublished document stays at `_status: draft` until either an admin
+ * intervenes or the next tick succeeds. Throwing would retry indefinitely
+ * on a permanent error (e.g. composition check failure), which is wrong
+ * for cron-style work.
+ */
+export declare function createExecuteScheduledPublishesFunction(options: ExecuteScheduledPublishesOptions): InngestFunction.Any;
+//# sourceMappingURL=execute-scheduled-publishes.d.ts.map

package/dist/execute-scheduled-publishes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-scheduled-publishes.d.ts","sourceRoot":"","sources":["../src/execute-scheduled-publishes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAE,gCAAgC,EAAE,MAAM,YAAY,CAAA;AAelE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uCAAuC,CACrD,OAAO,EAAE,gCAAgC,GACxC,eAAe,CAAC,GAAG,CA4DrB"}

package/dist/execute-scheduled-publishes.js

@@ -0,0 +1,119 @@
+const DEFAULT_SCHEDULE = '*/5 * * * *';
+/**
+ * Cron-driven scheduled publish executor. Every tick (default: every 5
+ * minutes) the function looks for documents in any of the configured
+ * collections whose `_status` is still `draft` and whose
+ * `scheduledPublishAt` has passed. For each, it calls the publishing
+ * server's MCP `publish` tool — going through the full publishing pipeline
+ * means scheduled publishes get the same composition / accessibility /
+ * approval checks as interactive publishes.
+ *
+ * The `publishingApiKey` (or `PUBLISHING_SYSTEM_API_KEY` env var) must
+ * carry `publishing.execute` scope. The factory throws at construction if
+ * neither is present so misconfigurations surface immediately.
+ *
+ * Failures from the publishing MCP are logged but do not throw; the
+ * unpublished document stays at `_status: draft` until either an admin
+ * intervenes or the next tick succeeds. Throwing would retry indefinitely
+ * on a permanent error (e.g. composition check failure), which is wrong
+ * for cron-style work.
+ */
+export function createExecuteScheduledPublishesFunction(options) {
+    const apiKey = options.publishingApiKey ?? process.env['PUBLISHING_SYSTEM_API_KEY'];
+    if (!apiKey) {
+        throw new Error('createExecuteScheduledPublishesFunction requires options.publishingApiKey or the PUBLISHING_SYSTEM_API_KEY env var.');
+    }
+    const schedule = options.schedule ?? DEFAULT_SCHEDULE;
+    const baseUrl = options.publishingServerUrl.replace(/\/$/, '');
+    return options.inngest.createFunction({
+        id: options.id ?? 'execute-scheduled-publishes',
+        triggers: [{ cron: schedule }],
+    }, async ({ step, logger }) => {
+        const nowIso = new Date().toISOString();
+        let publishedCount = 0;
+        let blockedCount = 0;
+        for (const config of options.collections) {
+            const statusField = config.statusField ?? '_status';
+            const scheduledField = config.scheduledField ?? 'scheduledPublishAt';
+            const due = await step.run(`find-due-${config.slug}`, async () => {
+                const result = await options.payload.find({
+                    collection: config.slug,
+                    where: {
+                        and: [
+                            { [statusField]: { equals: 'draft' } },
+                            { [scheduledField]: { exists: true } },
+                            { [scheduledField]: { less_than_equal: nowIso } },
+                        ],
+                    },
+                    limit: 100,
+                });
+                return result.docs.map((doc) => ({
+                    id: String(doc['id']),
+                    title: String(doc['title'] ?? doc['id']),
+                    collection: config.slug,
+                }));
+            });
+            for (const doc of due) {
+                const outcome = await step.run(`publish-${config.slug}-${doc.id}`, async () => {
+                    return executePublish({ doc, baseUrl, apiKey, logger });
+                });
+                if (outcome === 'published')
+                    publishedCount += 1;
+                if (outcome === 'blocked')
+                    blockedCount += 1;
+            }
+        }
+        logger.info('Scheduled publish tick complete', { publishedCount, blockedCount });
+        return { publishedCount, blockedCount };
+    });
+}
+async function executePublish({ doc, baseUrl, apiKey, logger, }) {
+    let response;
+    try {
+        response = await fetch(`${baseUrl}/api/publishing/mcp`, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${apiKey}`,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'tools/call',
+                params: {
+                    name: 'publish',
+                    arguments: {
+                        collection: doc.collection,
+                        id: doc.id,
+                        _meta: { reasoning: 'Scheduled publish executed by workflow cron' },
+                    },
+                },
+            }),
+        });
+    }
+    catch (error) {
+        logger.error('Scheduled publish HTTP error', {
+            document: doc.title,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        return 'error';
+    }
+    if (!response.ok) {
+        logger.error('Scheduled publish HTTP non-2xx', {
+            document: doc.title,
+            status: response.status,
+        });
+        return 'error';
+    }
+    const body = (await response.json());
+    if (body.error) {
+        logger.warn('Scheduled publish blocked by policy', {
+            document: doc.title,
+            reason: body.error.message,
+        });
+        return 'blocked';
+    }
+    logger.info('Scheduled publish succeeded', { document: doc.title });
+    return 'published';
+}
+//# sourceMappingURL=execute-scheduled-publishes.js.map

package/dist/execute-scheduled-publishes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-scheduled-publishes.js","sourceRoot":"","sources":["../src/execute-scheduled-publishes.ts"],"names":[],"mappings":"AAGA,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAatC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uCAAuC,CACrD,OAAyC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,qHAAqH,CACtH,CAAA;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAE9D,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CACnC;QACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,6BAA6B;QAC/C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/B,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACvC,IAAI,cAAc,GAAG,CAAC,CAAA;QACtB,IAAI,YAAY,GAAG,CAAC,CAAA;QAEpB,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,SAAS,CAAA;YACnD,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,oBAAoB,CAAA;YAEpE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,IAAuB,EAAE;gBAClF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBACxC,UAAU,EAAE,MAAM,CAAC,IAAI;oBACvB,KAAK,EAAE;wBACL,GAAG,EAAE;4BACH,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;4BACtC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;4BACtC,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,EAAE;yBAClD;qBACF;oBACD,KAAK,EAAE,GAAG;iBACX,CAAC,CAAA;gBACF,OAAQ,MAAM,CAAC,IAAuC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBACnE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;oBACxC,UAAU,EAAE,MAAM,CAAC,IAAI;iBACxB,CAAC,CAAC,CAAA;YACL,CAAC,CAAC,CAAA;YAEF,KAAK,MAAM,GAAG,IAAI,GAAG,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAC5B,WAAW,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,EAAE,EAClC,KAAK,IAAgD,EAAE;oBACrD,OAAO,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;gBACzD,CAAC,CACF,CAAA;gBACD,IAAI,OAAO,KAAK,WAAW;oBAAE,cAAc,IAAI,CAAC,CAAA;gBAChD,IAAI,OAAO,KAAK,SAAS;oBAAE,YAAY,IAAI,CAAC,CAAA;YAC9C,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;QAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAA;IACzC,CAAC,CACF,CAAA;AACH,CAAC;AASD,KAAK,UAAU,cAAc,CAAC,EAC5B,GAAG,EACH,OAAO,EACP,MAAM,EACN,MAAM,GACa;IACnB,IAAI,QAAkB,CAAA;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,qBAAqB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE;wBACT,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,EAAE,EAAE,GAAG,CAAC,EAAE;wBACV,KAAK,EAAE,EAAE,SAAS,EAAE,6CAA6C,EAAE;qBACpE;iBACF;aACF,CAAC;SACH,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,CAAC,8BAA8B,EAAE;YAC3C,QAAQ,EAAE,GAAG,CAAC,KAAK;YACnB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;YAC7C,QAAQ,EAAE,GAAG,CAAC,KAAK;YACnB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,CAAC,CAAA;QACF,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAA;IAC7D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE;YACjD,QAAQ,EAAE,GAAG,CAAC,KAAK;YACnB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;SAC3B,CAAC,CAAA;QACF,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;IACnE,OAAO,WAAW,CAAA;AACpB,CAAC"}

package/dist/expire-stale-approvals.d.ts

@@ -0,0 +1,11 @@
+import type { InngestFunction } from 'inngest';
+import type { ExpireStaleApprovalsOptions } from './types.js';
+/**
+ * Cron that finds pending approvals whose `expiresAt` has passed and flips
+ * them to `status: 'expired'`. For each expired record it writes an
+ * `approval.expired` audit event and fires an `approval/expired` Inngest
+ * event so notification workflows (e.g. C11 email) can let the requester
+ * know without polling.
+ */
+export declare function createExpireStaleApprovalsFunction(options: ExpireStaleApprovalsOptions): InngestFunction.Any;
+//# sourceMappingURL=expire-stale-approvals.d.ts.map

package/dist/expire-stale-approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expire-stale-approvals.d.ts","sourceRoot":"","sources":["../src/expire-stale-approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAA;AAa7D;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,OAAO,EAAE,2BAA2B,GACnC,eAAe,CAAC,GAAG,CA0ErB"}

package/dist/expire-stale-approvals.js

@@ -0,0 +1,83 @@
+import { getAuditWriter } from '@forumone/throughline-core';
+const DEFAULT_SCHEDULE = '0 2 * * *'; // daily at 2am UTC
+const DEFAULT_SLUG = 'approvals';
+/**
+ * Cron that finds pending approvals whose `expiresAt` has passed and flips
+ * them to `status: 'expired'`. For each expired record it writes an
+ * `approval.expired` audit event and fires an `approval/expired` Inngest
+ * event so notification workflows (e.g. C11 email) can let the requester
+ * know without polling.
+ */
+export function createExpireStaleApprovalsFunction(options) {
+    const schedule = options.schedule ?? DEFAULT_SCHEDULE;
+    const collectionSlug = options.collectionSlug ?? DEFAULT_SLUG;
+    return options.inngest.createFunction({
+        id: options.id ?? 'expire-stale-approvals',
+        triggers: [{ cron: schedule }],
+    }, async ({ step, logger }) => {
+        const now = new Date().toISOString();
+        const expired = await step.run('find-expired', async () => {
+            const result = await options.payload.find({
+                collection: collectionSlug,
+                where: {
+                    and: [
+                        { status: { equals: 'pending' } },
+                        { expiresAt: { less_than: now } },
+                    ],
+                },
+                limit: 500,
+            });
+            return result.docs.map((doc) => ({
+                id: String(doc['id']),
+                targetCollection: String(doc['targetCollection'] ?? ''),
+                targetId: String(doc['targetId'] ?? ''),
+                targetTitle: String(doc['targetTitle'] ?? doc['targetId'] ?? '(unknown)'),
+                requesterId: extractRequesterId(doc['requestedBy']),
+            }));
+        });
+        if (expired.length === 0) {
+            logger.info('No stale approvals to expire');
+            return { expiredCount: 0 };
+        }
+        const auditWriter = getAuditWriter(options.payload);
+        for (const approval of expired) {
+            await step.run(`expire-${approval.id}`, async () => {
+                await options.payload.update({
+                    collection: collectionSlug,
+                    id: approval.id,
+                    data: { status: 'expired' },
+                });
+                await auditWriter({
+                    actor: { type: 'system', apiKeyName: 'workflow:expire-stale-approvals' },
+                    action: 'approval.expired',
+                    mcpServer: 'approvals',
+                    mcpTool: 'expire-stale-approvals',
+                    targetCollection: approval.targetCollection,
+                    targetId: approval.targetId,
+                    targetTitle: approval.targetTitle,
+                    approvalRequestId: approval.id,
+                });
+                await options.inngest.send({
+                    name: 'approval/expired',
+                    data: {
+                        approvalId: approval.id,
+                        requesterId: approval.requesterId,
+                        targetCollection: approval.targetCollection,
+                        targetId: approval.targetId,
+                    },
+                });
+            });
+        }
+        logger.info('Expired stale approvals', { count: expired.length });
+        return { expiredCount: expired.length };
+    });
+}
+function extractRequesterId(value) {
+    if (typeof value === 'string')
+        return value;
+    if (value && typeof value === 'object' && 'id' in value) {
+        return String(value.id);
+    }
+    return null;
+}
+//# sourceMappingURL=expire-stale-approvals.js.map

package/dist/expire-stale-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expire-stale-approvals.js","sourceRoot":"","sources":["../src/expire-stale-approvals.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAG3D,MAAM,gBAAgB,GAAG,WAAW,CAAA,CAAC,mBAAmB;AACxD,MAAM,YAAY,GAAG,WAAW,CAAA;AAUhC;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,OAAoC;IAEpC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,YAAY,CAAA;IAE7D,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CACnC;QACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,wBAAwB;QAC1C,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/B,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,IAAgC,EAAE;YACpF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBACxC,UAAU,EAAE,cAAc;gBAC1B,KAAK,EAAE;oBACL,GAAG,EAAE;wBACH,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;wBACjC,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;qBAClC;iBACF;gBACD,KAAK,EAAE,GAAG;aACX,CAAC,CAAA;YACF,OAAQ,MAAM,CAAC,IAAuC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACnE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;gBACvD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACvC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC;gBACzE,WAAW,EAAE,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;aACpD,CAAC,CAAC,CAAA;QACL,CAAC,CAAC,CAAA;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC3C,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QAEnD,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;gBACjD,MAAM,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;oBAC3B,UAAU,EAAE,cAAc;oBAC1B,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;iBAC5B,CAAC,CAAA;gBAEF,MAAM,WAAW,CAAC;oBAChB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,iCAAiC,EAAE;oBACxE,MAAM,EAAE,kBAAkB;oBAC1B,SAAS,EAAE,WAAW;oBACtB,OAAO,EAAE,wBAAwB;oBACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;oBAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,iBAAiB,EAAE,QAAQ,CAAC,EAAE;iBAC/B,CAAC,CAAA;gBAEF,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;oBACzB,IAAI,EAAE,kBAAkB;oBACxB,IAAI,EAAE;wBACJ,UAAU,EAAE,QAAQ,CAAC,EAAE;wBACvB,WAAW,EAAE,QAAQ,CAAC,WAAW;wBACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;wBAC3C,QAAQ,EAAE,QAAQ,CAAC,QAAQ;qBAC5B;iBACF,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;QACjE,OAAO,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;IACzC,CAAC,CACF,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxD,OAAO,MAAM,CAAE,KAAyB,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/healthcheck.d.ts

@@ -0,0 +1,23 @@
+import type { InngestFunction } from 'inngest';
+import type { HealthcheckDefinition, HealthcheckOptions } from './types.js';
+/**
+ * Cron healthcheck. Runs every check in its own `step.run` so one
+ * misbehaving probe can't take down the rest, collects failures, and
+ * routes them to `onFailure` (defaults to `console.error`). Always fires
+ * a `system/healthcheck` Inngest event so external dashboards can
+ * observe heartbeats independently of failure routing.
+ */
+export declare function createHealthcheckFunction(options: HealthcheckOptions): InngestFunction.Any;
+/**
+ * Check that Payload is reachable and able to query a collection. Defaults
+ * to `users` because every Payload deployment has it; pass a different
+ * slug if `users` isn't always present (rare).
+ */
+export declare function createPayloadReachableCheck(collectionSlug?: string): HealthcheckDefinition;
+/**
+ * Check that a manifest URL is reachable. Aimed at the design-system
+ * manifest the components server consults, but works for any HTTPS
+ * endpoint that responds 2xx to a GET.
+ */
+export declare function createManifestReachableCheck(manifestUrl: string): HealthcheckDefinition;
+//# sourceMappingURL=healthcheck.d.ts.map

package/dist/healthcheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.d.ts","sourceRoot":"","sources":["../src/healthcheck.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAE9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAqB,MAAM,YAAY,CAAA;AAK9F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,kBAAkB,GAAG,eAAe,CAAC,GAAG,CA4D1F;AAWD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,cAAc,GAAE,MAAgB,GAC/B,qBAAqB,CAevB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,WAAW,EAAE,MAAM,GAAG,qBAAqB,CAkBvF"}

package/dist/healthcheck.js

@@ -0,0 +1,117 @@
+const DEFAULT_SCHEDULE = '*/15 * * * *';
+const REACHABLE_TIMEOUT_MS = 5_000;
+/**
+ * Cron healthcheck. Runs every check in its own `step.run` so one
+ * misbehaving probe can't take down the rest, collects failures, and
+ * routes them to `onFailure` (defaults to `console.error`). Always fires
+ * a `system/healthcheck` Inngest event so external dashboards can
+ * observe heartbeats independently of failure routing.
+ */
+export function createHealthcheckFunction(options) {
+    const schedule = options.schedule ?? DEFAULT_SCHEDULE;
+    const onFailure = options.onFailure ?? defaultOnFailure;
+    return options.inngest.createFunction({
+        id: options.id ?? 'healthcheck',
+        triggers: [{ cron: schedule }],
+    }, async ({ step, logger }) => {
+        const results = [];
+        for (const check of options.checks) {
+            const outcome = await step.run(`check-${check.name}`, async () => {
+                try {
+                    const result = await check.run({ payload: options.payload });
+                    return { name: check.name, ...result };
+                }
+                catch (error) {
+                    return {
+                        name: check.name,
+                        ok: false,
+                        details: error instanceof Error ? error.message : 'Unknown error',
+                    };
+                }
+            });
+            results.push(outcome);
+        }
+        const failures = results
+            .filter((r) => !r.ok)
+            .map((r) => {
+            const entry = { name: r.name };
+            if (r.details)
+                entry.details = r.details;
+            return entry;
+        });
+        if (failures.length > 0) {
+            await step.run('report-failures', async () => {
+                await onFailure(failures);
+            });
+        }
+        await step.run('emit-heartbeat', async () => {
+            await options.inngest.send({
+                name: 'system/healthcheck',
+                data: {
+                    source: 'workflow',
+                    timestamp: new Date().toISOString(),
+                },
+            });
+        });
+        logger.info('Healthcheck complete', {
+            totalChecks: results.length,
+            failures: failures.length,
+        });
+        return { results, failureCount: failures.length };
+    });
+}
+async function defaultOnFailure(failures) {
+    // eslint-disable-next-line no-console
+    console.error(`[healthcheck] ${failures.length} check(s) failed: ${failures
+        .map((f) => `${f.name}: ${f.details ?? 'no details'}`)
+        .join('; ')}`);
+}
+/**
+ * Check that Payload is reachable and able to query a collection. Defaults
+ * to `users` because every Payload deployment has it; pass a different
+ * slug if `users` isn't always present (rare).
+ */
+export function createPayloadReachableCheck(collectionSlug = 'users') {
+    return {
+        name: 'payload-reachable',
+        run: async ({ payload }) => {
+            try {
+                await payload.find({ collection: collectionSlug, limit: 1 });
+                return { ok: true };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    details: error instanceof Error ? error.message : 'Unknown error',
+                };
+            }
+        },
+    };
+}
+/**
+ * Check that a manifest URL is reachable. Aimed at the design-system
+ * manifest the components server consults, but works for any HTTPS
+ * endpoint that responds 2xx to a GET.
+ */
+export function createManifestReachableCheck(manifestUrl) {
+    return {
+        name: 'manifest-reachable',
+        run: async () => {
+            try {
+                const response = await fetch(manifestUrl, {
+                    signal: AbortSignal.timeout(REACHABLE_TIMEOUT_MS),
+                });
+                if (response.ok)
+                    return { ok: true };
+                return { ok: false, details: `HTTP ${response.status}` };
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    details: error instanceof Error ? error.message : 'Unknown error',
+                };
+            }
+        },
+    };
+}
+//# sourceMappingURL=healthcheck.js.map

package/dist/healthcheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"healthcheck.js","sourceRoot":"","sources":["../src/healthcheck.ts"],"names":[],"mappings":"AAIA,MAAM,gBAAgB,GAAG,cAAc,CAAA;AACvC,MAAM,oBAAoB,GAAG,KAAK,CAAA;AAElC;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAA2B;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,gBAAgB,CAAA;IACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAA;IAEvD,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CACnC;QACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,aAAa;QAC/B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;KAC/B,EACD,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzB,MAAM,OAAO,GAA2D,EAAE,CAAA;QAE1E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC/D,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;oBAC5D,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,EAAE,CAAA;gBACxC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO;wBACL,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,EAAE,EAAE,KAAK;wBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;qBAClE,CAAA;gBACH,CAAC;YACH,CAAC,CAAC,CAAA;YACF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvB,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO;aACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAuC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;YAClE,IAAI,CAAC,CAAC,OAAO;gBAAE,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAA;YACxC,OAAO,KAAK,CAAA;QACd,CAAC,CAAC,CAAA;QAEJ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,IAAI,EAAE;gBAC3C,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;YAC3B,CAAC,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;YAC1C,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBACzB,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE;oBACJ,MAAM,EAAE,UAAU;oBAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACpC;aACF,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;YAClC,WAAW,EAAE,OAAO,CAAC,MAAM;YAC3B,QAAQ,EAAE,QAAQ,CAAC,MAAM;SAC1B,CAAC,CAAA;QAEF,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;IACnD,CAAC,CACF,CAAA;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAmD;IACjF,sCAAsC;IACtC,OAAO,CAAC,KAAK,CACX,iBAAiB,QAAQ,CAAC,MAAM,qBAAqB,QAAQ;SAC1D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;SACrD,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CACzC,iBAAyB,OAAO;IAEhC,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,GAAG,EAAE,KAAK,EAAE,EAAE,OAAO,EAAwB,EAA8B,EAAE;YAC3E,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;gBAC5D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAClE,CAAA;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,WAAmB;IAC9D,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,GAAG,EAAE,KAAK,IAAgC,EAAE;YAC1C,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;oBACxC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,oBAAoB,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,QAAQ,CAAC,EAAE;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;gBACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAA;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;iBAClE,CAAA;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { createRevalidateOnPublishFunction } from './revalidate-on-publish.js';
+export { createExecuteScheduledPublishesFunction } from './execute-scheduled-publishes.js';
+export { createExpireStaleApprovalsFunction } from './expire-stale-approvals.js';
+export { createAuditEventEchoFunction } from './audit-event-echo.js';
+export { createHealthcheckFunction, createPayloadReachableCheck, createManifestReachableCheck, } from './healthcheck.js';
+export type { BaseWorkflowOptions, RevalidateFn, RevalidatePathsInput, RevalidateOnPublishOptions, ScheduledCollectionConfig, ExecuteScheduledPublishesOptions, ExpireStaleApprovalsOptions, AuditEchoEvent, AuditEchoHandler, AuditEventEchoOptions, HealthcheckDefinition, HealthcheckOptions, HealthcheckResult, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAA;AAC1F,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA;AAEzB,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,gCAAgC,EAChC,2BAA2B,EAC3B,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -0,0 +1,7 @@
+// Other factory exports land in subsequent commits.
+export { createRevalidateOnPublishFunction } from './revalidate-on-publish.js';
+export { createExecuteScheduledPublishesFunction } from './execute-scheduled-publishes.js';
+export { createExpireStaleApprovalsFunction } from './expire-stale-approvals.js';
+export { createAuditEventEchoFunction } from './audit-event-echo.js';
+export { createHealthcheckFunction, createPayloadReachableCheck, createManifestReachableCheck, } from './healthcheck.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oDAAoD;AAEpD,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uCAAuC,EAAE,MAAM,kCAAkC,CAAA;AAC1F,OAAO,EAAE,kCAAkC,EAAE,MAAM,6BAA6B,CAAA;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAA;AACpE,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,kBAAkB,CAAA"}

package/dist/revalidate-on-publish.d.ts

@@ -0,0 +1,13 @@
+import type { InngestFunction } from 'inngest';
+import type { RevalidateOnPublishOptions } from './types.js';
+/**
+ * Builds the `revalidate-on-publish` Inngest function. Subscribes to the
+ * publishing taxonomy and revalidates Next.js cache entries for the affected
+ * page, the listing routes, and the sitemap.
+ *
+ * The default revalidate function dynamically imports `next/cache`, so the
+ * package is safe to install in non-Next.js contexts. Pass `options.revalidate`
+ * to use a different cache invalidation strategy.
+ */
+export declare function createRevalidateOnPublishFunction(options: RevalidateOnPublishOptions): InngestFunction.Any;
+//# sourceMappingURL=revalidate-on-publish.d.ts.map

package/dist/revalidate-on-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidate-on-publish.d.ts","sourceRoot":"","sources":["../src/revalidate-on-publish.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAC9C,OAAO,KAAK,EAAgB,0BAA0B,EAAwB,MAAM,YAAY,CAAA;AAOhG;;;;;;;;GAQG;AACH,wBAAgB,iCAAiC,CAC/C,OAAO,EAAE,0BAA0B,GAClC,eAAe,CAAC,GAAG,CAuCrB"}

package/dist/revalidate-on-publish.js

@@ -0,0 +1,59 @@
+const DEFAULT_URL_BUILDERS = {
+    pages: (slug) => (slug === 'home' || slug === '' ? '/' : `/${slug}`),
+    posts: (slug) => `/blog/${slug}`,
+};
+/**
+ * Builds the `revalidate-on-publish` Inngest function. Subscribes to the
+ * publishing taxonomy and revalidates Next.js cache entries for the affected
+ * page, the listing routes, and the sitemap.
+ *
+ * The default revalidate function dynamically imports `next/cache`, so the
+ * package is safe to install in non-Next.js contexts. Pass `options.revalidate`
+ * to use a different cache invalidation strategy.
+ */
+export function createRevalidateOnPublishFunction(options) {
+    const urlBuilders = { ...DEFAULT_URL_BUILDERS, ...options.urlBuilders };
+    const collectionTags = options.collectionTags ?? {};
+    const revalidate = options.revalidate ?? defaultRevalidate;
+    return options.inngest.createFunction({
+        id: options.id ?? 'revalidate-on-publish',
+        retries: 5,
+        triggers: [
+            { event: 'content/page.published' },
+            { event: 'content/page.unpublished' },
+            { event: 'content/page.rolled_back' },
+        ],
+    }, async ({ event, step, logger }) => {
+        const data = (event.data ?? {});
+        const collection = data.collection ?? 'pages';
+        const slug = data.slug ?? data.id ?? '';
+        const tags = collectionTags[collection] ?? [collection];
+        await step.run('revalidate-page-path', async () => {
+            const builder = urlBuilders[collection] ?? ((s) => `/${s}`);
+            const path = builder(slug);
+            await revalidate({ path, tags });
+            logger.info('Revalidated page path', { path, tags });
+        });
+        await step.run('revalidate-listings', async () => {
+            await revalidate({ path: '', tags });
+        });
+        await step.run('revalidate-sitemap', async () => {
+            await revalidate({ path: '/sitemap.xml', tags: ['sitemap'] });
+        });
+        return { collection, slug, revalidated: true };
+    });
+}
+/**
+ * Default revalidator: dynamic-imports `next/cache` so the package can be
+ * imported in environments without Next.js (e.g. test runners that don't
+ * stub the module). Calls `revalidatePath` only when `path` is non-empty
+ * because `revalidatePath('')` triggers a noisy Next.js warning.
+ */
+const defaultRevalidate = async ({ path, tags }) => {
+    const { revalidatePath, revalidateTag } = (await import('next/cache'));
+    if (path)
+        revalidatePath(path);
+    for (const tag of tags)
+        revalidateTag(tag);
+};
+//# sourceMappingURL=revalidate-on-publish.js.map

package/dist/revalidate-on-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revalidate-on-publish.js","sourceRoot":"","sources":["../src/revalidate-on-publish.ts"],"names":[],"mappings":"AAGA,MAAM,oBAAoB,GAA6C;IACrE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IACpE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE;CACjC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iCAAiC,CAC/C,OAAmC;IAEnC,MAAM,WAAW,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACvE,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAA;IAE1D,OAAO,OAAO,CAAC,OAAO,CAAC,cAAc,CACnC;QACE,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,uBAAuB;QACzC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE;YACR,EAAE,KAAK,EAAE,wBAAwB,EAAE;YACnC,EAAE,KAAK,EAAE,0BAA0B,EAAE;YACrC,EAAE,KAAK,EAAE,0BAA0B,EAAE;SACtC;KACF,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAwD,CAAA;QACtF,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,CAAA;QACvC,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAEvD,MAAM,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YAChC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,IAAI,EAAE;YAC/C,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QACtC,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,UAAU,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QAC/D,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAChD,CAAC,CACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,iBAAiB,GAAiB,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAwB,EAAE,EAAE;IACrF,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAGpE,CAAA;IACD,IAAI,IAAI;QAAE,cAAc,CAAC,IAAI,CAAC,CAAA;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,aAAa,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC,CAAA"}

package/dist/types.d.ts

@@ -0,0 +1,135 @@
+import type { Inngest } from 'inngest';
+import type { Payload } from 'payload';
+/**
+ * Common dependencies for workflow factories. Every factory takes an
+ * Inngest client and a Payload instance — the workflows-as-factories shape
+ * means the client app is responsible for instantiating both and passing
+ * them in.
+ */
+export interface BaseWorkflowOptions {
+    inngest: Inngest;
+    payload: Payload;
+}
+export interface RevalidatePathsInput {
+    /** A page path (`/about`, `/blog/post-1`, or `''` for layout-level only). */
+    path: string;
+    /** Tag list passed through to Next.js's `revalidateTag`. */
+    tags: string[];
+}
+export type RevalidateFn = (input: RevalidatePathsInput) => Promise<void>;
+export interface RevalidateOnPublishOptions extends BaseWorkflowOptions {
+    /**
+     * Custom revalidation function. Defaults to Next.js `revalidatePath` +
+     * `revalidateTag` (loaded via dynamic import so non-Next.js consumers
+     * don't fail to import the package). Supply your own for non-Next.js
+     * frontends or richer cache invalidation.
+     */
+    revalidate?: RevalidateFn;
+    /**
+     * Per-collection URL builders. Built-in defaults: pages → /slug
+     * (with `home` mapped to `/`), posts → /blog/slug. Other collections
+     * fall back to /<slug> unless you provide a builder.
+     */
+    urlBuilders?: Record<string, (slug: string) => string>;
+    /**
+     * Per-collection cache tags. Defaults to `[<collection>]`. Multiple tags
+     * supported for collections that participate in shared listings (e.g.
+     * `programs` → `['programs', 'sitemap']`).
+     */
+    collectionTags?: Record<string, string[]>;
+    /**
+     * Override the function id. Default: `revalidate-on-publish`.
+     * Useful if multiple instances of the workflow run in the same Inngest
+     * deployment (rare).
+     */
+    id?: string;
+}
+export interface ScheduledCollectionConfig {
+    slug: string;
+    /**
+     * Field name carrying the publish status. Default: `_status`.
+     * Override only if the collection uses a non-default status field.
+     */
+    statusField?: string;
+    /**
+     * Field name carrying the scheduled-publish timestamp. Default: `scheduledPublishAt`.
+     */
+    scheduledField?: string;
+}
+export interface ExecuteScheduledPublishesOptions extends BaseWorkflowOptions {
+    /** Collections that participate in scheduled publishing. */
+    collections: ScheduledCollectionConfig[];
+    /** Cron schedule. Default: `*\/5 * * * *` (every 5 minutes). */
+    schedule?: string;
+    /**
+     * Base URL of the deployment's publishing server. Scheduled publishes
+     * call through the publishing MCP so the full pipeline runs (composition
+     * checks, accessibility, approval gating). Direct Payload writes would
+     * skip those checks.
+     */
+    publishingServerUrl: string;
+    /**
+     * API-key value for `Authorization: Bearer <key>` against the publishing
+     * MCP. Falls back to `process.env.PUBLISHING_SYSTEM_API_KEY` when omitted.
+     * Required at construction time — the factory throws if neither is set.
+     */
+    publishingApiKey?: string;
+    /** Override the function id. Default: `execute-scheduled-publishes`. */
+    id?: string;
+}
+export interface ExpireStaleApprovalsOptions extends BaseWorkflowOptions {
+    /** Approvals collection slug. Default: 'approvals'. */
+    collectionSlug?: string;
+    /** Cron schedule. Default: `0 2 * * *` (daily at 2am UTC). */
+    schedule?: string;
+    /** Override the function id. Default: `expire-stale-approvals`. */
+    id?: string;
+}
+export interface AuditEchoEvent {
+    action: string;
+    data: Record<string, unknown>;
+}
+export interface AuditEchoHandler {
+    /** Predicate. Return true to run `handle`. */
+    match: (event: {
+        action: string;
+    }) => boolean;
+    /** Side-effects (e.g. fire a follow-on Inngest event). */
+    handle: (event: AuditEchoEvent) => Promise<void>;
+}
+export interface AuditEventEchoOptions {
+    inngest: Inngest;
+    /**
+     * Additional handlers run after the built-in approval fan-out. Each
+     * handler is wrapped in its own `step.run` so failures retry independently.
+     */
+    handlers?: AuditEchoHandler[];
+    /** Override the function id. Default: `audit-event-echo`. */
+    id?: string;
+}
+export interface HealthcheckResult {
+    ok: boolean;
+    details?: string;
+}
+export interface HealthcheckDefinition {
+    name: string;
+    run: (ctx: {
+        payload: Payload;
+    }) => Promise<HealthcheckResult>;
+}
+export interface HealthcheckOptions extends BaseWorkflowOptions {
+    checks: HealthcheckDefinition[];
+    /** Cron schedule. Default: `*\/15 * * * *`. */
+    schedule?: string;
+    /**
+     * Called once per run when at least one check fails. Defaults to
+     * `console.error`; production deployments route this to monitoring.
+     */
+    onFailure?: (failures: Array<{
+        name: string;
+        details?: string;
+    }>) => Promise<void>;
+    /** Override the function id. Default: `healthcheck`. */
+    id?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAA;IACZ,4DAA4D;IAC5D,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,MAAM,YAAY,GAAG,CAAC,KAAK,EAAE,oBAAoB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;AAEzE,MAAM,WAAW,0BAA2B,SAAQ,mBAAmB;IACrE;;;;;OAKG;IACH,UAAU,CAAC,EAAE,YAAY,CAAA;IACzB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,CAAA;IACtD;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IACzC;;;;OAIG;IACH,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;OAEG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,gCAAiC,SAAQ,mBAAmB;IAC3E,4DAA4D;IAC5D,WAAW,EAAE,yBAAyB,EAAE,CAAA;IACxC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAA;IAC3B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,wEAAwE;IACxE,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE,uDAAuD;IACvD,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,mEAAmE;IACnE,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,KAAK,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAA;IAC7C,0DAA0D;IAC1D,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACjD;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB;;;OAGG;IACH,QAAQ,CAAC,EAAE,gBAAgB,EAAE,CAAA;IAC7B,6DAA6D;IAC7D,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,CAAC,GAAG,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAC/D;AAED,MAAM,WAAW,kBAAmB,SAAQ,mBAAmB;IAC7D,MAAM,EAAE,qBAAqB,EAAE,CAAA;IAC/B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IAClF,wDAAwD;IACxD,EAAE,CAAC,EAAE,MAAM,CAAA;CACZ"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,10 +1,70 @@
 {
   "name": "@forumone/throughline-workflows",
-  "version": "0.0.1",
-  "description": "OIDC trusted publishing setup package for @forumone/throughline-workflows",
+  "version": "0.2.0",
+  "description": "Composable Inngest function factories for the Throughline framework — revalidation, scheduled publishing, approval expiration, audit fan-out, healthcheck.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
-}
+    "throughline",
+    "payload",
+    "inngest",
+    "workflows"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/forumone/throughline.git",
+    "directory": "packages/workflows"
+  },
+  "homepage": "https://github.com/forumone/throughline/tree/main/packages/workflows#readme",
+  "bugs": {
+    "url": "https://github.com/forumone/throughline/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "inngest": "^4.0.0",
+    "next": ">=15.0.0",
+    "payload": "^3.0.0"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@forumone/throughline-core": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "eslint": "^9.15.0",
+    "inngest": "^4.2.0",
+    "next": "^16.2.4",
+    "payload": "^3.83.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0",
+    "@forumone/throughline-eslint-config": "0.0.0",
+    "@forumone/throughline-tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsc -b -w",
+    "clean": "rm -rf dist .turbo *.tsbuildinfo",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}