@forumone/throughline 0.0.0-stage → 1.0.0-next.0

package/dist/approvals/tools/list-my-requests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-my-requests.d.ts","sourceRoot":"","sources":["../../../src/approvals/tools/list-my-requests.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAEtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAG3D,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,kBAAkB,GAAG,iBAAiB,CAmDpF"}

package/dist/approvals/tools/list-my-requests.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { withMeta } from '../../mcp/meta.js';
+import { DEFAULT_APPROVALS_SLUG } from '../collection.js';
+import { APPROVALS_TOOLS } from './descriptors.js';
+export function createListMyRequestsTool(deps) {
+    const inputSchema = withMeta({
+        status: z
+            .enum(['pending', 'granted', 'declined', 'changes-requested', 'expired'])
+            .optional()
+            .describe('Filter by status. Defaults to all.'),
+        limit: z
+            .number()
+            .int()
+            .positive()
+            .max(100)
+            .optional()
+            .describe('Max results. Default: 25'),
+    });
+    return {
+        ...APPROVALS_TOOLS.listMyRequests,
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!ctx.user)
+                return { error: 'Must be authenticated to list approval requests' };
+            const result = await deps.payload.find({
+                collection: deps.options.collectionSlug ?? DEFAULT_APPROVALS_SLUG,
+                where: input.status
+                    ? {
+                        and: [
+                            { requestedBy: { equals: ctx.user.id } },
+                            { status: { equals: input.status } },
+                        ],
+                    }
+                    : { requestedBy: { equals: ctx.user.id } },
+                limit: input.limit ?? 25,
+                sort: '-requestedAt',
+            });
+            const docs = result.docs;
+            return {
+                requests: docs.map((doc) => ({
+                    approvalId: String(doc['id']),
+                    status: doc['status'],
+                    targetCollection: doc['targetCollection'],
+                    targetId: doc['targetId'],
+                    targetTitle: doc['targetTitle'],
+                    requestedAt: doc['requestedAt'],
+                    decidedAt: doc['decidedAt'],
+                    decisionNotes: doc['decisionNotes'],
+                    expiresAt: doc['expiresAt'],
+                })),
+            };
+        },
+    };
+}
+//# sourceMappingURL=list-my-requests.js.map

package/dist/approvals/tools/list-my-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-my-requests.js","sourceRoot":"","sources":["../../../src/approvals/tools/list-my-requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAOlD,MAAM,UAAU,wBAAwB,CAAC,IAAwB;IAC/D,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC3B,MAAM,EAAE,CAAC;aACN,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;aACxE,QAAQ,EAAE;aACV,QAAQ,CAAC,oCAAoC,CAAC;QACjD,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,0BAA0B,CAAC;KACxC,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,eAAe,CAAC,cAAc;QACjC,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAA;YAElF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,sBAAsB;gBACjE,KAAK,EAAE,KAAK,CAAC,MAAM;oBACjB,CAAC,CAAC;wBACE,GAAG,EAAE;4BACH,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;4BACxC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE;yBACrC;qBACF;oBACH,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE;gBAC5C,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,cAAc;aACrB,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsC,CAAA;YAC1D,OAAO;gBACL,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC3B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;oBACrB,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,CAAC;oBACzC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;oBACzB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;oBAC/B,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;oBAC/B,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;oBAC3B,aAAa,EAAE,GAAG,CAAC,eAAe,CAAC;oBACnC,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;iBAC5B,CAAC,CAAC;aACJ,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/approvals/tools/list-pending-approvals.d.ts

@@ -0,0 +1,11 @@
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '../../plugin-contract/mcp.js';
+import type { ApprovalsPluginOptions } from '../options.js';
+export interface ListPendingApprovalsDeps {
+    payload: Payload;
+    options: ApprovalsPluginOptions & {
+        tokenSecret: string;
+    };
+}
+export declare function createListPendingApprovalsTool(deps: ListPendingApprovalsDeps): McpToolDefinition;
+//# sourceMappingURL=list-pending-approvals.d.ts.map

package/dist/approvals/tools/list-pending-approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-pending-approvals.d.ts","sourceRoot":"","sources":["../../../src/approvals/tools/list-pending-approvals.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAGtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAG3D,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1D;AAED,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,wBAAwB,GAC7B,iBAAiB,CA+CnB"}

package/dist/approvals/tools/list-pending-approvals.js

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import { unwrapRelationshipId } from '../../utils/relationships.js';
+import { withMeta } from '../../mcp/meta.js';
+import { DEFAULT_APPROVALS_SLUG } from '../collection.js';
+import { APPROVALS_TOOLS } from './descriptors.js';
+export function createListPendingApprovalsTool(deps) {
+    const inputSchema = withMeta({
+        limit: z
+            .number()
+            .int()
+            .positive()
+            .max(100)
+            .optional()
+            .describe('Max results. Default: 25'),
+    });
+    return {
+        ...APPROVALS_TOOLS.listPendingApprovals,
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!ctx.user)
+                return { error: 'Must be authenticated to list pending approvals' };
+            const userGroups = ctx.user.groups;
+            if (userGroups.length === 0)
+                return { pending: [] };
+            const result = await deps.payload.find({
+                collection: deps.options.collectionSlug ?? DEFAULT_APPROVALS_SLUG,
+                where: {
+                    and: [
+                        { status: { equals: 'pending' } },
+                        { approverGroups: { in: userGroups } },
+                    ],
+                },
+                limit: input.limit ?? 25,
+                sort: '-requestedAt',
+            });
+            const docs = result.docs;
+            return {
+                pending: docs.map((doc) => ({
+                    approvalId: String(doc['id']),
+                    targetCollection: doc['targetCollection'],
+                    targetId: doc['targetId'],
+                    targetTitle: doc['targetTitle'],
+                    changesSummary: doc['changesSummary'],
+                    requestedBy: unwrapRelationshipId(doc['requestedBy']),
+                    requestedAt: doc['requestedAt'],
+                    expiresAt: doc['expiresAt'],
+                    previewUrl: doc['previewUrl'],
+                })),
+            };
+        },
+    };
+}
+//# sourceMappingURL=list-pending-approvals.js.map

package/dist/approvals/tools/list-pending-approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-pending-approvals.js","sourceRoot":"","sources":["../../../src/approvals/tools/list-pending-approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAOlD,MAAM,UAAU,8BAA8B,CAC5C,IAA8B;IAE9B,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC3B,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,EAAE;aACL,QAAQ,EAAE;aACV,GAAG,CAAC,GAAG,CAAC;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,0BAA0B,CAAC;KACxC,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,eAAe,CAAC,oBAAoB;QACvC,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,iDAAiD,EAAE,CAAA;YAClF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAA;YAClC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;YAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,sBAAsB;gBACjE,KAAK,EAAE;oBACL,GAAG,EAAE;wBACH,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;wBACjC,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE;qBACvC;iBACF;gBACD,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,cAAc;aACrB,CAAC,CAAA;YAEF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAsC,CAAA;YAC1D,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;oBAC1B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC7B,gBAAgB,EAAE,GAAG,CAAC,kBAAkB,CAAC;oBACzC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC;oBACzB,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;oBAC/B,cAAc,EAAE,GAAG,CAAC,gBAAgB,CAAC;oBACrC,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACrD,WAAW,EAAE,GAAG,CAAC,aAAa,CAAC;oBAC/B,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;oBAC3B,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;iBAC9B,CAAC,CAAC;aACJ,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/approvals/tools/request-approval.d.ts

@@ -0,0 +1,13 @@
+import type { Payload } from 'payload';
+import { type AuditWriter } from '../../audit/writer.js';
+import type { McpToolDefinition } from '../../plugin-contract/mcp.js';
+import type { ApprovalsPluginOptions } from '../options.js';
+export interface RequestApprovalDeps {
+    payload: Payload;
+    options: ApprovalsPluginOptions & {
+        tokenSecret: string;
+    };
+    auditWriter: AuditWriter;
+}
+export declare function createRequestApprovalTool(deps: RequestApprovalDeps): McpToolDefinition;
+//# sourceMappingURL=request-approval.d.ts.map

package/dist/approvals/tools/request-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-approval.d.ts","sourceRoot":"","sources":["../../../src/approvals/tools/request-approval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAG3D,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,WAAW,EAAE,WAAW,CAAA;CACzB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,mBAAmB,GAAG,iBAAiB,CA+HtF"}

package/dist/approvals/tools/request-approval.js

@@ -0,0 +1,123 @@
+import { z } from 'zod';
+import { auditContext } from '../../mcp/audit-context.js';
+import { documentContentHash } from '../../utils/content-hash.js';
+import { withMeta } from '../../mcp/meta.js';
+import { DEFAULT_APPROVALS_SLUG } from '../collection.js';
+import { APPROVALS_TOOLS } from './descriptors.js';
+export function createRequestApprovalTool(deps) {
+    const inputSchema = withMeta({
+        collection: z.string(),
+        id: z.string(),
+        changesSummary: z
+            .string()
+            .min(20)
+            .describe('Clear description of what is changing and why, shown to approvers in notifications'),
+        requestReason: z
+            .string()
+            .optional()
+            .describe('Optional context about why the change is being made'),
+        approverGroups: z
+            .array(z.string())
+            .min(1)
+            .describe('Group slugs the request should be routed to'),
+    });
+    return {
+        ...APPROVALS_TOOLS.requestApproval,
+        requiredScope: 'approvals.request',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!ctx.user) {
+                return { error: 'Approval requests must be made by an authenticated user' };
+            }
+            const approverGroups = input.approverGroups;
+            const validGroupSlugs = new Set(deps.options.groups.map((g) => g.slug));
+            const unknownGroups = approverGroups.filter((g) => !validGroupSlugs.has(g));
+            if (unknownGroups.length > 0) {
+                return { error: `Unknown approver groups: ${unknownGroups.join(', ')}` };
+            }
+            const document = (await deps.payload.findByID({
+                collection: input.collection,
+                id: input.id,
+                draft: true,
+            }));
+            if (!document)
+                return { error: 'Document not found' };
+            const approvers = await deps.options.groupResolver.resolveUsers(approverGroups);
+            if (approvers.length === 0) {
+                return {
+                    error: `No approvers found in groups: ${approverGroups.join(', ')}`,
+                };
+            }
+            /*
+            What the approval is bound to. A hash of the document's content, not of
+            its `updatedAt` — so a save that changed nothing leaves a granted
+            approval standing, and one that changed something invalidates it.
+      
+            Publishing's approval step hashes the same document the same way, with
+            the same function, from a `findByID` with the same arguments. That is
+            the only reason the two agree; see `documentContentHash`.
+            */
+            const targetVersion = await documentContentHash(document);
+            const targetTitle = typeof document['title'] === 'string' ? document['title'] : input.id;
+            const slug = typeof document['slug'] === 'string' ? document['slug'] : input.id;
+            const previewUrl = buildPreviewUrl(deps.options, input.collection, slug);
+            const expiresAt = new Date(Date.now() + (deps.options.expirationDays ?? 7) * 24 * 60 * 60 * 1000).toISOString();
+            const created = (await deps.payload.create({
+                collection: deps.options.collectionSlug ?? DEFAULT_APPROVALS_SLUG,
+                data: {
+                    targetCollection: input.collection,
+                    targetId: input.id,
+                    targetTitle,
+                    targetVersion,
+                    previewUrl,
+                    requestedBy: ctx.user.id,
+                    requestedAt: new Date().toISOString(),
+                    ...(input.requestReason ? { requestReason: input.requestReason } : {}),
+                    changesSummary: input.changesSummary,
+                    approverGroups: approverGroups,
+                    status: 'pending',
+                    expiresAt,
+                    notifiedApprovers: approvers.map((a) => a.id),
+                    consumedTokens: [],
+                },
+            }));
+            const approvalId = String(created.id);
+            await deps.options.inngest.send({
+                name: 'approval/requested',
+                data: {
+                    approvalId,
+                    targetCollection: input.collection,
+                    targetId: input.id,
+                    targetTitle,
+                    requestedBy: ctx.user.id,
+                    approverIds: approvers.map((a) => a.id),
+                    expiresAt,
+                },
+            });
+            await deps.auditWriter({
+                ...auditContext(ctx, input._meta),
+                action: 'approval.requested',
+                mcpServer: 'approvals',
+                mcpTool: 'request_approval',
+                targetCollection: input.collection,
+                targetId: input.id,
+                targetTitle,
+                changesSummary: input.changesSummary,
+                approvalRequestId: approvalId,
+                success: true,
+            });
+            return {
+                approvalId,
+                status: 'pending',
+                expiresAt,
+                approvers: approvers.map((a) => ({ id: a.id, name: a.name ?? a.email })),
+                previewUrl,
+            };
+        },
+    };
+}
+function buildPreviewUrl(options, collection, slug) {
+    const baseUrl = options.publicUrl ?? process.env['NEXT_PUBLIC_SERVER_URL'] ?? '';
+    return `${baseUrl.replace(/\/$/, '')}/api/preview?collection=${encodeURIComponent(collection)}&slug=${encodeURIComponent(slug)}`;
+}
+//# sourceMappingURL=request-approval.js.map

package/dist/approvals/tools/request-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-approval.js","sourceRoot":"","sources":["../../../src/approvals/tools/request-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAE5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAQlD,MAAM,UAAU,yBAAyB,CAAC,IAAyB;IACjE,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,cAAc,EAAE,CAAC;aACd,MAAM,EAAE;aACR,GAAG,CAAC,EAAE,CAAC;aACP,QAAQ,CACP,oFAAoF,CACrF;QACH,aAAa,EAAE,CAAC;aACb,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,qDAAqD,CAAC;QAClE,cAAc,EAAE,CAAC;aACd,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;aACjB,GAAG,CAAC,CAAC,CAAC;aACN,QAAQ,CAAC,6CAA6C,CAAC;KAC3D,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,eAAe,CAAC,eAAe;QAClC,aAAa,EAAE,mBAAmB;QAClC,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,yDAAyD,EAAE,CAAA;YAC7E,CAAC;YAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAA0B,CAAA;YACvD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;YACvE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YAC3E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,EAAE,KAAK,EAAE,4BAA4B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAA;YAC1E,CAAC;YAED,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC5C,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,IAAI;aACZ,CAAC,CAAmC,CAAA;YACrC,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;YAErD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;YAC/E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO;oBACL,KAAK,EAAE,iCAAiC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;iBACpE,CAAA;YACH,CAAC;YAED;;;;;;;;cAQE;YACF,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAA;YACzD,MAAM,WAAW,GACf,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAA;YACtE,MAAM,IAAI,GACR,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAA;YACpE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;YAExE,MAAM,SAAS,GAAG,IAAI,IAAI,CACxB,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CACtE,CAAC,WAAW,EAAE,CAAA;YAEf,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,sBAAsB;gBACjE,IAAI,EAAE;oBACJ,gBAAgB,EAAE,KAAK,CAAC,UAAU;oBAClC,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,WAAW;oBACX,aAAa;oBACb,UAAU;oBACV,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;oBACxB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACtE,cAAc,EAAE,KAAK,CAAC,cAAc;oBACpC,cAAc,EAAE,cAAc;oBAC9B,MAAM,EAAE,SAAS;oBACjB,SAAS;oBACT,iBAAiB,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7C,cAAc,EAAE,EAAE;iBACnB;aACF,CAAC,CAA4B,CAAA;YAE9B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAErC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC9B,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE;oBACJ,UAAU;oBACV,gBAAgB,EAAE,KAAK,CAAC,UAAU;oBAClC,QAAQ,EAAE,KAAK,CAAC,EAAE;oBAClB,WAAW;oBACX,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;oBACxB,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,SAAS;iBACV;aACF,CAAC,CAAA;YAEF,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,oBAAoB;gBAC5B,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,kBAAkB;gBAC3B,gBAAgB,EAAE,KAAK,CAAC,UAAU;gBAClC,QAAQ,EAAE,KAAK,CAAC,EAAE;gBAClB,WAAW;gBACX,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,iBAAiB,EAAE,UAAU;gBAC7B,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YAEF,OAAO;gBACL,UAAU;gBACV,MAAM,EAAE,SAAS;gBACjB,SAAS;gBACT,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;gBACxE,UAAU;aACX,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,eAAe,CACtB,OAA+B,EAC/B,UAAkB,EAClB,IAAY;IAEZ,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,EAAE,CAAA;IAChF,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,kBAAkB,CAAC,UAAU,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;AAClI,CAAC"}

package/dist/approvals/tools/respond-to-approval.d.ts

@@ -0,0 +1,13 @@
+import type { Payload } from 'payload';
+import { type AuditWriter } from '../../audit/writer.js';
+import type { McpToolDefinition } from '../../plugin-contract/mcp.js';
+import type { ApprovalsPluginOptions } from '../options.js';
+export interface RespondToApprovalDeps {
+    payload: Payload;
+    options: ApprovalsPluginOptions & {
+        tokenSecret: string;
+    };
+    auditWriter: AuditWriter;
+}
+export declare function createRespondToApprovalTool(deps: RespondToApprovalDeps): McpToolDefinition;
+//# sourceMappingURL=respond-to-approval.d.ts.map

package/dist/approvals/tools/respond-to-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond-to-approval.d.ts","sourceRoot":"","sources":["../../../src/approvals/tools/respond-to-approval.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AAItC,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AAErE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAG3D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,sBAAsB,GAAG;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,WAAW,EAAE,WAAW,CAAA;CACzB;AAcD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,qBAAqB,GAAG,iBAAiB,CA2F1F"}

package/dist/approvals/tools/respond-to-approval.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+import { auditContext } from '../../mcp/audit-context.js';
+import { unwrapRelationshipId } from '../../utils/relationships.js';
+import { withMeta } from '../../mcp/meta.js';
+import { DEFAULT_APPROVALS_SLUG } from '../collection.js';
+import { APPROVALS_TOOLS } from './descriptors.js';
+const decisionToStatus = {
+    approve: 'granted',
+    decline: 'declined',
+    request_changes: 'changes-requested',
+};
+const decisionToAuditAction = {
+    approve: 'approval.granted',
+    decline: 'approval.declined',
+    request_changes: 'approval.changes_requested',
+};
+export function createRespondToApprovalTool(deps) {
+    const inputSchema = withMeta({
+        approvalId: z.string(),
+        decision: z.enum(['approve', 'decline', 'request_changes']),
+        notes: z
+            .string()
+            .optional()
+            .describe('Decision rationale, shown to the requester (optional but encouraged for declines)'),
+    });
+    return {
+        ...APPROVALS_TOOLS.respondToApproval,
+        requiredScope: 'approvals.decide',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!ctx.user) {
+                return { error: 'Must be authenticated to respond to approvals' };
+            }
+            const collectionSlug = deps.options.collectionSlug ?? DEFAULT_APPROVALS_SLUG;
+            const approval = (await deps.payload.findByID({
+                collection: collectionSlug,
+                id: input.approvalId,
+            }));
+            if (!approval)
+                return { error: 'Approval not found' };
+            if (approval['status'] !== 'pending') {
+                return { error: `Approval is already ${String(approval['status'])}` };
+            }
+            const requesterId = unwrapRelationshipId(approval['requestedBy']);
+            if (requesterId === ctx.user.id) {
+                return { error: 'You cannot approve your own request' };
+            }
+            const approverGroups = approval['approverGroups'] ?? [];
+            const userGroups = ctx.user.groups;
+            const hasAccess = approverGroups.some((g) => userGroups.includes(g));
+            if (!hasAccess) {
+                return { error: 'You are not in an approver group for this request' };
+            }
+            const decision = input.decision;
+            const newStatus = decisionToStatus[decision];
+            const decidedAt = new Date().toISOString();
+            await deps.payload.update({
+                collection: collectionSlug,
+                id: input.approvalId,
+                data: {
+                    status: newStatus,
+                    decidedBy: ctx.user.id,
+                    decidedAt,
+                    ...(input.notes ? { decisionNotes: input.notes } : {}),
+                },
+            });
+            await deps.options.inngest.send({
+                name: 'approval/decided',
+                data: {
+                    approvalId: input.approvalId,
+                    decision: newStatus,
+                    decidedBy: ctx.user.id,
+                    decidedAt,
+                    targetCollection: String(approval['targetCollection']),
+                    targetId: String(approval['targetId']),
+                },
+            });
+            await deps.auditWriter({
+                ...auditContext(ctx, input._meta),
+                action: decisionToAuditAction[decision],
+                mcpServer: 'approvals',
+                mcpTool: 'respond_to_approval',
+                targetCollection: String(approval['targetCollection']),
+                targetId: String(approval['targetId']),
+                targetTitle: typeof approval['targetTitle'] === 'string'
+                    ? approval['targetTitle']
+                    : String(approval['targetId']),
+                // The decision notes are the reasoning when there are any: they are
+                // what the approver actually wrote.
+                reasoning: input.notes ?? input._meta?.reasoning,
+                approvalRequestId: input.approvalId,
+                success: true,
+            });
+            return { success: true, status: newStatus, decidedAt };
+        },
+    };
+}
+//# sourceMappingURL=respond-to-approval.js.map

package/dist/approvals/tools/respond-to-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"respond-to-approval.js","sourceRoot":"","sources":["../../../src/approvals/tools/respond-to-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAI5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAQlD,MAAM,gBAAgB,GAAG;IACvB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,UAAU;IACnB,eAAe,EAAE,mBAAmB;CAC5B,CAAA;AAEV,MAAM,qBAAqB,GAAuD;IAChF,OAAO,EAAE,kBAAkB;IAC3B,OAAO,EAAE,mBAAmB;IAC5B,eAAe,EAAE,4BAA4B;CAC9C,CAAA;AAED,MAAM,UAAU,2BAA2B,CAAC,IAA2B;IACrE,MAAM,WAAW,GAAG,QAAQ,CAAC;QAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC3D,KAAK,EAAE,CAAC;aACL,MAAM,EAAE;aACR,QAAQ,EAAE;aACV,QAAQ,CAAC,mFAAmF,CAAC;KACjG,CAAC,CAAA;IAEF,OAAO;QACL,GAAG,eAAe,CAAC,iBAAiB;QACpC,aAAa,EAAE,kBAAkB;QACjC,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,EAAE,KAAK,EAAE,+CAA+C,EAAE,CAAA;YACnE,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,IAAI,sBAAsB,CAAA;YAC5E,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAC5C,UAAU,EAAE,cAAc;gBAC1B,EAAE,EAAE,KAAK,CAAC,UAAU;aACrB,CAAC,CAAmC,CAAA;YAErC,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAA;YAErD,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,uBAAuB,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAA;YACvE,CAAC;YAED,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAA;YACjE,IAAI,WAAW,KAAK,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBAChC,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAA;YACzD,CAAC;YAED,MAAM,cAAc,GAAI,QAAQ,CAAC,gBAAgB,CAA0B,IAAI,EAAE,CAAA;YACjF,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAA;YAClC,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;YACpE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,mDAAmD,EAAE,CAAA;YACvE,CAAC;YAED,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAyC,CAAA;YAChE,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YAE1C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,UAAU,EAAE,cAAc;gBAC1B,EAAE,EAAE,KAAK,CAAC,UAAU;gBACpB,IAAI,EAAE;oBACJ,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;oBACtB,SAAS;oBACT,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD;aACF,CAAC,CAAA;YAEF,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC9B,IAAI,EAAE,kBAAkB;gBACxB,IAAI,EAAE;oBACJ,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,QAAQ,EAAE,SAAS;oBACnB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;oBACtB,SAAS;oBACT,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;oBACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;iBACvC;aACF,CAAC,CAAA;YAEF,MAAM,IAAI,CAAC,WAAW,CAAC;gBACrB,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC;gBACvC,SAAS,EAAE,WAAW;gBACtB,OAAO,EAAE,qBAAqB;gBAC9B,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;gBACtD,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACtC,WAAW,EACT,OAAO,QAAQ,CAAC,aAAa,CAAC,KAAK,QAAQ;oBACzC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC;oBACzB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAClC,oEAAoE;gBACpE,oCAAoC;gBACpC,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,SAAS;gBAChD,iBAAiB,EAAE,KAAK,CAAC,UAAU;gBACnC,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,CAAA;QACxD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/audit/collection.d.ts

@@ -0,0 +1,22 @@
+import type { Access, CollectionConfig } from 'payload';
+import { type PluginAdminOptions } from '../plugin-contract/index.js';
+export interface AuditCollectionOptions {
+    /** Override the collection slug. Default: `'audit-events'`. */
+    slug?: string;
+    /**
+     * Read access function. Receives the standard Payload access args.
+     * Defaults to admin/editor roles.
+     */
+    readAccess?: Access;
+    /** Sidebar placement. Default: the `'Throughline'` group; `group: false` leaves it ungrouped. */
+    admin?: PluginAdminOptions;
+}
+export declare const DEFAULT_AUDIT_SLUG = "audit-events";
+/**
+ * Builds the audit-events collection config. The collection is read-only
+ * from outside the writer: `create`, `update`, and `delete` are denied
+ * for all callers; the writer uses Payload's local API which bypasses
+ * these checks.
+ */
+export declare function createAuditCollection(options?: AuditCollectionOptions): CollectionConfig;
+//# sourceMappingURL=collection.d.ts.map

package/dist/audit/collection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,6BAA6B,CAAA;AAGxF,MAAM,WAAW,sBAAsB;IACrC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,iGAAiG;IACjG,KAAK,CAAC,EAAE,kBAAkB,CAAA;CAC3B;AAED,eAAO,MAAM,kBAAkB,iBAAiB,CAAA;AAOhD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,sBAA2B,GAAG,gBAAgB,CAgG5F"}

package/dist/audit/collection.js

@@ -0,0 +1,109 @@
+import { resolveAdminGroup } from '../plugin-contract/index.js';
+import { AUDIT_ACTIONS, AUDIT_MCP_SERVERS } from './types.js';
+export const DEFAULT_AUDIT_SLUG = 'audit-events';
+const defaultReadAccess = ({ req }) => {
+    const roles = req.user?.['roles'] ?? [];
+    return roles.includes('admin') || roles.includes('editor');
+};
+/**
+ * Builds the audit-events collection config. The collection is read-only
+ * from outside the writer: `create`, `update`, and `delete` are denied
+ * for all callers; the writer uses Payload's local API which bypasses
+ * these checks.
+ */
+export function createAuditCollection(options = {}) {
+    const slug = options.slug ?? DEFAULT_AUDIT_SLUG;
+    return {
+        slug,
+        admin: {
+            ...resolveAdminGroup(options.admin),
+            useAsTitle: 'summary',
+            defaultColumns: ['createdAt', 'actor', 'action', 'targetCollection', 'targetId'],
+            description: 'Immutable record of every consequential action in the system. Read-only through the admin.',
+        },
+        access: {
+            read: options.readAccess ?? defaultReadAccess,
+            create: () => false,
+            update: () => false,
+            delete: () => false,
+        },
+        fields: [
+            {
+                name: 'createdAt',
+                type: 'date',
+                required: true,
+                defaultValue: () => new Date().toISOString(),
+                admin: { position: 'sidebar', readOnly: true },
+            },
+            {
+                name: 'actor',
+                type: 'group',
+                fields: [
+                    {
+                        name: 'type',
+                        type: 'select',
+                        required: true,
+                        options: [
+                            { label: 'User', value: 'user' },
+                            { label: 'System', value: 'system' },
+                            { label: 'Integration', value: 'integration' },
+                        ],
+                    },
+                    { name: 'userId', type: 'text' },
+                    { name: 'userName', type: 'text' },
+                    { name: 'apiKeyName', type: 'text' },
+                    { name: 'apiKeyId', type: 'text' },
+                    { name: 'sessionId', type: 'text' },
+                ],
+            },
+            {
+                name: 'action',
+                type: 'select',
+                required: true,
+                options: AUDIT_ACTIONS.map((value) => ({ label: value, value })),
+            },
+            {
+                name: 'mcpServer',
+                type: 'select',
+                required: true,
+                options: AUDIT_MCP_SERVERS.map((value) => ({ label: value, value })),
+            },
+            { name: 'mcpTool', type: 'text', required: true },
+            { name: 'targetCollection', type: 'text' },
+            { name: 'targetId', type: 'text' },
+            { name: 'targetTitle', type: 'text' },
+            {
+                name: 'prompt',
+                type: 'textarea',
+                admin: { description: "The user's natural-language prompt, if surfaced via _meta." },
+            },
+            {
+                name: 'reasoning',
+                type: 'textarea',
+                admin: { description: "Claude's reasoning, if surfaced via _meta." },
+            },
+            { name: 'changesSummary', type: 'textarea' },
+            { name: 'summary', type: 'text', required: true },
+            {
+                name: 'diff',
+                type: 'json',
+                admin: {
+                    description: 'Before/after fields for update operations; null for reads.',
+                },
+            },
+            { name: 'success', type: 'checkbox', defaultValue: true },
+            { name: 'errorMessage', type: 'text' },
+            { name: 'approvalRequestId', type: 'text' },
+            { name: 'integrationId', type: 'text' },
+        ],
+        indexes: [
+            { fields: ['createdAt'] },
+            { fields: ['actor.userId', 'createdAt'] },
+            { fields: ['targetCollection', 'targetId', 'createdAt'] },
+            { fields: ['action', 'createdAt'] },
+            { fields: ['mcpServer', 'createdAt'] },
+        ],
+        timestamps: false,
+    };
+}
+//# sourceMappingURL=collection.js.map

package/dist/audit/collection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection.js","sourceRoot":"","sources":["../../src/audit/collection.ts"],"names":[],"mappings":"AACA,OAAO,EAA2B,iBAAiB,EAAE,MAAM,6BAA6B,CAAA;AACxF,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAc7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAA;AAEhD,MAAM,iBAAiB,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IAC5C,MAAM,KAAK,GAAI,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAA0B,IAAI,EAAE,CAAA;IACjE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC5D,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkC,EAAE;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,kBAAkB,CAAA;IAE/C,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,GAAG,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,UAAU,CAAC;YAChF,WAAW,EACT,4FAA4F;SAC/F;QACD,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,UAAU,IAAI,iBAAiB;YAC7C,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;YACnB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK;SACpB;QACD,MAAM,EAAE;YACN;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,YAAY,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;aAC/C;YACD;gBACE,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,MAAM,EAAE;oBACN;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,QAAQ;wBACd,QAAQ,EAAE,IAAI;wBACd,OAAO,EAAE;4BACP,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;4BAChC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;4BACpC,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE;yBAC/C;qBACF;oBACD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE;oBAChC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;oBACpC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;oBAClC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE;iBACpC;aACF;YACD;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACjE;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,IAAI;gBACd,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;aACrE;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC1C,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;YAClC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE;YACrC;gBACE,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE;aACrF;YACD;gBACE,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE;aACrE;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE;YAC5C,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjD;gBACE,IAAI,EAAE,MAAM;gBACZ,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE;oBACL,WAAW,EAAE,4DAA4D;iBAC1E;aACF;YACD,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE;YACzD,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE;YACtC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,EAAE;YAC3C,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE;SACxC;QACD,OAAO,EAAE;YACP,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;YACzB,EAAE,MAAM,EAAE,CAAC,cAAc,EAAE,WAAW,CAAC,EAAE;YACzC,EAAE,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE;YACzD,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE;YACnC,EAAE,MAAM,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE;SACvC;QACD,UAAU,EAAE,KAAK;KAClB,CAAA;AACH,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,16 @@
+export { auditPlugin, getAuditWriter } from './plugin.js';
+export type { AuditPluginOptions } from './plugin.js';
+export { createAuditCollection, DEFAULT_AUDIT_SLUG } from './collection.js';
+export type { AuditCollectionOptions } from './collection.js';
+export { createAuditWriter } from './writer.js';
+export type { AuditWriter, AuditWriterOptions, AuditEventInput, AuditActor } from './writer.js';
+export { AUDIT_ACTIONS, AUDIT_MCP_SERVERS } from './types.js';
+export type { AuditAction, AuditMcpServer } from './types.js';
+export { auditEventEchoJob } from './jobs/audit-event-echo.js';
+export type { AuditEchoEvent, AuditEchoHandler, AuditEventEchoOptions, } from '../jobs/workflow-types.js';
+export { auditQueryPlugin } from './query/plugin.js';
+export type { AuditQueryPluginOptions } from './query/options.js';
+export { formatAuditEvent, formatRelativeTime } from './query/formatting/index.js';
+export type { FormattedAuditEvent } from './query/formatting/index.js';
+export { createQueryAuditTool, createGetChangeHistoryTool, createWhoChangedWhatTool, createWhatChangedInRangeTool, createGetRecentFailuresTool, } from './query/tools/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAC3E,YAAY,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAA;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC/C,YAAY,EAAE,WAAW,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE/F,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAC7D,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,YAAY,EACV,cAAc,EACd,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAGlC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,YAAY,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAA;AAEjE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAClF,YAAY,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AAEtE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA"}

package/dist/audit/index.js

@@ -0,0 +1,11 @@
+export { auditPlugin, getAuditWriter } from './plugin.js';
+export { createAuditCollection, DEFAULT_AUDIT_SLUG } from './collection.js';
+export { createAuditWriter } from './writer.js';
+export { AUDIT_ACTIONS, AUDIT_MCP_SERVERS } from './types.js';
+// The job that fans an audit event out to its follow-ons (approval emails).
+export { auditEventEchoJob } from './jobs/audit-event-echo.js';
+// The query plugin and its MCP tools, which were `@forumone/throughline-audit`.
+export { auditQueryPlugin } from './query/plugin.js';
+export { formatAuditEvent, formatRelativeTime } from './query/formatting/index.js';
+export { createQueryAuditTool, createGetChangeHistoryTool, createWhoChangedWhatTool, createWhatChangedInRangeTool, createGetRecentFailuresTool, } from './query/tools/index.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAGzD,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAG3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAG/C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAG7D,4EAA4E;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAO9D,gFAAgF;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAGlF,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,wBAAwB,CAAA"}

package/dist/audit/jobs/audit-event-echo.d.ts

@@ -0,0 +1,14 @@
+import type { Job } from '../../jobs/types.js';
+import type { AuditEventEchoOptions } from '../../jobs/workflow-types.js';
+/**
+ * Subscribes to `audit/event.recorded` and fans out to notification
+ * workflows. The built-in handlers cover the approval lifecycle (which
+ * the email package in C11 subscribes to); custom handlers in
+ * `options.handlers` add other fan-outs (e.g. "post integration.failed
+ * to a #alerts Slack channel").
+ *
+ * Each handler runs in its own `step.run` so a failure in one fan-out
+ * does not affect the others.
+ */
+export declare function auditEventEchoJob(options: AuditEventEchoOptions): Job;
+//# sourceMappingURL=audit-event-echo.d.ts.map

package/dist/audit/jobs/audit-event-echo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-event-echo.d.ts","sourceRoot":"","sources":["../../../src/audit/jobs/audit-event-echo.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAiBzE;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,GAAG,CAgDrE"}