@forumone/throughline 0.0.0 → 1.0.0-next.0

package/dist/publishing/service.js

@@ -0,0 +1,474 @@
+import { sendEventSafely } from './events.js';
+import { resolveCollection } from './options.js';
+import { runPreflightPipeline, runPublishPipeline } from './pipeline/index.js';
+const SERVICE_SYMBOL = Symbol.for('@forumone/throughline/publishing-service');
+/**
+ * The single implementation of publish / unpublish / status. Both the MCP
+ * tools and the admin endpoints call through here, so the two channels
+ * cannot drift: same pipeline, same audit shape, same trust boundary.
+ */
+export function createPublishingService(deps) {
+    const { payload, options, auditWriter, logger } = deps;
+    /*
+    `disableErrors`, and an empty object for a document that is not there.
+  
+    Without it `findByID` throws `NotFound`, which happens before the pipeline
+    runs — so the `exist` step's `not-found` branch was unreachable from every
+    caller, and publishing a document that does not exist came back as a thrown
+    error rather than as the structured block the pipeline exists to return. The
+    step's own tests passed it an empty document and so never noticed; a real
+    Payload found it in one call.
+  
+    An empty object rather than `null` because that is what `existStep` already
+    checks for: `Object.keys(ctx.document).length === 0`. The branch was written
+    for this and only ever needed a caller that could reach it.
+    */
+    async function loadDocument(slug, id, actor) {
+        const document = await payload.findByID({
+            collection: slug,
+            id,
+            draft: true,
+            disableErrors: true,
+            ...(actor.enforceAccessAs
+                ? { user: actor.enforceAccessAs, overrideAccess: false }
+                : {}),
+        });
+        return (document ?? {});
+    }
+    /*
+    Whether the document is live — which the latest version cannot say.
+  
+    `loadDocument` reads with `draft: true`, so a live page with a draft saved on
+    top comes back with `_status: 'draft'`, and unpublish refused it as "not
+    currently published" while it sat on the site. Scheduling a revision of a live
+    page creates exactly that state, so the gap stopped being rare. A latest
+    version of `published` settles it; only a `draft` needs the main row read,
+    which is the same reasoning as `resolveLiveStatus` in the trust boundary.
+    */
+    async function liveStatus(slug, id, latest, actor) {
+        if (latest['_status'] === 'published')
+            return 'published';
+        const live = await payload.findByID({
+            collection: slug,
+            id,
+            draft: false,
+            depth: 0,
+            disableErrors: true,
+            ...(actor.enforceAccessAs ? { user: actor.enforceAccessAs, overrideAccess: false } : {}),
+        });
+        return live?.['_status'];
+    }
+    return {
+        async publish(request) {
+            const collection = resolveCollection(options, request.collection);
+            const document = await loadDocument(collection.slug, request.id, request.actor);
+            const result = await runPublishPipeline({
+                payload,
+                inngest: options.inngest,
+                options,
+                collection,
+                document,
+                documentId: request.id,
+                actor: toPipelineActor(request.actor),
+                ...(request.meta ? { meta: request.meta } : {}),
+            });
+            await auditWriter({
+                actor: toAuditActor(request.actor),
+                action: 'publishing.publish',
+                mcpServer: 'publishing',
+                mcpTool: toolName('publish', request.actor),
+                targetCollection: request.collection,
+                targetId: request.id,
+                targetTitle: stringField(document, 'title') ?? request.id,
+                prompt: request.meta?.userPrompt,
+                reasoning: request.meta?.reasoning,
+                changesSummary: request.meta?.changesSummary,
+                success: result.success,
+                errorMessage: result.success ? undefined : result.reason,
+            });
+            if (result.warnings?.length) {
+                logger?.warn('Publish completed with warnings', {
+                    collection: request.collection,
+                    id: request.id,
+                    warnings: result.warnings,
+                });
+            }
+            const warnings = result.warnings?.length ? { warnings: result.warnings } : {};
+            if (result.success) {
+                return {
+                    published: true,
+                    ...(result.publishedAt ? { publishedAt: result.publishedAt } : {}),
+                    ...warnings,
+                };
+            }
+            return {
+                published: false,
+                ...(result.failedAt ? { failedAt: result.failedAt } : {}),
+                ...(result.reason ? { reason: result.reason } : {}),
+                ...(result.code ? { code: result.code } : {}),
+                ...(result.issues ? { issues: result.issues } : {}),
+                ...(result.suggestion ? { suggestion: result.suggestion } : {}),
+                ...warnings,
+            };
+        },
+        async unpublish(request) {
+            const collection = resolveCollection(options, request.collection);
+            const document = await loadDocument(collection.slug, request.id, request.actor);
+            // A document that is not there and one that is there and already a draft
+            // are different answers, and only one of them means "nothing to do".
+            if (Object.keys(document).length === 0) {
+                return { unpublished: false, reason: 'Document not found' };
+            }
+            if ((await liveStatus(collection.slug, request.id, document, request.actor)) !== 'published') {
+                return { unpublished: false, reason: 'Document is not currently published' };
+            }
+            // `overrideLock: false` for the same reason as the publish write: taking a
+            // live page down while somebody has it open in the admin should be a
+            // refusal, not a surprise. A lock held by the caller themselves passes.
+            // The schedule goes with it. Left in place, a past date on a document
+            // that is a draft again is exactly what the scheduled-publish backstop
+            // looks for, and the page would put itself back up within the day.
+            await payload.update({
+                collection: collection.slug,
+                id: request.id,
+                data: {
+                    _status: 'draft',
+                    ...(document[collection.scheduledPublishField] != null
+                        ? { [collection.scheduledPublishField]: null }
+                        : {}),
+                },
+                ...(request.actor.enforceAccessAs
+                    ? { user: request.actor.enforceAccessAs, overrideAccess: false }
+                    : {}),
+                overrideLock: false,
+                context: { bypassPublishingServer: true },
+            });
+            // Same rule as publish: the write has landed, so a failed emission is
+            // a warning, not a failure.
+            const slug = document[collection.slugField];
+            const warning = await sendEventSafely(options.inngest, {
+                name: 'content/page.unpublished',
+                data: {
+                    collection: collection.slug,
+                    id: request.id,
+                    slug: typeof slug === 'string' ? slug : request.id,
+                    unpublishedBy: request.actor.user?.id ?? 'system',
+                },
+            });
+            if (warning) {
+                logger?.warn('Unpublish completed with warnings', {
+                    collection: request.collection,
+                    id: request.id,
+                    warnings: [warning],
+                });
+            }
+            await auditWriter({
+                actor: toAuditActor(request.actor),
+                action: 'publishing.unpublish',
+                mcpServer: 'publishing',
+                mcpTool: toolName('unpublish', request.actor),
+                targetCollection: request.collection,
+                targetId: request.id,
+                targetTitle: stringField(document, 'title') ?? request.id,
+                prompt: request.meta?.userPrompt,
+                reasoning: request.meta?.reasoning,
+                changesSummary: request.meta?.changesSummary,
+                success: true,
+            });
+            return { unpublished: true, ...(warning ? { warnings: [warning] } : {}) };
+        },
+        async schedule(request) {
+            const collection = resolveCollection(options, request.collection);
+            const publishAtMs = Date.parse(request.publishAt);
+            if (Number.isNaN(publishAtMs)) {
+                return { scheduled: false, reason: 'The scheduled time is not a date' };
+            }
+            if (publishAtMs <= Date.now()) {
+                return { scheduled: false, reason: 'The scheduled time must be in the future' };
+            }
+            const publishAt = new Date(publishAtMs).toISOString();
+            const document = await loadDocument(collection.slug, request.id, request.actor);
+            if (Object.keys(document).length === 0) {
+                return { scheduled: false, reason: 'Document not found' };
+            }
+            // Everything a publish would check, now, so an editor hears about a
+            // missing alt text while they are looking at the page rather than from a
+            // log line on the morning it was meant to go out. The same checks run
+            // again at the scheduled time; this is the early warning, not the gate.
+            const preflight = await runPreflightPipeline({
+                payload,
+                inngest: options.inngest,
+                options,
+                collection,
+                document,
+                documentId: request.id,
+                actor: toPipelineActor(request.actor),
+                ...(request.meta ? { meta: request.meta } : {}),
+            });
+            const deferred = preflight.success
+                ? { ok: true }
+                : deferUntilScheduledTime(preflight, document, collection.policyField, publishAtMs);
+            const audit = (success, errorMessage) => auditWriter({
+                actor: toAuditActor(request.actor),
+                action: 'publishing.schedule',
+                mcpServer: 'publishing',
+                mcpTool: toolName('schedule_publish', request.actor),
+                targetCollection: request.collection,
+                targetId: request.id,
+                targetTitle: stringField(document, 'title') ?? request.id,
+                prompt: request.meta?.userPrompt,
+                reasoning: request.meta?.reasoning,
+                changesSummary: `Scheduled publish for ${publishAt}`,
+                success,
+                errorMessage,
+            });
+            if (!deferred.ok) {
+                const block = deferred.block;
+                await audit(false, block.reason);
+                return {
+                    scheduled: false,
+                    ...(block.failedAt ? { failedAt: block.failedAt } : {}),
+                    ...(block.reason ? { reason: block.reason } : {}),
+                    ...(block.code ? { code: block.code } : {}),
+                    ...(block.issues ? { issues: block.issues } : {}),
+                    ...(block.suggestion ? { suggestion: block.suggestion } : {}),
+                };
+            }
+            /*
+            A draft write, so it lands on the latest version and leaves the live
+            document alone. That is what makes a revision of a live page schedulable
+            at all — a non-draft write of one field would be a publish of the pending
+            draft, which the trust boundary rightly refuses — and it is where the
+            publish at the scheduled time reads from, since publishing promotes the
+            latest version.
+      
+            The plugin's `afterChange` hook sees the field change and sends
+            `content/page.scheduled`, so the wake-up is sent however the field was
+            set: here, from the admin, over the REST API.
+            */
+            await payload.update({
+                collection: collection.slug,
+                id: request.id,
+                draft: true,
+                data: { [collection.scheduledPublishField]: publishAt },
+                overrideLock: false,
+                ...(request.actor.enforceAccessAs
+                    ? { user: request.actor.enforceAccessAs, overrideAccess: false }
+                    : {}),
+            });
+            await audit(true);
+            return {
+                scheduled: true,
+                scheduledFor: publishAt,
+                ...(deferred.warning ? { warnings: [deferred.warning] } : {}),
+            };
+        },
+        async unschedule(request) {
+            const collection = resolveCollection(options, request.collection);
+            const document = await loadDocument(collection.slug, request.id, request.actor);
+            if (Object.keys(document).length === 0) {
+                return { unscheduled: false, reason: 'Document not found' };
+            }
+            const previous = document[collection.scheduledPublishField];
+            if (previous == null) {
+                return { unscheduled: false, reason: 'Nothing is scheduled' };
+            }
+            // No event. The run sleeping on this schedule re-reads the document when
+            // it wakes, finds the field empty, and ends without publishing.
+            await payload.update({
+                collection: collection.slug,
+                id: request.id,
+                draft: true,
+                data: { [collection.scheduledPublishField]: null },
+                overrideLock: false,
+                ...(request.actor.enforceAccessAs
+                    ? { user: request.actor.enforceAccessAs, overrideAccess: false }
+                    : {}),
+            });
+            // `publishing.schedule` with a summary that says which way, rather than a
+            // new action: the action list is a select on the audit collection, and a
+            // new value is a migration for every host.
+            await auditWriter({
+                actor: toAuditActor(request.actor),
+                action: 'publishing.schedule',
+                mcpServer: 'publishing',
+                mcpTool: toolName('unschedule_publish', request.actor),
+                targetCollection: request.collection,
+                targetId: request.id,
+                targetTitle: stringField(document, 'title') ?? request.id,
+                changesSummary: `Cancelled the scheduled publish for ${String(previous)}`,
+                success: true,
+            });
+            return { unscheduled: true };
+        },
+        async getStatus(request) {
+            const collection = resolveCollection(options, request.collection);
+            const document = await loadDocument(collection.slug, request.id, request.actor);
+            const result = await runPreflightPipeline({
+                payload,
+                inngest: options.inngest,
+                options,
+                collection,
+                document,
+                documentId: request.id,
+                actor: toPipelineActor(request.actor),
+            });
+            const updatedAt = stringField(document, 'updatedAt');
+            const publishedAt = stringField(document, collection.publishedAtField);
+            return {
+                status: stringField(document, '_status') ?? 'draft',
+                publishable: result.success,
+                ...(result.failedAt ? { failedAt: result.failedAt } : {}),
+                ...(result.reason ? { reason: result.reason } : {}),
+                ...(result.code ? { code: result.code } : {}),
+                ...(result.issues ? { issues: result.issues } : {}),
+                ...(result.suggestion ? { suggestion: result.suggestion } : {}),
+                publishedAt: publishedAt ?? null,
+                hasUnpublishedChanges: Boolean(updatedAt && publishedAt && Date.parse(updatedAt) > Date.parse(publishedAt)),
+            };
+        },
+    };
+}
+/**
+ * Whether a preflight block is one the scheduled time itself may resolve.
+ *
+ * Two are. An approval not granted *yet* is the ordinary case — schedule the
+ * post, get it approved, it goes out on the day — and refusing to schedule it
+ * would make an editor wait for the approver before they could pick a date. An
+ * embargo that ends before the scheduled time is the other, and one that ends
+ * after it is a refusal, because the publish would be refused then too.
+ *
+ * Both are the last two preflight steps, so every content check before them
+ * has already passed. The one thing lost is that an embargo block stops the
+ * pipeline before approval, so approval is not evaluated at all in that case;
+ * it will be at the scheduled time.
+ */
+function deferUntilScheduledTime(preflight, document, policyField, publishAtMs) {
+    if (preflight.code === 'approval-required') {
+        return {
+            ok: true,
+            warning: 'This document needs an approval that has not been granted yet. If it is not granted by the scheduled time, the publish will be refused.',
+        };
+    }
+    if (preflight.code === 'embargoed') {
+        const policy = document[policyField];
+        const until = typeof policy?.['embargoedUntil'] === 'string' ? Date.parse(policy['embargoedUntil']) : NaN;
+        if (!Number.isNaN(until) && until <= publishAtMs) {
+            return {
+                ok: true,
+                warning: 'The embargo ends before the scheduled time. Approval, if this document needs it, is checked when the schedule fires.',
+            };
+        }
+        return {
+            ok: false,
+            block: {
+                ...preflight,
+                reason: `${preflight.reason ?? 'Embargoed'}, which is after the scheduled time`,
+                suggestion: 'Schedule it for after the embargo ends, or change the embargo.',
+            },
+        };
+    }
+    return { ok: false, block: preflight };
+}
+function toPipelineActor(actor) {
+    return {
+        user: actor.user ?? null,
+        apiKeyName: actor.apiKeyName ?? '',
+        ...(actor.enforceAccessAs ? { enforceAccessAs: actor.enforceAccessAs } : {}),
+    };
+}
+/**
+ * Attribution: a call carrying a real user is a user action, whoever
+ * transported it. An admin publish records the editor, not a service key.
+ */
+function toAuditActor(actor) {
+    return {
+        type: actor.user ? 'user' : 'system',
+        userId: actor.user?.id,
+        userName: actor.user?.name,
+        apiKeyName: actor.apiKeyName,
+    };
+}
+function toolName(tool, actor) {
+    return actor.channel === 'admin' ? `admin:${tool}` : tool;
+}
+function stringField(doc, name) {
+    const value = doc[name];
+    return typeof value === 'string' ? value : undefined;
+}
+/** Attaches the service to the Payload instance so host code can find it. */
+export function attachPublishingService(payload, service) {
+    Object.defineProperty(payload, SERVICE_SYMBOL, {
+        value: service,
+        enumerable: false,
+        writable: false,
+        configurable: true,
+    });
+}
+/**
+ * Returns the publishing service attached to this Payload instance.
+ *
+ * Use this (or the `publishDocument` / `unpublishDocument` /
+ * `getPublishStatus` helpers below) from host code — a custom endpoint, a
+ * job, a Server Action — to publish through the full policy pipeline as a
+ * given user. No API key, and the audit event records that user.
+ */
+export function getPublishingService(payload) {
+    const service = payload[SERVICE_SYMBOL];
+    if (!service) {
+        throw new Error('Publishing service not found on this Payload instance. Add publishingPlugin() to your Payload config — the service is attached during onInit.');
+    }
+    return service;
+}
+/**
+ * Publishes a document through the full pipeline as `user`. Rejects if that
+ * user lacks update access on the collection.
+ */
+export function publishDocument(args) {
+    return getPublishingService(args.payload).publish(toRequest(args));
+}
+/** Reverts a published document to draft as `user`. */
+export function unpublishDocument(args) {
+    return getPublishingService(args.payload).unpublish(toRequest(args));
+}
+/** Schedules a document to publish at `publishAt`, as `user`. */
+export function scheduleDocument(args) {
+    return getPublishingService(args.payload).schedule({ ...toRequest(args), publishAt: args.publishAt });
+}
+/** Cancels a document's scheduled publish, as `user`. */
+export function unscheduleDocument(args) {
+    return getPublishingService(args.payload).unschedule(toRequest(args));
+}
+/**
+ * Runs every check except the write and reports whether the document would
+ * publish. Mutates nothing.
+ */
+export function getPublishStatus(args) {
+    return getPublishingService(args.payload).getStatus(toRequest(args));
+}
+function toRequest(args) {
+    return {
+        collection: args.collection,
+        id: args.id,
+        actor: {
+            user: toAuthenticatedUser(args.user),
+            enforceAccessAs: args.user,
+            channel: 'admin',
+        },
+        ...(args.meta ? { meta: args.meta } : {}),
+    };
+}
+/** Narrows a Payload user document to the audit-log actor shape. */
+export function toAuthenticatedUser(user) {
+    if (!user)
+        return null;
+    const raw = user;
+    return {
+        id: String(raw['id']),
+        email: String(raw['email'] ?? ''),
+        name: String(raw['name'] ?? raw['email'] ?? raw['id']),
+        roles: Array.isArray(raw['roles']) ? raw['roles'] : [],
+        groups: Array.isArray(raw['groups']) ? raw['groups'] : [],
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/publishing/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/publishing/service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,EAAgC,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAC9E,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAG9E,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAA;AA6G7E;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAiC;IAEjC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAEtD;;;;;;;;;;;;;MAaE;IACF,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,EAAU,EACV,KAAsB;QAEtB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACtC,UAAU,EAAE,IAAI;YAChB,EAAE;YACF,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,IAAI;YACnB,GAAG,CAAC,KAAK,CAAC,eAAe;gBACvB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAA;QACF,OAAO,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAA;IACpD,CAAC;IAED;;;;;;;;;MASE;IACF,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,EAAU,EACV,MAA+B,EAC/B,KAAsB;QAEtB,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,WAAW;YAAE,OAAO,WAAW,CAAA;QACzD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YAClC,UAAU,EAAE,IAAI;YAChB,EAAE;YACF,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,IAAI;YACnB,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzF,CAAC,CAAA;QACF,OAAQ,IAAuC,EAAE,CAAC,SAAS,CAAC,CAAA;IAC9D,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAE/E,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAA;YAEF,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClC,MAAM,EAAE,oBAAoB;gBAC5B,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC;gBAC3C,gBAAgB,EAAE,OAAO,CAAC,UAAU;gBACpC,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE;gBACzD,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU;gBAChC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS;gBAClC,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc;gBAC5C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;aACzD,CAAC,CAAA;YAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,EAAE,IAAI,CAAC,iCAAiC,EAAE;oBAC9C,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAE7E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO;oBACL,SAAS,EAAE,IAAI;oBACf,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClE,GAAG,QAAQ;iBACZ,CAAA;YACH,CAAC;YAED,OAAO;gBACL,SAAS,EAAE,KAAK;gBAChB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,GAAG,QAAQ;aACZ,CAAA;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAE/E,yEAAyE;YACzE,qEAAqE;YACrE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;YAC7D,CAAC;YAED,IAAI,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;gBAC7F,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAA;YAC9E,CAAC;YAED,2EAA2E;YAC3E,qEAAqE;YACrE,wEAAwE;YACxE,sEAAsE;YACtE,uEAAuE;YACvE,mEAAmE;YACnE,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,IAAI,EAAE;oBACJ,OAAO,EAAE,OAAO;oBAChB,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,IAAI,IAAI;wBACpD,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe;oBAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;gBACP,YAAY,EAAE,KAAK;gBACnB,OAAO,EAAE,EAAE,sBAAsB,EAAE,IAAI,EAAE;aAC1C,CAAC,CAAA;YAEF,sEAAsE;YACtE,4BAA4B;YAC5B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE;gBACrD,IAAI,EAAE,0BAA0B;gBAChC,IAAI,EAAE;oBACJ,UAAU,EAAE,UAAU,CAAC,IAAI;oBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE;oBAClD,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,QAAQ;iBAClD;aACF,CAAC,CAAA;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,mCAAmC,EAAE;oBAChD,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,QAAQ,EAAE,CAAC,OAAO,CAAC;iBACpB,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClC,MAAM,EAAE,sBAAsB;gBAC9B,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC;gBAC7C,gBAAgB,EAAE,OAAO,CAAC,UAAU;gBACpC,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE;gBACzD,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU;gBAChC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS;gBAClC,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc;gBAC5C,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YAEF,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC3E,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACjD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC9B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAA;YACzE,CAAC;YACD,IAAI,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC9B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAA;YACjF,CAAC;YACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAA;YAErD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;YAC3D,CAAC;YAED,oEAAoE;YACpE,yEAAyE;YACzE,sEAAsE;YACtE,wEAAwE;YACxE,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC;gBAC3C,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO;gBAChC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE;gBACvB,CAAC,CAAC,uBAAuB,CACrB,SAA6B,EAC7B,QAAQ,EACR,UAAU,CAAC,WAAW,EACtB,WAAW,CACZ,CAAA;YAEL,MAAM,KAAK,GAAG,CAAC,OAAgB,EAAE,YAAqB,EAAE,EAAE,CACxD,WAAW,CAAC;gBACV,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC;gBACpD,gBAAgB,EAAE,OAAO,CAAC,UAAU;gBACpC,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE;gBACzD,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,UAAU;gBAChC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS;gBAClC,cAAc,EAAE,yBAAyB,SAAS,EAAE;gBACpD,OAAO;gBACP,YAAY;aACb,CAAC,CAAA;YAEJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAA;gBAC5B,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;gBAChC,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAA;YACH,CAAC;YAED;;;;;;;;;;;cAWE;YACF,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,SAAS,EAAE;gBACvD,YAAY,EAAE,KAAK;gBACnB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe;oBAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAA;YAEF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAA;YAEjB,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,SAAS;gBACvB,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAA;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,OAAO;YACtB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAC/E,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;YAC7D,CAAC;YACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAA;YAC3D,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAA;YAC/D,CAAC;YAED,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,OAAO,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE;gBAClD,YAAY,EAAE,KAAK;gBACnB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe;oBAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,cAAc,EAAE,KAAK,EAAE;oBAChE,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAA;YAEF,0EAA0E;YAC1E,yEAAyE;YACzE,2CAA2C;YAC3C,MAAM,WAAW,CAAC;gBAChB,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;gBAClC,MAAM,EAAE,qBAAqB;gBAC7B,SAAS,EAAE,YAAY;gBACvB,OAAO,EAAE,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC,KAAK,CAAC;gBACtD,gBAAgB,EAAE,OAAO,CAAC,UAAU;gBACpC,QAAQ,EAAE,OAAO,CAAC,EAAE;gBACpB,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,EAAE;gBACzD,cAAc,EAAE,uCAAuC,MAAM,CAAC,QAAQ,CAAC,EAAE;gBACzE,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;YAEF,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC9B,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;YACjE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAA;YAE/E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;gBACxC,OAAO;gBACP,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,OAAO;gBACP,UAAU;gBACV,QAAQ;gBACR,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC;aACtC,CAAC,CAAA;YAEF,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;YACpD,MAAM,WAAW,GAAG,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,gBAAgB,CAAC,CAAA;YAEtE,OAAO;gBACL,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,OAAO;gBACnD,WAAW,EAAE,MAAM,CAAC,OAAO;gBAC3B,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/D,WAAW,EAAE,WAAW,IAAI,IAAI;gBAChC,qBAAqB,EAAE,OAAO,CAC5B,SAAS,IAAI,WAAW,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAC5E;aACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAWD;;;;;;;;;;;;;GAaG;AACH,SAAS,uBAAuB,CAC9B,SAA2B,EAC3B,QAAiC,EACjC,WAAmB,EACnB,WAAmB;IAEnB,IAAI,SAAS,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EACL,yIAAyI;SAC5I,CAAA;IACH,CAAC;IAED,IAAI,SAAS,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAwC,CAAA;QAC3E,MAAM,KAAK,GAAG,OAAO,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACzG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,WAAW,EAAE,CAAC;YACjD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,OAAO,EACL,sHAAsH;aACzH,CAAA;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACL,GAAG,SAAS;gBACZ,MAAM,EAAE,GAAG,SAAS,CAAC,MAAM,IAAI,WAAW,qCAAqC;gBAC/E,UAAU,EAAE,gEAAgE;aAC7E;SACF,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAA;AACxC,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB;IAC7C,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,EAAE;QAClC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7E,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAsB;IAC1C,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QACpC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE;QACtB,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAA;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAsB;IACpD,OAAO,KAAK,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED,SAAS,WAAW,CAAC,GAA4B,EAAE,IAAY;IAC7D,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAA;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,OAA0B;IAE1B,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE;QAC7C,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,KAAK;QACjB,QAAQ,EAAE,KAAK;QACf,YAAY,EAAE,IAAI;KACnB,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,OAAO,GAAI,OAAmC,CAAC,cAAc,CAAC,CAAA;IACpE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,+IAA+I,CAChJ,CAAA;IACH,CAAC;IACD,OAAO,OAA4B,CAAA;AACrC,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAwB;IACtD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,gBAAgB,CAC9B,IAAgD;IAEhD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;AACvG,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAAC,IAAwB;IACzD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAwB;IAExB,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;AACtE,CAAC;AAED,SAAS,SAAS,CAAC,IAAwB;IACzC,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE;YACL,IAAI,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YACpC,eAAe,EAAE,IAAI,CAAC,IAAI;YAC1B,OAAO,EAAE,OAAO;SACjB;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,GAAG,GAAG,IAA0C,CAAA;IACtD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QACtD,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,OAAO,CAAc,CAAC,CAAC,CAAC,EAAE;QACpE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,QAAQ,CAAc,CAAC,CAAC,CAAC,EAAE;KACxE,CAAA;AACH,CAAC"}

package/dist/publishing/tools/actor.d.ts

@@ -0,0 +1,32 @@
+import type { AuthenticatedUser, McpToolContext } from '../../plugin-contract/mcp.js';
+import type { PublishingActor } from '../service.js';
+/** A tool result that refused before doing anything. */
+export interface ActorRefusal {
+    error: string;
+}
+/**
+ * A publishing actor that is known to carry an identity.
+ *
+ * Both fields are non-optional, which is the invariant the guard establishes
+ * and is worth having in the type rather than only in a comment: `user` is
+ * what the audit row attributes the action to, and `enforceAccessAs` is what
+ * makes the write consult collection access. A `PublishingActor` with either
+ * absent is exactly the actor the five tools used to build, so narrowing here
+ * means the old shape no longer typechecks at these call sites.
+ */
+export interface EnforcedPublishingActor extends PublishingActor {
+    user: AuthenticatedUser;
+    enforceAccessAs: NonNullable<PublishingActor['enforceAccessAs']>;
+    /** Definite, because `McpToolContext` types it as a required string. */
+    apiKeyName: string;
+}
+/**
+ * The actor to run a publishing call as, or a refusal to return unchanged.
+ *
+ * Callers narrow on `'error' in resolved`. Returning the envelope rather than
+ * throwing matches every other gated tool in the suite — `query-audit.ts`'s
+ * `deniedEnvelope`, `trigger-sync.ts`, `respond-to-approval.ts` — so a refused
+ * MCP call reads as a refusal to the model rather than as a server fault.
+ */
+export declare function resolvePublishingActor(ctx: Pick<McpToolContext, 'user' | 'apiKeyName'>, channel?: 'mcp'): EnforcedPublishingActor | ActorRefusal;
+//# sourceMappingURL=actor.d.ts.map

package/dist/publishing/tools/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../../src/publishing/tools/actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AA8CpD,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,IAAI,EAAE,iBAAiB,CAAA;IACvB,eAAe,EAAE,WAAW,CAAC,eAAe,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAChE,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,YAAY,CAAC,EAChD,OAAO,GAAE,KAAa,GACrB,uBAAuB,GAAG,YAAY,CAgCxC"}

package/dist/publishing/tools/actor.js

@@ -0,0 +1,40 @@
+/**
+ * The actor to run a publishing call as, or a refusal to return unchanged.
+ *
+ * Callers narrow on `'error' in resolved`. Returning the envelope rather than
+ * throwing matches every other gated tool in the suite — `query-audit.ts`'s
+ * `deniedEnvelope`, `trigger-sync.ts`, `respond-to-approval.ts` — so a refused
+ * MCP call reads as a refusal to the model rather than as a server fault.
+ */
+export function resolvePublishingActor(ctx, channel = 'mcp') {
+    if (!ctx.user) {
+        return {
+            error: 'Must be authenticated to use the publishing tools. An API key alone does not carry an ' +
+                'identity to enforce collection access against.',
+        };
+    }
+    return {
+        user: ctx.user,
+        apiKeyName: ctx.apiKeyName,
+        channel,
+        /*
+        The whole point. Without this the service runs at `overrideAccess: true`
+        and the collection's `update` rule — the thing that distinguishes an editor
+        from an approver — is never consulted.
+    
+        One cast, and it is the kind audit 02 F-06 calls the acceptable shape: the
+        two types genuinely disagree and the comment says how. `AuthenticatedUser`
+        is this package's local shape — `{ id, email, name, roles, groups }` — while
+        `TypedUser` is generated from the consuming app's own `users` collection.
+        They describe the same row, but only the app that owns that collection can
+        say so, and this package may not import from `apps/` (see the boundary rule
+        in the repository's CLAUDE.md, enforced by `pnpm check:boundary`).
+    
+        What the value is used for downstream bounds the risk: Payload passes it to
+        `update`/`findByID` as `user`, and the access functions read `id` and
+        `roles` off it. Both are present and both are the same type on either side.
+        */
+        enforceAccessAs: ctx.user,
+    };
+}
+//# sourceMappingURL=actor.js.map

package/dist/publishing/tools/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../../src/publishing/tools/actor.ts"],"names":[],"mappings":"AAqEA;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAgD,EAChD,UAAiB,KAAK;IAEtB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACd,OAAO;YACL,KAAK,EACH,wFAAwF;gBACxF,gDAAgD;SACnD,CAAA;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,OAAO;QACP;;;;;;;;;;;;;;;;UAgBE;QACF,eAAe,EAAE,GAAG,CAAC,IAAkE;KACxF,CAAA;AACH,CAAC"}

package/dist/publishing/tools/descriptors.d.ts

@@ -0,0 +1,26 @@
+import type { McpToolDescriptor } from '../../mcp/collector.js';
+export declare const PUBLISHING_TOOLS: {
+    readonly publish: {
+        readonly name: "publish";
+        readonly description: "Publishes a draft document. Runs the full publish pipeline: composition, accessibility, required-field, embargo, and approval checks. Returns success with the publish timestamp, or a specific failedAt step with reason / suggestion when something blocks the publish.";
+    };
+    readonly unpublish: {
+        readonly name: "unpublish";
+        readonly description: "Unpublishes a published document by reverting it to draft. Use when content needs to be removed from the public site without deleting it. Fires content/page.unpublished so revalidation and integrations can react.";
+    };
+    readonly schedulePublish: {
+        readonly name: "schedule_publish";
+        readonly description: "Schedules a future publish. Validates the document would currently pass the preflight pipeline (composition, accessibility, required fields, embargo, approval), then stores `scheduledPublishAt` on the document. The framework's workflow runner picks up the schedule and executes the full publish pipeline at that time.";
+    };
+    readonly getPublishStatus: {
+        readonly name: "get_publish_status";
+        readonly description: "Returns the current publishability of a document without actually publishing. Reports current status, whether unpublished changes exist, the last publish timestamp, and a preflight result indicating whether `publish` would currently succeed. Read-only; no audit record is written.";
+    };
+    readonly rollback: {
+        readonly name: "rollback";
+        readonly description: "Rolls a document back to a prior version from Payload's version history. The restored content lands as a fresh draft; call `publish` afterwards if you want it live again. Audits the rollback under publishing.rollback.";
+    };
+};
+/** Every tool this server contributes, for the collector. */
+export declare const PUBLISHING_TOOL_DESCRIPTORS: readonly McpToolDescriptor[];
+//# sourceMappingURL=descriptors.d.ts.map

package/dist/publishing/tools/descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.d.ts","sourceRoot":"","sources":["../../../src/publishing/tools/descriptors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAe/D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;CA0ByB,CAAA;AAEtD,6DAA6D;AAC7D,eAAO,MAAM,2BAA2B,EAAE,SAAS,iBAAiB,EACnC,CAAA"}

package/dist/publishing/tools/descriptors.js

@@ -0,0 +1,38 @@
+/*
+This server's tools, by name and description, knowable without a Payload.
+
+`@payloadcms/plugin-mcp` reads exactly these two fields while the host's config
+is being built, to generate one per-key checkbox per tool — and gates every call
+on the checkbox matching the tool's name. The handlers cannot exist that early,
+because each closes over `payload`, the publishing service and the audit writer.
+So the plugin declares from here as the config builds, and binds handlers at
+`onInit`.
+
+The factories below spread these, so a description edited here is the one the
+checkbox and the MCP client both show, and the two cannot drift.
+*/
+export const PUBLISHING_TOOLS = {
+    publish: {
+        name: 'publish',
+        description: 'Publishes a draft document. Runs the full publish pipeline: composition, accessibility, required-field, embargo, and approval checks. Returns success with the publish timestamp, or a specific failedAt step with reason / suggestion when something blocks the publish.',
+    },
+    unpublish: {
+        name: 'unpublish',
+        description: 'Unpublishes a published document by reverting it to draft. Use when content needs to be removed from the public site without deleting it. Fires content/page.unpublished so revalidation and integrations can react.',
+    },
+    schedulePublish: {
+        name: 'schedule_publish',
+        description: "Schedules a future publish. Validates the document would currently pass the preflight pipeline (composition, accessibility, required fields, embargo, approval), then stores `scheduledPublishAt` on the document. The framework's workflow runner picks up the schedule and executes the full publish pipeline at that time.",
+    },
+    getPublishStatus: {
+        name: 'get_publish_status',
+        description: 'Returns the current publishability of a document without actually publishing. Reports current status, whether unpublished changes exist, the last publish timestamp, and a preflight result indicating whether `publish` would currently succeed. Read-only; no audit record is written.',
+    },
+    rollback: {
+        name: 'rollback',
+        description: "Rolls a document back to a prior version from Payload's version history. The restored content lands as a fresh draft; call `publish` afterwards if you want it live again. Audits the rollback under publishing.rollback.",
+    },
+};
+/** Every tool this server contributes, for the collector. */
+export const PUBLISHING_TOOL_DESCRIPTORS = Object.values(PUBLISHING_TOOLS);
+//# sourceMappingURL=descriptors.js.map