@forumone/throughline 0.0.0 → 1.0.0-next.1

package/dist/testing/anonymousAccess.js

@@ -0,0 +1,185 @@
+/**
+ * The anonymous request an access rule is handed.
+ *
+ * `req.payload` is a stub that throws on use rather than a mock that answers:
+ * a read rule that looks something up to decide is one this cannot evaluate
+ * without a database, and it should say so here rather than pass on a guess.
+ */
+export function anonymousAccessArgs() {
+    const payload = new Proxy({}, {
+        get(_target, property) {
+            // Not thenable: an `await req.payload` must not hang on a stub.
+            if (property === 'then' || typeof property === 'symbol')
+                return undefined;
+            return () => {
+                throw new Error(`An access rule called payload.${property} for an anonymous request. ` +
+                    'A rule that needs the database cannot be checked as a value; test it against one.');
+            };
+        },
+    });
+    return {
+        req: { user: null, headers: new Headers(), payload },
+    };
+}
+/**
+ * What a read rule answers an anonymous request: `true`, `false`, a `where`
+ * query, or `undefined` when there is no rule at all.
+ */
+export async function anonymousRead(entity) {
+    const read = entity.access?.read;
+    if (typeof read !== 'function')
+        return undefined;
+    return read(anonymousAccessArgs());
+}
+/** Whether an entity keeps drafts, so an anonymous read must be narrowed to published. */
+export function hasDrafts(entity) {
+    const versions = entity.versions;
+    return typeof versions === 'object' && versions !== null && Boolean(versions.drafts);
+}
+/**
+ * Why a render-path entity fails, or `undefined` when it passes.
+ *
+ * `undefined` is a failure here and not in `privateProblem`, deliberately. A
+ * collection with no `read` rule gets Payload's default, which requires a user
+ * — so leaving one off is the same outage as writing an editors-only rule, and
+ * reads in review as though no decision were needed.
+ */
+export async function renderPathProblem(entity) {
+    const answer = await anonymousRead(entity);
+    if (answer === undefined) {
+        return {
+            kind: 'render-path-refused',
+            message: `${entity.slug} has no read rule, so Payload's default applies and an anonymous read is refused.`,
+        };
+    }
+    if (answer === false) {
+        return {
+            kind: 'render-path-refused',
+            message: `${entity.slug} refuses an anonymous read, so the render path sees nothing.`,
+        };
+    }
+    /*
+    A bare `true` on a collection with drafts serves an unpublished document to
+    anybody who guesses its slug. A query is what narrows it — usually
+    `{ _status: { equals: 'published' } }` — and which query is the site's call.
+    */
+    if (answer === true && hasDrafts(entity)) {
+        return {
+            kind: 'drafts-unfiltered',
+            message: `${entity.slug} keeps drafts and answers an anonymous read with \`true\`, so drafts reach the internet. Answer with a query that narrows to published documents.`,
+        };
+    }
+    return undefined;
+}
+/**
+ * Why a private entity fails, or `undefined` when it passes.
+ *
+ * `undefined` passes: Payload's default refuses an anonymous read, so a plugin
+ * collection with no rule of its own is already closed. What must not happen is
+ * `true`, or a query — a query is a successful read of some subset.
+ */
+export async function privateProblem(entity) {
+    const answer = await anonymousRead(entity);
+    if (answer === true) {
+        return { kind: 'private-readable', message: `${entity.slug} is readable by anyone.` };
+    }
+    if (answer !== null && typeof answer === 'object') {
+        return {
+            kind: 'private-readable',
+            message: `${entity.slug} answers an anonymous read with a query, so it succeeds for whatever matches.`,
+        };
+    }
+    return undefined;
+}
+/** Slugs of a bucket, whichever shape it was written in. */
+export function bucketSlugs(bucket) {
+    if (!bucket)
+        return [];
+    return Array.isArray(bucket) ? [...bucket] : Object.keys(bucket);
+}
+/**
+ * Every entity in exactly one bucket, and every bucket entry in the config.
+ */
+export function classificationFindings(entity, inConfig, renderPath, closed) {
+    const findings = [];
+    const slugs = new Set(inConfig.map((item) => item.slug));
+    const classified = [...renderPath, ...closed];
+    const seen = new Set();
+    for (const slug of classified) {
+        if (seen.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'classified-twice',
+                message: `${slug} is listed more than once. Each ${entity} belongs in exactly one bucket.`,
+            });
+        }
+        seen.add(slug);
+    }
+    for (const slug of slugs) {
+        if (!seen.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'unclassified',
+                message: `${slug} is in the config and in no bucket. Decide whether a published page reads it ` +
+                    `with nobody signed in (renderPath, with where) or the internet must not (private).`,
+            });
+        }
+    }
+    for (const slug of seen) {
+        if (!slugs.has(slug)) {
+            findings.push({
+                entity,
+                slug,
+                kind: 'not-in-config',
+                message: `${slug} is in a bucket and not in the config. Remove it, or fix the slug.`,
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Every finding for a config and its buckets, empty when it is sound.
+ *
+ * The pure form of `describeAnonymousAccess`, for a script or a test that
+ * wants the list rather than one test per collection.
+ */
+export async function checkAnonymousAccess(config, buckets) {
+    const resolved = await config;
+    const findings = [];
+    const sides = [
+        {
+            entity: 'collection',
+            items: resolved.collections ?? [],
+            renderPath: bucketSlugs(buckets.renderPath),
+            closed: bucketSlugs(buckets.private),
+        },
+    ];
+    if (buckets.globals) {
+        sides.push({
+            entity: 'global',
+            items: resolved.globals ?? [],
+            renderPath: bucketSlugs(buckets.globals.renderPath),
+            closed: bucketSlugs(buckets.globals.private),
+        });
+    }
+    for (const side of sides) {
+        findings.push(...classificationFindings(side.entity, side.items, side.renderPath, side.closed));
+        const bySlug = new Map(side.items.map((item) => [item.slug, item]));
+        for (const slug of side.renderPath) {
+            const item = bySlug.get(slug);
+            const problem = item && (await renderPathProblem(item));
+            if (problem)
+                findings.push({ entity: side.entity, slug, ...problem });
+        }
+        for (const slug of side.closed) {
+            const item = bySlug.get(slug);
+            const problem = item && (await privateProblem(item));
+            if (problem)
+                findings.push({ entity: side.entity, slug, ...problem });
+        }
+    }
+    return findings;
+}
+//# sourceMappingURL=anonymousAccess.js.map

package/dist/testing/anonymousAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymousAccess.js","sourceRoot":"","sources":["../../src/testing/anonymousAccess.ts"],"names":[],"mappings":"AAsFA;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,IAAI,KAAK,CACvB,EAAE,EACF;QACE,GAAG,CAAC,OAAO,EAAE,QAAQ;YACnB,gEAAgE;YAChE,IAAI,QAAQ,KAAK,MAAM,IAAI,OAAO,QAAQ,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YACzE,OAAO,GAAG,EAAE;gBACV,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,6BAA6B;oBACpE,mFAAmF,CACtF,CAAA;YACH,CAAC,CAAA;QACH,CAAC;KACF,CACF,CAAA;IACD,OAAO;QACL,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,EAAE,OAAO,EAAE;KACjB,CAAA;AACvC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAA2B;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAA;IAChC,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAChD,OAAQ,IAAe,CAAC,mBAAmB,EAAE,CAAC,CAAA;AAChD,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,SAAS,CAAC,MAA2B;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAsD,CAAA;IAC9E,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,mFAAmF;SAC3G,CAAA;IACH,CAAC;IACD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,8DAA8D;SACtF,CAAA;IACH,CAAC;IACD;;;;MAIE;IACF,IAAI,MAAM,KAAK,IAAI,IAAI,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,mJAAmJ;SAC3K,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAA2B;IAE3B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,yBAAyB,EAAE,CAAA;IACvF,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,+EAA+E;SACvG,CAAA;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CACzB,MAAwE;IAExE,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAA;IACtB,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAI,MAA4B,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AACzF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA+B,EAC/B,QAAwC,EACxC,UAA6B,EAC7B,MAAyB;IAEzB,MAAM,QAAQ,GAAoB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;IACxD,MAAM,UAAU,GAAG,CAAC,GAAG,UAAU,EAAE,GAAG,MAAM,CAAC,CAAA;IAE7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,GAAG,IAAI,mCAAmC,MAAM,iCAAiC;aAC3F,CAAC,CAAA;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAChB,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,cAAc;gBACpB,OAAO,EACL,GAAG,IAAI,+EAA+E;oBACtF,oFAAoF;aACvF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM;gBACN,IAAI;gBACJ,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,GAAG,IAAI,oEAAoE;aACrF,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAmB,EACnB,OAA+B;IAE/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAA;IAC7B,MAAM,QAAQ,GAAoB,EAAE,CAAA;IAEpC,MAAM,KAAK,GAKN;QACH;YACE,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,QAAQ,CAAC,WAAW,IAAI,EAAE;YACjC,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC;YAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;SACrC;KACF,CAAA;IACD,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC;YACT,MAAM,EAAE,QAAQ;YAChB,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;YAC7B,UAAU,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC;YACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;SAC7C,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAA;QAC/F,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAEnE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAA;YACvD,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACvE,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAA;YACpD,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAA;QACvE,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/testing/describeAnonymousAccess.d.ts

@@ -0,0 +1,26 @@
+import { type AnonymousAccessBuckets, type ConfigInput } from './anonymousAccess.js';
+export interface DescribeAnonymousAccessOptions {
+    /** The suite's name. Defaults to "anonymous access". */
+    title?: string;
+}
+/**
+ * Registers a vitest suite asserting what an anonymous request may read.
+ *
+ * Call it at the top level of a test file with the site's `payload.config.ts`
+ * and its bucket map:
+ *
+ * ```ts
+ * import config from '../payload.config'
+ * describeAnonymousAccess(config, {
+ *   renderPath: { pages: 'the [...slug] route', media: 'every populated upload' },
+ *   private: ['users', 'audit-events', 'payload-preferences'],
+ * })
+ * ```
+ *
+ * One test classifies every collection (and every global, when `globals` is
+ * given) into exactly one bucket; then one test per entry checks the rule
+ * itself, so a failure names the collection. No database: the config is
+ * imported, never connected.
+ */
+export declare function describeAnonymousAccess(config: ConfigInput, buckets: AnonymousAccessBuckets, options?: DescribeAnonymousAccessOptions): void;
+//# sourceMappingURL=describeAnonymousAccess.d.ts.map

package/dist/testing/describeAnonymousAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeAnonymousAccess.d.ts","sourceRoot":"","sources":["../../src/testing/describeAnonymousAccess.ts"],"names":[],"mappings":"AACA,OAAO,EAOL,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAA;AAE7B,MAAM,WAAW,8BAA8B;IAC7C,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,OAAO,EAAE,sBAAsB,EAC/B,OAAO,GAAE,8BAAmC,GAC3C,IAAI,CAqEN"}

package/dist/testing/describeAnonymousAccess.js

@@ -0,0 +1,76 @@
+import { beforeAll, describe, expect, it } from 'vitest';
+import { bucketSlugs, classificationFindings, privateProblem, renderPathProblem, } from './anonymousAccess.js';
+/**
+ * Registers a vitest suite asserting what an anonymous request may read.
+ *
+ * Call it at the top level of a test file with the site's `payload.config.ts`
+ * and its bucket map:
+ *
+ * ```ts
+ * import config from '../payload.config'
+ * describeAnonymousAccess(config, {
+ *   renderPath: { pages: 'the [...slug] route', media: 'every populated upload' },
+ *   private: ['users', 'audit-events', 'payload-preferences'],
+ * })
+ * ```
+ *
+ * One test classifies every collection (and every global, when `globals` is
+ * given) into exactly one bucket; then one test per entry checks the rule
+ * itself, so a failure names the collection. No database: the config is
+ * imported, never connected.
+ */
+export function describeAnonymousAccess(config, buckets, options = {}) {
+    describe(options.title ?? 'anonymous access', () => {
+        let resolved;
+        beforeAll(async () => {
+            // `buildConfig` is async, and awaiting it is the only way to see the
+            // collections the plugins add on top of the site's own.
+            resolved = await config;
+        });
+        const find = (entity, slug) => {
+            const items = (entity === 'collection' ? resolved.collections : resolved.globals) ?? [];
+            const item = items.find((candidate) => candidate.slug === slug);
+            // Reported by the classification test as `not-in-config`; failing here
+            // too keeps this entry's own result honest.
+            expect(item, `${slug} is not in the config`).toBeDefined();
+            return item;
+        };
+        const sides = [{ entity: 'collection', renderPath: buckets.renderPath, closed: buckets.private }];
+        if (buckets.globals) {
+            sides.push({
+                entity: 'global',
+                renderPath: buckets.globals.renderPath ?? {},
+                closed: buckets.globals.private,
+            });
+        }
+        for (const side of sides) {
+            const plural = `${side.entity}s`;
+            it(`puts every ${side.entity} in exactly one bucket`, () => {
+                const items = (side.entity === 'collection' ? resolved.collections : resolved.globals) ?? [];
+                // A config with nothing in it makes every assertion below vacuous.
+                expect(items.length, `the config has no ${plural}`).toBeGreaterThan(0);
+                const findings = classificationFindings(side.entity, items, Object.keys(side.renderPath), bucketSlugs(side.closed));
+                expect(findings.map((finding) => finding.message)).toEqual([]);
+            });
+            const renderEntries = Object.entries(side.renderPath);
+            if (renderEntries.length > 0) {
+                describe(`${plural} the render path reads`, () => {
+                    it.each(renderEntries)('%s — read by %s', async (slug) => {
+                        const problem = await renderPathProblem(find(side.entity, slug));
+                        expect(problem?.message).toBeUndefined();
+                    });
+                });
+            }
+            const closedSlugs = bucketSlugs(side.closed);
+            if (closedSlugs.length > 0) {
+                describe(`${plural} the internet must not read`, () => {
+                    it.each(closedSlugs)('%s refuses an anonymous read', async (slug) => {
+                        const problem = await privateProblem(find(side.entity, slug));
+                        expect(problem?.message).toBeUndefined();
+                    });
+                });
+            }
+        }
+    });
+}
+//# sourceMappingURL=describeAnonymousAccess.js.map

package/dist/testing/describeAnonymousAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"describeAnonymousAccess.js","sourceRoot":"","sources":["../../src/testing/describeAnonymousAccess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,EACL,WAAW,EACX,sBAAsB,EACtB,cAAc,EACd,iBAAiB,GAKlB,MAAM,sBAAsB,CAAA;AAO7B;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmB,EACnB,OAA+B,EAC/B,UAA0C,EAAE;IAE5C,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,kBAAkB,EAAE,GAAG,EAAE;QACjD,IAAI,QAA6B,CAAA;QAEjC,SAAS,CAAC,KAAK,IAAI,EAAE;YACnB,qEAAqE;YACrE,wDAAwD;YACxD,QAAQ,GAAG,MAAM,MAAM,CAAA;QACzB,CAAC,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,CAAC,MAA+B,EAAE,IAAY,EAAuB,EAAE;YAClF,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;YACvF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;YAC/D,uEAAuE;YACvE,4CAA4C;YAC5C,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1D,OAAO,IAA2B,CAAA;QACpC,CAAC,CAAA;QAED,MAAM,KAAK,GAIN,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;QACxF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC;gBACT,MAAM,EAAE,QAAQ;gBAChB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE;gBAC5C,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAA;YAEhC,EAAE,CAAC,cAAc,IAAI,CAAC,MAAM,wBAAwB,EAAE,GAAG,EAAE;gBACzD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;gBAC5F,mEAAmE;gBACnE,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;gBACtE,MAAM,QAAQ,GAAG,sBAAsB,CACrC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAC5B,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CACzB,CAAA;gBACD,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;YAChE,CAAC,CAAC,CAAA;YAEF,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YACrD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,QAAQ,CAAC,GAAG,MAAM,wBAAwB,EAAE,GAAG,EAAE;oBAC/C,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,iBAAiB,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBACvD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;wBAChE,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;oBAC1C,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAC5C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,GAAG,MAAM,6BAA6B,EAAE,GAAG,EAAE;oBACpD,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,8BAA8B,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;wBAClE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;wBAC7D,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,aAAa,EAAE,CAAA;oBAC1C,CAAC,CAAC,CAAA;gBACJ,CAAC,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/dist/testing/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Test helpers for a Throughline site, as `@forumone/throughline/testing`.
+ *
+ * Kept off the package root — which re-exports every other subpath — because
+ * these import `vitest`, an optional peer that a running site never loads.
+ */
+export { anonymousAccessArgs, anonymousRead, checkAnonymousAccess, hasDrafts, } from './anonymousAccess.js';
+export type { AccessCheckedConfig, AccessCheckedEntity, AccessFinding, AccessFindingKind, AnonymousAccessBuckets, ConfigInput, } from './anonymousAccess.js';
+export { describeAnonymousAccess } from './describeAnonymousAccess.js';
+export type { DescribeAnonymousAccessOptions } from './describeAnonymousAccess.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/testing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAA;AAC7B,YAAY,EACV,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,GACZ,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA;AACtE,YAAY,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/testing/index.js

@@ -0,0 +1,9 @@
+/**
+ * Test helpers for a Throughline site, as `@forumone/throughline/testing`.
+ *
+ * Kept off the package root — which re-exports every other subpath — because
+ * these import `vitest`, an optional peer that a running site never loads.
+ */
+export { anonymousAccessArgs, anonymousRead, checkAnonymousAccess, hasDrafts, } from './anonymousAccess.js';
+export { describeAnonymousAccess } from './describeAnonymousAccess.js';
+//# sourceMappingURL=index.js.map

package/dist/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/testing/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,oBAAoB,EACpB,SAAS,GACV,MAAM,sBAAsB,CAAA;AAS7B,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAA"}

package/dist/utils/content-hash.d.ts

@@ -0,0 +1,31 @@
+export interface DocumentContentHashOptions {
+    /**
+     * Extra field names to treat as volatile, stripped at every level.
+     * For app-specific bookkeeping written on save — a sync timestamp, a
+     * cached count — that no approver is looking at.
+     */
+    exclude?: string[];
+}
+/**
+ * Hashes the *content* of a document, ignoring the metadata that moves on
+ * every save.
+ *
+ * This is the binding an approval is tied to. Two documents hash the same
+ * when an approver would read the same thing, which means:
+ *
+ * - a save that changed nothing leaves a granted approval standing, and
+ * - a save that changed something invalidates it.
+ *
+ * That is the rule stated deliberately, rather than inherited from
+ * whichever timestamp field happened to be nearby.
+ *
+ * **Both sides must hash a document fetched the same way.** The approvals
+ * request tool and publishing's approval step both use
+ * `payload.findByID({ collection, id, draft: true })` at the config's
+ * default depth, so they see the same shape. A caller that hashes a
+ * document fetched at some other depth gets a hash that matches nothing:
+ * a populated relationship and a bare relationship id are not the same
+ * value, and no amount of normalising makes them one.
+ */
+export declare function documentContentHash(document: Record<string, unknown>, options?: DocumentContentHashOptions): Promise<string>;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/utils/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/utils/content-hash.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/utils/content-hash.js

@@ -0,0 +1,94 @@
+import { sha256Hex } from './sha256.js';
+/**
+ * Fields that move without the content moving. Stripped at every level of
+ * the document before hashing.
+ *
+ * `updatedAt` is the reason this module exists: an approval bound to it is
+ * invalidated by any save at all, including one that changed nothing, and
+ * including every tick of autosave. `createdAt`, `_status`, `__v`,
+ * `globalType` and `_id` are storage and publishing machinery rather than
+ * anything an approver read.
+ *
+ * The document's own `id` is stripped separately, at the top level only —
+ * see `normalize`.
+ */
+const VOLATILE_FIELDS = new Set(['createdAt', 'updatedAt', '_status', '__v', '_id', 'globalType']);
+/**
+ * Hashes the *content* of a document, ignoring the metadata that moves on
+ * every save.
+ *
+ * This is the binding an approval is tied to. Two documents hash the same
+ * when an approver would read the same thing, which means:
+ *
+ * - a save that changed nothing leaves a granted approval standing, and
+ * - a save that changed something invalidates it.
+ *
+ * That is the rule stated deliberately, rather than inherited from
+ * whichever timestamp field happened to be nearby.
+ *
+ * **Both sides must hash a document fetched the same way.** The approvals
+ * request tool and publishing's approval step both use
+ * `payload.findByID({ collection, id, draft: true })` at the config's
+ * default depth, so they see the same shape. A caller that hashes a
+ * document fetched at some other depth gets a hash that matches nothing:
+ * a populated relationship and a bare relationship id are not the same
+ * value, and no amount of normalising makes them one.
+ */
+export async function documentContentHash(document, options = {}) {
+    const volatile = new Set(VOLATILE_FIELDS);
+    for (const field of options.exclude ?? [])
+        volatile.add(field);
+    return sha256Hex(stableStringify(normalize(document, volatile, true)));
+}
+/**
+ * Strips volatile fields and normalises values whose representation can
+ * vary without their meaning varying.
+ *
+ * `id` is dropped only at the top level, where it is the document's own id
+ * and constant for the life of the document. Nested `id`s are kept, because
+ * that is where a populated relationship carries which document it points
+ * at — dropping those would make a page that swapped one image for another
+ * with the same alt text hash identically to the one an approver read.
+ */
+function normalize(value, volatile, topLevel = false) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Array.isArray(value))
+        return value.map((entry) => normalize(entry, volatile));
+    if (value === null || typeof value !== 'object')
+        return value;
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (volatile.has(key))
+            continue;
+        if (topLevel && key === 'id')
+            continue;
+        // A field the caller never set and one set to `undefined` are the same
+        // document. JSON.stringify already drops these; doing it here keeps the
+        // sorted key list honest.
+        if (entry === undefined)
+            continue;
+        result[key] = normalize(entry, volatile);
+    }
+    return result;
+}
+/**
+ * `JSON.stringify` with object keys in sorted order, so that two documents
+ * differing only in key order hash the same. Payload reads blocks back out
+ * of JSONB, and neither Postgres nor the JSON parser promises to hand them
+ * back in the order they went in.
+ *
+ * Array order is meaningful — it is the order of the blocks on the page —
+ * and is preserved.
+ */
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(',')}]`;
+    }
+    if (value !== null && typeof value === 'object') {
+        const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+//# sourceMappingURL=content-hash.js.map

package/dist/utils/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../src/utils/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAEvC;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;AAWlG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAiC,EACjC,UAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9D,OAAO,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAAc,EAAE,QAAqB,EAAE,QAAQ,GAAG,KAAK;IACxE,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC/B,IAAI,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAQ;QACtC,uEAAuE;QACvE,wEAAwE;QACxE,0BAA0B;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACpD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC/F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACxC,CAAC"}

package/dist/utils/index.d.ts

@@ -0,0 +1,6 @@
+export { documentContentHash } from './content-hash.js';
+export type { DocumentContentHashOptions } from './content-hash.js';
+export { sha256Hex } from './sha256.js';
+export { unwrapRelationshipId } from './relationships.js';
+export { formatZodIssues } from './zod-issues.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/utils/index.js

@@ -0,0 +1,5 @@
+export { documentContentHash } from './content-hash.js';
+export { sha256Hex } from './sha256.js';
+export { unwrapRelationshipId } from './relationships.js';
+export { formatZodIssues } from './zod-issues.js';
+//# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA"}

package/dist/utils/relationships.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The id out of a Payload relationship field, whatever depth it came back at.
+ *
+ * A relationship is an id at depth 0 and a populated document above it, so every
+ * reader has to handle both. Four copies of this existed — three private to
+ * `approvals`, one exported from `email` — differing only in a null guard that
+ * `typeof value === 'string'` already covers.
+ *
+ * **One deliberate difference from all four.** None of them handled a *numeric*
+ * id, so on Postgres at `depth: 0` they returned `null` for a relationship that
+ * was populated perfectly well. No current caller reads at depth 0 — they take
+ * the config default and get objects — so this fixes nothing today and stops a
+ * shared helper being wrong for the first caller that does. The change can only
+ * turn a `null` into a correct id, and no caller branches on that distinction.
+ */
+export declare function unwrapRelationshipId(value: unknown): string | null;
+//# sourceMappingURL=relationships.d.ts.map

package/dist/utils/relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.d.ts","sourceRoot":"","sources":["../../src/utils/relationships.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAOlE"}

package/dist/utils/relationships.js

@@ -0,0 +1,26 @@
+/**
+ * The id out of a Payload relationship field, whatever depth it came back at.
+ *
+ * A relationship is an id at depth 0 and a populated document above it, so every
+ * reader has to handle both. Four copies of this existed — three private to
+ * `approvals`, one exported from `email` — differing only in a null guard that
+ * `typeof value === 'string'` already covers.
+ *
+ * **One deliberate difference from all four.** None of them handled a *numeric*
+ * id, so on Postgres at `depth: 0` they returned `null` for a relationship that
+ * was populated perfectly well. No current caller reads at depth 0 — they take
+ * the config default and get objects — so this fixes nothing today and stops a
+ * shared helper being wrong for the first caller that does. The change can only
+ * turn a `null` into a correct id, and no caller branches on that distinction.
+ */
+export function unwrapRelationshipId(value) {
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number')
+        return String(value);
+    if (value && typeof value === 'object' && 'id' in value) {
+        return String(value.id);
+    }
+    return null;
+}
+//# sourceMappingURL=relationships.js.map

package/dist/utils/relationships.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.js","sourceRoot":"","sources":["../../src/utils/relationships.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACnD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACxD,OAAO,MAAM,CAAE,KAAyB,CAAC,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/utils/sha256.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Hashes a string with SHA-256 using the Web Crypto API; returns lowercase hex.
+ *
+ * Lived in `auth/api-keys.ts` while this package minted and stored its own MCP
+ * keys. Those are gone — `@payloadcms/plugin-mcp` owns key storage now — and
+ * `documentContentHash` is the remaining caller, so the function moved to sit
+ * beside it rather than being deleted with the collection it was written for.
+ */
+export declare function sha256Hex(input: string): Promise<string>;
+//# sourceMappingURL=sha256.d.ts.map

package/dist/utils/sha256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.d.ts","sourceRoot":"","sources":["../../src/utils/sha256.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9D"}

package/dist/utils/sha256.js

@@ -0,0 +1,16 @@
+/**
+ * Hashes a string with SHA-256 using the Web Crypto API; returns lowercase hex.
+ *
+ * Lived in `auth/api-keys.ts` while this package minted and stored its own MCP
+ * keys. Those are gone — `@payloadcms/plugin-mcp` owns key storage now — and
+ * `documentContentHash` is the remaining caller, so the function moved to sit
+ * beside it rather than being deleted with the collection it was written for.
+ */
+export async function sha256Hex(input) {
+    const data = new TextEncoder().encode(input);
+    const buffer = await crypto.subtle.digest('SHA-256', data);
+    return Array.from(new Uint8Array(buffer))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+//# sourceMappingURL=sha256.js.map

package/dist/utils/sha256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sha256.js","sourceRoot":"","sources":["../../src/utils/sha256.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAA;AACb,CAAC"}

package/dist/utils/zod-issues.d.ts

@@ -0,0 +1,19 @@
+import type { z } from 'zod';
+/**
+ * Zod's issues as an indented list, one per line.
+ *
+ * `componentsPlugin`'s options and a publishable collection's config formatted
+ * them identically, because the shape is what makes a config error readable:
+ * the path to the field, then what is wrong with it. Both plugins already
+ * depend on this package, so sharing costs nothing.
+ *
+ * `(root)` for an issue with no path — what a schema-level refinement produces,
+ * and what an empty `join('.')` would otherwise render as nothing at all.
+ *
+ * A third copy lives in `design-contract`'s loader and stays there. That
+ * package depends on `zod` and nothing else, which is what lets the scaffolder
+ * and a standalone design system consume it; trading that for four lines would
+ * pull the whole plugin surface behind it.
+ */
+export declare function formatZodIssues(error: z.ZodError): string;
+//# sourceMappingURL=zod-issues.d.ts.map

package/dist/utils/zod-issues.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-issues.d.ts","sourceRoot":"","sources":["../../src/utils/zod-issues.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAE5B;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,GAAG,MAAM,CAIzD"}

package/dist/utils/zod-issues.js

@@ -0,0 +1,22 @@
+/**
+ * Zod's issues as an indented list, one per line.
+ *
+ * `componentsPlugin`'s options and a publishable collection's config formatted
+ * them identically, because the shape is what makes a config error readable:
+ * the path to the field, then what is wrong with it. Both plugins already
+ * depend on this package, so sharing costs nothing.
+ *
+ * `(root)` for an issue with no path — what a schema-level refinement produces,
+ * and what an empty `join('.')` would otherwise render as nothing at all.
+ *
+ * A third copy lives in `design-contract`'s loader and stays there. That
+ * package depends on `zod` and nothing else, which is what lets the scaffolder
+ * and a standalone design system consume it; trading that for four lines would
+ * pull the whole plugin surface behind it.
+ */
+export function formatZodIssues(error) {
+    return error.issues
+        .map((issue) => `  - ${issue.path.join('.') || '(root)'}: ${issue.message}`)
+        .join('\n');
+}
+//# sourceMappingURL=zod-issues.js.map

package/dist/utils/zod-issues.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"zod-issues.js","sourceRoot":"","sources":["../../src/utils/zod-issues.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,KAAK,CAAC,MAAM;SAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;SAC3E,IAAI,CAAC,IAAI,CAAC,CAAA;AACf,CAAC"}