@forumone/throughline-audit 0.0.1 → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,7 @@
+# @forumone/throughline-audit
+
+## 0.2.0
+
+### Minor Changes
+
+- 68cad81: Initial release of the audit query server. Five read-only MCP tools surface the audit log written by `@forumone/throughline-core`'s `auditPlugin`: `query_audit` (general filter), `get_change_history` (single-document history), `who_changed_what` (user activity, defaults to the caller), `what_changed_in_range` (grouped time-bounded summary), `get_recent_failures` (recent `success=false` events). Output is formatted for conversational use — relative times, named actors, prose summaries. Admin / editor gate by default, with `who_changed_what` always allowing self-lookup.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Forum One Communications Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,45 +1,86 @@
 # @forumone/throughline-audit
 
-## ⚠️ IMPORTANT NOTICE ⚠️
+Read-only MCP query tools over the Throughline audit log. Pairs with the writer in `@forumone/throughline-core`: `auditPlugin` writes records, `auditQueryPlugin` exposes them as conversational query tools.
 
-**This package is created solely for the purpose of setting up OIDC (OpenID Connect) trusted publishing with npm.**
+## What this package provides
 
-This is **NOT** a functional package and contains **NO** code or functionality beyond the OIDC setup configuration.
+Five MCP tools served at `/api/audit/mcp`. All are read-only and emit no audit events of their own.
 
-## Purpose
+| Tool | Use it for | Default access |
+|---|---|---|
+| `query_audit` | General-purpose filter (collection, document, actor, action, server, date range, failures) | admin / editor |
+| `get_change_history` | Chronological history of one document, with diffs | admin / editor |
+| `who_changed_what` | A user's recent activity. Defaults to the authenticated caller, so anyone can ask about their own changes | self always; others require admin / editor |
+| `what_changed_in_range` | Counts grouped by action / actor / collection / server over a date range | admin / editor |
+| `get_recent_failures` | `success=false` events in the last N hours, optionally filtered by server | admin / editor |
 
-This package exists to:
-1. Configure OIDC trusted publishing for the package name `@forumone/throughline-audit`
-2. Enable secure, token-less publishing from CI/CD workflows
-3. Establish provenance for packages published under this name
+Each tool returns conversational output: relative times ("2 hours ago"), named actors (`userName` then `apiKeyName` then `system` then `unknown`), and prose summaries.
 
-## What is OIDC Trusted Publishing?
+## Installation
 
-OIDC trusted publishing allows package maintainers to publish packages directly from their CI/CD workflows without needing to manage npm access tokens. Instead, it uses OpenID Connect to establish trust between the CI/CD provider (like GitHub Actions) and npm.
+```bash
+pnpm add @forumone/throughline-audit
+```
 
-## Setup Instructions
+Peers: `payload@^3.0.0`. Required runtime peer: `@forumone/throughline-core` (the audit log writer).
 
-To properly configure OIDC trusted publishing for this package:
+## Usage
 
-1. Go to [npmjs.com](https://www.npmjs.com/) and navigate to your package settings
-2. Configure the trusted publisher (e.g., GitHub Actions)
-3. Specify the repository and workflow that should be allowed to publish
-4. Use the configured workflow to publish your actual package
+```ts
+import { buildConfig } from 'payload'
+import { auditPlugin, createInngestClient } from '@forumone/throughline-core'
+import { auditQueryPlugin } from '@forumone/throughline-audit'
 
-## DO NOT USE THIS PACKAGE
+const inngest = createInngestClient({ id: 'my-site' })
 
-This package is a placeholder for OIDC configuration only. It:
-- Contains no executable code
-- Provides no functionality
-- Should not be installed as a dependency
-- Exists only for administrative purposes
+export default buildConfig({
+  // collections, db, secret...
+  plugins: [
+    auditPlugin({ inngest }), // writes
+    auditQueryPlugin({}),     // reads
+  ],
+})
+```
 
-## More Information
+The query plugin requires the `audit-log` capability. If `auditPlugin` is not registered first, initialization fails fast with a clear message.
 
-For more details about npm's trusted publishing feature, see:
-- [npm Trusted Publishing Documentation](https://docs.npmjs.com/generating-provenance-statements)
-- [GitHub Actions OIDC Documentation](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
+## Why a separate package?
 
----
+Core writes audit events; this package exposes them. Splitting reads from writes lets clients deploy the writer (which is mandatory) without exposing query tools to MCP clients that don't need them. It also keeps the read-side surface (formatting, access control, paginated tools) out of the core's hot path.
 
-**Maintained for OIDC setup purposes only**
+## Why purpose-built tools instead of a raw query?
+
+Raw collection access via Payload MCP would give Claude too much: pagination semantics for conversational UX are wrong, sensitive fields are easy to leak, and raw JSON is harder to relay than formatted prose. The five tools here are bounded — every result set has a default limit and a documented purpose — and the formatted output is what Claude relays directly.
+
+## Access control
+
+- The default predicate (`isAuditReader`) admits `admin` and `editor` roles.
+- `who_changed_what` defaults `actorId` to the authenticated caller, so any role can ask about their own activity.
+- Looking up another user's activity requires admin / editor.
+- Override the predicate via the `readAccess` option if your role model differs.
+
+```ts
+auditQueryPlugin({
+  readAccess: (req) => {
+    const roles = (req.user?.roles as string[] | undefined) ?? []
+    return roles.includes('observability')
+  },
+})
+```
+
+> Note: `readAccess` currently controls the underlying collection read (via the slug match with `auditPlugin`). The MCP tools layer their own admin/editor gate on top.
+
+## Options
+
+| Option | Type | Default | Notes |
+|---|---|---|---|
+| `routePrefix` | `string` | `/audit` | Payload prepends `/api`, so the MCP endpoint lands at `/api/audit/mcp` |
+| `collectionSlug` | `string` | `audit-events` | Must match the slug used by core's `auditPlugin` |
+| `readAccess` | `(req) => boolean` | admin / editor | Custom predicate for read-side access |
+| `enabled` | `boolean` | `true` | Set to `false` to no-op the plugin |
+| `logger` | `Logger` | `defaultLogger` | Standard Throughline logger |
+
+## Related packages
+
+- `@forumone/throughline-core` — required peer; provides the audit collection, writer, and event taxonomy
+- `@forumone/throughline-publishing`, `@forumone/throughline-approvals` — write audit events that this package surfaces

package/dist/formatting/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Conversational-output helpers for audit records. The query tools return
+ * objects shaped via `formatAuditEvent` so Claude can relay them to users
+ * without reformatting raw collection JSON.
+ */
+export interface FormattedAuditEvent {
+    when: string;
+    whenIso: string;
+    who: string;
+    what: string;
+    why?: string;
+    prompt?: string;
+    changesSummary?: string;
+    diff?: Record<string, {
+        before: unknown;
+        after: unknown;
+    }>;
+    success: boolean;
+    errorMessage?: string;
+    action: string;
+    mcpServer: string;
+    mcpTool: string;
+    targetCollection?: string;
+    targetId?: string;
+    targetTitle?: string;
+}
+/**
+ * Formats an ISO timestamp as a relative time string. Crude but
+ * conversational: "just now", "5 minutes ago", "3 hours ago", "2 days ago",
+ * or an `YYYY-MM-DD` for anything older than a week.
+ */
+export declare function formatRelativeTime(iso: string, now?: number): string;
+/**
+ * Maps a raw audit-collection record to the conversational shape the query
+ * tools return. Internal-only fields (`consumedTokens`, `notifiedApprovers`)
+ * are dropped; ISO timestamps are kept alongside the relative form so the
+ * caller can sort or render at their preference.
+ */
+export declare function formatAuditEvent(raw: Record<string, unknown>, now?: number): FormattedAuditEvent;
+//# sourceMappingURL=index.d.ts.map

package/dist/formatting/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/formatting/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAC1D,OAAO,EAAE,OAAO,CAAA;IAChB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAID;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,MAAM,CAcxE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,SAAa,GACf,mBAAmB,CAgCrB"}

package/dist/formatting/index.js

@@ -0,0 +1,73 @@
+/**
+ * Conversational-output helpers for audit records. The query tools return
+ * objects shaped via `formatAuditEvent` so Claude can relay them to users
+ * without reformatting raw collection JSON.
+ */
+const DAY_IN_MS = 24 * 60 * 60 * 1000;
+/**
+ * Formats an ISO timestamp as a relative time string. Crude but
+ * conversational: "just now", "5 minutes ago", "3 hours ago", "2 days ago",
+ * or an `YYYY-MM-DD` for anything older than a week.
+ */
+export function formatRelativeTime(iso, now = Date.now()) {
+    const then = new Date(iso).getTime();
+    if (Number.isNaN(then))
+        return iso;
+    const diffMs = Math.max(0, now - then);
+    const seconds = Math.floor(diffMs / 1000);
+    const minutes = Math.floor(seconds / 60);
+    const hours = Math.floor(minutes / 60);
+    const days = Math.floor(hours / 24);
+    if (seconds < 60)
+        return 'just now';
+    if (minutes < 60)
+        return `${minutes} minute${minutes === 1 ? '' : 's'} ago`;
+    if (hours < 24)
+        return `${hours} hour${hours === 1 ? '' : 's'} ago`;
+    if (diffMs < 7 * DAY_IN_MS)
+        return `${days} day${days === 1 ? '' : 's'} ago`;
+    return iso.slice(0, 10);
+}
+/**
+ * Maps a raw audit-collection record to the conversational shape the query
+ * tools return. Internal-only fields (`consumedTokens`, `notifiedApprovers`)
+ * are dropped; ISO timestamps are kept alongside the relative form so the
+ * caller can sort or render at their preference.
+ */
+export function formatAuditEvent(raw, now = Date.now()) {
+    const actor = (raw['actor'] ?? {});
+    const userName = typeof actor['userName'] === 'string' ? actor['userName'] : null;
+    const apiKeyName = typeof actor['apiKeyName'] === 'string' ? actor['apiKeyName'] : null;
+    const actorType = typeof actor['type'] === 'string' ? actor['type'] : 'unknown';
+    const who = userName ?? apiKeyName ?? (actorType === 'system' ? 'system' : 'unknown');
+    const createdAt = typeof raw['createdAt'] === 'string' ? raw['createdAt'] : '';
+    const formatted = {
+        when: createdAt ? formatRelativeTime(createdAt, now) : 'unknown',
+        whenIso: createdAt,
+        who,
+        what: typeof raw['summary'] === 'string' ? raw['summary'] : String(raw['action'] ?? ''),
+        success: raw['success'] !== false,
+        action: typeof raw['action'] === 'string' ? raw['action'] : 'unknown',
+        mcpServer: typeof raw['mcpServer'] === 'string' ? raw['mcpServer'] : 'unknown',
+        mcpTool: typeof raw['mcpTool'] === 'string' ? raw['mcpTool'] : 'unknown',
+    };
+    if (typeof raw['reasoning'] === 'string')
+        formatted.why = raw['reasoning'];
+    if (typeof raw['prompt'] === 'string')
+        formatted.prompt = raw['prompt'];
+    if (typeof raw['changesSummary'] === 'string')
+        formatted.changesSummary = raw['changesSummary'];
+    if (raw['diff'] && typeof raw['diff'] === 'object') {
+        formatted.diff = raw['diff'];
+    }
+    if (typeof raw['errorMessage'] === 'string')
+        formatted.errorMessage = raw['errorMessage'];
+    if (typeof raw['targetCollection'] === 'string')
+        formatted.targetCollection = raw['targetCollection'];
+    if (typeof raw['targetId'] === 'string')
+        formatted.targetId = raw['targetId'];
+    if (typeof raw['targetTitle'] === 'string')
+        formatted.targetTitle = raw['targetTitle'];
+    return formatted;
+}
+//# sourceMappingURL=index.js.map

package/dist/formatting/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/formatting/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAqBH,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAErC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC9D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAA;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAA;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;IAEnC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,UAAU,CAAA;IACnC,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;IAC3E,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,GAAG,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;IACnE,IAAI,MAAM,GAAG,CAAC,GAAG,SAAS;QAAE,OAAO,GAAG,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAA;IAC5E,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACzB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAA4B,EAC5B,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC7D,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACjF,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IAC/E,MAAM,GAAG,GAAG,QAAQ,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAErF,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAE9E,MAAM,SAAS,GAAwB;QACrC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,OAAO,EAAE,SAAS;QAClB,GAAG;QACH,IAAI,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvF,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;QACjC,MAAM,EAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACrE,SAAS,EAAE,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9E,OAAO,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;KACzE,CAAA;IAED,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;IAC1E,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAA;IACvE,IAAI,OAAO,GAAG,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,cAAc,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAA;IAC/F,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,SAAS,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAwD,CAAA;IACrF,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC,CAAA;IACzF,IAAI,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAA;IACrG,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAA;IAC7E,IAAI,OAAO,GAAG,CAAC,aAAa,CAAC,KAAK,QAAQ;QAAE,SAAS,CAAC,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,CAAA;IAEtF,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { auditQueryPlugin } from './plugin.js';
+export type { AuditQueryPluginOptions } from './options.js';
+export { DEFAULT_AUDIT_COLLECTION_SLUG } from './options.js';
+export { formatAuditEvent, formatRelativeTime } from './formatting/index.js';
+export type { FormattedAuditEvent } from './formatting/index.js';
+export { createQueryAuditTool, createGetChangeHistoryTool, createWhoChangedWhatTool, createWhatChangedInRangeTool, createGetRecentFailuresTool, } from './tools/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9C,YAAY,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAC3D,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAA"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { auditQueryPlugin } from './plugin.js';
+export { DEFAULT_AUDIT_COLLECTION_SLUG } from './options.js';
+export { formatAuditEvent, formatRelativeTime } from './formatting/index.js';
+export { createQueryAuditTool, createGetChangeHistoryTool, createWhoChangedWhatTool, createWhatChangedInRangeTool, createGetRecentFailuresTool, } from './tools/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAE9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,cAAc,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAG5E,OAAO,EACL,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,kBAAkB,CAAA"}

package/dist/options.d.ts

@@ -0,0 +1,21 @@
+import type { PayloadRequest } from 'payload';
+import type { BaseCorePluginOptions } from '@forumone/throughline-plugin-contract';
+export interface AuditQueryPluginOptions extends BaseCorePluginOptions {
+    /**
+     * Override the audit collection slug. Must match the slug `auditPlugin`
+     * (in `@forumone/throughline-core`) writes to. Default: `'audit-events'`.
+     */
+    collectionSlug?: string;
+    /**
+     * Custom access-control function for read operations. Returns true to
+     * allow reads. Defaults to admin and editor roles.
+     */
+    readAccess?: (req: PayloadRequest) => boolean;
+}
+export declare const DEFAULT_AUDIT_COLLECTION_SLUG = "audit-events";
+/**
+ * Validates options at load time. Currently a passthrough; reserved for
+ * future option-shape additions so callers always go through the same gate.
+ */
+export declare function validateOptions(options: AuditQueryPluginOptions): AuditQueryPluginOptions;
+//# sourceMappingURL=options.d.ts.map

package/dist/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAElF,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAA;CAC9C;AAED,eAAO,MAAM,6BAA6B,iBAAiB,CAAA;AAE3D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAEzF"}

package/dist/options.js

@@ -0,0 +1,9 @@
+export const DEFAULT_AUDIT_COLLECTION_SLUG = 'audit-events';
+/**
+ * Validates options at load time. Currently a passthrough; reserved for
+ * future option-shape additions so callers always go through the same gate.
+ */
+export function validateOptions(options) {
+    return options;
+}
+//# sourceMappingURL=options.js.map

package/dist/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAA;AAE3D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,11 @@
+import type { CorePlugin } from '@forumone/throughline-plugin-contract';
+import { type AuditQueryPluginOptions } from './options.js';
+/**
+ * Read-only MCP server over the audit log. Pairs with `auditPlugin` from
+ * `@forumone/throughline-core` (which writes records). The query plugin
+ * requires the `audit-log` capability and refuses to initialize without it.
+ *
+ * Exported as `auditQueryPlugin` to disambiguate from core's `auditPlugin`.
+ */
+export declare const auditQueryPlugin: CorePlugin<AuditQueryPluginOptions>;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,uCAAuC,CAAA;AAG1F,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,cAAc,CAAA;AAerB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,uBAAuB,CAwE9D,CAAA"}

package/dist/plugin.js

@@ -0,0 +1,76 @@
+import { getPluginRegistry } from '@forumone/throughline-plugin-contract';
+import { createMcpHandler, createNamedLogger, defaultLogger } from '@forumone/throughline-core';
+import { DEFAULT_AUDIT_COLLECTION_SLUG, validateOptions, } from './options.js';
+import { createGetChangeHistoryTool, createGetRecentFailuresTool, createQueryAuditTool, createWhatChangedInRangeTool, createWhoChangedWhatTool, } from './tools/index.js';
+const PLUGIN_ID = '@forumone/throughline-audit';
+const PLUGIN_VERSION = '0.1.0';
+const MCP_HANDLER_SYMBOL = Symbol.for('@forumone/throughline/audit-mcp-handler');
+/**
+ * Read-only MCP server over the audit log. Pairs with `auditPlugin` from
+ * `@forumone/throughline-core` (which writes records). The query plugin
+ * requires the `audit-log` capability and refuses to initialize without it.
+ *
+ * Exported as `auditQueryPlugin` to disambiguate from core's `auditPlugin`.
+ */
+export const auditQueryPlugin = (rawOptions) => (incomingConfig) => {
+    if (rawOptions.enabled === false)
+        return incomingConfig;
+    const options = validateOptions(rawOptions);
+    const routePrefix = options.routePrefix ?? '/audit';
+    const collectionSlug = options.collectionSlug ?? DEFAULT_AUDIT_COLLECTION_SLUG;
+    const logger = createNamedLogger('audit-query', options.logger ?? defaultLogger);
+    return {
+        ...incomingConfig,
+        endpoints: [
+            ...(incomingConfig.endpoints ?? []),
+            {
+                path: `${routePrefix}/mcp`,
+                method: 'post',
+                handler: async (req) => {
+                    const handler = req.payload[MCP_HANDLER_SYMBOL];
+                    if (!handler) {
+                        return new Response(JSON.stringify({ error: 'Audit query MCP not initialized' }), { status: 503, headers: { 'content-type': 'application/json' } });
+                    }
+                    return handler(req);
+                },
+            },
+        ],
+        onInit: async (payload) => {
+            if (incomingConfig.onInit)
+                await incomingConfig.onInit(payload);
+            const registry = getPluginRegistry(payload);
+            registry.requireCapability('audit-log', PLUGIN_ID);
+            const deps = { payload, collectionSlug };
+            const tools = [
+                createQueryAuditTool(deps),
+                createGetChangeHistoryTool(deps),
+                createWhoChangedWhatTool(deps),
+                createWhatChangedInRangeTool(deps),
+                createGetRecentFailuresTool(deps),
+            ];
+            const handler = createMcpHandler({
+                payload,
+                serverName: 'audit',
+                tools,
+                logger,
+            });
+            Object.defineProperty(payload, MCP_HANDLER_SYMBOL, {
+                value: handler,
+                enumerable: false,
+                writable: false,
+                configurable: false,
+            });
+            registry.register({
+                id: PLUGIN_ID,
+                version: PLUGIN_VERSION,
+                capabilities: ['audit-query'],
+            });
+            logger.info('Audit query server ready', {
+                collectionSlug,
+                routePrefix,
+                toolCount: tools.length,
+            });
+        },
+    };
+};
+//# sourceMappingURL=plugin.js.map

package/dist/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,EAEL,6BAA6B,EAC7B,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,SAAS,GAAG,6BAA6B,CAAA;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAA;AAC9B,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;AAIhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IACjC,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEvD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAA;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAA;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAA;IAEhF,OAAO;QACL,GAAG,cAAc;QACjB,SAAS,EAAE;YACT,GAAG,CAAC,cAAc,CAAC,SAAS,IAAI,EAAE,CAAC;YACnC;gBACE,IAAI,EAAE,GAAG,WAAW,MAAM;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,OAAO,GAAI,GAAG,CAAC,OAA8C,CACjE,kBAAkB,CACO,CAAA;oBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;oBACH,CAAC;oBACD,OAAO,OAAO,CAAC,GAAyB,CAAC,CAAA;gBAC3C,CAAC;aACF;SACF;QACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,cAAc,CAAC,MAAM;gBAAE,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAE/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAElD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG;gBACZ,oBAAoB,CAAC,IAAI,CAAC;gBAC1B,0BAA0B,CAAC,IAAI,CAAC;gBAChC,wBAAwB,CAAC,IAAI,CAAC;gBAC9B,4BAA4B,CAAC,IAAI,CAAC;gBAClC,2BAA2B,CAAC,IAAI,CAAC;aACA,CAAA;YAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAC/B,OAAO;gBACP,UAAU,EAAE,OAAO;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YAEF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE;gBACjD,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,QAAQ,CAAC,QAAQ,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,aAAa,CAAC;aAC9B,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBACtC,cAAc;gBACd,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;aACxB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/dist/tools/access.d.ts

@@ -0,0 +1,11 @@
+import type { McpToolContext } from '@forumone/throughline-plugin-contract';
+/**
+ * Default read-access predicate. Admins and editors can read everything;
+ * anyone else is treated as scoped to their own actions and gets a
+ * "permission-denied" envelope from broad-scope tools.
+ */
+export declare function isAuditReader(ctx: McpToolContext): boolean;
+export declare function deniedEnvelope(reason: string): {
+    error: string;
+};
+//# sourceMappingURL=access.d.ts.map

package/dist/tools/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/tools/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAA;AAE3E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAI1D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEhE"}

package/dist/tools/access.js

@@ -0,0 +1,15 @@
+/**
+ * Default read-access predicate. Admins and editors can read everything;
+ * anyone else is treated as scoped to their own actions and gets a
+ * "permission-denied" envelope from broad-scope tools.
+ */
+export function isAuditReader(ctx) {
+    if (!ctx.user)
+        return false;
+    const roles = ctx.user.roles;
+    return roles.includes('admin') || roles.includes('editor');
+}
+export function deniedEnvelope(reason) {
+    return { error: reason };
+}
+//# sourceMappingURL=access.js.map

package/dist/tools/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/tools/access.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB;IAC/C,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAA;IAC5B,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAC5D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;AAC1B,CAAC"}

package/dist/tools/get-change-history.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+export interface GetChangeHistoryDeps {
+    payload: Payload;
+    collectionSlug: string;
+}
+declare const inputSchema: z.ZodObject<{
+    targetCollection: z.ZodString;
+    targetId: z.ZodString;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    targetCollection: string;
+    targetId: string;
+    limit?: number | undefined;
+}, {
+    targetCollection: string;
+    targetId: string;
+    limit?: number | undefined;
+}>;
+export declare function createGetChangeHistoryTool(deps: GetChangeHistoryDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=get-change-history.d.ts.map

package/dist/tools/get-change-history.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-change-history.d.ts","sourceRoot":"","sources":["../../src/tools/get-change-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAI9E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,QAAA,MAAM,WAAW;;;;;;;;;;;;EAUf,CAAA;AAEF,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CA+BvC"}

package/dist/tools/get-change-history.js

@@ -0,0 +1,44 @@
+import { z } from 'zod';
+import { formatAuditEvent } from '../formatting/index.js';
+import { deniedEnvelope, isAuditReader } from './access.js';
+const inputSchema = z.object({
+    targetCollection: z.string().describe('Collection slug (e.g. "pages").'),
+    targetId: z.string().describe('Document ID within the collection.'),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(200)
+        .optional()
+        .describe('Max events to return. Default: 50.'),
+});
+export function createGetChangeHistoryTool(deps) {
+    return {
+        name: 'get_change_history',
+        description: 'Returns the complete chronological history of actions on a single document, including diffs. Use to answer "what has happened to this page?" or "who changed X?". Most-recent first.',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isAuditReader(ctx)) {
+                return deniedEnvelope('Only admins and editors can read a document\'s change history.');
+            }
+            const result = await deps.payload.find({
+                collection: deps.collectionSlug,
+                where: {
+                    and: [
+                        { targetCollection: { equals: input.targetCollection } },
+                        { targetId: { equals: input.targetId } },
+                    ],
+                },
+                sort: '-createdAt',
+                limit: input.limit ?? 50,
+            });
+            return {
+                targetCollection: input.targetCollection,
+                targetId: input.targetId,
+                eventCount: result.totalDocs,
+                history: result.docs.map((doc) => formatAuditEvent(doc)),
+            };
+        },
+    };
+}
+//# sourceMappingURL=get-change-history.js.map

package/dist/tools/get-change-history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-change-history.js","sourceRoot":"","sources":["../../src/tools/get-change-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACnE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,oCAAoC,CAAC;CAClD,CAAC,CAAA;AAEF,MAAM,UAAU,0BAA0B,CACxC,IAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EACT,sLAAsL;QACxL,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,gEAAgE,CAAC,CAAA;YACzF,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,cAAc;gBAC/B,KAAK,EAAE;oBACL,GAAG,EAAE;wBACH,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE;wBACxD,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE;qBACzC;iBACF;gBACD,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;aACzB,CAAC,CAAA;YAEF,OAAO;gBACL,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,UAAU,EAAE,MAAM,CAAC,SAAS;gBAC5B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAA8B,CAAC,CAAC;aACpF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/get-recent-failures.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+export interface GetRecentFailuresDeps {
+    payload: Payload;
+    collectionSlug: string;
+}
+declare const inputSchema: z.ZodObject<{
+    hours: z.ZodOptional<z.ZodNumber>;
+    mcpServer: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    mcpServer?: string | undefined;
+    limit?: number | undefined;
+    hours?: number | undefined;
+}, {
+    mcpServer?: string | undefined;
+    limit?: number | undefined;
+    hours?: number | undefined;
+}>;
+export declare function createGetRecentFailuresTool(deps: GetRecentFailuresDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=get-recent-failures.d.ts.map

package/dist/tools/get-recent-failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-recent-failures.d.ts","sourceRoot":"","sources":["../../src/tools/get-recent-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAS,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAI9E,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,QAAA,MAAM,WAAW;;;;;;;;;;;;EAmBf,CAAA;AAEF,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,qBAAqB,GAC1B,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAkCvC"}

package/dist/tools/get-recent-failures.js

@@ -0,0 +1,56 @@
+import { z } from 'zod';
+import { formatAuditEvent } from '../formatting/index.js';
+import { deniedEnvelope, isAuditReader } from './access.js';
+const inputSchema = z.object({
+    hours: z
+        .number()
+        .int()
+        .positive()
+        .max(24 * 30)
+        .optional()
+        .describe('How far back to scan, in hours. Default: 24.'),
+    mcpServer: z
+        .string()
+        .optional()
+        .describe('Filter to a specific server (e.g. "publishing", "integrations").'),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(100)
+        .optional()
+        .describe('Max results. Default: 25.'),
+});
+export function createGetRecentFailuresTool(deps) {
+    return {
+        name: 'get_recent_failures',
+        description: 'Recent failed operations across all MCP servers. Use for "what broke recently?" or when diagnosing issues. Returns actions with success=false and their error messages, most recent first.',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isAuditReader(ctx)) {
+                return deniedEnvelope('Only admins and editors can review recent failures.');
+            }
+            const hours = input.hours ?? 24;
+            const since = new Date(Date.now() - hours * 60 * 60 * 1000).toISOString();
+            const conditions = [
+                { success: { equals: false } },
+                { createdAt: { greater_than_equal: since } },
+            ];
+            if (input.mcpServer)
+                conditions.push({ mcpServer: { equals: input.mcpServer } });
+            const result = await deps.payload.find({
+                collection: deps.collectionSlug,
+                where: { and: conditions },
+                sort: '-createdAt',
+                limit: input.limit ?? 25,
+            });
+            return {
+                hoursScanned: hours,
+                since,
+                failureCount: result.totalDocs,
+                failures: result.docs.map((doc) => formatAuditEvent(doc)),
+            };
+        },
+    };
+}
+//# sourceMappingURL=get-recent-failures.js.map

package/dist/tools/get-recent-failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-recent-failures.js","sourceRoot":"","sources":["../../src/tools/get-recent-failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;SACZ,QAAQ,EAAE;SACV,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;CACzC,CAAC,CAAA;AAEF,MAAM,UAAU,2BAA2B,CACzC,IAA2B;IAE3B,OAAO;QACL,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EACT,4LAA4L;QAC9L,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,qDAAqD,CAAC,CAAA;YAC9E,CAAC;YAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAA;YAC/B,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;YACzE,MAAM,UAAU,GAAY;gBAC1B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;gBAC9B,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE;aAC7C,CAAA;YACD,IAAI,KAAK,CAAC,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAEhF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,cAAc;gBAC/B,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;gBAC1B,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;aACzB,CAAC,CAAA;YAEF,OAAO;gBACL,YAAY,EAAE,KAAK;gBACnB,KAAK;gBACL,YAAY,EAAE,MAAM,CAAC,SAAS;gBAC9B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAA8B,CAAC,CAAC;aACrF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/index.d.ts

@@ -0,0 +1,12 @@
+export { createQueryAuditTool } from './query-audit.js';
+export type { QueryAuditDeps } from './query-audit.js';
+export { createGetChangeHistoryTool } from './get-change-history.js';
+export type { GetChangeHistoryDeps } from './get-change-history.js';
+export { createWhoChangedWhatTool } from './who-changed-what.js';
+export type { WhoChangedWhatDeps } from './who-changed-what.js';
+export { createWhatChangedInRangeTool } from './what-changed-in-range.js';
+export type { WhatChangedInRangeDeps } from './what-changed-in-range.js';
+export { createGetRecentFailuresTool } from './get-recent-failures.js';
+export type { GetRecentFailuresDeps } from './get-recent-failures.js';
+export { isAuditReader } from './access.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AACpE,YAAY,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAChE,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AACzE,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAA;AACxE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AACtE,YAAY,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}

package/dist/tools/index.js

@@ -0,0 +1,7 @@
+export { createQueryAuditTool } from './query-audit.js';
+export { createGetChangeHistoryTool } from './get-change-history.js';
+export { createWhoChangedWhatTool } from './who-changed-what.js';
+export { createWhatChangedInRangeTool } from './what-changed-in-range.js';
+export { createGetRecentFailuresTool } from './get-recent-failures.js';
+export { isAuditReader } from './access.js';
+//# sourceMappingURL=index.js.map

package/dist/tools/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAA;AAEpE,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAA;AAEhE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAA;AAEzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA"}

package/dist/tools/query-audit.d.ts

@@ -0,0 +1,53 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+export interface QueryAuditDeps {
+    payload: Payload;
+    collectionSlug: string;
+}
+declare const inputSchema: z.ZodObject<{
+    targetCollection: z.ZodOptional<z.ZodString>;
+    targetId: z.ZodOptional<z.ZodString>;
+    actorId: z.ZodOptional<z.ZodString>;
+    action: z.ZodOptional<z.ZodString>;
+    mcpServer: z.ZodOptional<z.ZodString>;
+    dateRange: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }>>;
+    onlyFailures: z.ZodOptional<z.ZodBoolean>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    action?: string | undefined;
+    mcpServer?: string | undefined;
+    targetCollection?: string | undefined;
+    targetId?: string | undefined;
+    actorId?: string | undefined;
+    dateRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+    onlyFailures?: boolean | undefined;
+    limit?: number | undefined;
+}, {
+    action?: string | undefined;
+    mcpServer?: string | undefined;
+    targetCollection?: string | undefined;
+    targetId?: string | undefined;
+    actorId?: string | undefined;
+    dateRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+    onlyFailures?: boolean | undefined;
+    limit?: number | undefined;
+}>;
+export declare function createQueryAuditTool(deps: QueryAuditDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=query-audit.d.ts.map

package/dist/tools/query-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-audit.d.ts","sourceRoot":"","sources":["../../src/tools/query-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAS,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAI9E,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiCf,CAAA;AAEF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAqChG"}

package/dist/tools/query-audit.js

@@ -0,0 +1,78 @@
+import { z } from 'zod';
+import { formatAuditEvent } from '../formatting/index.js';
+import { deniedEnvelope, isAuditReader } from './access.js';
+const inputSchema = z.object({
+    targetCollection: z
+        .string()
+        .optional()
+        .describe('Filter to a specific collection (e.g. "pages").'),
+    targetId: z.string().optional().describe('Filter to a specific document ID.'),
+    actorId: z.string().optional().describe('Filter to a specific user ID.'),
+    action: z
+        .string()
+        .optional()
+        .describe('Filter to a specific action (e.g. "publishing.publish").'),
+    mcpServer: z
+        .string()
+        .optional()
+        .describe('Filter to a specific server (e.g. "publishing", "approvals").'),
+    dateRange: z
+        .object({
+        from: z.string().datetime().optional(),
+        to: z.string().datetime().optional(),
+    })
+        .optional()
+        .describe('ISO-8601 timestamps. Inclusive on both ends.'),
+    onlyFailures: z
+        .boolean()
+        .optional()
+        .describe('If true, only return actions where success=false.'),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(100)
+        .optional()
+        .describe('Max results. Default: 20.'),
+});
+export function createQueryAuditTool(deps) {
+    return {
+        name: 'query_audit',
+        description: "General-purpose audit log query. Filter by collection, document, actor, action, server, date range, or failure-only. Returns chronologically ordered results, most recent first. Use when you need a custom view of system activity that doesn't fit the more specific tools.",
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isAuditReader(ctx)) {
+                return deniedEnvelope('Only admins and editors can run general audit queries. Try `who_changed_what` for your own activity.');
+            }
+            const conditions = [];
+            if (input.targetCollection)
+                conditions.push({ targetCollection: { equals: input.targetCollection } });
+            if (input.targetId)
+                conditions.push({ targetId: { equals: input.targetId } });
+            if (input.actorId)
+                conditions.push({ 'actor.userId': { equals: input.actorId } });
+            if (input.action)
+                conditions.push({ action: { equals: input.action } });
+            if (input.mcpServer)
+                conditions.push({ mcpServer: { equals: input.mcpServer } });
+            if (input.onlyFailures)
+                conditions.push({ success: { equals: false } });
+            if (input.dateRange?.from)
+                conditions.push({ createdAt: { greater_than_equal: input.dateRange.from } });
+            if (input.dateRange?.to)
+                conditions.push({ createdAt: { less_than_equal: input.dateRange.to } });
+            const result = await deps.payload.find({
+                collection: deps.collectionSlug,
+                ...(conditions.length > 0 ? { where: { and: conditions } } : {}),
+                sort: '-createdAt',
+                limit: input.limit ?? 20,
+            });
+            return {
+                total: result.totalDocs,
+                returned: result.docs.length,
+                events: result.docs.map((doc) => formatAuditEvent(doc)),
+            };
+        },
+    };
+}
+//# sourceMappingURL=query-audit.js.map

package/dist/tools/query-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-audit.js","sourceRoot":"","sources":["../../src/tools/query-audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,+BAA+B,CAAC;IACxE,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,0DAA0D,CAAC;IACvE,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,QAAQ,EAAE;SACV,QAAQ,CAAC,8CAA8C,CAAC;IAC3D,YAAY,EAAE,CAAC;SACZ,OAAO,EAAE;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,mDAAmD,CAAC;IAChE,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;CACzC,CAAC,CAAA;AAEF,MAAM,UAAU,oBAAoB,CAAC,IAAoB;IACvD,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,+QAA+Q;QACjR,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CACnB,sGAAsG,CACvG,CAAA;YACH,CAAC;YAED,MAAM,UAAU,GAAY,EAAE,CAAA;YAC9B,IAAI,KAAK,CAAC,gBAAgB;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAA;YACrG,IAAI,KAAK,CAAC,QAAQ;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;YAC7E,IAAI,KAAK,CAAC,OAAO;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;YACjF,IAAI,KAAK,CAAC,MAAM;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;YACvE,IAAI,KAAK,CAAC,SAAS;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;YAChF,IAAI,KAAK,CAAC,YAAY;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;YACvE,IAAI,KAAK,CAAC,SAAS,EAAE,IAAI;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACvG,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE;gBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YAEhG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,cAAc;gBAC/B,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;aACzB,CAAC,CAAA;YAEF,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,SAAS;gBACvB,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC5B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAA8B,CAAC,CAAC;aACnF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/what-changed-in-range.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+export interface WhatChangedInRangeDeps {
+    payload: Payload;
+    collectionSlug: string;
+}
+declare const inputSchema: z.ZodObject<{
+    from: z.ZodString;
+    to: z.ZodString;
+    scanLimit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    from: string;
+    to: string;
+    scanLimit?: number | undefined;
+}, {
+    from: string;
+    to: string;
+    scanLimit?: number | undefined;
+}>;
+export declare function createWhatChangedInRangeTool(deps: WhatChangedInRangeDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=what-changed-in-range.d.ts.map

package/dist/tools/what-changed-in-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"what-changed-in-range.d.ts","sourceRoot":"","sources":["../../src/tools/what-changed-in-range.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAG9E,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,QAAA,MAAM,WAAW;;;;;;;;;;;;EAUf,CAAA;AAEF,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,sBAAsB,GAC3B,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAsFvC"}

package/dist/tools/what-changed-in-range.js

@@ -0,0 +1,86 @@
+import { z } from 'zod';
+import { deniedEnvelope, isAuditReader } from './access.js';
+const inputSchema = z.object({
+    from: z.string().datetime().describe('ISO-8601 start of range (inclusive).'),
+    to: z.string().datetime().describe('ISO-8601 end of range (inclusive).'),
+    scanLimit: z
+        .number()
+        .int()
+        .positive()
+        .max(5000)
+        .optional()
+        .describe('Max events to scan when computing the summary. Default: 1000.'),
+});
+export function createWhatChangedInRangeTool(deps) {
+    return {
+        name: 'what_changed_in_range',
+        description: 'Summarized activity over a time range, grouped by action type, actor, and target collection. Use for "what happened last week?" or weekly review questions. Returns counts and top contributors rather than individual events. Caps the scan at 1000 events by default — for wider sweeps, raise scanLimit or use query_audit with paging.',
+        inputSchema,
+        handler: async (input, ctx) => {
+            if (!isAuditReader(ctx)) {
+                return deniedEnvelope('Only admins and editors can summarize activity ranges.');
+            }
+            const scanLimit = input.scanLimit ?? 1000;
+            const result = await deps.payload.find({
+                collection: deps.collectionSlug,
+                where: {
+                    and: [
+                        { createdAt: { greater_than_equal: input.from } },
+                        { createdAt: { less_than_equal: input.to } },
+                    ],
+                },
+                sort: '-createdAt',
+                limit: scanLimit,
+            });
+            const byAction = new Map();
+            const byActor = new Map();
+            const byCollection = new Map();
+            const byServer = new Map();
+            let failureCount = 0;
+            for (const doc of result.docs) {
+                const action = typeof doc['action'] === 'string' ? doc['action'] : 'unknown';
+                byAction.set(action, (byAction.get(action) ?? 0) + 1);
+                const actor = (doc['actor'] ?? {});
+                const actorId = typeof actor['userId'] === 'string'
+                    ? actor['userId']
+                    : typeof actor['type'] === 'string'
+                        ? actor['type']
+                        : 'unknown';
+                const actorName = typeof actor['userName'] === 'string' ? actor['userName'] : actorId;
+                const existing = byActor.get(actorId);
+                byActor.set(actorId, { name: actorName, count: (existing?.count ?? 0) + 1 });
+                const targetCollection = doc['targetCollection'];
+                if (typeof targetCollection === 'string') {
+                    byCollection.set(targetCollection, (byCollection.get(targetCollection) ?? 0) + 1);
+                }
+                const server = typeof doc['mcpServer'] === 'string' ? doc['mcpServer'] : 'unknown';
+                byServer.set(server, (byServer.get(server) ?? 0) + 1);
+                if (doc['success'] === false)
+                    failureCount += 1;
+            }
+            const totalDocs = result.totalDocs;
+            const truncated = totalDocs > result.docs.length;
+            return {
+                from: input.from,
+                to: input.to,
+                totalActions: totalDocs,
+                scanned: result.docs.length,
+                truncated,
+                ...(truncated
+                    ? {
+                        note: `Range contains ${totalDocs} events but only ${result.docs.length} were scanned for summary; raise scanLimit to widen the sweep.`,
+                    }
+                    : {}),
+                failureCount,
+                byAction: Object.fromEntries(Array.from(byAction.entries()).sort((a, b) => b[1] - a[1])),
+                topActors: Array.from(byActor.entries())
+                    .map(([id, { name, count }]) => ({ id, name, count }))
+                    .sort((a, b) => b.count - a.count)
+                    .slice(0, 10),
+                byCollection: Object.fromEntries(Array.from(byCollection.entries()).sort((a, b) => b[1] - a[1])),
+                byServer: Object.fromEntries(Array.from(byServer.entries()).sort((a, b) => b[1] - a[1])),
+            };
+        },
+    };
+}
+//# sourceMappingURL=what-changed-in-range.js.map

package/dist/tools/what-changed-in-range.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"what-changed-in-range.js","sourceRoot":"","sources":["../../src/tools/what-changed-in-range.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,sCAAsC,CAAC;IAC5E,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,EAAE;SACV,QAAQ,CAAC,+DAA+D,CAAC;CAC7E,CAAC,CAAA;AAEF,MAAM,UAAU,4BAA4B,CAC1C,IAA4B;IAE5B,OAAO;QACL,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EACT,4UAA4U;QAC9U,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,wDAAwD,CAAC,CAAA;YACjF,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAA;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,cAAc;gBAC/B,KAAK,EAAE;oBACL,GAAG,EAAE;wBACH,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE;wBACjD,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE;qBAC7C;iBACF;gBACD,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2C,CAAA;YAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC9C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;YAC1C,IAAI,YAAY,GAAG,CAAC,CAAA;YAEpB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAsC,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC5E,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBAErD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAA;gBAC7D,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ;oBACjD,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACjB,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ;wBACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;wBACf,CAAC,CAAC,SAAS,CAAA;gBACf,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;gBACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACrC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBAE5E,MAAM,gBAAgB,GAAG,GAAG,CAAC,kBAAkB,CAAC,CAAA;gBAChD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;oBACzC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBACnF,CAAC;gBAED,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;gBAClF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;gBAErD,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,KAAK;oBAAE,YAAY,IAAI,CAAC,CAAA;YACjD,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAA;YAClC,MAAM,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAA;YAEhD,OAAO;gBACL,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,YAAY,EAAE,SAAS;gBACvB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;gBAC3B,SAAS;gBACT,GAAG,CAAC,SAAS;oBACX,CAAC,CAAC;wBACE,IAAI,EAAE,kBAAkB,SAAS,oBAAoB,MAAM,CAAC,IAAI,CAAC,MAAM,gEAAgE;qBACxI;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,YAAY;gBACZ,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3D;gBACD,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;qBACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;qBACrD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;qBACjC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACf,YAAY,EAAE,MAAM,CAAC,WAAW,CAC9B,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC/D;gBACD,QAAQ,EAAE,MAAM,CAAC,WAAW,CAC1B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3D;aACF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/tools/who-changed-what.d.ts

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+import type { Payload } from 'payload';
+import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
+export interface WhoChangedWhatDeps {
+    payload: Payload;
+    collectionSlug: string;
+}
+declare const inputSchema: z.ZodObject<{
+    actorId: z.ZodOptional<z.ZodString>;
+    dateRange: z.ZodOptional<z.ZodObject<{
+        from: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }, {
+        from?: string | undefined;
+        to?: string | undefined;
+    }>>;
+    limit: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    actorId?: string | undefined;
+    dateRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+    limit?: number | undefined;
+}, {
+    actorId?: string | undefined;
+    dateRange?: {
+        from?: string | undefined;
+        to?: string | undefined;
+    } | undefined;
+    limit?: number | undefined;
+}>;
+export declare function createWhoChangedWhatTool(deps: WhoChangedWhatDeps): McpToolDefinition<typeof inputSchema>;
+export {};
+//# sourceMappingURL=who-changed-what.d.ts.map

package/dist/tools/who-changed-what.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-changed-what.d.ts","sourceRoot":"","sources":["../../src/tools/who-changed-what.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAS,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAI9E,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBf,CAAA;AAEF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,kBAAkB,GACvB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAgDvC"}

package/dist/tools/who-changed-what.js

@@ -0,0 +1,66 @@
+import { z } from 'zod';
+import { formatAuditEvent } from '../formatting/index.js';
+import { deniedEnvelope, isAuditReader } from './access.js';
+const inputSchema = z.object({
+    actorId: z
+        .string()
+        .optional()
+        .describe('User ID to look up. Defaults to the authenticated caller.'),
+    dateRange: z
+        .object({
+        from: z.string().datetime().optional(),
+        to: z.string().datetime().optional(),
+    })
+        .optional(),
+    limit: z
+        .number()
+        .int()
+        .positive()
+        .max(100)
+        .optional()
+        .describe('Max results. Default: 25.'),
+});
+export function createWhoChangedWhatTool(deps) {
+    return {
+        name: 'who_changed_what',
+        description: "A user's recent activity. Use when someone asks 'what has Sarah been working on?' or 'show me my changes today'. If actorId is omitted, defaults to the authenticated caller — so users can ask about themselves without knowing their ID. Other users' activity requires admin/editor.",
+        inputSchema,
+        handler: async (input, ctx) => {
+            const callerId = ctx.user?.id;
+            const actorId = input.actorId ?? callerId;
+            if (!actorId)
+                return deniedEnvelope('No actorId provided and no authenticated caller.');
+            const queryingSelf = !!callerId && actorId === callerId;
+            if (!queryingSelf && !isAuditReader(ctx)) {
+                return deniedEnvelope("Only admins and editors can look up other users' activity.");
+            }
+            const conditions = [{ 'actor.userId': { equals: actorId } }];
+            if (input.dateRange?.from) {
+                conditions.push({ createdAt: { greater_than_equal: input.dateRange.from } });
+            }
+            if (input.dateRange?.to) {
+                conditions.push({ createdAt: { less_than_equal: input.dateRange.to } });
+            }
+            const result = await deps.payload.find({
+                collection: deps.collectionSlug,
+                where: { and: conditions },
+                sort: '-createdAt',
+                limit: input.limit ?? 25,
+            });
+            const firstDoc = result.docs[0];
+            const firstActor = (firstDoc?.['actor'] ?? {});
+            const actorName = typeof firstActor['userName'] === 'string'
+                ? firstActor['userName']
+                : queryingSelf
+                    ? (ctx.user?.name ?? actorId)
+                    : actorId;
+            return {
+                actorId,
+                actor: actorName,
+                actionCount: result.totalDocs,
+                actions: result.docs.map((doc) => formatAuditEvent(doc)),
+            };
+        },
+    };
+}
+//# sourceMappingURL=who-changed-what.js.map

package/dist/tools/who-changed-what.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"who-changed-what.js","sourceRoot":"","sources":["../../src/tools/who-changed-what.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAO3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2DAA2D,CAAC;IACxE,SAAS,EAAE,CAAC;SACT,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;KACrC,CAAC;SACD,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,EAAE;SACL,QAAQ,EAAE;SACV,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,2BAA2B,CAAC;CACzC,CAAC,CAAA;AAEF,MAAM,UAAU,wBAAwB,CACtC,IAAwB;IAExB,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,yRAAyR;QAC3R,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,CAAA;YAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAA;YACzC,IAAI,CAAC,OAAO;gBAAE,OAAO,cAAc,CAAC,kDAAkD,CAAC,CAAA;YAEvF,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,IAAI,OAAO,KAAK,QAAQ,CAAA;YACvD,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,cAAc,CAAC,4DAA4D,CAAC,CAAA;YACrF,CAAC;YAED,MAAM,UAAU,GAAY,CAAC,EAAE,cAAc,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;YACrE,IAAI,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;gBAC1B,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC9E,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;YACzE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,UAAU,EAAE,IAAI,CAAC,cAAc;gBAC/B,KAAK,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;gBAC1B,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;aACzB,CAAC,CAAA;YAEF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAwC,CAAA;YACtE,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAA4B,CAAA;YACzE,MAAM,SAAS,GACb,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,QAAQ;gBACxC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;gBACxB,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,CAAC;oBAC7B,CAAC,CAAC,OAAO,CAAA;YAEf,OAAO;gBACL,OAAO;gBACP,KAAK,EAAE,SAAS;gBAChB,WAAW,EAAE,MAAM,CAAC,SAAS;gBAC7B,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAA8B,CAAC,CAAC;aACpF,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/package.json

@@ -1,10 +1,63 @@
 {
   "name": "@forumone/throughline-audit",
-  "version": "0.0.1",
-  "description": "OIDC trusted publishing setup package for @forumone/throughline-audit",
+  "version": "0.2.0",
+  "description": "Read-only MCP query tools over the Throughline audit log. Pairs with core's auditPlugin (which writes records).",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
   "keywords": [
-    "oidc",
-    "trusted-publishing",
-    "setup"
-  ]
-}
+    "throughline",
+    "payload",
+    "mcp",
+    "audit"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/forumone/throughline.git",
+    "directory": "packages/audit"
+  },
+  "homepage": "https://github.com/forumone/throughline/tree/main/packages/audit#readme",
+  "bugs": {
+    "url": "https://github.com/forumone/throughline/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "peerDependencies": {
+    "payload": "^3.0.0"
+  },
+  "dependencies": {
+    "zod": "^3.23.0",
+    "@forumone/throughline-plugin-contract": "0.0.0",
+    "@forumone/throughline-core": "0.2.0"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "eslint": "^9.15.0",
+    "payload": "^3.83.0",
+    "typescript": "^5.6.0",
+    "vitest": "^2.1.0",
+    "@forumone/throughline-eslint-config": "0.0.0",
+    "@forumone/throughline-tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "dev": "tsc -b -w",
+    "clean": "rm -rf dist .turbo *.tsbuildinfo",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "test": "vitest run"
+  }
+}