@forumone/throughline-audit 0.3.1 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,53 @@
 # @forumone/throughline-audit
 
+## 0.4.0
+
+### Minor Changes
+
+- 3140ea0: One MCP transport, not seven
+
+  Every plugin served its own `POST /<prefix>/mcp` on a 146-line JSON-RPC subset of
+  the protocol that spoke `tools/list` and `tools/call` and nothing else. Payload
+  ships an MCP server built on the official SDK — streamable HTTP, sessions, per-key
+  capability checkboxes — and the tools were never the transport. They now reach a
+  client through the host's `@payloadcms/plugin-mcp`, on one `/api/mcp`, via the
+  collector `createMcpToolCollector` already provided.
+
+  **Breaking.** Removed from `@forumone/throughline-core`: `createMcpHandler`,
+  `McpHandlerOptions`, `createApiKeysCollection`, `ApiKeysCollectionOptions`,
+  `DEFAULT_API_KEYS_SLUG`, `createBearerTokenAuthenticator`,
+  `BearerTokenAuthenticatorOptions`, `generateApiKey`. Removed from
+  `@forumone/throughline-plugin-contract`: `McpAuthenticator`, `McpAuthResult`.
+  `sha256Hex` stays exported, from `./utils` rather than `./auth`.
+
+  `routePrefix` is gone from `auditQueryPlugin`, `componentsPlugin` and
+  `integrationsPlugin` — omitted from their options types, so passing one is a
+  compile error rather than config that reads as if it does something. `/mcp` was
+  the only endpoint any of the three served. `publishingPlugin`, `approvalsPlugin`
+  and `formsPlugin` keep theirs; they still serve admin controls, the approval
+  action link and the public form post.
+
+  **A host that passes no `mcpTools` collector now has no MCP surface.** There is no
+  per-server endpoint left as a fallback. This is a config change of one line per
+  plugin, and `createMcpToolCollector`'s own docs carry the shape.
+
+  **What this costs, stated plainly.** `requiredScope` is now read by nothing —
+  `plugin-mcp` gates on checkboxes generated at config time, which this suite cannot
+  fill because every tool is built at `onInit`. So a key that authenticates reaches
+  every collected tool, exactly as an all-or-nothing per-server key did. The
+  declarations are kept because they are the mapping those checkboxes need; #78
+  tracks restoring enforcement, and the type's own doc comment says so.
+
+  Also drops the key collection from the playground, which leaves that app with no
+  MCP surface at all until `mcpPlugin` can be wired there — #79, blocked on moving
+  it off `payload@^3.83.0`.
+
+### Patch Changes
+
+- Updated dependencies [3140ea0]
+  - @forumone/throughline-plugin-contract@0.4.0
+  - @forumone/throughline-core@0.7.0
+
 ## 0.3.1
 
 ### Patch Changes

package/README.md

@@ -4,7 +4,9 @@ Read-only MCP query tools over the Throughline audit log. Pairs with the writer
 
 ## What this package provides
 
-Five MCP tools served at `/api/audit/mcp`. All are read-only and emit no audit events of their own.
+Five MCP tools, handed to the host's collector at `onInit` and served by
+`@payloadcms/plugin-mcp` on one `/api/mcp`. Pass `mcpTools` or they reach nobody.
+All are read-only and emit no audit events of their own.
 
 | Tool | Use it for | Default access |
 |---|---|---|
@@ -74,7 +76,7 @@ auditQueryPlugin({
 
 | Option | Type | Default | Notes |
 |---|---|---|---|
-| `routePrefix` | `string` | `/audit` | Payload prepends `/api`, so the MCP endpoint lands at `/api/audit/mcp` |
+| `mcpTools` | `McpToolCollector` | — | The host's collector. Without it these five tools are unreachable |
 | `collectionSlug` | `string` | `audit-events` | Must match the slug used by core's `auditPlugin` |
 | `readAccess` | `(req) => boolean` | admin / editor | Custom predicate for read-side access |
 | `enabled` | `boolean` | `true` | Set to `false` to no-op the plugin |

package/dist/options.d.ts

@@ -1,7 +1,7 @@
 import type { McpToolCollector } from '@forumone/throughline-core';
 import type { PayloadRequest } from 'payload';
 import type { BaseCorePluginOptions } from '@forumone/throughline-plugin-contract';
-export interface AuditQueryPluginOptions extends BaseCorePluginOptions {
+export interface AuditQueryPluginOptions extends Omit<BaseCorePluginOptions, 'routePrefix'> {
     /**
      * Override the audit collection slug. Must match the slug `auditPlugin`
      * (in `@forumone/throughline-core`) writes to. Default: `'audit-events'`.

package/dist/options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAElF,MAAM,WAAW,uBAAwB,SAAQ,qBAAqB;IACpE;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAA;IAE7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC5B;AAED,eAAO,MAAM,6BAA6B,iBAAiB,CAAA;AAE3D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAEzF"}
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAA;AAQlF,MAAM,WAAW,uBAAwB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,aAAa,CAAC;IACzF;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAA;IAE7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,gBAAgB,CAAA;CAC5B;AAED,eAAO,MAAM,6BAA6B,iBAAiB,CAAA;AAE3D;;;GAGG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,uBAAuB,GAAG,uBAAuB,CAEzF"}

package/dist/options.js.map

@@ -1 +1 @@
-{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AA+BA,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAA;AAE3D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,OAAO,OAAO,CAAA;AAChB,CAAC"}
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../src/options.ts"],"names":[],"mappings":"AAqCA,MAAM,CAAC,MAAM,6BAA6B,GAAG,cAAc,CAAA;AAE3D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,OAAgC;IAC9D,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,uCAAuC,CAAA;AAG1F,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,cAAc,CAAA;AAerB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,uBAAuB,CA6E9D,CAAA"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAqB,MAAM,uCAAuC,CAAA;AAG1F,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,cAAc,CAAA;AAWrB;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,uBAAuB,CA0C9D,CAAA"}

package/dist/plugin.js

@@ -1,10 +1,9 @@
 import { getPluginRegistry } from '@forumone/throughline-plugin-contract';
-import { createMcpHandler, createNamedLogger, defaultLogger } from '@forumone/throughline-core';
+import { createNamedLogger, defaultLogger } from '@forumone/throughline-core';
 import { DEFAULT_AUDIT_COLLECTION_SLUG, validateOptions, } from './options.js';
 import { createGetChangeHistoryTool, createGetRecentFailuresTool, createQueryAuditTool, createWhatChangedInRangeTool, createWhoChangedWhatTool, } from './tools/index.js';
 const PLUGIN_ID = '@forumone/throughline-audit';
 const PLUGIN_VERSION = '0.1.0';
-const MCP_HANDLER_SYMBOL = Symbol.for('@forumone/throughline/audit-mcp-handler');
 /**
  * Read-only MCP server over the audit log. Pairs with `auditPlugin` from
  * `@forumone/throughline-core` (which writes records). The query plugin
@@ -16,25 +15,10 @@ export const auditQueryPlugin = (rawOptions) => (incomingConfig) => {
     if (rawOptions.enabled === false)
         return incomingConfig;
     const options = validateOptions(rawOptions);
-    const routePrefix = options.routePrefix ?? '/audit';
     const collectionSlug = options.collectionSlug ?? DEFAULT_AUDIT_COLLECTION_SLUG;
     const logger = createNamedLogger('audit-query', options.logger ?? defaultLogger);
     return {
         ...incomingConfig,
-        endpoints: [
-            ...(incomingConfig.endpoints ?? []),
-            {
-                path: `${routePrefix}/mcp`,
-                method: 'post',
-                handler: async (req) => {
-                    const handler = req.payload[MCP_HANDLER_SYMBOL];
-                    if (!handler) {
-                        return new Response(JSON.stringify({ error: 'Audit query MCP not initialized' }), { status: 503, headers: { 'content-type': 'application/json' } });
-                    }
-                    return handler(req);
-                },
-            },
-        ],
         onInit: async (payload) => {
             if (incomingConfig.onInit)
                 await incomingConfig.onInit(payload);
@@ -48,22 +32,10 @@ export const auditQueryPlugin = (rawOptions) => (incomingConfig) => {
                 createWhatChangedInRangeTool(deps),
                 createGetRecentFailuresTool(deps),
             ];
-            // Payload's own MCP plugin, when the host is using it. See the option's
-            // note — `onInit` is both the earliest these tools can exist and still
-            // early enough that the array is read populated.
+            // Payload's own MCP plugin, and the only transport these tools have.
+            // `onInit` is both the earliest they can exist and still early enough
+            // that `mcpPlugin` reads the array populated.
             options.mcpTools?.add(tools, { serverName: 'audit', logger });
-            const handler = createMcpHandler({
-                payload,
-                serverName: 'audit',
-                tools,
-                logger,
-            });
-            Object.defineProperty(payload, MCP_HANDLER_SYMBOL, {
-                value: handler,
-                enumerable: false,
-                writable: false,
-                configurable: false,
-            });
             registry.register({
                 id: PLUGIN_ID,
                 version: PLUGIN_VERSION,
@@ -71,7 +43,6 @@ export const auditQueryPlugin = (rawOptions) => (incomingConfig) => {
             });
             logger.info('Audit query server ready', {
                 collectionSlug,
-                routePrefix,
                 toolCount: tools.length,
             });
         },

package/dist/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/F,OAAO,EAEL,6BAA6B,EAC7B,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,SAAS,GAAG,6BAA6B,CAAA;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAA;AAC9B,MAAM,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAAC,yCAAyC,CAAC,CAAA;AAIhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IACjC,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEvD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,QAAQ,CAAA;IACnD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAA;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAA;IAEhF,OAAO;QACL,GAAG,cAAc;QACjB,SAAS,EAAE;YACT,GAAG,CAAC,cAAc,CAAC,SAAS,IAAI,EAAE,CAAC;YACnC;gBACE,IAAI,EAAE,GAAG,WAAW,MAAM;gBAC1B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBACrB,MAAM,OAAO,GAAI,GAAG,CAAC,OAA8C,CACjE,kBAAkB,CACO,CAAA;oBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;wBACb,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,CAAC,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAA;oBACH,CAAC;oBACD,OAAO,OAAO,CAAC,GAAyB,CAAC,CAAA;gBAC3C,CAAC;aACF;SACF;QACD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,cAAc,CAAC,MAAM;gBAAE,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAE/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAElD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG;gBACZ,oBAAoB,CAAC,IAAI,CAAC;gBAC1B,0BAA0B,CAAC,IAAI,CAAC;gBAChC,wBAAwB,CAAC,IAAI,CAAC;gBAC9B,4BAA4B,CAAC,IAAI,CAAC;gBAClC,2BAA2B,CAAC,IAAI,CAAC;aACA,CAAA;YAEnC,wEAAwE;YACxE,uEAAuE;YACvE,iDAAiD;YACjD,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YAE7D,MAAM,OAAO,GAAG,gBAAgB,CAAC;gBAC/B,OAAO;gBACP,UAAU,EAAE,OAAO;gBACnB,KAAK;gBACL,MAAM;aACP,CAAC,CAAA;YAEF,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE;gBACjD,KAAK,EAAE,OAAO;gBACd,UAAU,EAAE,KAAK;gBACjB,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,KAAK;aACpB,CAAC,CAAA;YAEF,QAAQ,CAAC,QAAQ,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,aAAa,CAAC;aAC9B,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBACtC,cAAc;gBACd,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,MAAM;aACxB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AACzE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC7E,OAAO,EAEL,6BAA6B,EAC7B,eAAe,GAChB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,kBAAkB,CAAA;AAEzB,MAAM,SAAS,GAAG,6BAA6B,CAAA;AAC/C,MAAM,cAAc,GAAG,OAAO,CAAA;AAC9B;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAC3B,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,cAAc,EAAE,EAAE;IACjC,IAAI,UAAU,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,cAAc,CAAA;IAEvD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,CAAA;IAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,6BAA6B,CAAA;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAA;IAEhF,OAAO;QACL,GAAG,cAAc;QACjB,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACxB,IAAI,cAAc,CAAC,MAAM;gBAAE,MAAM,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAE/D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;YAC3C,QAAQ,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;YAElD,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,cAAc,EAAE,CAAA;YACxC,MAAM,KAAK,GAAG;gBACZ,oBAAoB,CAAC,IAAI,CAAC;gBAC1B,0BAA0B,CAAC,IAAI,CAAC;gBAChC,wBAAwB,CAAC,IAAI,CAAC;gBAC9B,4BAA4B,CAAC,IAAI,CAAC;gBAClC,2BAA2B,CAAC,IAAI,CAAC;aACA,CAAA;YAEnC,qEAAqE;YACrE,sEAAsE;YACtE,8CAA8C;YAC9C,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;YAE7D,QAAQ,CAAC,QAAQ,CAAC;gBAChB,EAAE,EAAE,SAAS;gBACb,OAAO,EAAE,cAAc;gBACvB,YAAY,EAAE,CAAC,aAAa,CAAC;aAC9B,CAAC,CAAA;YAEF,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE;gBACtC,cAAc;gBACd,SAAS,EAAE,KAAK,CAAC,MAAM;aACxB,CAAC,CAAA;QACJ,CAAC;KACF,CAAA;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-audit",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Read-only MCP query tools over the Throughline audit log. Pairs with core's auditPlugin (which writes records).",
   "type": "module",
   "main": "./dist/index.js",
@@ -40,8 +40,8 @@
   },
   "dependencies": {
     "zod": "^3.23.0",
-    "@forumone/throughline-core": "0.6.0",
-    "@forumone/throughline-plugin-contract": "0.3.0"
+    "@forumone/throughline-core": "0.7.0",
+    "@forumone/throughline-plugin-contract": "0.4.0"
   },
   "devDependencies": {
     "@types/node": "^20.17.0",