@forumone/throughline-core 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @forumone/throughline-core
 
+## 0.2.2
+
+### Patch Changes
+
+- 7ee992d: Fix broken external installs of the core plugins.
+
+  Every core plugin emits a runtime `import { getPluginRegistry } from '@forumone/throughline-plugin-contract'`, but `plugin-contract` was marked `private` and never published — so the published plugins pinned `@forumone/throughline-plugin-contract: 0.0.0`, a version that does not exist on npm, and any external `pnpm install` failed with a 404.
+
+  `plugin-contract` is now published, so the dependent plugins re-pin a real version. The cross-plugin registry is keyed on a global `Symbol.for(...)` and stored on the Payload instance, so behavior is unchanged.
+
+  Also fixes the scaffolder, which pinned `@forumone/throughline-reference-ds@^0.1.0` (latest is `0.2.0`) in the generated `apps/web` and `design-system` packages.
+
+- Updated dependencies [7ee992d]
+  - @forumone/throughline-plugin-contract@0.2.1
+
+## 0.2.1
+
+### Patch Changes
+
+- a4b5108: Initial release of the forms package. Wraps Payload's Form Builder plugin with the Throughline policy layer: mandatory privacy notice, consent enforcement (server-side), honeypot spam protection, Postgres-backed per-IP rate limiting, a destination allowlist (the security perimeter), and submitter confirmations. Six MCP tools (`list_allowed_destinations`, `validate_form`, `create_form`, `update_form_fields`, `update_form_destinations`, `get_form_submissions`) and four Inngest functions (`form-fan-out`, `form-email-destination`, `form-webhook-destination`, `form-submitter-confirmation`) drive the conversational flow and the async destination delivery. Includes `FormSubmissionEmail` and `SubmitterConfirmationEmail` React Email templates. Allowlist enforcement runs at three layers (MCP tool, collection beforeChange hook, fan-out worker) so prompt injection or admin direct-API writes can't bypass it. IPs are HMAC-hashed; raw IPs are never persisted. Adds `form.updated` to the core audit-action taxonomy used by the two update tools.
+
 ## 0.2.0
 
 ### Minor Changes

package/dist/audit/types.d.ts

@@ -3,7 +3,7 @@
  * actions from this list rather than introducing free-form strings, so
  * audit queries (C8) can build on a known taxonomy.
  */
-export declare const AUDIT_ACTIONS: readonly ["content.find", "content.create", "content.update", "content.delete", "design.list", "design.suggest", "design.validate", "design.get_contract", "design.find_anti_pattern", "publishing.draft", "publishing.publish", "publishing.unpublish", "publishing.schedule", "publishing.rollback", "approval.requested", "approval.granted", "approval.declined", "approval.changes_requested", "approval.expired", "approval.discussed", "form.created", "form.submission_received", "integration.synced", "integration.failed", "system.error", "system.healthcheck"];
+export declare const AUDIT_ACTIONS: readonly ["content.find", "content.create", "content.update", "content.delete", "design.list", "design.suggest", "design.validate", "design.get_contract", "design.find_anti_pattern", "publishing.draft", "publishing.publish", "publishing.unpublish", "publishing.schedule", "publishing.rollback", "approval.requested", "approval.granted", "approval.declined", "approval.changes_requested", "approval.expired", "approval.discussed", "form.created", "form.updated", "form.submission_received", "integration.synced", "integration.failed", "system.error", "system.healthcheck"];
 export type AuditAction = (typeof AUDIT_ACTIONS)[number];
 /** MCP server identifiers. Keep in sync with the planned server packages. */
 export declare const AUDIT_MCP_SERVERS: readonly ["payload", "component", "publishing", "approvals", "audit", "forms", "integrations"];

package/dist/audit/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,aAAa,6iBA2BhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,gGAQpB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,aAAa,6jBA4BhB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,gGAQpB,CAAA;AAEV,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAA"}

package/dist/audit/types.js

@@ -25,6 +25,7 @@ export const AUDIT_ACTIONS = [
     'approval.expired',
     'approval.discussed',
     'form.created',
+    'form.updated',
     'form.submission_received',
     'integration.synced',
     'integration.failed',

package/dist/audit/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,0BAA0B;IAC1B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,oBAAoB;CACZ,CAAA;AAIV,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;IACP,cAAc;CACN,CAAA"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;IACjB,qBAAqB;IACrB,0BAA0B;IAC1B,kBAAkB;IAClB,oBAAoB;IACpB,sBAAsB;IACtB,qBAAqB;IACrB,qBAAqB;IACrB,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,kBAAkB;IAClB,oBAAoB;IACpB,cAAc;IACd,cAAc;IACd,0BAA0B;IAC1B,oBAAoB;IACpB,oBAAoB;IACpB,cAAc;IACd,oBAAoB;CACZ,CAAA;AAIV,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,SAAS;IACT,WAAW;IACX,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;IACP,cAAc;CACN,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-core",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Core plumbing for Throughline: audit log, MCP authentication and handler, event taxonomy + Inngest client factory, env handling, logger, shared utilities.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,7 +62,7 @@
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-plugin-contract": "0.0.0"
+    "@forumone/throughline-plugin-contract": "0.2.1"
   },
   "devDependencies": {
     "@types/node": "^20.17.0",