@forumone/throughline-core 0.2.1 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # @forumone/throughline-core
 
+## 0.3.0
+
+### Minor Changes
+
+- d20f909: Bind an approval to the document's content rather than to its `updatedAt`.
+
+  `request_approval` stored `String(document['updatedAt'] ?? …)` as `targetVersion`,
+  and publishing's approval step recomputed the same expression at publish time. So
+  an approval was tied to a timestamp that moves on **every** save. An editor fixing
+  a typo between an approver opening the request and clicking approve invalidated the
+  approval — and the approver spent that time reading a version that no longer
+  existed.
+
+  Requiring re-approval after an edit is a defensible rule. Inheriting it from
+  whichever timestamp field happened to be nearby is not, and it is why **autosave
+  could not be turned on** anywhere the approvals plugin is installed: autosave moves
+  `updatedAt` every couple of seconds of typing, so a pending approval would be
+  invalidated continuously.
+
+  Both sides now call `documentContentHash(document)`, new in
+  `@forumone/throughline-core`. It hashes the document with the metadata that moves
+  without the content moving stripped at every level — `id`, `createdAt`,
+  `updatedAt`, `_status`, `__v`, `_id`, `globalType` — over keys in sorted order,
+  since blocks come back out of JSONB in no promised order. Array order is preserved,
+  because that is the order of the blocks on the page. `{ exclude }` adds
+  app-specific bookkeeping fields to the strip list.
+
+  The rule is now the one that was wanted all along: a save that changed nothing
+  keeps a granted approval, a save that changed something invalidates it, and an edit
+  that is reverted brings the approval back. That last one is why this is a content
+  hash rather than a version id — a version id moves whether or not the content did.
+
+  The two sides only agree because they load the document identically, with
+  `payload.findByID({ collection, id, draft: true })` at the config's default depth.
+  A populated relationship and a bare relationship id are different values and no
+  normalising makes them one, so a caller hashing a document fetched at some other
+  depth gets a hash that matches nothing. That is stated on the function.
+
+  **Approvals pending at upgrade must be re-requested.** Their `targetVersion` holds
+  an ISO timestamp; the publish step now computes a hash, so nothing matches and
+  those documents report `approval-required` until a fresh request is granted. No
+  migration is offered, because the old value cannot be converted — the content it
+  was granted against is not recoverable from a timestamp. Grant a moment for
+  in-flight requests to clear before upgrading, or expect approvers to be asked once
+  more.
+
+  Also exports `isDraftWrite` from `@forumone/throughline-publishing`. It is the
+  predicate the plugin's own trust boundary uses to tell a "Save draft" apart from
+  an unpublish, and it is unavailable to host code that needs the same answer: an
+  `afterChange` hook cannot work it out, because Payload sets `data._status =
+'draft'` on any `draft: true` update before the hooks run and `previousDoc` is the
+  latest _version_ rather than the live document. With autosave on, a host hook that
+  drops a cache or sends a notification fires every few seconds of typing unless it
+  asks this first.
+
+  Minor rather than patch on all three: `documentContentHash` and `isDraftWrite` are
+  new public API, and the stored meaning of `targetVersion` changes.
+
+## 0.2.2
+
+### Patch Changes
+
+- 7ee992d: Fix broken external installs of the core plugins.
+
+  Every core plugin emits a runtime `import { getPluginRegistry } from '@forumone/throughline-plugin-contract'`, but `plugin-contract` was marked `private` and never published — so the published plugins pinned `@forumone/throughline-plugin-contract: 0.0.0`, a version that does not exist on npm, and any external `pnpm install` failed with a 404.
+
+  `plugin-contract` is now published, so the dependent plugins re-pin a real version. The cross-plugin registry is keyed on a global `Symbol.for(...)` and stored on the Payload instance, so behavior is unchanged.
+
+  Also fixes the scaffolder, which pinned `@forumone/throughline-reference-ds@^0.1.0` (latest is `0.2.0`) in the generated `apps/web` and `design-system` packages.
+
+- Updated dependencies [7ee992d]
+  - @forumone/throughline-plugin-contract@0.2.1
+
 ## 0.2.1
 
 ### Patch Changes

package/README.md

@@ -12,7 +12,7 @@ The shared plumbing every Throughline server package depends on. Drop it into a
 | MCP | `./mcp` | `createMcpHandler`, `McpMetaSchema`, `withMeta` |
 | Env | `./env` | `ENV_VARS`, `validateBaseEnv`, `requireEnv`, `optionalEnv` |
 | Logger | (main) | `defaultLogger`, `createNamedLogger` |
-| Utils | (main) | `shallowDiff`, `generateId` |
+| Utils | (main) | `shallowDiff`, `generateId`, `documentContentHash` |
 
 The main entry re-exports everything; the subpath exports keep bundles smaller for consumers who only need one slice.
 
@@ -116,6 +116,21 @@ validateBaseEnv() // throws on missing PAYLOAD_SECRET / DATABASE_URI / NEXT_PUBL
 const apiKey = requireEnv(ENV_VARS.PUBLISHING_SERVER_API_KEY)
 ```
 
+## Document content hashing
+
+`documentContentHash(document)` reduces a Payload document to a hash of the part an editor authored, ignoring the metadata that moves without the content moving — `id`, `createdAt`, `updatedAt`, `_status`, `__v`, `_id`, `globalType`, stripped at every level of the document. Object key order does not affect the result, because blocks come back out of JSONB in no promised order; array order does, because that is the order of the blocks on the page.
+
+```ts
+import { documentContentHash } from '@forumone/throughline-core'
+
+const version = await documentContentHash(page)
+const withExtras = await documentContentHash(page, { exclude: ['syncedAt'] })
+```
+
+It exists so that approvals can bind to *what an approver read* rather than to when it was last saved. Approvals writes it as `targetVersion`; publishing recomputes it at publish time. Two consequences worth stating: a save that changed nothing keeps a granted approval, and an edit that is reverted brings one back.
+
+**Two callers only agree if they hash a document loaded the same way.** Both of the above use `payload.findByID({ collection, id, draft: true })` at the config's default depth. A populated relationship and a bare relationship id are different values, and normalising cannot turn one into the other — so a third caller fetching at a different depth would produce a hash that matches nothing.
+
 ## Why all of this lives in one package
 
 Server packages (Component, Publishing, Approvals, Audit Query, Forms, Integrations) all depend on the same audit log, the same authentication pattern, and the same event taxonomy. Splitting these across packages would create circular dependencies — every server package would need the audit writer, and an audit-only package would need to know about every server. Consolidating the plumbing here keeps the dependency graph one-way: core → server packages → client app.

package/dist/index.d.ts

@@ -9,6 +9,7 @@ export type { CoreEvents, FrameworkEvents, InngestClientOptions } from './events
 export { McpMetaSchema, createMcpHandler, withMeta } from './mcp/index.js';
 export type { McpHandlerOptions, McpMeta } from './mcp/index.js';
 export { defaultLogger, createNamedLogger } from './logger/index.js';
-export { shallowDiff, generateId } from './utils/index.js';
+export { shallowDiff, generateId, documentContentHash } from './utils/index.js';
+export type { DocumentContentHashOptions } from './utils/index.js';
 export type { AuthenticatedUser, BaseCorePluginOptions, CorePlugin, Logger, McpAuthResult, McpAuthenticator, McpToolContext, McpToolDefinition, PluginRegistry, PluginRegistryEntry, } from '@forumone/throughline-plugin-contract';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,8BAA8B,EAC9B,cAAc,EACd,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAA;AAEhG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnF,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAEzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC1E,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAI1D,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,uCAAuC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,8BAA8B,EAC9B,cAAc,EACd,SAAS,GACV,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,wBAAwB,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAA;AAEhG,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AACnF,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAEzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAC1E,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAEhE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC/E,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAIlE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,MAAM,EACN,aAAa,EACb,gBAAgB,EAChB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,uCAAuC,CAAA"}

package/dist/index.js

@@ -6,5 +6,5 @@ export { ENV_VARS, validateBaseEnv, requireEnv, optionalEnv } from './env/index.
 export { createInngestClient } from './events/index.js';
 export { McpMetaSchema, createMcpHandler, withMeta } from './mcp/index.js';
 export { defaultLogger, createNamedLogger } from './logger/index.js';
-export { shallowDiff, generateId } from './utils/index.js';
+export { shallowDiff, generateId, documentContentHash } from './utils/index.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4DAA4D;AAE5D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,8BAA8B,EAC9B,cAAc,EACd,SAAS,GACV,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAGnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAG1E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4DAA4D;AAE5D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,8BAA8B,EAC9B,cAAc,EACd,SAAS,GACV,MAAM,iBAAiB,CAAA;AAGxB,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAGnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAG1E,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/utils/content-hash.d.ts

@@ -0,0 +1,31 @@
+export interface DocumentContentHashOptions {
+    /**
+     * Extra field names to treat as volatile, stripped at every level.
+     * For app-specific bookkeeping written on save — a sync timestamp, a
+     * cached count — that no approver is looking at.
+     */
+    exclude?: string[];
+}
+/**
+ * Hashes the *content* of a document, ignoring the metadata that moves on
+ * every save.
+ *
+ * This is the binding an approval is tied to. Two documents hash the same
+ * when an approver would read the same thing, which means:
+ *
+ * - a save that changed nothing leaves a granted approval standing, and
+ * - a save that changed something invalidates it.
+ *
+ * That is the rule stated deliberately, rather than inherited from
+ * whichever timestamp field happened to be nearby.
+ *
+ * **Both sides must hash a document fetched the same way.** The approvals
+ * request tool and publishing's approval step both use
+ * `payload.findByID({ collection, id, draft: true })` at the config's
+ * default depth, so they see the same shape. A caller that hashes a
+ * document fetched at some other depth gets a hash that matches nothing:
+ * a populated relationship and a bare relationship id are not the same
+ * value, and no amount of normalising makes them one.
+ */
+export declare function documentContentHash(document: Record<string, unknown>, options?: DocumentContentHashOptions): Promise<string>;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/utils/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/utils/content-hash.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,0BAA0B;IACzC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,MAAM,CAAC,CAIjB"}

package/dist/utils/content-hash.js

@@ -0,0 +1,94 @@
+import { sha256Hex } from '../auth/api-keys.js';
+/**
+ * Fields that move without the content moving. Stripped at every level of
+ * the document before hashing.
+ *
+ * `updatedAt` is the reason this module exists: an approval bound to it is
+ * invalidated by any save at all, including one that changed nothing, and
+ * including every tick of autosave. `createdAt`, `_status`, `__v`,
+ * `globalType` and `_id` are storage and publishing machinery rather than
+ * anything an approver read.
+ *
+ * The document's own `id` is stripped separately, at the top level only —
+ * see `normalize`.
+ */
+const VOLATILE_FIELDS = new Set(['createdAt', 'updatedAt', '_status', '__v', '_id', 'globalType']);
+/**
+ * Hashes the *content* of a document, ignoring the metadata that moves on
+ * every save.
+ *
+ * This is the binding an approval is tied to. Two documents hash the same
+ * when an approver would read the same thing, which means:
+ *
+ * - a save that changed nothing leaves a granted approval standing, and
+ * - a save that changed something invalidates it.
+ *
+ * That is the rule stated deliberately, rather than inherited from
+ * whichever timestamp field happened to be nearby.
+ *
+ * **Both sides must hash a document fetched the same way.** The approvals
+ * request tool and publishing's approval step both use
+ * `payload.findByID({ collection, id, draft: true })` at the config's
+ * default depth, so they see the same shape. A caller that hashes a
+ * document fetched at some other depth gets a hash that matches nothing:
+ * a populated relationship and a bare relationship id are not the same
+ * value, and no amount of normalising makes them one.
+ */
+export async function documentContentHash(document, options = {}) {
+    const volatile = new Set(VOLATILE_FIELDS);
+    for (const field of options.exclude ?? [])
+        volatile.add(field);
+    return sha256Hex(stableStringify(normalize(document, volatile, true)));
+}
+/**
+ * Strips volatile fields and normalises values whose representation can
+ * vary without their meaning varying.
+ *
+ * `id` is dropped only at the top level, where it is the document's own id
+ * and constant for the life of the document. Nested `id`s are kept, because
+ * that is where a populated relationship carries which document it points
+ * at — dropping those would make a page that swapped one image for another
+ * with the same alt text hash identically to the one an approver read.
+ */
+function normalize(value, volatile, topLevel = false) {
+    if (value instanceof Date)
+        return value.toISOString();
+    if (Array.isArray(value))
+        return value.map((entry) => normalize(entry, volatile));
+    if (value === null || typeof value !== 'object')
+        return value;
+    const result = {};
+    for (const [key, entry] of Object.entries(value)) {
+        if (volatile.has(key))
+            continue;
+        if (topLevel && key === 'id')
+            continue;
+        // A field the caller never set and one set to `undefined` are the same
+        // document. JSON.stringify already drops these; doing it here keeps the
+        // sorted key list honest.
+        if (entry === undefined)
+            continue;
+        result[key] = normalize(entry, volatile);
+    }
+    return result;
+}
+/**
+ * `JSON.stringify` with object keys in sorted order, so that two documents
+ * differing only in key order hash the same. Payload reads blocks back out
+ * of JSONB, and neither Postgres nor the JSON parser promises to hand them
+ * back in the order they went in.
+ *
+ * Array order is meaningful — it is the order of the blocks on the page —
+ * and is preserved.
+ */
+function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableStringify).join(',')}]`;
+    }
+    if (value !== null && typeof value === 'object') {
+        const entries = Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+        return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+//# sourceMappingURL=content-hash.js.map

package/dist/utils/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../src/utils/content-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAA;AAWlG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAiC,EACjC,UAAsC,EAAE;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE;QAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IAC9D,OAAO,SAAS,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,SAAS,CAAC,KAAc,EAAE,QAAqB,EAAE,QAAQ,GAAG,KAAK;IACxE,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACrD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE7D,MAAM,MAAM,GAA4B,EAAE,CAAA;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC/B,IAAI,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,SAAQ;QACtC,uEAAuE;QACvE,wEAAwE;QACxE,0BAA0B;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAQ;QACjC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IAC1C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IACpD,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3B,CAAA;QACD,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAA;IAC/F,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAA;AACxC,CAAC"}

package/dist/utils/index.d.ts

@@ -1,3 +1,5 @@
 export { shallowDiff } from './diff.js';
+export { documentContentHash } from './content-hash.js';
+export type { DocumentContentHashOptions } from './content-hash.js';
 export { generateId } from './id.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA"}

package/dist/utils/index.js

@@ -1,3 +1,4 @@
 export { shallowDiff } from './diff.js';
+export { documentContentHash } from './content-hash.js';
 export { generateId } from './id.js';
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-core",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Core plumbing for Throughline: audit log, MCP authentication and handler, event taxonomy + Inngest client factory, env handling, logger, shared utilities.",
   "type": "module",
   "main": "./dist/index.js",
@@ -62,7 +62,7 @@
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-plugin-contract": "0.0.0"
+    "@forumone/throughline-plugin-contract": "0.2.1"
   },
   "devDependencies": {
     "@types/node": "^20.17.0",