@forumone/throughline-core 0.7.0 → 0.8.1

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # @forumone/throughline-core
 
+## 0.8.1
+
+### Patch Changes
+
+- 957403b: One `@types/node`, so a host does not end up with two copies of `@payloadcms/ui`
+
+  Twelve packages asked for `@types/node@^20.17.0` and `design-system-payload`
+  asked for `^24.13.2`. Inside this repository that is untidy. Inside a host that
+  consumes the suite from source — which is how `forumone/forumone-2026` uses it,
+  as a git submodule in one pnpm workspace — it is a runtime failure.
+
+  pnpm hashes a package's identity with its resolved peers. `publishing` and
+  `integrations` both take `@payloadcms/ui` as a peer _and_ as a devDependency, so
+  each got its own copy resolved against `@types/node@20`, while the host's copy
+  resolved against `@types/node@24`. Same version, 3.87.1, two directories:
+
+      apps/web                     → @payloadcms+ui@3.87.1_…_9ce0de5c…
+      packages/publishing          → @payloadcms+ui@3.87.1_…_13184ec4…
+      packages/integrations        → @payloadcms+ui@3.87.1_…_13184ec4…
+
+  Two directories are two module instances. Two instances of `@payloadcms/ui` are
+  two `ConfigContext` objects, and `PublishButton` read the one the admin's
+  provider had never populated:
+
+      TypeError: Cannot destructure property 'config' of useConfig() as it is undefined
+
+  The host saw an intermittent 500 on every admin document view — `PublishButton`
+  is installed on each collection with a publish policy, so lists, `/admin` and
+  the login screen were all fine and only editing broke. Nothing caught it:
+  install, `--frozen-lockfile`, typecheck, lint and every test passed, because the
+  two copies are byte-identical and the split exists only at module resolution.
+  forumone/forumone-2026#498.
+
+  Aligning on `^24.13.2` collapses them to one instance. Nothing here targets a
+  Node 20 API deliberately; the packages typecheck and test unchanged against the
+  newer types.
+
+  `create-throughline` keeps `^20.17.0` on purpose. It is the one package
+  declaring `engines.node: >=20.9.0`, and typechecking a CLI against types newer
+  than the runtime it promises to support is how a Node 24-only call ships to
+  somebody on Node 20.
+
+- Updated dependencies [957403b]
+  - @forumone/throughline-plugin-contract@0.4.1
+
+## 0.8.0
+
+### Minor Changes
+
+- a9262da: Per-tool gating works, because tool names no longer wait for `onInit`
+
+  `@payloadcms/plugin-mcp` generates one per-key checkbox per tool while the host's
+  config is being built, and then gates every call on the checkbox matching the
+  tool's name. Every Throughline tool was built at `onInit` — each closes over
+  `payload`, the publishing service or the manifest loader — so the array it maps
+  over was empty, no checkboxes were generated, and its `?? false` denied all 27
+  tools to every key. A valid key got a 200 and an empty `tools/list`, with nothing
+  wrong on either side.
+
+  The plugin needs only `name` and `description` then, and neither needs a Payload.
+  So a server now **declares** its tools as the config is built and **binds** their
+  handlers at `onInit`:
+
+  ```ts
+  options.mcpTools?.declare(PUBLISHING_TOOL_DESCRIPTORS, { serverName: 'publishing' })
+  // …later, at onInit:
+  options.mcpTools?.add(tools, { serverName: 'publishing' })
+  ```
+
+  Each package gained a `tools/descriptors.ts` holding every tool's name and
+  description; the factories spread from it, so the checkbox and the MCP client
+  cannot describe a tool differently. A `descriptors.test.ts` in each package
+  asserts the two sets match, without needing a database.
+
+  `createMcpToolCollector` gains `declare()` and an `unbound` list. Both mismatches
+  are refused rather than absorbed: a tool built but never declared throws at
+  `onInit` (it would otherwise be denied to every key, silently), and a tool
+  declared but never bound stays advertised with a handler that explains itself.
+
+  **Order in the host's plugin array is now load-bearing.** Every tool-bearing
+  server must come before `mcpPlugin`, or it declares into an array that has
+  already been read. It was only a convention before; it is a requirement now, and
+  the failure mode — a server's tools missing from every key — is the one this
+  change exists to remove.
+
+  `requiredScope` stays declared and read by nothing. Enforcement is the checkbox;
+  these record which tools are consequential, and are the mapping a scope-aware
+  default would be built from.
+
+  The playground registers `mcpPlugin` for the first time, so the suite's only
+  end-to-end host now exercises the tools rather than just their composition.
+
 ## 0.7.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { AuditAction, AuditActor, AuditCollectionOptions, AuditEventInput,
 export { createInngestClient } from './events/index.js';
 export type { CoreEvents, FrameworkEvents, InngestClientOptions } from './events/index.js';
 export { McpMetaSchema, auditContext, deniedEnvelope, createMcpToolCollector, toPayloadMcpTool, toPayloadMcpTools, withMeta, } from './mcp/index.js';
-export type { AddToolsOptions, AuditContextFields, CreateMcpToolCollectorOptions, McpMeta, McpToolCollector, PayloadMcpRequest, PayloadMcpTool, ToPayloadMcpToolOptions, } from './mcp/index.js';
+export type { AddToolsOptions, AuditContextFields, CreateMcpToolCollectorOptions, DeclareToolsOptions, McpMeta, McpToolCollector, McpToolDescriptor, PayloadMcpRequest, PayloadMcpTool, ToPayloadMcpToolOptions, } from './mcp/index.js';
 export { defaultLogger, createNamedLogger } from './logger/index.js';
 export { documentContentHash, formatZodIssues, sha256Hex, unwrapRelationshipId, } from './utils/index.js';
 export type { DocumentContentHashOptions } from './utils/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,6BAA6B,EAC7B,OAAO,EACP,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAIlE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,uCAAuC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,YAAY,EACV,WAAW,EACX,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,WAAW,EACX,kBAAkB,GACnB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAE1F,OAAO,EACL,aAAa,EACb,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,MAAM,gBAAgB,CAAA;AACvB,YAAY,EACV,eAAe,EACf,kBAAkB,EAClB,6BAA6B,EAC7B,mBAAmB,EACnB,OAAO,EACP,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAIlE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,UAAU,EACV,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,mBAAmB,GACpB,MAAM,uCAAuC,CAAA"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4DAA4D;AAE5D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,MAAM,gBAAgB,CAAA;AAYvB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4DAA4D;AAE5D,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GACf,MAAM,kBAAkB,CAAA;AAYzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAGvD,OAAO,EACL,aAAa,EACb,YAAY,EACZ,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,QAAQ,GACT,MAAM,gBAAgB,CAAA;AAcvB,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA"}

package/dist/mcp/collector.d.ts

@@ -1,18 +1,33 @@
 import type { McpToolDefinition } from '@forumone/throughline-plugin-contract';
 import { type PayloadMcpTool, type ToPayloadMcpToolOptions } from './payload-mcp.js';
+/** What `plugin-mcp` needs about a tool while the config is being built. */
+export interface McpToolDescriptor {
+    name: string;
+    description: string;
+}
 export interface McpToolCollector {
     /**
-     * The array to hand `mcpPlugin`. Empty until the plugins initialise, and the
-     * same array afterwards — do not copy or spread it at config time, or the
-     * tools will be added to something nobody reads.
+     * The array to hand `mcpPlugin`. Filled by `declare` at config time and
+     * completed by `add` at `onInit` — and the same array throughout, so do not
+     * copy or spread it, or the tools will be added to something nobody reads.
      */
     readonly tools: PayloadMcpTool[];
-    /** Called by a plugin at `onInit`, once it can build its tools. */
+    /**
+     * Called by a plugin as the config is built, with its tools' names and
+     * descriptions. This is what `plugin-mcp` turns into per-key checkboxes.
+     */
+    declare(descriptors: readonly McpToolDescriptor[], options?: DeclareToolsOptions): void;
+    /** Called by a plugin at `onInit`, once it can build its handlers. */
     add(tools: McpToolDefinition[], options?: AddToolsOptions): void;
-    /** Which servers have contributed, in the order they initialised. */
+    /** Which servers have declared, in the order they did. */
     readonly servers: string[];
+    /**
+     * Tools declared and never bound. Empty after every server's `onInit` has
+     * run; anything left is a server that declared a tool it does not build.
+     */
+    readonly unbound: string[];
 }
-export interface AddToolsOptions extends ToPayloadMcpToolOptions {
+export interface DeclareToolsOptions {
     /**
      * Which server these came from — `'publishing'`, `'approvals'`. Used to name
      * both sides of a duplicate-name collision, which is the only thing that
@@ -20,6 +35,8 @@ export interface AddToolsOptions extends ToPayloadMcpToolOptions {
      */
     serverName?: string;
 }
+export interface AddToolsOptions extends ToPayloadMcpToolOptions, DeclareToolsOptions {
+}
 export type CreateMcpToolCollectorOptions = ToPayloadMcpToolOptions;
 /**
  * Somewhere for the plugins to put their tools, that the host can pass to

package/dist/mcp/collector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../src/mcp/collector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAC9E,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AA6BvG,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,CAAA;IAChC,mEAAmE;IACnE,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAChE,qEAAqE;IACrE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,eAAgB,SAAQ,uBAAuB;IAC9D;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,MAAM,6BAA6B,GAAG,uBAAuB,CAAA;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,6BAAkC,GAC1C,gBAAgB,CA2BlB"}
+{"version":3,"file":"collector.d.ts","sourceRoot":"","sources":["../../src/mcp/collector.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAC9E,OAAO,EAAqB,KAAK,cAAc,EAAE,KAAK,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AA4CvG,4EAA4E;AAC5E,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,CAAA;IAChC;;;OAGG;IACH,OAAO,CAAC,WAAW,EAAE,SAAS,iBAAiB,EAAE,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAAA;IACvF,sEAAsE;IACtE,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAA;IAChE,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,eAAgB,SAAQ,uBAAuB,EAAE,mBAAmB;CAAG;AAExF,MAAM,MAAM,6BAA6B,GAAG,uBAAuB,CAAA;AAEnE;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,6BAAkC,GAC1C,gBAAgB,CA+ElB"}

package/dist/mcp/collector.js

@@ -11,24 +11,67 @@ import { toPayloadMcpTools } from './payload-mcp.js';
 export function createMcpToolCollector(options = {}) {
     const tools = [];
     const servers = [];
-    const byName = new Map();
+    const declaredBy = new Map();
+    const slots = new Map();
+    const bound = new Set();
     return {
         tools,
         servers,
-        add(incoming, addOptions = {}) {
-            const { serverName = 'an unnamed server', ...toolOptions } = addOptions;
-            for (const tool of incoming) {
-                const existing = byName.get(tool.name);
+        get unbound() {
+            return [...declaredBy.keys()].filter(name => !bound.has(name));
+        },
+        declare(descriptors, declareOptions = {}) {
+            const { serverName = 'an unnamed server' } = declareOptions;
+            for (const descriptor of descriptors) {
+                const existing = declaredBy.get(descriptor.name);
                 if (existing !== undefined) {
-                    throw new Error(`Two MCP tools are called "${tool.name}" — one from ${existing}, one from ` +
+                    throw new Error(`Two MCP tools are called "${descriptor.name}" — one from ${existing}, one from ` +
                         `${serverName}. Under a single MCP server a tool name is a namespace, and a client ` +
                         `offered both gets whichever registered last. Rename one.`);
                 }
-                byName.set(tool.name, serverName);
+                declaredBy.set(descriptor.name, serverName);
+                /*
+                A slot, not a tool. `name` and `description` are everything the plugin
+                reads now; `parameters` and `handler` arrive at `onInit`, on this same
+                object, because the array identity is what the host handed over.
+                */
+                const slot = {
+                    name: descriptor.name,
+                    description: descriptor.description,
+                    parameters: {},
+                    handler: () => {
+                        throw new Error(`MCP tool "${descriptor.name}" was declared by ${serverName} and never bound. ` +
+                            `A server declares its tools as the config is built and binds their handlers at ` +
+                            `onInit; this one did not reach the second step, so the tool is advertised and ` +
+                            `cannot run.`);
+                    },
+                };
+                slots.set(descriptor.name, slot);
+                tools.push(slot);
             }
-            tools.push(...toPayloadMcpTools(incoming, { ...options, ...toolOptions }));
             servers.push(serverName);
         },
+        add(incoming, addOptions = {}) {
+            const { serverName = 'an unnamed server', ...toolOptions } = addOptions;
+            for (const tool of toPayloadMcpTools(incoming, { ...options, ...toolOptions })) {
+                const slot = slots.get(tool.name);
+                if (!slot) {
+                    throw new Error(`${serverName} built an MCP tool called "${tool.name}" that it never declared. ` +
+                        `Add it to that package's tool descriptors: a tool the collector does not know ` +
+                        `about while the config is built gets no per-key checkbox, and \`plugin-mcp\` ` +
+                        `then denies it to every key with no error anywhere.`);
+                }
+                /*
+                Mutated rather than replaced. `mcpPlugin` was handed this array at config
+                time and reads it per request; swapping the element would leave the
+                checkbox pointing at an object nobody serves.
+                */
+                slot.description = tool.description;
+                slot.parameters = tool.parameters;
+                slot.handler = tool.handler;
+                bound.add(tool.name);
+            }
+        },
     };
 }
 //# sourceMappingURL=collector.js.map

package/dist/mcp/collector.js.map

@@ -1 +1 @@
-{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../src/mcp/collector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAqD,MAAM,kBAAkB,CAAA;AAqDvG;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IAExC,OAAO;QACL,KAAK;QACL,OAAO;QACP,GAAG,CAAC,QAAQ,EAAE,UAAU,GAAG,EAAE;YAC3B,MAAM,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAA;YAEvE,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,IAAI,gBAAgB,QAAQ,aAAa;wBACzE,GAAG,UAAU,uEAAuE;wBACpF,0DAA0D,CAC7D,CAAA;gBACH,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;YACnC,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC,CAAA;YAC1E,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"collector.js","sourceRoot":"","sources":["../../src/mcp/collector.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAqD,MAAM,kBAAkB,CAAA;AAsFvG;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAyC,EAAE;IAE3C,MAAM,KAAK,GAAqB,EAAE,CAAA;IAClC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAE/B,OAAO;QACL,KAAK;QACL,OAAO;QACP,IAAI,OAAO;YACT,OAAO,CAAC,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,OAAO,CAAC,WAAW,EAAE,cAAc,GAAG,EAAE;YACtC,MAAM,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,cAAc,CAAA;YAE3D,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;oBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,UAAU,CAAC,IAAI,gBAAgB,QAAQ,aAAa;wBAC/E,GAAG,UAAU,uEAAuE;wBACpF,0DAA0D,CAC7D,CAAA;gBACH,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;gBAE3C;;;;kBAIE;gBACF,MAAM,IAAI,GAAmB;oBAC3B,IAAI,EAAE,UAAU,CAAC,IAAI;oBACrB,WAAW,EAAE,UAAU,CAAC,WAAW;oBACnC,UAAU,EAAE,EAAE;oBACd,OAAO,EAAE,GAAG,EAAE;wBACZ,MAAM,IAAI,KAAK,CACb,aAAa,UAAU,CAAC,IAAI,qBAAqB,UAAU,oBAAoB;4BAC7E,iFAAiF;4BACjF,gFAAgF;4BAChF,aAAa,CAChB,CAAA;oBACH,CAAC;iBACF,CAAA;gBACD,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;gBAChC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAClB,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC1B,CAAC;QAED,GAAG,CAAC,QAAQ,EAAE,UAAU,GAAG,EAAE;YAC3B,MAAM,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,WAAW,EAAE,GAAG,UAAU,CAAA;YAEvE,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,GAAG,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,8BAA8B,IAAI,CAAC,IAAI,4BAA4B;wBAC9E,gFAAgF;wBAChF,+EAA+E;wBAC/E,qDAAqD,CACxD,CAAA;gBACH,CAAC;gBAED;;;;kBAIE;gBACF,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;gBACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;gBACjC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;gBAC3B,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACtB,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/mcp/index.d.ts

@@ -5,6 +5,6 @@ export type { AuditContextFields } from './audit-context.js';
 export { toPayloadMcpTool, toPayloadMcpTools } from './payload-mcp.js';
 export type { PayloadMcpRequest, PayloadMcpTool, ToPayloadMcpToolOptions, } from './payload-mcp.js';
 export { createMcpToolCollector } from './collector.js';
-export type { AddToolsOptions, CreateMcpToolCollectorOptions, McpToolCollector, } from './collector.js';
+export type { AddToolsOptions, CreateMcpToolCollectorOptions, DeclareToolsOptions, McpToolCollector, McpToolDescriptor, } from './collector.js';
 export { deniedEnvelope } from './envelope.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtE,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtE,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA"}

package/dist/mcp/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAOtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AAOvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AAOtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AASvD,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-core",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Core plumbing for Throughline: audit log, MCP authentication and handler, event taxonomy + Inngest client factory, logger, shared utilities.",
   "type": "module",
   "main": "./dist/index.js",
@@ -58,10 +58,10 @@
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-plugin-contract": "0.4.0"
+    "@forumone/throughline-plugin-contract": "0.4.1"
   },
   "devDependencies": {
-    "@types/node": "^20.17.0",
+    "@types/node": "^24.13.2",
     "eslint": "^9.15.0",
     "inngest": "^4.2.0",
     "payload": "^3.83.0",