@forumone/throughline-forms 0.2.1 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +40 -0
- package/dist/tools/create-form.d.ts.map +1 -1
- package/dist/tools/create-form.js +3 -9
- package/dist/tools/create-form.js.map +1 -1
- package/dist/tools/update-form-destinations.d.ts.map +1 -1
- package/dist/tools/update-form-destinations.js +3 -9
- package/dist/tools/update-form-destinations.js.map +1 -1
- package/dist/tools/update-form-fields.d.ts.map +1 -1
- package/dist/tools/update-form-fields.js +3 -9
- package/dist/tools/update-form-fields.js.map +1 -1
- package/package.json +4 -4
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,45 @@
|
|
|
1
1
|
# @forumone/throughline-forms
|
|
2
2
|
|
|
3
|
+
## 0.3.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 9f39ace: Enforce API-key scopes, which until now were only a label
|
|
8
|
+
|
|
9
|
+
The API-keys collection has always had a required `scopes` field, the README has always told you to mint keys with `--scopes publishing.execute`, and the scheduled-publish factory documents that its key "must carry `publishing.execute` scope". Nothing read the field. Every key could do whatever its linked user could, whatever it said on the label.
|
|
10
|
+
|
|
11
|
+
A tool may now declare `requiredScope`, and the handler holds callers to it: the tool is hidden from `tools/list` and refused on a direct call unless the key names that scope. Hidden as well as refused, because an agent shown a tool it will be turned away from will try it, fail, and report the tool as broken when what is narrow is the key.
|
|
12
|
+
|
|
13
|
+
The consequential tools are annotated — `publish`, `unpublish`, `schedule_publish`, `rollback` (`publishing.execute`); `request_approval` (`approvals.request`); `respond_to_approval` (`approvals.decide`); the three form writers (`forms.manage`); `trigger_sync` and `test_integration` (`integrations.trigger`). Reads are left unscoped, which is the right default for a read.
|
|
14
|
+
|
|
15
|
+
**This narrows existing keys.** A key minted with one scope could previously call every tool on every server and now cannot. That is the point, but it will change what an existing MCP client can do — check the scopes on your keys before upgrading. A key carrying no scopes at all passes nothing scoped: absent is read as none, not as everything.
|
|
16
|
+
|
|
17
|
+
### Patch Changes
|
|
18
|
+
|
|
19
|
+
- f138b3d: One audit actor shape for every tool, and stop recording agents as people
|
|
20
|
+
|
|
21
|
+
Ten tools built the audit actor by hand and four of them disagreed. Three were only untidy — a dropped `userName`, conditional spreads, an assumption that `ctx.user` is non-null. The fourth was wrong: the component tools wrote `type: 'user'` unconditionally, so a call made with an API key and no linked user was recorded as a person. An audit log that cannot tell an agent from an editor is not an audit log.
|
|
22
|
+
|
|
23
|
+
`auditContext(ctx, meta)` is now exported from core and used at all eight tool call sites. `type` follows the rule the publishing service already used — a call carrying a user is that user's, one without is the system's — and `apiKeyName` rides along either way, because a key acting for a linked user is still worth naming.
|
|
24
|
+
|
|
25
|
+
It also passes `sessionId` through for the first time. The column has been on the audit collection since it was written and nothing ever filled it; it is what lets somebody reading the log group one conversation's writes instead of reading them one at a time.
|
|
26
|
+
|
|
27
|
+
- Updated dependencies [40839b5]
|
|
28
|
+
- Updated dependencies [9f39ace]
|
|
29
|
+
- Updated dependencies [f138b3d]
|
|
30
|
+
- Updated dependencies [6fac789]
|
|
31
|
+
- @forumone/throughline-core@0.4.0
|
|
32
|
+
- @forumone/throughline-plugin-contract@0.3.0
|
|
33
|
+
- @forumone/throughline-email@0.2.4
|
|
34
|
+
|
|
35
|
+
## 0.2.2
|
|
36
|
+
|
|
37
|
+
### Patch Changes
|
|
38
|
+
|
|
39
|
+
- Updated dependencies [d20f909]
|
|
40
|
+
- @forumone/throughline-core@0.3.0
|
|
41
|
+
- @forumone/throughline-email@0.2.3
|
|
42
|
+
|
|
3
43
|
## 0.2.1
|
|
4
44
|
|
|
5
45
|
### Patch Changes
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-form.d.ts","sourceRoot":"","sources":["../../src/tools/create-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AASxD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"create-form.d.ts","sourceRoot":"","sources":["../../src/tools/create-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AASxD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgCC,CAAC;sBAET,CAAA;kBACe,CAAC;;iBAEJ,CAAC;sBAA4C,CAAC;kBAAwC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAd3G,CAAA;AAEF,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B;AAED,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,cAAc,GACnB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAmEvC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
2
|
+
import { auditContext, withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
3
3
|
import { validateDestinationLabel } from '../destinations.js';
|
|
4
4
|
import { FieldSchema, validateFieldSet, validateSubmitterConfirmation, } from './_field-schema.js';
|
|
5
5
|
import { deniedEnvelope, isFormsAuthor } from './access.js';
|
|
@@ -30,6 +30,7 @@ const inputSchema = withMeta({
|
|
|
30
30
|
export function createCreateFormTool(deps) {
|
|
31
31
|
return {
|
|
32
32
|
name: 'create_form',
|
|
33
|
+
requiredScope: 'forms.manage',
|
|
33
34
|
description: "Creates a form with privacy notice, consent checkbox, and honeypot enabled by default. Destinations must be selected from the allowlist (call list_allowed_destinations first). Field names must be snake_case; every field needs a label (accessibility); submitterConfirmation, if enabled, must point to an existing email-typed field on the form.",
|
|
34
35
|
inputSchema,
|
|
35
36
|
handler: async (input, ctx) => {
|
|
@@ -65,20 +66,13 @@ export function createCreateFormTool(deps) {
|
|
|
65
66
|
}));
|
|
66
67
|
const auditWriter = getAuditWriter(deps.payload);
|
|
67
68
|
await auditWriter({
|
|
68
|
-
|
|
69
|
-
type: 'user',
|
|
70
|
-
...(ctx.user?.id ? { userId: ctx.user.id } : {}),
|
|
71
|
-
...(ctx.user?.name ? { userName: ctx.user.name } : {}),
|
|
72
|
-
...(ctx.apiKeyName ? { apiKeyName: ctx.apiKeyName } : {}),
|
|
73
|
-
},
|
|
69
|
+
...auditContext(ctx, input._meta),
|
|
74
70
|
action: 'form.created',
|
|
75
71
|
mcpServer: 'forms',
|
|
76
72
|
mcpTool: 'create_form',
|
|
77
73
|
targetCollection: deps.resolved.formsCollectionSlug,
|
|
78
74
|
targetId: String(created['id']),
|
|
79
75
|
targetTitle: input.title,
|
|
80
|
-
...(input._meta?.userPrompt ? { prompt: input._meta.userPrompt } : {}),
|
|
81
|
-
...(input._meta?.reasoning ? { reasoning: input._meta.reasoning } : {}),
|
|
82
76
|
changesSummary: `Created form "${input.title}" with ${input.fields.length} fields, destinations: ${input.destinationLabels.join(', ')}.`,
|
|
83
77
|
});
|
|
84
78
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-form.js","sourceRoot":"","sources":["../../src/tools/create-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;
|
|
1
|
+
{"version":3,"file":"create-form.js","sourceRoot":"","sources":["../../src/tools/create-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,6BAA6B,GAC9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,CAAC,iFAAiF,CAAC;IAC9F,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yEAAyE,CAAC;IACtF,qBAAqB,EAAE,CAAC;SACrB,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC5B,CAAC;SACD,QAAQ,EAAE;IACb,qBAAqB,EAAE,CAAC;SACrB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,gEAAgE,CAAC;CAC9E,CAAC,CAAA;AAOF,MAAM,UAAU,oBAAoB,CAClC,IAAoB;IAEpB,OAAO;QACL,IAAI,EAAE,aAAa;QACnB,aAAa,EAAE,cAAc;QAC7B,WAAW,EACT,wVAAwV;QAC1V,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,2CAA2C,CAAC,CAAA;YACpE,CAAC;YAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,IAAI,mCAAmC,CAAC,CAAA;YAC3F,CAAC;YAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,UAAU,CAAC,MAAO,CAAC,CAAA;YAE7D,MAAM,iBAAiB,GAAG,6BAA6B,CACrD,KAAK,CAAC,qBAAqB,EAC3B,KAAK,CAAC,MAAM,CACb,CAAA;YACD,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,iBAAiB,CAAC,MAAO,CAAC,CAAA;YAE3E,MAAM,MAAM,GAA4B;gBACtC,iBAAiB,EAAE,KAAK,CAAC,qBAAqB,IAAI,IAAI,CAAC,QAAQ,CAAC,oBAAoB;gBACpF,uBAAuB,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB;gBAC9D,YAAY,EAAE,0DAA0D;gBACxE,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;gBACtE,YAAY,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE;aACzE,CAAA;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBAC7C,IAAI,EAAE;oBACJ,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM;iBACP;aACF,CAAC,CAA4B,CAAA;YAE9B,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,WAAW,CAAC;gBAChB,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,aAAa;gBACtB,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC/B,WAAW,EAAE,KAAK,CAAC,KAAK;gBACxB,cAAc,EAAE,iBAAiB,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,MAAM,CAAC,MAAM,0BAA0B,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACzI,CAAC,CAAA;YAEF,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,YAAY,EAAE,KAAK,CAAC,iBAAiB;gBACrC,aAAa,EAAE,SAAS;gBACxB,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,uBAAuB;gBAC9C,QAAQ,EAAE,IAAI;gBACd,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,OAAO,IAAI,KAAK;aACrE,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"update-form-destinations.d.ts","sourceRoot":"","sources":["../../src/tools/update-form-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAIxD,QAAA,MAAM,WAAW;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"update-form-destinations.d.ts","sourceRoot":"","sources":["../../src/tools/update-form-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAIxD,QAAA,MAAM,WAAW;;;;;;;;;iBA0BoB,CAAC;sBAA4C,CAAC;kBAE3E,CAAF;;iBAAgD,CAAC;sBAChC,CAAA;kBAAwC,CAAC;;;;;;;;;;;;;;;;;;EA1B9D,CAAA;AAEF,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B;AAED,wBAAgB,gCAAgC,CAC9C,IAAI,EAAE,0BAA0B,GAC/B,iBAAiB,CAAC,OAAO,WAAW,CAAC,CA8DvC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
2
|
+
import { auditContext, withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
3
3
|
import { validateDestinationLabel } from '../destinations.js';
|
|
4
4
|
import { deniedEnvelope, isFormsAuthor } from './access.js';
|
|
5
5
|
const inputSchema = withMeta({
|
|
@@ -9,6 +9,7 @@ const inputSchema = withMeta({
|
|
|
9
9
|
export function createUpdateFormDestinationsTool(deps) {
|
|
10
10
|
return {
|
|
11
11
|
name: 'update_form_destinations',
|
|
12
|
+
requiredScope: 'forms.manage',
|
|
12
13
|
description: "Replaces a form's destinations with the given labels. Every label must be on the allowlist (use list_allowed_destinations to discover). The replace-all semantics are deliberate — incremental destination edits are too easy to misuse via prompt injection.",
|
|
13
14
|
inputSchema,
|
|
14
15
|
handler: async (input, ctx) => {
|
|
@@ -48,20 +49,13 @@ export function createUpdateFormDestinationsTool(deps) {
|
|
|
48
49
|
});
|
|
49
50
|
const auditWriter = getAuditWriter(deps.payload);
|
|
50
51
|
await auditWriter({
|
|
51
|
-
|
|
52
|
-
type: 'user',
|
|
53
|
-
...(ctx.user?.id ? { userId: ctx.user.id } : {}),
|
|
54
|
-
...(ctx.user?.name ? { userName: ctx.user.name } : {}),
|
|
55
|
-
...(ctx.apiKeyName ? { apiKeyName: ctx.apiKeyName } : {}),
|
|
56
|
-
},
|
|
52
|
+
...auditContext(ctx, input._meta),
|
|
57
53
|
action: 'form.updated',
|
|
58
54
|
mcpServer: 'forms',
|
|
59
55
|
mcpTool: 'update_form_destinations',
|
|
60
56
|
targetCollection: deps.resolved.formsCollectionSlug,
|
|
61
57
|
targetId: input.formId,
|
|
62
58
|
targetTitle: typeof existing['title'] === 'string' ? existing['title'] : undefined,
|
|
63
|
-
...(input._meta?.userPrompt ? { prompt: input._meta.userPrompt } : {}),
|
|
64
|
-
...(input._meta?.reasoning ? { reasoning: input._meta.reasoning } : {}),
|
|
65
59
|
changesSummary: `Set destinations to: ${input.destinationLabels.join(', ')}.`,
|
|
66
60
|
});
|
|
67
61
|
return {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"update-form-destinations.js","sourceRoot":"","sources":["../../src/tools/update-form-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;
|
|
1
|
+
{"version":3,"file":"update-form-destinations.js","sourceRoot":"","sources":["../../src/tools/update-form-destinations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9C,CAAC,CAAA;AAOF,MAAM,UAAU,gCAAgC,CAC9C,IAAgC;IAEhC,OAAO;QACL,IAAI,EAAE,0BAA0B;QAChC,aAAa,EAAE,cAAc;QAC7B,WAAW,EACT,+PAA+P;QACjQ,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,uDAAuD,CAAC,CAAA;YAChF,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;oBAAE,OAAO,cAAc,CAAC,gCAAgC,KAAK,IAAI,CAAC,CAAA;gBACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;gBACf,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;gBACpE,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,IAAI,mCAAmC,CAAC,CAAA;YAC3F,CAAC;YAED,IAAI,QAAQ,GAAmC,IAAI,CAAA;YACnD,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;oBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;iBACjB,CAAC,CAAmC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,cAAc,CAAC,oBAAoB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;YAE1E,MAAM,MAAM,GAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAA;YACtE,MAAM,aAAa,GAAG;gBACpB,GAAG,MAAM;gBACT,YAAY,EAAE,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;aACjF,CAAA;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;gBAChB,IAAI,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;aAChC,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,WAAW,CAAC;gBAChB,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,0BAA0B;gBACnC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9F,cAAc,EAAE,wBAAwB,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAC9E,CAAC,CAAA;YAEF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,YAAY,EAAE,KAAK,CAAC,iBAAiB;aACtC,CAAA;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"update-form-fields.d.ts","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AASxD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"update-form-fields.d.ts","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uCAAuC,CAAA;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AASxD,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB0C,CAAC;sBAEzB,CAAC;kBAE5B,CAAD;;iBACG,CAAJ;sBAA4C,CAAC;kBAE3C,CAAD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA7BL,CAAA;AAEF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,QAAQ,EAAE,mBAAmB,CAAA;CAC9B;AAED,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,oBAAoB,GACzB,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAoDvC"}
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from 'zod';
|
|
2
|
-
import { withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
2
|
+
import { auditContext, withMeta, getAuditWriter } from '@forumone/throughline-core';
|
|
3
3
|
import { FieldSchema, validateFieldSet, validateSubmitterConfirmation, } from './_field-schema.js';
|
|
4
4
|
import { deniedEnvelope, isFormsAuthor } from './access.js';
|
|
5
5
|
const inputSchema = withMeta({
|
|
@@ -9,6 +9,7 @@ const inputSchema = withMeta({
|
|
|
9
9
|
export function createUpdateFormFieldsTool(deps) {
|
|
10
10
|
return {
|
|
11
11
|
name: 'update_form_fields',
|
|
12
|
+
requiredScope: 'forms.manage',
|
|
12
13
|
description: 'Replaces the fields on an existing form. Re-runs the same accessibility / submitter-confirmation checks `create_form` runs against the form\'s current submitterConfirmation config so existing email-field references stay valid.',
|
|
13
14
|
inputSchema,
|
|
14
15
|
handler: async (input, ctx) => {
|
|
@@ -42,20 +43,13 @@ export function createUpdateFormFieldsTool(deps) {
|
|
|
42
43
|
});
|
|
43
44
|
const auditWriter = getAuditWriter(deps.payload);
|
|
44
45
|
await auditWriter({
|
|
45
|
-
|
|
46
|
-
type: 'user',
|
|
47
|
-
...(ctx.user?.id ? { userId: ctx.user.id } : {}),
|
|
48
|
-
...(ctx.user?.name ? { userName: ctx.user.name } : {}),
|
|
49
|
-
...(ctx.apiKeyName ? { apiKeyName: ctx.apiKeyName } : {}),
|
|
50
|
-
},
|
|
46
|
+
...auditContext(ctx, input._meta),
|
|
51
47
|
action: 'form.updated',
|
|
52
48
|
mcpServer: 'forms',
|
|
53
49
|
mcpTool: 'update_form_fields',
|
|
54
50
|
targetCollection: deps.resolved.formsCollectionSlug,
|
|
55
51
|
targetId: input.formId,
|
|
56
52
|
targetTitle: typeof existing['title'] === 'string' ? existing['title'] : undefined,
|
|
57
|
-
...(input._meta?.userPrompt ? { prompt: input._meta.userPrompt } : {}),
|
|
58
|
-
...(input._meta?.reasoning ? { reasoning: input._meta.reasoning } : {}),
|
|
59
53
|
changesSummary: `Replaced form fields (${input.fields.length} fields).`,
|
|
60
54
|
});
|
|
61
55
|
return { ok: true, formId: input.formId, fieldCount: input.fields.length };
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"update-form-fields.js","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;
|
|
1
|
+
{"version":3,"file":"update-form-fields.js","sourceRoot":"","sources":["../../src/tools/update-form-fields.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAEnF,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,6BAA6B,GAE9B,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAE3D,MAAM,WAAW,GAAG,QAAQ,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CACpC,CAAC,CAAA;AAOF,MAAM,UAAU,0BAA0B,CACxC,IAA0B;IAE1B,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,aAAa,EAAE,cAAc;QAC7B,WAAW,EACT,oOAAoO;QACtO,WAAW;QACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,iDAAiD,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACjD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,UAAU,CAAC,MAAO,CAAC,CAAA;YAE7D,IAAI,QAAQ,GAAmC,IAAI,CAAA;YACnD,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACtC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;oBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;iBACjB,CAAC,CAAmC,CAAA;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,IAAI,CAAA;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ;gBAAE,OAAO,cAAc,CAAC,oBAAoB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;YAE1E,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAA;YACpE,MAAM,qBAAqB,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,IAAI,EAAE,CAAgC,CAAA;YACpG,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAA;YAC5F,IAAI,CAAC,iBAAiB,CAAC,EAAE;gBAAE,OAAO,cAAc,CAAC,iBAAiB,CAAC,MAAO,CAAC,CAAA;YAE3E,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBACxB,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBAC7C,EAAE,EAAE,KAAK,CAAC,MAAM;gBAChB,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;aAC/B,CAAC,CAAA;YAEF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAChD,MAAM,WAAW,CAAC;gBAChB,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;gBACjC,MAAM,EAAE,cAAc;gBACtB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,oBAAoB;gBAC7B,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,mBAAmB;gBACnD,QAAQ,EAAE,KAAK,CAAC,MAAM;gBACtB,WAAW,EAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,QAAQ,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS;gBAC9F,cAAc,EAAE,yBAAyB,KAAK,CAAC,MAAM,CAAC,MAAM,WAAW;aACxE,CAAC,CAAA;YAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@forumone/throughline-forms",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.3.0",
|
|
4
4
|
"description": "Policy-aware forms layer for the Throughline framework. Wraps Payload's Form Builder with privacy notices, consent, honeypot spam protection, IP rate limiting, a destination allowlist, and submitter confirmation. Six MCP tools for Claude-driven form management; submissions fan out to email and webhook destinations via Inngest.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -46,9 +46,9 @@
|
|
|
46
46
|
"@react-email/components": "^0.5.4",
|
|
47
47
|
"@react-email/render": "^1.3.2",
|
|
48
48
|
"zod": "^3.23.0",
|
|
49
|
-
"@forumone/throughline-core": "0.
|
|
50
|
-
"@forumone/throughline-email": "0.2.
|
|
51
|
-
"@forumone/throughline-plugin-contract": "0.
|
|
49
|
+
"@forumone/throughline-core": "0.4.0",
|
|
50
|
+
"@forumone/throughline-email": "0.2.4",
|
|
51
|
+
"@forumone/throughline-plugin-contract": "0.3.0"
|
|
52
52
|
},
|
|
53
53
|
"devDependencies": {
|
|
54
54
|
"@payloadcms/plugin-form-builder": "3.83.0",
|