@forumone/throughline-plugin-contract 0.3.0 → 0.4.0

package/README.md

@@ -5,9 +5,9 @@ Shared type contracts every Throughline core plugin satisfies, plus the cross-pl
 ## What's in here
 
 - `CorePlugin<Options>` — the Payload plugin signature every core package exports
-- `BaseCorePluginOptions` — options every plugin accepts (`enabled`, `routePrefix`, `logger`)
-- `McpToolDefinition`, `McpToolContext`, `McpMeta` — the MCP server surface
-- `McpAuthenticator`, `McpAuthResult`, `AuthenticatedUser` — shared bearer-token auth types
+- `BaseCorePluginOptions` — options every plugin accepts (`enabled`, `logger`, and `routePrefix` for a plugin that serves HTTP endpoints of its own)
+- `McpToolDefinition`, `McpToolContext`, `McpMeta` — the MCP tool surface
+- `AuthenticatedUser` — the actor a tool handler receives
 - `getPluginRegistry` — the runtime registry plugins use to announce themselves and check for sibling plugins
 - `examplePlugin` — a reference implementation showing the exact shape every future plugin follows
 

package/dist/index.d.ts

@@ -7,9 +7,15 @@ export interface BaseCorePluginOptions {
     /** Enable or disable the plugin without removing it from the config. Defaults to `true`. */
     enabled?: boolean;
     /**
-     * Route prefix the plugin mounts its MCP server and API endpoints under.
-     * Defaults to a plugin-specific value (e.g. `/api/publishing`). Override
-     * to avoid collisions or to expose under a different path.
+     * Route prefix the plugin mounts its HTTP endpoints under. Defaults to a
+     * plugin-specific value (e.g. `/api/publishing`). Override to avoid
+     * collisions or to expose under a different path.
+     *
+     * MCP is not among those endpoints any more: tools reach a client through
+     * the host's `@payloadcms/plugin-mcp`, on one `/api/mcp`. A plugin serving
+     * no HTTP endpoints of its own omits this option rather than accepting one
+     * it cannot honour — see `auditQueryPlugin`, `componentsPlugin` and
+     * `integrationsPlugin`.
      */
     routePrefix?: string;
     /** Logger used for plugin diagnostics. Falls back to a console logger if omitted. */
@@ -27,6 +33,5 @@ export interface Logger {
  */
 export type CorePlugin<Options extends BaseCorePluginOptions = BaseCorePluginOptions> = (options: Options) => Plugin;
 export * from './mcp.js';
-export * from './auth.js';
 export * from './registry.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACpE;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,qBAAqB,GAAG,qBAAqB,IAAI,CACtF,OAAO,EAAE,OAAO,KACb,MAAM,CAAA;AAEX,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAErC;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,4FAA4F;IAC5F,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IAClE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;CACpE;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,qBAAqB,GAAG,qBAAqB,IAAI,CACtF,OAAO,EAAE,OAAO,KACb,MAAM,CAAA;AAEX,cAAc,UAAU,CAAA;AACxB,cAAc,eAAe,CAAA"}

package/dist/index.js

@@ -1,4 +1,3 @@
 export * from './mcp.js';
-export * from './auth.js';
 export * from './registry.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkCA,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwCA,cAAc,UAAU,CAAA;AACxB,cAAc,eAAe,CAAA"}

package/dist/mcp.d.ts

@@ -16,6 +16,17 @@ export interface McpToolDefinition<Input extends z.ZodType = z.ZodType, Output =
      * Declared on the consequential tools — the ones that write, publish or
      * decide. A tool with no `requiredScope` is callable by any authenticated
      * key, which is the right default for a read.
+     *
+     * **Nothing enforces this today.** The per-server JSON-RPC handler that read
+     * it is gone, and `@payloadcms/plugin-mcp` gates on per-key checkboxes it
+     * generates at config time instead — which this suite cannot fill, because
+     * every tool is built at `onInit`. So a key that authenticates reaches every
+     * collected tool.
+     *
+     * Kept, rather than deleted with its enforcer, because this is the tool → scope
+     * mapping those checkboxes need: it is the input to restoring gating, not a
+     * leftover. Deleting it would mean re-deriving eleven declarations by hand.
+     * Tracked as #78.
      */
     requiredScope?: string;
     /** Handler invoked with validated input plus per-request context. */

package/dist/mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IACtF,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,WAAW,EAAE,KAAK,CAAA;IAClB;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC;;GAEG;AACH,MAAM,WAAW,iBAAiB,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IACtF,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,WAAW,EAAE,MAAM,CAAA;IACnB,4FAA4F;IAC5F,WAAW,EAAE,KAAK,CAAA;IAClB;;;;;;;;;;;;;;;;;OAiBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC9B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAA;IAClB,uDAAuD;IACvD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-plugin-contract",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Shared plugin and MCP contract types and the cross-plugin registry for @forumone/throughline core packages.",
   "license": "MIT",
   "repository": {

package/dist/auth.d.ts

@@ -1,30 +0,0 @@
-import type { AuthenticatedUser } from './mcp.js';
-/**
- * Validates an incoming MCP request and resolves the caller's identity.
- * Plugins accept an optional `authenticator` option; if omitted they fall
- * back to the default Payload bearer-token authenticator.
- */
-export interface McpAuthenticator {
-    /**
-     * Inspects the `Authorization` header on the request and returns an
-     * {@link McpAuthResult} if the token is valid, or `null` otherwise.
-     */
-    authenticate(request: Request): Promise<McpAuthResult | null>;
-}
-export interface McpAuthResult {
-    user: AuthenticatedUser;
-    apiKeyName: string;
-    apiKeyId: string;
-    /**
-     * What this key was granted, from the key record. A tool declaring a
-     * `requiredScope` is refused — and hidden from `tools/list` — unless it is
-     * named here.
-     *
-     * Optional so an authenticator predating scopes still type-checks; absent is
-     * read as "no scopes", which refuses every scoped tool rather than allowing
-     * them. A key that cannot say what it may do may not do the consequential
-     * things.
-     */
-    scopes?: string[];
-}
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAEjD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,iBAAiB,CAAA;IACvB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB"}

package/dist/auth.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":""}