@forumone/throughline 1.1.0 → 1.2.0-next-17f8d7c

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @forumone/throughline
 
+## 1.2.0-next-17f8d7c
+
+### Minor Changes
+
+- 17f8d7c: `mcpApiKeyAccess` takes an optional `holder` rule. Given one, an admin can choose who a new MCP key belongs to; nobody can change it afterwards; and a key for someone the rule refuses is not saved, with the rule's reason. Without it, nothing changes: a key belongs to whoever created it.
+
+### Patch Changes
+
+- @forumone/throughline-design-system@1.2.0-next-17f8d7c
+
 ## 1.1.0
 
 ### Minor Changes

package/dist/index.d.ts

@@ -3,7 +3,7 @@ export type { ThroughlineOptions, ThroughlinePublishingOptions, ThroughlineSuite
 export { EnvironmentError, assertEnvironment, checkEnvValue } from './env/index.js';
 export type { EnvValueProblem, EnvironmentCheck } from './env/index.js';
 export { MCP_API_KEYS_SLUG, McpMetaSchema, auditContext, deniedEnvelope, isMcpApiKeyPrincipal, isSignedIn, mcpApiKeyAccess, signedIn, withMeta, } from './mcp/index.js';
-export type { AuditContextFields, McpMeta } from './mcp/index.js';
+export type { AuditContextFields, McpApiKeyAccessOptions, McpMeta } from './mcp/index.js';
 export type { McpToolCollector, PayloadMcpTool } from './mcp/index.js';
 export { defaultLogger, createNamedLogger } from './logger/index.js';
 export { LOCKED_DOCUMENTS_SLUG, hardenCoreCollections } from './access/coreCollections.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGvE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,QAAQ,EACR,QAAQ,GACT,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAIjE,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,YAAY,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAGlE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,cAAc,EACd,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,4BAA4B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC/E,YAAY,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,gBAAgB,GACjB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACnF,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAGvE,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,QAAQ,EACR,QAAQ,GACT,MAAM,gBAAgB,CAAA;AACvB,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAA;AAIzF,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEtE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,YAAY,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAA;AAE/E,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,SAAS,EACT,oBAAoB,GACrB,MAAM,kBAAkB,CAAA;AACzB,YAAY,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AAGlE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,UAAU,EACV,cAAc,EACd,MAAM,EACN,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,4BAA4B,CAAA"}

package/dist/mcp/api-key-access.d.ts

@@ -1,4 +1,4 @@
-import type { Access, CollectionConfig } from 'payload';
+import { type Access, type CollectionConfig } from 'payload';
 /** The slug `@payloadcms/plugin-mcp` gives its key collection. */
 export declare const MCP_API_KEYS_SLUG = "payload-mcp-api-keys";
 /** What Payload puts on `req.user`. */
@@ -43,8 +43,35 @@ export declare const signedIn: Access;
  * })
  * ```
  *
- * The plugin's field-level rules on the key's `user` relationship are left as
- * shipped: a new key is bound to whoever creates it.
+ * Without `holder`, the plugin's field-level rules on the key's `user`
+ * relationship are left as shipped: a new key is bound to whoever creates it.
+ * See `McpApiKeyAccessOptions.holder` for issuing a key to somebody else.
  */
-export declare function mcpApiKeyAccess(isAdmin: Access): (collection: CollectionConfig) => CollectionConfig;
+export declare function mcpApiKeyAccess(isAdmin: Access, options?: McpApiKeyAccessOptions): (collection: CollectionConfig) => CollectionConfig;
+export interface McpApiKeyAccessOptions {
+    /**
+     * Who may hold a key: `true`, or the reason they may not. Given, an
+     * administrator chooses the person a new key runs as.
+     *
+     * The plugin binds every new key to whoever creates it and forbids changing
+     * that, which is the safe default and the wrong one for a site where keys are
+     * admin-only — every key then runs as an administrator, with an
+     * administrator's permissions, in an administrator's name in the audit log.
+     *
+     * With this, the key's `user` may be set on create by whoever passes
+     * `isAdmin`, and still never changed afterwards; the creator stays the
+     * default. The chosen person is loaded and handed to this rule before the key
+     * is saved, so "an editor or above" is the site's to say:
+     *
+     * ```ts
+     * mcpApiKeyAccess(isAdmin, {
+     *   holder: user => hasEditorRole(user) || 'Only an editor or an admin can hold a key.',
+     * })
+     * ```
+     *
+     * The rule is asked on create only. Somebody who loses the role later keeps a
+     * key that their own access rules then refuse, tool by tool.
+     */
+    holder?: (user: Record<string, unknown>) => true | string;
+}
 //# sourceMappingURL=api-key-access.d.ts.map

package/dist/mcp/api-key-access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-access.d.ts","sourceRoot":"","sources":["../../src/mcp/api-key-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAiCvD,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAExF;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,EAAE,MAA0C,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,GACd,CAAC,UAAU,EAAE,gBAAgB,KAAK,gBAAgB,CAcpD"}
+{"version":3,"file":"api-key-access.d.ts","sourceRoot":"","sources":["../../src/mcp/api-key-access.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,MAAM,EAEX,KAAK,gBAAgB,EAGtB,MAAM,SAAS,CAAA;AAiChB,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,yBAAyB,CAAA;AAEvD,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,CAExF;AAED,mDAAmD;AACnD,eAAO,MAAM,QAAQ,EAAE,MAA0C,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,sBAA2B,GACnC,CAAC,UAAU,EAAE,gBAAgB,KAAK,gBAAgB,CAiBpD;AAED,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,MAAM,CAAA;CAC1D"}

package/dist/mcp/api-key-access.js

@@ -1,3 +1,4 @@
+import { ValidationError, } from 'payload';
 /*
 Who may manage MCP keys, and who counts as signed in. Issue #157.
 
@@ -74,21 +75,92 @@ export const signedIn = ({ req }) => isSignedIn(req.user);
  * })
  * ```
  *
- * The plugin's field-level rules on the key's `user` relationship are left as
- * shipped: a new key is bound to whoever creates it.
+ * Without `holder`, the plugin's field-level rules on the key's `user`
+ * relationship are left as shipped: a new key is bound to whoever creates it.
+ * See `McpApiKeyAccessOptions.holder` for issuing a key to somebody else.
  */
-export function mcpApiKeyAccess(isAdmin) {
+export function mcpApiKeyAccess(isAdmin, options = {}) {
     const adminOnly = args => (isMcpApiKeyPrincipal(args.req.user) ? false : isAdmin(args));
-    return collection => ({
+    return collection => {
+        const hardened = {
+            ...collection,
+            access: {
+                ...collection.access,
+                read: adminOnly,
+                create: adminOnly,
+                update: adminOnly,
+                delete: adminOnly,
+                unlock: adminOnly,
+            },
+        };
+        return options.holder ? issuedToAPerson(hardened, adminOnly, options.holder) : hardened;
+    };
+}
+/** The plugin's name for the relationship a key runs as. */
+const KEY_USER_FIELD = 'user';
+/*
+Payload strips a field from a create when its `create` access says no, and then
+applies its `defaultValue`. So opening `create` to an administrator is all it
+takes for their choice to stick, and leaving the default in place keeps "a key
+for myself" a single click. `update` stays shut whatever the role: a key that
+could be re-pointed is a key that could be made to act as anybody.
+
+Field access is a boolean, where collection access may be a query, so only a
+literal `true` from the site's rule counts.
+*/
+function issuedToAPerson(collection, adminOnly, holder) {
+    const field = collection.fields.find((each) => 'name' in each && each.name === KEY_USER_FIELD && each.type === 'relationship');
+    if (!field || typeof field.relationTo !== 'string') {
+        throw new Error(`mcpApiKeyAccess(): "${collection.slug}" has no single-collection "${KEY_USER_FIELD}" relationship, ` +
+            'so there is nobody to issue a key to. Has @payloadcms/plugin-mcp changed its key collection?');
+    }
+    const adminChooses = async ({ req, data, id }) => (await adminOnly({ req, data, id })) === true;
+    return {
         ...collection,
-        access: {
-            ...collection.access,
-            read: adminOnly,
-            create: adminOnly,
-            update: adminOnly,
-            delete: adminOnly,
-            unlock: adminOnly,
+        fields: collection.fields.map(each => each === field
+            ? { ...field, access: { ...field.access, create: adminChooses, update: () => false } }
+            : each),
+        hooks: {
+            ...collection.hooks,
+            beforeChange: [
+                ...(collection.hooks?.beforeChange ?? []),
+                refuseIneligibleHolder(collection.slug, field.relationTo, holder),
+            ],
         },
-    });
+    };
+}
+/*
+A `beforeChange` rather than a `validate` on the field, so the relationship keeps
+Payload's own validation — required, and pointing at a document that exists —
+and this only adds to it. By this point field access has run and the default has
+been applied, so the value is the one that will be saved.
+*/
+function refuseIneligibleHolder(collection, users, holder) {
+    return async ({ data, operation, req }) => {
+        if (operation !== 'create')
+            return data;
+        const value = data[KEY_USER_FIELD];
+        const id = value && typeof value === 'object' ? value.id : value;
+        if (typeof id !== 'string' && typeof id !== 'number')
+            return data;
+        const user = await req.payload.findByID({
+            collection: users,
+            id,
+            depth: 0,
+            overrideAccess: true,
+            disableErrors: true,
+            req,
+        });
+        // A user that does not exist is the relationship's own validation to report.
+        if (!user)
+            return data;
+        const verdict = holder(user);
+        if (verdict === true)
+            return data;
+        throw new ValidationError({
+            collection,
+            errors: [{ path: KEY_USER_FIELD, label: 'User', message: verdict }],
+        });
+    };
 }
 //# sourceMappingURL=api-key-access.js.map

package/dist/mcp/api-key-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-key-access.js","sourceRoot":"","sources":["../../src/mcp/api-key-access.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BE;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAKvD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA4B;IAC/D,OAAQ,IAAoD,EAAE,UAAU,KAAK,iBAAiB,CAAA;AAChG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAA4B;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAA;AACrD,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe;IAEf,MAAM,SAAS,GAAW,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAE/F,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;QACpB,GAAG,UAAU;QACb,MAAM,EAAE;YACN,GAAG,UAAU,CAAC,MAAM;YACpB,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;SAClB;KACF,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"api-key-access.js","sourceRoot":"","sources":["../../src/mcp/api-key-access.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,GAMhB,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BE;AAEF,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAA;AAKvD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA4B;IAC/D,OAAQ,IAAoD,EAAE,UAAU,KAAK,iBAAiB,CAAA;AAChG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,IAA4B;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAA;AACrD,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAW,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;AAEjE;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAe,EACf,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAW,IAAI,CAAC,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAE/F,OAAO,UAAU,CAAC,EAAE;QAClB,MAAM,QAAQ,GAAqB;YACjC,GAAG,UAAU;YACb,MAAM,EAAE;gBACN,GAAG,UAAU,CAAC,MAAM;gBACpB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;aAClB;SACF,CAAA;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IACzF,CAAC,CAAA;AACH,CAAC;AA6BD,4DAA4D;AAC5D,MAAM,cAAc,GAAG,MAAM,CAAA;AAE7B;;;;;;;;;EASE;AACF,SAAS,eAAe,CACtB,UAA4B,EAC5B,SAAiB,EACjB,MAAqD;IAErD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAClC,CAAC,IAAI,EAAoD,EAAE,CACzD,MAAM,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,IAAI,IAAI,CAAC,IAAI,KAAK,cAAc,CACjF,CAAA;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,CAAC,IAAI,+BAA+B,cAAc,kBAAkB;YACnG,8FAA8F,CACjG,CAAA;IACH,CAAC;IAED,MAAM,YAAY,GAAgB,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAC5D,CAAC,MAAM,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAA2B,CAAC,CAAC,KAAK,IAAI,CAAA;IAExE,OAAO;QACL,GAAG,UAAU;QACb,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CACnC,IAAI,KAAK,KAAK;YACZ,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE;YACtF,CAAC,CAAC,IAAI,CACT;QACD,KAAK,EAAE;YACL,GAAG,UAAU,CAAC,KAAK;YACnB,YAAY,EAAE;gBACZ,GAAG,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,IAAI,EAAE,CAAC;gBACzC,sBAAsB,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;aAClE;SACF;KACF,CAAA;AACH,CAAC;AAED;;;;;EAKE;AACF,SAAS,sBAAsB,CAC7B,UAAkB,EAClB,KAAa,EACb,MAAqD;IAErD,OAAO,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE;QACxC,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvC,MAAM,KAAK,GAAY,IAAI,CAAC,cAAc,CAAC,CAAA;QAC3C,MAAM,EAAE,GACN,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA0B,CAAC,EAAE,CAAC,CAAC,CAAE,KAAiB,CAAA;QAC1F,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAA;QAEjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtC,UAAU,EAAE,KAAc;YAC1B,EAAE;YACF,KAAK,EAAE,CAAC;YACR,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;YACnB,GAAG;SACJ,CAAC,CAAA;QACF,6EAA6E;QAC7E,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QAEtB,MAAM,OAAO,GAAG,MAAM,CAAC,IAA0C,CAAC,CAAA;QAClE,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,IAAI,CAAA;QACjC,MAAM,IAAI,eAAe,CAAC;YACxB,UAAU;YACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;SACpE,CAAC,CAAA;IACJ,CAAC,CAAA;AACH,CAAC"}

package/dist/mcp/index.d.ts

@@ -9,4 +9,5 @@ export type { AddToolsOptions, CreateMcpToolCollectorOptions, DeclareToolsOption
 export { deniedEnvelope } from './envelope.js';
 export { auditServerFor, mcpServerRefusal } from './audit-server.js';
 export { MCP_API_KEYS_SLUG, isMcpApiKeyPrincipal, isSignedIn, mcpApiKeyAccess, signedIn, } from './api-key-access.js';
+export type { McpApiKeyAccessOptions } from './api-key-access.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/mcp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtE,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,QAAQ,GACT,MAAM,qBAAqB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mcp/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACnD,YAAY,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE5D,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACtE,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,uBAAuB,GACxB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EACV,eAAe,EACf,6BAA6B,EAC7B,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,QAAQ,GACT,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/migrate/exports.json

@@ -178,6 +178,7 @@
         "ManifestSource": ["@forumone/throughline/components"],
         "ManualSyncRefusal": ["@forumone/throughline/integrations"],
         "MatchingConfig": ["@forumone/throughline/components"],
+        "McpApiKeyAccessOptions": ["@forumone/throughline"],
         "McpMeta": ["@forumone/throughline"],
         "McpMetaSchema": ["@forumone/throughline"],
         "McpToolCollector": ["@forumone/throughline"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline",
-  "version": "1.1.0",
+  "version": "1.2.0-next-17f8d7c",
   "description": "Throughline: an editorial platform for Payload CMS. Publishing, approvals, audit, integrations, email and jobs, with every feature reachable over MCP.",
   "type": "module",
   "main": "./dist/index.js",
@@ -162,7 +162,7 @@
   "dependencies": {
     "zod": "^3.23.0",
     "zod-to-json-schema": "^3.25.2",
-    "@forumone/throughline-design-system": "1.1.0"
+    "@forumone/throughline-design-system": "1.2.0-next-17f8d7c"
   },
   "devDependencies": {
     "@payloadcms/db-sqlite": "^3.83.0",
@@ -184,8 +184,8 @@
     "resend": "^6.1.4",
     "typescript": "^5.6.0",
     "vitest": "^4.1.10",
-    "@forumone/throughline-reference-ds": "0.3.10",
     "@forumone/throughline-eslint-config": "0.0.1",
+    "@forumone/throughline-reference-ds": "0.3.11-next-17f8d7c",
     "@forumone/throughline-tsconfig": "0.0.1"
   },
   "scripts": {