@abinnovision/payloadcms-mcpx 2.0.0-beta.8 → 2.0.0

package/dist/write/draft-guard.mjs

@@ -1,27 +1,28 @@
-import { hasPublishIntent, takePublishIntent } from "./publish-intent.mjs";
+import { propOf } from "../guards.mjs";
 import { isMcpxRequest } from "../request.mjs";
+import { hasPublishIntent, hasTrashIntent, takeDuplicateIntent, takePublishIntent, takeTrashIntent, withTrashIntent } from "./publish-intent.mjs";
 import { APIError } from "payload";
 import { hasDraftsEnabled } from "payload/shared";
 //#region src/write/draft-guard.ts
 const STRIPPED_ARGS = /* @__PURE__ */ new Set([
 	"where",
 	"publishAllLocales",
-	"publishSpecificLocale",
 	"unpublishAllLocales",
 	"duplicateFromID",
 	"selectedLocales",
 	"overwriteExistingFiles"
 ]);
-const scrubWriteArgs = (args, publishing) => {
-	const next = Object.fromEntries(Object.entries(args).filter(([key]) => !STRIPPED_ARGS.has(key)));
+const scrubWriteArgs = (args, intent) => {
+	const publishing = intent === "publish";
+	const next = Object.fromEntries(Object.entries(args).filter(([key]) => !STRIPPED_ARGS.has(key) && (publishing || key !== "publishSpecificLocale")));
 	if (next["data"] && typeof next["data"] === "object") {
-		const { _status: _ignoredStatus, deletedAt: _ignoredDeletedAt, ...data } = next["data"];
+		const { _status: _ignoredStatus, deletedAt, ...data } = next["data"];
 		next["data"] = publishing ? {
 			...data,
 			_status: "published"
-		} : data;
+		} : intent === "trash" ? withTrashIntent({ deletedAt }) : data;
 	}
-	next["draft"] = !publishing;
+	next["draft"] = intent === void 0;
 	next["autosave"] = false;
 	next["overrideLock"] = false;
 	next["trash"] = false;
@@ -30,26 +31,35 @@ const scrubWriteArgs = (args, publishing) => {
 const forceDraftWrite = (hookArgs) => {
 	const { args, operation, req } = hookArgs;
 	if (!isMcpxRequest(req) || operation !== "create" && operation !== "update") return args;
-	const publishing = operation === "update" && hasPublishIntent(args.data);
-	return scrubWriteArgs(args, publishing);
+	if (operation === "create" && takeDuplicateIntent(args.data)) {
+		const next = scrubWriteArgs(args, void 0);
+		next["duplicateFromID"] = args.duplicateFromID;
+		return next;
+	}
+	const intent = operation !== "update" ? void 0 : hasPublishIntent(args.data) ? "publish" : hasTrashIntent(args.data) ? "trash" : void 0;
+	return scrubWriteArgs(args, intent);
 };
 /**
-* The global counterpart of {@link forceDraftWrite}. `updateGlobal` destructures
-* `draft` and the publish arguments before it runs `beforeOperation` and
-* re-reads only `data` afterwards, so setting them here has no effect. Only
-* `data` with `_status` stripped lands, so {@link refusePublishGlobal} is what
-* enforces the guard. `publishDocument` therefore passes `draft: false` at the
-* call site, and this hook restores `_status` instead of stripping it.
+* The global counterpart of {@link forceDraftWrite}. `updateGlobal` reads
+* `draft` and the publish arguments before this hook runs, so only changes to
+* `data` take effect. A write to a global with drafts that did not ask for a
+* draft save is therefore refused here, and `_status` is restored for a publish.
 */ const forceDraftWriteGlobal = (hookArgs) => {
-	const { operation, req } = hookArgs;
+	const { global, operation, req } = hookArgs;
 	const args = hookArgs.args;
 	if (!isMcpxRequest(req) || operation !== "update") return args;
-	return scrubWriteArgs(args, hasPublishIntent(args["data"]));
+	const publishing = hasPublishIntent(args["data"]);
+	if (!publishing && args["draft"] !== true && hasDraftsEnabled(global)) {
+		req.payload.logger.warn(`[payloadcms-mcpx] Refused a write to ${global.slug} that did not ask for a draft save.`);
+		throw new APIError("MCP clients may only write drafts. This write was refused because it would not have been saved as one. Use publishDocument to publish.", 403);
+	}
+	return scrubWriteArgs(args, publishing ? "publish" : void 0);
 };
 const refuseUnlessExpected = (req, slug, data) => {
 	const publishing = takePublishIntent(data);
-	if (!isMcpxRequest(req)) return;
-	const status = data._status;
+	const trashing = takeTrashIntent(data);
+	if (!isMcpxRequest(req) || trashing) return;
+	const status = propOf(data, "_status");
 	const expected = publishing ? "published" : "draft";
 	if (status === expected) return;
 	req.payload.logger.warn(`[payloadcms-mcpx] Refused a write to ${slug} that would not have been a ${expected} (_status: ${String(status)}).`);
@@ -67,30 +77,29 @@ const refusePublishGlobal = ({ data, global, req }) => {
 	refuseUnlessExpected(req, global.slug, next);
 	return next;
 };
-/**
-* Attaches the draft guard to every collection: `forceDraftWrite` everywhere
-* (it does nothing outside MCP requests) and `refusePublish` wherever drafts
-* exist. It runs on the final collection list, so no collection escapes it, and
-* both hooks are appended last, so a user hook cannot override them.
-*/ const installDraftGuards = (collections) => collections.map((collection) => ({
-	...collection,
+const appendGuards = (entities, guards) => entities.map((entity) => ({
+	...entity,
 	hooks: {
-		...collection.hooks,
-		beforeOperation: [...collection.hooks?.beforeOperation ?? [], forceDraftWrite],
-		...hasDraftsEnabled(collection) ? { beforeChange: [...collection.hooks?.beforeChange ?? [], refusePublish] } : {}
+		...entity.hooks,
+		beforeOperation: [...entity.hooks?.beforeOperation ?? [], guards.beforeOperation],
+		...hasDraftsEnabled(entity) ? { beforeChange: [...entity.hooks?.beforeChange ?? [], guards.beforeChange] } : {}
 	}
 }));
 /**
+* Attaches the draft guard to every collection: `forceDraftWrite` everywhere
+* (it does nothing outside MCP requests) and `refusePublish` wherever drafts
+* exist. It runs on the final collection list, so no collection escapes it.
+*/ const installDraftGuards = (collections) => appendGuards(collections, {
+	beforeChange: refusePublish,
+	beforeOperation: forceDraftWrite
+});
+/**
 * Attaches the guard to every global, exposed or not: a custom tool running on
 * an MCP request must not be able to publish through a global the plugin config
 * never mentioned.
-*/ const installGlobalDraftGuards = (globals) => globals.map((global) => ({
-	...global,
-	hooks: {
-		...global.hooks,
-		beforeOperation: [...global.hooks?.beforeOperation ?? [], forceDraftWriteGlobal],
-		...hasDraftsEnabled(global) ? { beforeChange: [...global.hooks?.beforeChange ?? [], refusePublishGlobal] } : {}
-	}
-}));
+*/ const installGlobalDraftGuards = (globals) => appendGuards(globals, {
+	beforeChange: refusePublishGlobal,
+	beforeOperation: forceDraftWriteGlobal
+});
 //#endregion
 export { forceDraftWrite, forceDraftWriteGlobal, installDraftGuards, installGlobalDraftGuards, refusePublish, refusePublishGlobal };

package/dist/write/patch.mjs

@@ -1,6 +1,6 @@
-import { isIndexSegment, joinPath, prototypeSegmentProblem, splitPath } from "../schema/path.mjs";
-import { RESERVED_FIELD_NAMES, descriptorsUnder } from "../schema/walk.mjs";
 import { SchemaError } from "../schema/errors.mjs";
+import { isIndexSegment, parentPointer, prototypeSegmentProblem, splitPath } from "../schema/path.mjs";
+import { RESERVED_FIELD_NAMES, descriptorsUnder } from "../schema/walk.mjs";
 import { resolveDataPointer } from "../schema/pointer.mjs";
 import { EMPTY_ROOT, validateWriteValue } from "../schema/shape.mjs";
 import "../schema/index.mjs";
@@ -37,7 +37,7 @@ const resolvesReadOnly = (resolution) => {
 };
 const isReadOnlyPointer = (config, target) => resolvesReadOnly(resolveDataPointer(config, {
 	doc: target.doc,
-	pointer: isElementPointer(target.pointer) ? joinPath(splitPath(target.pointer).slice(0, -1)) : target.pointer,
+	pointer: isElementPointer(target.pointer) ? parentPointer(target.pointer) : target.pointer,
 	ref: target.ref
 }));
 const resolutionAt = (config, target) => {
@@ -60,7 +60,7 @@ const droppedFieldProblem = (config, target) => {
 	return `"${target.pointer}" is a field, not a list element, and removing it would do nothing. The patched document is written whole, and Payload keeps any field absent from a write rather than clearing it. Use "replace" with null to clear a field, or with [] to empty a list.`;
 };
 const emptiesTheRoot = (config, target) => {
-	const list = joinPath(splitPath(target.pointer).slice(0, -1));
+	const list = parentPointer(target.pointer);
 	const owner = resolutionAt(config, {
 		...target,
 		pointer: list

package/dist/write/publish-intent.mjs

@@ -1,17 +1,31 @@
 import { isPlainObject } from "../guards.mjs";
 import { randomUUID } from "node:crypto";
 //#region src/write/publish-intent.ts
-const PUBLISH_INTENT = "__mcpxPublishIntent";
 const TOKEN = randomUUID();
-const withPublishIntent = (data) => ({
-	...data,
-	[PUBLISH_INTENT]: TOKEN
+const intent = (key) => ({
+	has: (data) => isPlainObject(data) && data[key] === TOKEN,
+	take: (data) => {
+		if (!isPlainObject(data) || data[key] !== TOKEN) return false;
+		delete data[key];
+		return true;
+	},
+	with: (data) => ({
+		...data,
+		[key]: TOKEN
+	})
 });
-const hasPublishIntent = (data) => isPlainObject(data) && data[PUBLISH_INTENT] === TOKEN;
-/** Called by the last hook that needs the marker, which removes it. */ const takePublishIntent = (data) => {
-	if (!hasPublishIntent(data)) return false;
-	delete data[PUBLISH_INTENT];
-	return true;
-};
+const publish = intent("__mcpxPublishIntent");
+const trash = intent("__mcpxTrashIntent");
+const duplicate = intent("__mcpxDuplicateIntent");
+const withPublishIntent = publish.with;
+const hasPublishIntent = publish.has;
+/**
+* Called by the last hook that needs the marker, which removes it.
+*/ const takePublishIntent = publish.take;
+const withTrashIntent = trash.with;
+const hasTrashIntent = trash.has;
+const takeTrashIntent = trash.take;
+const withDuplicateIntent = duplicate.with;
+const takeDuplicateIntent = duplicate.take;
 //#endregion
-export { hasPublishIntent, takePublishIntent, withPublishIntent };
+export { hasPublishIntent, hasTrashIntent, takeDuplicateIntent, takePublishIntent, takeTrashIntent, withDuplicateIntent, withPublishIntent, withTrashIntent };

package/dist/write/row-ids.mjs

@@ -1,6 +1,8 @@
 import { isPlainObject } from "../guards.mjs";
+import { editorRoot } from "../schema/lexical.mjs";
+import "../schema/index.mjs";
 //#region src/write/row-ids.ts
-const isRichTextState = (value) => isPlainObject(value["root"]) && Array.isArray(value["root"]["children"]);
+const isRichTextState = (value) => Array.isArray(editorRoot(value)?.["children"]);
 const walkRows = (value, visit, isRow = false) => {
 	if (Array.isArray(value)) {
 		for (const entry of value) walkRows(entry, visit, true);
@@ -33,7 +35,9 @@ const walkRows = (value, visit, isRow = false) => {
 		delete row["id"];
 	});
 };
-/** For create, where no stored row exists and any incoming id is invented. */ const stripRowIds = (value) => {
+/**
+* For create, where no stored row exists and any incoming id is invented.
+*/ const stripRowIds = (value) => {
 	const next = structuredClone(value);
 	walkRows(next, (row) => {
 		delete row["id"];

package/dist/write/write-data.mjs

@@ -1,6 +1,6 @@
 import { isPlainObject } from "../guards.mjs";
 import { splitPath } from "../schema/path.mjs";
-import { ROW_KEYS, blockOf, descriptorsUnder, findBlocksField } from "../schema/walk.mjs";
+import { ROW_KEYS, blockForRow, classifyKey, descriptorsUnder, findFieldAt } from "../schema/walk.mjs";
 import "../schema/index.mjs";
 //#region src/write/write-data.ts
 const pickDescribed = (config, value, at) => {
@@ -10,43 +10,30 @@ const pickDescribed = (config, value, at) => {
 	if (isRow) {
 		for (const key of ROW_KEYS) if (Object.hasOwn(value, key)) result[key] = value[key];
 	}
+	const pick = (row, at) => isPlainObject(row) ? pickDescribed(config, row, at) : row;
 	for (const [key, entry] of Object.entries(value)) {
-		const candidates = relative.filter(({ parts }) => parts[0] === key);
-		if (candidates.length === 0) continue;
-		const exact = candidates.find(({ parts }) => parts.length === 1);
-		if (exact?.descriptor.type === "blocks" && Array.isArray(entry)) {
-			const field = findBlocksField(fields, splitPath(exact.descriptor.path));
-			result[key] = entry.map((row) => {
-				const block = field && isPlainObject(row) && typeof row["blockType"] === "string" ? blockOf(config, field, row["blockType"]) : void 0;
-				return block && isPlainObject(row) ? pickDescribed(config, row, {
+		const found = classifyKey(relative, prefix, key);
+		if (found.kind === "none") continue;
+		if (found.kind === "leaf") {
+			const field = found.descriptor.type === "blocks" ? findFieldAt(fields, splitPath(found.descriptor.path), "blocks") : void 0;
+			result[key] = field && Array.isArray(entry) ? entry.map((row) => {
+				const block = blockForRow(config, field, row);
+				return block ? pick(row, {
 					fields: block.flattenedFields,
 					prefix: [],
 					isRow: true
 				}) : row;
-			});
-			continue;
-		}
-		if (exact) {
-			result[key] = entry;
-			continue;
-		}
-		if (candidates.some(({ parts }) => parts[1] === "*")) {
-			result[key] = Array.isArray(entry) ? entry.map((row) => isPlainObject(row) ? pickDescribed(config, row, {
-				fields,
-				prefix: [
-					...prefix,
-					key,
-					"*"
-				],
-				isRow: true
-			}) : row) : entry;
-			continue;
-		}
-		result[key] = isPlainObject(entry) ? pickDescribed(config, entry, {
+			}) : entry;
+		} else if (found.kind === "rows") result[key] = Array.isArray(entry) ? entry.map((row) => pick(row, {
 			fields,
-			prefix: [...prefix, key],
+			prefix: found.prefix,
+			isRow: true
+		})) : entry;
+		else result[key] = pick(entry, {
+			fields,
+			prefix: found.prefix,
 			isRow: false
-		}) : entry;
+		});
 	}
 	return result;
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@abinnovision/payloadcms-mcpx",
-  "version": "2.0.0-beta.8",
+  "version": "2.0.0",
   "description": "Payload CMS plugin exposing a fixed, schema-aware MCP tool surface with draft-only writes and per-API-key capabilities.",
   "keywords": [
     "payload",
@@ -57,7 +57,7 @@
   },
   "prettier": "@abinnovision/prettier-config",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
+    "@modelcontextprotocol/sdk": "^1.32.0",
     "rfc6902": "^5.3.0",
     "zod": "^4.6.5"
   },
@@ -65,23 +65,24 @@
     "@abinnovision/eslint-config-base": "^3.4.2",
     "@abinnovision/prettier-config": "^2.2.0",
     "@arethetypeswrong/core": "^0.18.5",
-    "@payloadcms/db-sqlite": "3.89.0",
-    "@payloadcms/richtext-lexical": "3.89.0",
-    "@payloadcms/ui": "3.89.0",
-    "@swc/core": "^1.16.2",
-    "@types/node": "^26.5.1",
+    "@internal/test-utils": "0.0.0",
+    "@payloadcms/db-sqlite": "3.90.2",
+    "@payloadcms/richtext-lexical": "3.90.2",
+    "@payloadcms/ui": "3.90.2",
+    "@swc/core": "^1.16.13",
+    "@types/node": "^26.6.3",
     "@types/react": "^19.3.0",
-    "@vitest/coverage-v8": "^5.0.0",
-    "eslint": "^10.10.0",
-    "payload": "3.89.0",
-    "prettier": "^3.9.5",
-    "publint": "^0.3.24",
+    "@vitest/coverage-v8": "^5.0.3",
+    "eslint": "^10.12.0",
+    "payload": "3.90.2",
+    "prettier": "^3.9.9",
+    "publint": "^0.3.25",
     "react": "^19.3.0",
     "react-dom": "^19.3.0",
     "tsdown": "^0.23.0",
     "typescript": "^6.0.3",
-    "unplugin-swc": "^1.6.0",
-    "vitest": "^5.0.0"
+    "unplugin-swc": "^2.0.0",
+    "vitest": "^5.0.3"
   },
   "peerDependencies": {
     "@payloadcms/ui": ">=3.88.0 <4",

package/dist/builtin-tool-names.mjs

@@ -1,16 +0,0 @@
-//#region src/builtin-tool-names.ts
-/**
-* Names of the builtin tools. Custom tools must not reuse them.
-*/ const BUILTIN_TOOL_NAMES = [
-	"listCapabilities",
-	"describeSchema",
-	"findDocuments",
-	"getDocument",
-	"findVersions",
-	"patchDocument",
-	"createDocument",
-	"validateDocument",
-	"publishDocument"
-];
-//#endregion
-export { BUILTIN_TOOL_NAMES };