@next-buildr/payload 0.0.0-stage → 2.0.0

package/dist/plugin/endpoints/mcp-http-backend.test.js

@@ -0,0 +1,84 @@
+import { runBackendContract } from '@next-buildr/mcp/testing';
+import { handleEndpoints } from 'payload';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { createPayloadMcpBackend } from '../../mcp/http-backend.js';
+import { boot, withChild } from './endpoints.test-kit.js';
+const KEYS = {
+    agent: 'agent-key-0123456789',
+    readOnly: 'ro-key-0123456789',
+    plain: 'plain-key-0123456789',
+};
+let h;
+/** A `fetch` that answers from the live Payload of the harness, exactly as the site would over HTTP. */
+const payloadFetch = (input, init) => handleEndpoints({ config: h.payload.config, request: new Request(input, init) });
+const backendFor = (apiKey) => createPayloadMcpBackend({
+    baseUrl: 'http://localhost/api',
+    apiKey,
+    collections: ['pages'],
+    fetch: payloadFetch,
+    retries: 0,
+});
+beforeAll(async () => {
+    h = await boot('mcp-http-backend', {
+        mcp: { enabled: true, allowPublish: true, collections: ['pages'] },
+        access: {
+            edit: ({ req }) => !String(req.user.email).startsWith('ro'),
+            publish: ({ req }) => String(req.user.email).startsWith('pub'),
+        },
+    }, { collections: [{ slug: 'users', auth: { useAPIKey: true }, fields: [] }] });
+    const users = [
+        { email: 'pub-agent@example.com', apiKey: KEYS.agent },
+        { email: 'ro-agent@example.com', apiKey: KEYS.readOnly },
+        { email: 'plain-agent@example.com', apiKey: KEYS.plain },
+    ];
+    for (const user of users) {
+        await h.payload.create({
+            collection: 'users',
+            data: { ...user, password: 'secret-password', enableAPIKey: true },
+        });
+    }
+});
+afterAll(() => h.close());
+runBackendContract({
+    name: 'payload HTTP backend (live Payload, SQLite)',
+    async create() {
+        const doc = await h.payload.create({
+            collection: 'pages',
+            data: { title: 'Existing', slug: `existing-${Date.now()}`, buildrRevision: 0 },
+            draft: true,
+        });
+        // Give the draft a real layout so load/save round-trip a non-empty document.
+        await h.payload.update({
+            collection: 'pages',
+            id: doc.id,
+            data: { layout: withChild({ title: { kind: 'static', value: 'Hi' } }), buildrRevision: 1 },
+            draft: true,
+        });
+        return {
+            backend: backendFor(KEYS.agent),
+            existing: { collection: 'pages', id: String(doc.id) },
+            missing: { collection: 'pages', id: '999999' },
+            collection: 'pages',
+            unknownCollection: 'nope',
+            dataSchemaCollection: 'pages',
+            noDataSchemaCollection: 'nope',
+            readOnlyBackend: backendFor(KEYS.readOnly),
+            noPublishBackend: backendFor(KEYS.plain),
+        };
+    },
+});
+describe('against a live Payload', () => {
+    it('reports the agent user and its permissions', async () => {
+        const session = await backendFor(KEYS.agent).getSession();
+        expect(session.ok && session.value.user.email).toBe('pub-agent@example.com');
+        expect(session.ok && session.value.permissions.canPublish).toBe(true);
+    });
+    it('turns a rejected key into forbidden without echoing it', async () => {
+        const result = await backendFor('not-a-real-key-000000').getSession();
+        expect(result.ok).toBe(false);
+        if (!result.ok) {
+            expect(result.error.code).toBe('forbidden');
+            expect(JSON.stringify(result.error)).not.toContain('not-a-real-key-000000');
+        }
+    });
+});

package/dist/plugin/endpoints/mcp-off.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-off.test.d.ts.map

package/dist/plugin/endpoints/mcp-off.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-off.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/mcp-off.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/mcp-off.test.js

@@ -0,0 +1,33 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { boot } from './endpoints.test-kit.js';
+const KEY = 'agent-key-0123456789';
+let h;
+beforeAll(async () => {
+    h = await boot('mcp-off', {}, { collections: [{ slug: 'users', auth: { useAPIKey: true }, fields: [] }] });
+    await h.payload.create({
+        collection: 'users',
+        data: {
+            email: 'agent@example.com',
+            password: 'secret-password',
+            enableAPIKey: true,
+            apiKey: KEY,
+        },
+    });
+});
+afterAll(() => h.close());
+const asAgent = (method, path) => h.call(method, path, { token: null, headers: { authorization: `users API-Key ${KEY}` } });
+describe('mcp disabled (the default)', () => {
+    it('refuses API-key requests to the builder, but not a session', async () => {
+        const doc = await h.payload.create({ collection: 'pages', data: { title: 'A' }, draft: true });
+        expect((await asAgent('GET', `/buildr/documents/pages/${doc.id}`)).status).toBe(403);
+        expect((await asAgent('GET', '/buildr/session')).body.permissions.canEdit).toBe(false);
+        expect((await h.call('GET', `/buildr/documents/pages/${doc.id}`)).status).toBe(200);
+    });
+    it('does not register the list and create endpoints', async () => {
+        expect((await h.call('GET', '/buildr/documents?collection=pages')).status).toBe(404);
+        const create = await h.call('POST', '/buildr/documents', {
+            body: { collection: 'pages', title: 'x' },
+        });
+        expect(create.status).toBe(404);
+    });
+});

package/dist/plugin/endpoints/mcp-publish.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-publish.test.d.ts.map

package/dist/plugin/endpoints/mcp-publish.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-publish.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/mcp-publish.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/mcp-publish.test.js

@@ -0,0 +1,42 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { boot, title, withChild } from './endpoints.test-kit.js';
+const KEY = 'agent-key-0123456789';
+const PLAIN_KEY = `${KEY}-2`;
+let h;
+beforeAll(async () => {
+    h = await boot('mcp-publish', {
+        mcp: { enabled: true, allowPublish: true },
+        access: {
+            publish: ({ req }) => String(req.user.email).startsWith('pub'),
+        },
+    }, { collections: [{ slug: 'users', auth: { useAPIKey: true }, fields: [] }] });
+    const users = [
+        { email: 'pub-agent@example.com', apiKey: KEY },
+        { email: 'plain-agent@example.com', apiKey: PLAIN_KEY },
+    ];
+    for (const user of users) {
+        await h.payload.create({
+            collection: 'users',
+            data: { ...user, password: 'secret-password', enableAPIKey: true },
+        });
+    }
+});
+afterAll(() => h.close());
+const as = (key, method, path, body) => h.call(method, path, {
+    token: null,
+    headers: { authorization: `users API-Key ${key}` },
+    ...(body === undefined ? {} : { body }),
+});
+describe('mcp.allowPublish', () => {
+    it('lets an API-key user publish only when access.publish also allows it', async () => {
+        const doc = await h.payload.create({ collection: 'pages', data: { title: 'P' }, draft: true });
+        const path = `/buildr/documents/pages/${doc.id}`;
+        const document = withChild(title('Hi'));
+        const saved = await as(KEY, 'PUT', path, { document, baseRevision: 0, autosave: false });
+        expect(saved.status).toBe(200);
+        const denied = await as(PLAIN_KEY, 'POST', `${path}/publish`, { baseRevision: 1 });
+        expect(denied.status).toBe(403);
+        expect((await as(KEY, 'GET', '/buildr/session')).body.permissions.canPublish).toBe(true);
+        expect((await as(KEY, 'POST', `${path}/publish`, { baseRevision: 1 })).status).toBe(200);
+    });
+});

package/dist/plugin/endpoints/mcp-route.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp-route.test.d.ts.map

package/dist/plugin/endpoints/mcp-route.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-route.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/mcp-route.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/mcp-route.test.js

@@ -0,0 +1,132 @@
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
+import { runToolScenario } from '@next-buildr/mcp/testing';
+import { afterAll, afterEach, beforeAll, describe, expect, it } from 'vitest';
+import { createBuildrMcpRoute } from '../../mcp/route.js';
+import { boot, meta } from './endpoints.test-kit.js';
+const KEY = 'agent-key-0123456789';
+const URL_ = 'http://localhost/api/buildr/mcp';
+let h;
+const clients = [];
+beforeAll(async () => {
+    h = await boot('mcp-route', { mcp: { enabled: true, collections: ['pages'] } }, { collections: [{ slug: 'users', auth: { useAPIKey: true }, fields: [] }] });
+    await h.payload.create({
+        collection: 'users',
+        data: {
+            email: 'agent@example.com',
+            password: 'secret-password',
+            enableAPIKey: true,
+            apiKey: KEY,
+        },
+    });
+});
+afterEach(async () => {
+    await Promise.all(clients.splice(0).map((client) => client.close()));
+});
+afterAll(() => h.close());
+const makeRoute = (extra = {}) => createBuildrMcpRoute({ payload: h.payload, registry: { meta }, ...extra });
+async function connect(route = makeRoute(), headers = {}) {
+    const transport = new StreamableHTTPClientTransport(new URL(URL_), {
+        requestInit: { headers: { authorization: `users API-Key ${KEY}`, ...headers } },
+        fetch: (input, init) => {
+            const request = new Request(input, init);
+            return request.method === 'POST' ? route.POST(request) : route.GET(request);
+        },
+    });
+    const client = new Client({ name: 'http-test', version: '0.0.0' });
+    clients.push(client);
+    await client.connect(transport);
+    return client;
+}
+const post = (route, headers) => route.POST(new Request(URL_, {
+    method: 'POST',
+    headers: {
+        'content-type': 'application/json',
+        accept: 'application/json, text/event-stream',
+        ...headers,
+    },
+    body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
+}));
+describe('the MCP route over Streamable HTTP', () => {
+    it('runs the shared tool scenario as the agent user and saves a draft', async () => {
+        const client = await connect();
+        const { ref, revision } = await runToolScenario(client, {
+            collection: 'pages',
+            tree: { type: 'buildr/widget', props: { title: 'Hello from agent' } },
+            expectText: 'Hello from agent',
+        });
+        expect(revision).toBeGreaterThan(0);
+        const stored = (await h.payload.findByID({
+            collection: 'pages',
+            id: ref.id,
+            draft: true,
+        }));
+        expect(Object.values(stored.layout.nodes).map((node) => node.type)).toContain('buildr/widget');
+        expect(stored.buildrUpdatedBy).toBeDefined();
+    });
+    it('keeps open documents between requests of the same user', async () => {
+        const route = makeRoute();
+        const first = await connect(route);
+        const created = await first.callTool({
+            name: 'create_document',
+            arguments: { collection: 'pages', title: 'Kept' },
+        });
+        const sessionId = created.structuredContent.sessionId;
+        // A different client (a new HTTP connection) of the same user continues the same working copy.
+        const second = await connect(route);
+        const outline = await second.callTool({ name: 'get_outline', arguments: { sessionId } });
+        expect(outline.isError).not.toBe(true);
+    });
+    it('answers 401 without a key, with a wrong key and with only a session cookie', async () => {
+        const route = makeRoute();
+        expect((await post(route, {})).status).toBe(401);
+        expect((await post(route, { authorization: 'users API-Key wrong-key-000000000' })).status).toBe(401);
+        expect((await post(route, { cookie: `payload-token=${h.token}` })).status).toBe(401);
+        expect((await post(route, { authorization: `JWT ${h.token}` })).status).toBe(401);
+        // Even next to a valid key a cookie is ignored, not used.
+        expect((await post(route, {
+            authorization: `users API-Key ${KEY}`,
+            cookie: `payload-token=${h.token}`,
+        })).status).toBe(200);
+    });
+    it('refuses a foreign browser origin and accepts the site itself', async () => {
+        const route = makeRoute();
+        const auth = { authorization: `users API-Key ${KEY}` };
+        expect((await post(route, { ...auth, origin: 'https://evil.example' })).status).toBe(403);
+        expect((await post(route, { ...auth, origin: 'http://localhost' })).status).toBe(200);
+        const allowed = makeRoute({ allowedOrigins: ['https://claude.ai'] });
+        expect((await post(allowed, { ...auth, origin: 'https://claude.ai' })).status).toBe(200);
+    });
+    it('is stateless: GET and DELETE are 405', async () => {
+        const route = makeRoute();
+        expect((await route.GET(new Request(URL_))).status).toBe(405);
+        expect((await route.DELETE(new Request(URL_, { method: 'DELETE' }))).status).toBe(405);
+    });
+    it('rate limits per user', async () => {
+        const route = makeRoute({ rateLimit: { limit: 2, windowMs: 60_000 } });
+        const auth = { authorization: `users API-Key ${KEY}` };
+        expect((await post(route, auth)).status).toBe(200);
+        expect((await post(route, auth)).status).toBe(200);
+        const limited = await post(route, auth);
+        expect(limited.status).toBe(429);
+        expect(limited.headers.get('retry-after')).not.toBeNull();
+    });
+    it('blocks a client that keeps failing to authenticate', async () => {
+        const route = makeRoute();
+        for (let n = 0; n < 31; n += 1)
+            await post(route, { 'x-forwarded-for': '203.0.113.9' });
+        const blocked = await post(route, {
+            'x-forwarded-for': '203.0.113.9',
+            authorization: `users API-Key ${KEY}`,
+        });
+        expect(blocked.status).toBe(429);
+    });
+    it('is disabled (404) when the plugin has no mcp.enabled', async () => {
+        const off = createBuildrMcpRoute({
+            payload: { config: { endpoints: [] } },
+            registry: { meta },
+        });
+        expect((await post(off, { authorization: `users API-Key ${KEY}` })).status).toBe(404);
+        expect((await off.GET(new Request(URL_))).status).toBe(404);
+    });
+});

package/dist/plugin/endpoints/mcp.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mcp.test.d.ts.map

package/dist/plugin/endpoints/mcp.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.test.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/mcp.test.ts"],"names":[],"mappings":""}

package/dist/plugin/endpoints/mcp.test.js

@@ -0,0 +1,231 @@
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { documentSummarySchema } from '../../contract.js';
+import { boot, title, withChild } from './endpoints.test-kit.js';
+const KEY = 'agent-key-0123456789';
+let blocked = false;
+let h;
+let agent;
+beforeAll(async () => {
+    h = await boot('mcp', {
+        collections: {
+            pages: { context: 'page', templates: true, path: (doc) => `/${String(doc['slug'])}` },
+            posts: { context: 'post' },
+        },
+        mcp: {
+            enabled: true,
+            collections: ['pages'],
+            rateLimiter: {
+                hit: () => (blocked ? { allowed: false, retryAfterSeconds: 7 } : { allowed: true }),
+            },
+        },
+    }, {
+        // Only "editor*" users may create pages; every signed-in user may read and update them.
+        pageAccess: {
+            create: ({ req }) => String(req.user.email).startsWith('editor'),
+            read: ({ req }) => req.user !== null && req.user !== undefined,
+            update: ({ req }) => req.user !== null && req.user !== undefined,
+        },
+        collections: [
+            { slug: 'users', admin: { useAsTitle: 'email' }, auth: { useAPIKey: true }, fields: [] },
+            {
+                slug: 'posts',
+                admin: { useAsTitle: 'title' },
+                fields: [{ name: 'title', type: 'text' }],
+                versions: { drafts: true },
+            },
+        ],
+    });
+    await h.payload.create({
+        collection: 'users',
+        data: {
+            email: 'editor-agent@example.com',
+            password: 'secret-password',
+            enableAPIKey: true,
+            apiKey: KEY,
+        },
+    });
+    agent = (method, path, body) => h.call(method, path, {
+        token: null,
+        headers: { authorization: `users API-Key ${KEY}` },
+        ...(body === undefined ? {} : { body }),
+    });
+});
+afterAll(() => h.close());
+describe('API-key access', () => {
+    it('reaches the session endpoint as the agent user, without publish permission', async () => {
+        const session = await agent('GET', '/buildr/session');
+        expect(session.status).toBe(200);
+        expect(session.body.user.email).toBe('editor-agent@example.com');
+        expect(session.body.permissions).toMatchObject({ canEdit: true, canPublish: false });
+    });
+    it('is refused without a key', async () => {
+        const list = await h.call('GET', '/buildr/documents?collection=pages', { token: null });
+        expect(list.status).toBe(401);
+        const create = await h.call('POST', '/buildr/documents', {
+            token: null,
+            body: { collection: 'pages', title: 'x' },
+        });
+        expect(create.status).toBe(401);
+    });
+});
+describe('POST /buildr/documents', () => {
+    it('creates a draft that is never published and attributes it to the agent user', async () => {
+        const created = await agent('POST', '/buildr/documents', {
+            collection: 'pages',
+            title: 'About us',
+            slug: 'about-us',
+        });
+        expect(created.status).toBe(201);
+        const summary = documentSummarySchema.parse(created.body);
+        expect(summary).toMatchObject({
+            title: 'About us',
+            slug: 'about-us',
+            status: 'draft',
+            revision: 0,
+            layoutSource: 'builtin',
+            previewPath: '/about-us',
+        });
+        const stored = await h.payload.findByID({
+            collection: 'pages',
+            id: summary.ref.id,
+            draft: true,
+            depth: 0,
+        });
+        expect(stored['_status']).toBe('draft');
+        expect(stored['buildrUpdatedBy']).toMatchObject({ relationTo: 'users' });
+        // The stored (non-draft) document is a draft too: nothing was published.
+        const live = await h.payload.findByID({
+            collection: 'pages',
+            id: summary.ref.id,
+            draft: false,
+            depth: 0,
+        });
+        expect(live['_status']).toBe('draft');
+    });
+    it('answers 403 to a user without create access', async () => {
+        const other = await h.login('viewer@example.com');
+        const before = (await h.payload.count({ collection: 'pages' })).totalDocs;
+        const denied = await h.call('POST', '/buildr/documents', {
+            token: other,
+            body: { collection: 'pages', title: 'Nope' },
+        });
+        expect(denied.status).toBe(403);
+        expect((await h.payload.count({ collection: 'pages' })).totalDocs).toBe(before);
+    });
+    it('rejects bodies that do not match the contract and unknown collections', async () => {
+        expect((await agent('POST', '/buildr/documents', { collection: 'pages' })).status).toBe(400);
+        const badSlug = { collection: 'pages', title: 'x', slug: 'Not OK' };
+        expect((await agent('POST', '/buildr/documents', badSlug)).status).toBe(400);
+        const unknown = { collection: 'nope', title: 'x' };
+        expect((await agent('POST', '/buildr/documents', unknown)).status).toBe(404);
+    });
+    it('keeps an agent out of collections outside mcp.collections, but not a browser user', async () => {
+        const body = { collection: 'posts', title: 'Hello' };
+        expect((await agent('POST', '/buildr/documents', body)).status).toBe(403);
+        expect((await agent('GET', '/buildr/documents?collection=posts')).status).toBe(403);
+        expect((await h.call('POST', '/buildr/documents', { body })).status).toBe(201);
+    });
+    it('is limited per API-key user; browser sessions are not limited', async () => {
+        blocked = true;
+        try {
+            const limited = await agent('POST', '/buildr/documents', {
+                collection: 'pages',
+                title: 'Too many',
+            });
+            expect(limited.status).toBe(429);
+            const browser = await h.call('POST', '/buildr/documents', {
+                body: { collection: 'pages', title: 'Browser' },
+            });
+            expect(browser.status).toBe(201);
+        }
+        finally {
+            blocked = false;
+        }
+    });
+});
+describe('GET /buildr/documents', () => {
+    it('lists documents with title, slug, status and layout source, and searches', async () => {
+        const all = await agent('GET', '/buildr/documents?collection=pages');
+        expect(all.status).toBe(200);
+        expect(all.body.page).toBe(1);
+        const titles = all.body.items.map((item) => item.title);
+        expect(titles).toContain('About us');
+        expect(documentSummarySchema.parse(all.body.items[0])).toBeDefined();
+        const found = await agent('GET', '/buildr/documents?collection=pages&search=about');
+        expect(found.body.items.map((item) => item.title)).toEqual(['About us']);
+        const none = await agent('GET', '/buildr/documents?collection=pages&search=zzzz');
+        expect(none.body.items).toEqual([]);
+    });
+    it('needs a collection, and a builder collection', async () => {
+        expect((await agent('GET', '/buildr/documents')).status).toBe(400);
+        expect((await agent('GET', '/buildr/documents?collection=users')).status).toBe(404);
+    });
+});
+describe('writes by an API key', () => {
+    it('saves like the editor and stamps buildrUpdatedBy in every version', async () => {
+        const created = await agent('POST', '/buildr/documents', {
+            collection: 'pages',
+            title: 'Save me',
+        });
+        const { id } = created.body.ref;
+        const path = `/buildr/documents/pages/${id}`;
+        const save = (baseRevision) => agent('PUT', path, { document: withChild(title('Hi')), baseRevision, autosave: false });
+        expect((await save(0)).status).toBe(200);
+        const versions = await h.payload.findVersions({
+            collection: 'pages',
+            where: { parent: { equals: id } },
+            depth: 0,
+            limit: 5,
+        });
+        expect(versions.docs.length).toBeGreaterThan(0);
+        for (const version of versions.docs) {
+            expect(version.version['buildrUpdatedBy']).toMatchObject({
+                relationTo: 'users',
+            });
+        }
+        // The conflict rule is the same as in the editor.
+        expect((await save(0)).status).toBe(409);
+    });
+    it('cannot publish unless mcp.allowPublish is on', async () => {
+        const created = await agent('POST', '/buildr/documents', {
+            collection: 'pages',
+            title: 'Stay draft',
+        });
+        const { id } = created.body.ref;
+        const denied = await agent('POST', `/buildr/documents/pages/${id}/publish`, {
+            baseRevision: 0,
+        });
+        expect(denied.status).toBe(403);
+        const stored = await h.payload.findByID({ collection: 'pages', id, draft: true, depth: 0 });
+        expect(stored['_status']).toBe('draft');
+    });
+});
+describe('GET /buildr/documents/:collection/:id/revision (PB-143)', () => {
+    it('answers with the revision and names the user who saved, without the document', async () => {
+        const created = await agent('POST', '/buildr/documents', {
+            collection: 'pages',
+            title: 'Watched',
+        });
+        const { id } = created.body.ref;
+        const path = `/buildr/documents/pages/${id}`;
+        const before = await agent('GET', `${path}/revision`);
+        expect(before.status).toBe(200);
+        expect(before.body).toMatchObject({ revision: 0, updatedBy: 'editor-agent@example.com' });
+        expect(before.body.document).toBeUndefined();
+        const saved = await agent('PUT', path, {
+            document: withChild(title('Hi')),
+            baseRevision: 0,
+            autosave: false,
+        });
+        expect(saved.status).toBe(200);
+        const after = await agent('GET', `${path}/revision`);
+        expect(after.body).toMatchObject({ revision: 1, updatedBy: 'editor-agent@example.com' });
+        expect(typeof after.body.updatedAt).toBe('string');
+    });
+    it('needs a signed-in user and an existing document', async () => {
+        const anonymous = await h.call('GET', '/buildr/documents/pages/1/revision', { token: null });
+        expect(anonymous.status).toBe(401);
+        const missing = await agent('GET', '/buildr/documents/pages/999999/revision');
+        expect(missing.status).toBe(404);
+    });
+});

package/dist/plugin/endpoints/media.d.ts

@@ -0,0 +1,7 @@
+import type { Endpoint } from 'payload';
+import { type EndpointEnv } from './context.ts';
+/** `GET /api/buildr/media?search&type&page`: the picker's listing, newest first. */
+export declare const mediaListEndpoint: (env: EndpointEnv) => Endpoint;
+/** `POST /api/buildr/media` (multipart `file`, `alt`): uploads through the Local API; `alt` is required. */
+export declare const mediaUploadEndpoint: (env: EndpointEnv) => Endpoint;
+//# sourceMappingURL=media.d.ts.map

package/dist/plugin/endpoints/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/plugin/endpoints/media.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,SAAS,CAAC;AAIxD,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AA0BzD,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,QAAS,WAAW,KAAG,QA4CnD,CAAC;AAEH,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB,QAAS,WAAW,KAAG,QAsCrD,CAAC"}