@nitrogenbuilder/connector-payload 0.1.43 → 0.1.50

package/dist/collection-registry.d.ts

@@ -3,8 +3,14 @@
  *
  * The plugin registers collections at init time via `registerCollection()`.
  */
+type RegisteredCollection = {
+    collectionSlug: string;
+    routePattern?: string;
+};
 export declare function registerCollection(alias: string, collectionSlug: string, routePattern?: string): void;
 export declare function resolveCollection(postType: string): string;
 export declare function resolveCollectionRoutePattern(postType: string): string | undefined;
+export declare function getRegisteredCollections(): RegisteredCollection[];
 export declare function buildRelativePermalink(postType: string, slug: string): string;
 export declare function buildPermalink(postType: string, slug: string, frontendUrl?: string): string;
+export {};

package/dist/collection-registry.js

@@ -33,6 +33,16 @@ export function resolveCollection(postType) {
 export function resolveCollectionRoutePattern(postType) {
     return registeredCollections.get(postType)?.routePattern;
 }
+export function getRegisteredCollections() {
+    const collectionsBySlug = new Map();
+    for (const collection of registeredCollections.values()) {
+        const existing = collectionsBySlug.get(collection.collectionSlug);
+        if (!existing || (!existing.routePattern && collection.routePattern)) {
+            collectionsBySlug.set(collection.collectionSlug, collection);
+        }
+    }
+    return Array.from(collectionsBySlug.values());
+}
 export function buildRelativePermalink(postType, slug) {
     return buildRelativePath(resolveCollectionRoutePattern(postType), slug);
 }

package/dist/components/NitrogenAgentCredential.d.ts

@@ -0,0 +1 @@
+export declare const NitrogenAgentCredential: import("react").ComponentType<import("./NitrogenAgentCredentialRuntime.js").NitrogenAgentCredentialRuntimeProps>;

package/dist/components/NitrogenAgentCredential.js

@@ -0,0 +1,6 @@
+'use client';
+import dynamic from 'next/dynamic.js';
+export const NitrogenAgentCredential = dynamic(() => import('./NitrogenAgentCredentialRuntime.js').then((module) => module.NitrogenAgentCredentialRuntime), {
+    loading: () => null,
+    ssr: false,
+});

package/dist/components/NitrogenAgentCredentialRuntime.d.ts

@@ -0,0 +1,10 @@
+import React from 'react';
+export interface NitrogenAgentCredentialRuntimeProps {
+    /** Base URL of the hosted Nitrogen app; the MCP endpoint is `${instanceUrl}/mcp`. */
+    instanceUrl?: string;
+    /** Connector API base advertised via the `x-nitrogen-api-url` header. */
+    apiUrl?: string;
+    /** Payload forwards arbitrary field props; tolerate them. */
+    [key: string]: unknown;
+}
+export declare const NitrogenAgentCredentialRuntime: React.FC<NitrogenAgentCredentialRuntimeProps>;

package/dist/components/NitrogenAgentCredentialRuntime.js

@@ -0,0 +1,136 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { Button, useAuth, useDocumentInfo } from '@payloadcms/ui';
+const DEFAULT_INSTANCE_URL = 'https://app.nitrogenbuilder.com';
+const DEFAULT_API_URL = '/api/nitrogen/v1';
+const TOKEN_ENDPOINT = '/api/nitrogen/v1/agent/token';
+function formatCreated(created) {
+    if (!created)
+        return '';
+    const date = new Date(created * 1000);
+    if (Number.isNaN(date.getTime()))
+        return '';
+    return date.toLocaleString();
+}
+const rowStyle = {
+    borderBottom: '1px solid var(--theme-elevation-150)',
+};
+const cellStyle = {
+    padding: '6px 10px',
+    verticalAlign: 'top',
+    textAlign: 'left',
+};
+const codeStyle = {
+    fontFamily: 'var(--font-mono, monospace)',
+    fontSize: 13,
+    wordBreak: 'break-all',
+};
+export const NitrogenAgentCredentialRuntime = ({ instanceUrl, apiUrl }) => {
+    const { user } = useAuth();
+    const { id: docId } = useDocumentInfo();
+    // The credential is personal: each user mints/revokes only their own. The
+    // /agent/token endpoints always act on the logged-in user, so the controls
+    // are meaningful only on your OWN account. On another user's edit screen
+    // (or an unsaved new user) render nothing. Mirrors the WP profile section,
+    // which hides the controls for everyone but the profile owner.
+    const isSelf = !!user && docId != null && String(user.id) === String(docId);
+    const [status, setStatus] = useState(null);
+    const [plaintext, setPlaintext] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    const resolvedInstanceUrl = (instanceUrl || DEFAULT_INSTANCE_URL).replace(/\/$/, '');
+    const mcpEndpoint = `${resolvedInstanceUrl}/mcp`;
+    const resolvedApiUrl = apiUrl || DEFAULT_API_URL;
+    useEffect(() => {
+        if (!isSelf)
+            return;
+        let cancelled = false;
+        fetch(TOKEN_ENDPOINT, { credentials: 'same-origin' })
+            .then((res) => res.json())
+            .then((data) => {
+            if (!cancelled) {
+                setStatus({
+                    exists: Boolean(data?.exists),
+                    created: Number(data?.created || 0),
+                });
+            }
+        })
+            .catch(() => {
+            if (!cancelled)
+                setError('Could not load credential status.');
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [isSelf]);
+    // Hide the whole section unless viewing your own account.
+    if (!isSelf)
+        return null;
+    const generate = () => {
+        if (!window.confirm('Generate a new credential? Any existing one will stop working.')) {
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        fetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'Content-Type': 'application/json' },
+        })
+            .then((res) => res.json())
+            .then((data) => {
+            setBusy(false);
+            if (data && data.token) {
+                setPlaintext(data.token);
+                setStatus({
+                    exists: true,
+                    created: Number(data.created || Math.floor(Date.now() / 1000)),
+                });
+            }
+            else {
+                setError('Could not generate a credential.');
+            }
+        })
+            .catch(() => {
+            setBusy(false);
+            setError('Could not generate a credential.');
+        });
+    };
+    const revoke = () => {
+        if (!window.confirm('Revoke your agent credential?')) {
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        fetch(TOKEN_ENDPOINT, {
+            method: 'DELETE',
+            credentials: 'same-origin',
+            headers: { 'Content-Type': 'application/json' },
+        })
+            .then(() => {
+            setBusy(false);
+            setPlaintext(null);
+            setStatus({ exists: false, created: 0 });
+        })
+            .catch(() => {
+            setBusy(false);
+            setError('Could not revoke the credential.');
+        });
+    };
+    const hasToken = Boolean(status?.exists);
+    const createdLabel = status ? formatCreated(status.created) : '';
+    return (_jsxs("div", { style: { color: 'var(--theme-text)', maxWidth: 640 }, children: [_jsx("h3", { style: { marginTop: 0 }, children: "Nitrogen AI Agent Access" }), _jsx("p", { style: { color: 'var(--theme-elevation-600)' }, children: "Connect your AI agent (e.g. Claude) to drive the Nitrogen editor as you. The agent can only ever edit on your behalf \u2014 never as another user. The credential is shown once; if you lose it, generate a new one." }), status === null ? (_jsx("p", { style: { color: 'var(--theme-elevation-600)' }, children: "Loading\u2026" })) : (_jsx("p", { children: hasToken
+                    ? `A credential is active${createdLabel ? ` (generated ${createdLabel})` : ''}.`
+                    : 'No credential generated yet.' })), _jsxs("div", { style: { display: 'flex', gap: 8, margin: '12px 0' }, children: [_jsx(Button, { buttonStyle: "primary", margin: false, disabled: busy || status === null, onClick: generate, children: hasToken ? 'Regenerate Credential' : 'Generate Credential' }), hasToken && (_jsx(Button, { buttonStyle: "secondary", margin: false, disabled: busy, onClick: revoke, children: "Revoke" }))] }), error && (_jsx("p", { style: { color: 'var(--theme-error-500, #c00)' }, children: error })), plaintext && (_jsxs("div", { style: { margin: '8px 0' }, children: [_jsx("p", { style: { margin: '0 0 4px' }, children: _jsx("strong", { children: "Copy this now \u2014 it will not be shown again:" }) }), _jsx("input", { type: "text", readOnly: true, value: plaintext, onClick: (e) => e.currentTarget.select(), style: {
+                            width: '100%',
+                            padding: '6px 8px',
+                            fontFamily: 'var(--font-mono, monospace)',
+                            fontSize: 13,
+                        } })] })), _jsx("table", { style: {
+                    width: '100%',
+                    borderCollapse: 'collapse',
+                    marginTop: 16,
+                    border: '1px solid var(--theme-elevation-150)',
+                }, children: _jsxs("tbody", { children: [_jsxs("tr", { style: rowStyle, children: [_jsx("td", { style: cellStyle, children: _jsx("strong", { children: "MCP endpoint" }) }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: mcpEndpoint })] }), _jsxs("tr", { style: rowStyle, children: [_jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "x-nitrogen-api-url" }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: resolvedApiUrl })] }), _jsxs("tr", { children: [_jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "Authorization" }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "Bearer <your credential>" })] })] }) })] }));
+};

package/dist/editor/NitrogenEditorPage.d.ts

@@ -2,7 +2,6 @@ interface NitrogenEditorSearchParams {
     pageId?: string;
     collection?: string;
     development?: string;
-    editorDevelopment?: string;
 }
 /**
  * Creates a standalone editor page that loads the Nitrogen builder.

package/dist/editor/NitrogenEditorPage.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { getPayload } from "payload";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
@@ -28,9 +28,6 @@ function getSiteUrl(settings, isDevelopment) {
         : settings.frontendDevUrl || settings.developmentUrl;
     return preferredUrl || fallbackUrl || "";
 }
-function getNitrogenEditorDevUrl(settings) {
-    return settings.nitrogenEditorDevUrl || settings.instanceUrl || "";
-}
 /**
  * Creates a standalone editor page that loads the Nitrogen builder.
  *
@@ -78,31 +75,20 @@ export function createNitrogenEditorPage(config) {
             cssInjection: nitrogenConfig.cssInjection || "",
         };
         const editId = params.pageId;
-        // Preserve the old localhost flow: `development=true` should still imply
-        // local editor HMR when the editor page itself is served from localhost.
-        // Deployed hosts stay on the built editor unless explicitly opted in.
-        const requestHost = headersList.get("host") || "";
-        const requestHostname = requestHost.split(":")[0];
-        const isLocalRequestHost = requestHostname === "localhost" ||
-            requestHostname === "127.0.0.1" ||
-            requestHostname === "[::1]";
-        const isEditorDevelopment = params.editorDevelopment === "true";
-        const editorDevOrigin = getNitrogenEditorDevUrl(settings).replace(/\/$/, "");
-        const isEditorDev = !!editorDevOrigin &&
-            (isEditorDevelopment ||
-                (isPreviewDevelopment && isLocalRequestHost));
-        const editorAssetsBase = isEditorDev
-            ? editorDevOrigin
-            : "/nitrogen-editor/assets";
+        const editorAssetsBase = "/nitrogen-editor/assets";
         const editorCdnVersion = typeof settings.editorCdnVersion === "string" &&
             settings.editorCdnVersion.trim()
             ? settings.editorCdnVersion.trim()
             : DEFAULT_EDITOR_CDN_VERSION;
         const cdnBase = `https://cdn.jsdelivr.net/npm/@nitrogenbuilder/editor@${editorCdnVersion}`;
-        return (_jsxs(_Fragment, { children: [!isEditorDev && (_jsxs(_Fragment, { children: [_jsx("link", { rel: "preconnect", href: "https://cdn.jsdelivr.net" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "" })] })), isEditorDev ? (_jsxs(_Fragment, { children: [_jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorDevOrigin}/src/index.scss` })] })) : (_jsxs(_Fragment, { children: [_jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${cdnBase}/index.css` })] })), _jsx("script", { dangerouslySetInnerHTML: {
+        return (_jsxs(_Fragment, { children: [_jsx("link", { rel: "preconnect", href: "https://cdn.jsdelivr.net" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "" }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${cdnBase}/index.css` }), _jsx("script", { dangerouslySetInnerHTML: {
                         __html: [
                             `window.nitrogenConfig = ${JSON.stringify(builderConfig)};`,
                             `window.nitrogenEditId = "${editId}";`,
+                            // Identity injected as a global (not via URL) so a copied edit URL
+                            // doesn't carry the original author's id/email. The editor reads
+                            // window.nitrogenUser, falling back to the authorId/author params below.
+                            `window.nitrogenUser = ${JSON.stringify({ id: String(user.id), email: user.email })};`,
                             // Keep both legacy and current author params present for editor builds.
                             `(function(){var u=new URL(window.location.href),a=${JSON.stringify(String(user.id))},changed=false;if(!u.searchParams.has("authorId")){u.searchParams.set("authorId",a);changed=true}if(!u.searchParams.has("author")){u.searchParams.set("author",a);changed=true}if(changed){window.history.replaceState(null,"",u.toString())}})();`,
                         ].join(""),
@@ -114,18 +100,12 @@ export function createNitrogenEditorPage(config) {
                                 alignItems: "center",
                                 justifyContent: "center",
                                 backgroundColor: "#0F1214",
-                            }, children: isEditorDev ? (_jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
-                                    width: "24rem",
-                                    maxWidth: "100%",
-                                    animation: "nitrogen-loader-pulse 3s ease-in-out infinite",
-                                } })) : (_jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
+                            }, children: _jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
                                     width: "24rem",
                                     maxWidth: "100%",
                                     animation: "nitrogen-loader-pulse 3s ease-in-out infinite",
-                                } })) }), _jsx("style", { dangerouslySetInnerHTML: {
+                                } }) }), _jsx("style", { dangerouslySetInnerHTML: {
                                 __html: `@keyframes nitrogen-loader-pulse{0%{transform:scale(1);opacity:0}50%{opacity:1}100%{transform:scale(1.05);opacity:0}}`,
-                            } })] }), isEditorDev ? (_jsxs(_Fragment, { children: [_jsx("script", { type: "module", dangerouslySetInnerHTML: {
-                                __html: `import RefreshRuntime from "${editorDevOrigin}/@react-refresh";RefreshRuntime.injectIntoGlobalHook(window);window.$RefreshReg$ = () => {};window.$RefreshSig$ = () => (type) => type;window.__vite_plugin_react_preamble_installed__ = true;`,
-                            } }), _jsx("script", { type: "module", src: `${editorDevOrigin}/@vite/client` }), _jsx("script", { type: "module", crossOrigin: "", src: `${editorDevOrigin}/src/main.tsx` })] })) : (_jsx("script", { type: "module", crossOrigin: "", src: `${cdnBase}/index.js` }))] }));
+                            } })] }), _jsx("script", { type: "module", crossOrigin: "", src: `${cdnBase}/index.js` })] }));
     };
 }

package/dist/endpoints/agent-auth.d.ts

@@ -0,0 +1,31 @@
+import type { Endpoint } from 'payload';
+/**
+ * AI-agent (MCP) authentication for the bundled Nitrogen MCP server.
+ *
+ * Port of the WordPress connector's `Agent_Auth` (includes/agent-auth.php). The
+ * cloud MCP server never trusts its caller's claimed identity; for each MCP
+ * session it POSTs the user's agent credential to `/agent/verify` and binds the
+ * session to the verified `{ userId, host }`.
+ *
+ * Credential format: `<userId>:<secret>` (Bearer). We persist only a salted
+ * scrypt hash of `<secret>` on the user, looked up by `<userId>` — so a single
+ * hash check verifies it without scanning every user. Each editor mints their
+ * own from their profile screen; the plaintext is shown exactly once.
+ */
+/** Generate a url-safe credential secret. */
+export declare function generateSecret(): Promise<string>;
+/**
+ * Hash a secret with a random salt using scrypt. Returns `salt:hash` (both hex).
+ */
+export declare function hashSecret(secret: string): Promise<string>;
+/**
+ * Verify a secret against a stored `salt:hash`. Constant-time comparison.
+ * Returns false on any malformed input; never throws.
+ */
+export declare function verifySecret(secret: string, stored: string): Promise<boolean>;
+/**
+ * Build the four agent-auth endpoints bound to a given user collection slug.
+ * The user collection must have fields `nitrogenAgentTokenHash` (text) and
+ * `nitrogenAgentTokenCreated` (number).
+ */
+export declare function createAgentAuthEndpoints(userCollection: string): Endpoint[];

package/dist/endpoints/agent-auth.js

@@ -0,0 +1,210 @@
+import { getNitrogenSettings, requireAuth } from './helpers.js';
+// Load node's crypto lazily via dynamic import so this module's STATIC import
+// graph contains no node-builtin import. Payload's tsx-based `migrate` bin
+// transpiles the config graph at load time and mishandles builtin imports once
+// esbuild normalizes them to `node:crypto` (throws ENOENT on
+// `node:crypto?tsx-namespace=…`). A dynamic import is left to runtime and is
+// only ever evaluated inside a request handler — never during `migrate`.
+async function loadCrypto() {
+    return import('crypto');
+}
+/**
+ * AI-agent (MCP) authentication for the bundled Nitrogen MCP server.
+ *
+ * Port of the WordPress connector's `Agent_Auth` (includes/agent-auth.php). The
+ * cloud MCP server never trusts its caller's claimed identity; for each MCP
+ * session it POSTs the user's agent credential to `/agent/verify` and binds the
+ * session to the verified `{ userId, host }`.
+ *
+ * Credential format: `<userId>:<secret>` (Bearer). We persist only a salted
+ * scrypt hash of `<secret>` on the user, looked up by `<userId>` — so a single
+ * hash check verifies it without scanning every user. Each editor mints their
+ * own from their profile screen; the plaintext is shown exactly once.
+ */
+/** Generate a url-safe credential secret. */
+export async function generateSecret() {
+    const { randomBytes } = await loadCrypto();
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * Hash a secret with a random salt using scrypt. Returns `salt:hash` (both hex).
+ */
+export async function hashSecret(secret) {
+    const { randomBytes, scryptSync } = await loadCrypto();
+    const salt = randomBytes(16);
+    const hash = scryptSync(secret, salt, 64);
+    return `${salt.toString('hex')}:${hash.toString('hex')}`;
+}
+/**
+ * Verify a secret against a stored `salt:hash`. Constant-time comparison.
+ * Returns false on any malformed input; never throws.
+ */
+export async function verifySecret(secret, stored) {
+    try {
+        if (typeof secret !== 'string' || typeof stored !== 'string')
+            return false;
+        const sep = stored.indexOf(':');
+        if (sep <= 0)
+            return false;
+        const saltHex = stored.slice(0, sep);
+        const hashHex = stored.slice(sep + 1);
+        if (!saltHex || !hashHex)
+            return false;
+        const salt = Buffer.from(saltHex, 'hex');
+        const expected = Buffer.from(hashHex, 'hex');
+        if (salt.length === 0 || expected.length === 0)
+            return false;
+        const { scryptSync, timingSafeEqual } = await loadCrypto();
+        const derived = scryptSync(secret, salt, expected.length);
+        if (derived.length !== expected.length)
+            return false;
+        return timingSafeEqual(derived, expected);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the bearer credential from the Authorization header. Returns the raw
+ * `<userId>:<secret>` string, or '' if absent/malformed. Some hosts strip the
+ * Authorization header, so an explicit `x-nitrogen-agent-token` fallback is
+ * allowed.
+ */
+function bearerCredential(req) {
+    const header = req.headers.get('authorization');
+    if (!header) {
+        const fallback = req.headers.get('x-nitrogen-agent-token');
+        return fallback ? fallback.trim() : '';
+    }
+    if (/^Bearer /i.test(header)) {
+        return header.slice(7).trim();
+    }
+    return '';
+}
+/** Hostname of the configured frontend URL, or '' if unset/unparseable. */
+function agentHost(frontendUrl) {
+    if (!frontendUrl)
+        return '';
+    try {
+        return new URL(frontendUrl).host;
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Build the four agent-auth endpoints bound to a given user collection slug.
+ * The user collection must have fields `nitrogenAgentTokenHash` (text) and
+ * `nitrogenAgentTokenCreated` (number).
+ */
+export function createAgentAuthEndpoints(userCollection) {
+    return [
+        // POST /agent/verify — identity verification, called by the MCP server, NOT
+        // a browser. Does its own bearer-credential auth, so the gate is open.
+        // Every failure returns an identical 401 (no enumeration).
+        {
+            path: '/nitrogen/v1/agent/verify',
+            method: 'post',
+            handler: async (req) => {
+                const unauthorized = () => Response.json({ error: 'Invalid agent credential.' }, { status: 401 });
+                const credential = bearerCredential(req);
+                const sep = credential.indexOf(':');
+                if (!credential || sep < 0) {
+                    return unauthorized();
+                }
+                const userId = credential.slice(0, sep);
+                const secret = credential.slice(sep + 1);
+                if (!userId || !secret) {
+                    return unauthorized();
+                }
+                const user = (await req.payload.findByID({
+                    collection: userCollection,
+                    id: userId,
+                    overrideAccess: true,
+                    disableErrors: true,
+                }));
+                const storedHash = user?.nitrogenAgentTokenHash;
+                if (!user || !storedHash || !(await verifySecret(secret, storedHash))) {
+                    return unauthorized();
+                }
+                const settings = await getNitrogenSettings(req.payload);
+                return Response.json({
+                    userId: String(userId),
+                    host: agentHost(settings.frontendUrl),
+                    // License key = the websocket room token the editor connects with;
+                    // lets the MCP server scope precisely to this user's room.
+                    token: settings.licenseKey || '',
+                });
+            },
+        },
+        // GET /agent/token — non-secret status of the current user's credential.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'get',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                // Read fresh with overrideAccess: the hash field is access-gated
+                // (read: () => false) and may be stripped from req.user.
+                const user = (await req.payload.findByID({
+                    collection: userCollection,
+                    id: req.user.id,
+                    overrideAccess: true,
+                    disableErrors: true,
+                }));
+                return Response.json({
+                    exists: Boolean(user?.nitrogenAgentTokenHash),
+                    created: Number(user?.nitrogenAgentTokenCreated || 0),
+                });
+            },
+        },
+        // POST /agent/token — mint a fresh credential for the current user,
+        // replacing any existing one. The plaintext is returned ONCE and never
+        // stored; only a salted hash is persisted.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'post',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                const secret = await generateSecret();
+                const created = Math.floor(Date.now() / 1000);
+                await req.payload.update({
+                    collection: userCollection,
+                    id: req.user.id,
+                    data: {
+                        nitrogenAgentTokenHash: await hashSecret(secret),
+                        nitrogenAgentTokenCreated: created,
+                    },
+                    overrideAccess: true,
+                });
+                return Response.json({
+                    token: `${req.user.id}:${secret}`,
+                    created,
+                }, { status: 201 });
+            },
+        },
+        // DELETE /agent/token — revoke the current user's credential.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'delete',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                await req.payload.update({
+                    collection: userCollection,
+                    id: req.user.id,
+                    data: {
+                        nitrogenAgentTokenHash: null,
+                        nitrogenAgentTokenCreated: null,
+                    },
+                    overrideAccess: true,
+                });
+                return Response.json({ exists: false });
+            },
+        },
+    ];
+}

package/dist/endpoints/batch.js

@@ -18,6 +18,16 @@ function isTruthyParam(value) {
 function unique(values) {
     return Array.from(new Set(values));
 }
+// Stable signature for a batch request — identical (endpoint, params) requests
+// share one underlying query (mirrors the WP batch dedup, rest-routes.php:542-580).
+// Object keys are sorted so param ordering doesn't defeat the dedup.
+function requestSignature(batchReq) {
+    const params = batchReq.params ?? {};
+    const sortedParams = Object.fromEntries(Object.keys(params)
+        .sort()
+        .map((k) => [k, params[k]]));
+    return JSON.stringify({ endpoint: batchReq.endpoint, params: sortedParams });
+}
 async function resolveRelationshipIds(payload, collection, values) {
     if (values.length === 0)
         return [];
@@ -88,7 +98,22 @@ export const batchEndpoints = [
             }
             const settings = await getNitrogenSettings(payload);
             const results = {};
-            await Promise.all(requests.map(async (batchReq) => {
+            // Dedup: group identical (endpoint, params) requests and run each group's
+            // query once via its first ("representative") request; fan the result out
+            // to the duplicate keys afterward.
+            const groups = new Map();
+            for (const batchReq of requests) {
+                const sig = requestSignature(batchReq);
+                const existing = groups.get(sig);
+                if (existing) {
+                    existing.push(batchReq);
+                }
+                else {
+                    groups.set(sig, [batchReq]);
+                }
+            }
+            await Promise.all(Array.from(groups.values()).map(async (group) => {
+                const batchReq = group[0];
                 const { key, endpoint, params = {} } = batchReq;
                 try {
                     const collectionSlug = resolveCollection(endpoint);
@@ -306,6 +331,13 @@ export const batchEndpoints = [
                     };
                 }
             }));
+            // Fan each representative's result out to the keys that shared its query.
+            for (const group of groups.values()) {
+                const representativeKey = group[0].key;
+                for (let i = 1; i < group.length; i++) {
+                    results[group[i].key] = results[representativeKey];
+                }
+            }
             return Response.json(results);
         },
     },