@nitrogenbuilder/connector-payload 0.1.44 → 0.1.51

package/dist/components/NitrogenAgentCredential.d.ts

@@ -0,0 +1 @@
+export declare const NitrogenAgentCredential: import("react").ComponentType<import("./NitrogenAgentCredentialRuntime.js").NitrogenAgentCredentialRuntimeProps>;

package/dist/components/NitrogenAgentCredential.js

@@ -0,0 +1,6 @@
+'use client';
+import dynamic from 'next/dynamic.js';
+export const NitrogenAgentCredential = dynamic(() => import('./NitrogenAgentCredentialRuntime.js').then((module) => module.NitrogenAgentCredentialRuntime), {
+    loading: () => null,
+    ssr: false,
+});

package/dist/components/NitrogenAgentCredentialRuntime.d.ts

@@ -0,0 +1,10 @@
+import React from 'react';
+export interface NitrogenAgentCredentialRuntimeProps {
+    /** Base URL of the hosted Nitrogen app; the MCP endpoint is `${instanceUrl}/mcp`. */
+    instanceUrl?: string;
+    /** Connector API base advertised via the `x-nitrogen-api-url` header. */
+    apiUrl?: string;
+    /** Payload forwards arbitrary field props; tolerate them. */
+    [key: string]: unknown;
+}
+export declare const NitrogenAgentCredentialRuntime: React.FC<NitrogenAgentCredentialRuntimeProps>;

package/dist/components/NitrogenAgentCredentialRuntime.js

@@ -0,0 +1,136 @@
+'use client';
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { Button, useAuth, useDocumentInfo } from '@payloadcms/ui';
+const DEFAULT_INSTANCE_URL = 'https://app.nitrogenbuilder.com';
+const DEFAULT_API_URL = '/api/nitrogen/v1';
+const TOKEN_ENDPOINT = '/api/nitrogen/v1/agent/token';
+function formatCreated(created) {
+    if (!created)
+        return '';
+    const date = new Date(created * 1000);
+    if (Number.isNaN(date.getTime()))
+        return '';
+    return date.toLocaleString();
+}
+const rowStyle = {
+    borderBottom: '1px solid var(--theme-elevation-150)',
+};
+const cellStyle = {
+    padding: '6px 10px',
+    verticalAlign: 'top',
+    textAlign: 'left',
+};
+const codeStyle = {
+    fontFamily: 'var(--font-mono, monospace)',
+    fontSize: 13,
+    wordBreak: 'break-all',
+};
+export const NitrogenAgentCredentialRuntime = ({ instanceUrl, apiUrl }) => {
+    const { user } = useAuth();
+    const { id: docId } = useDocumentInfo();
+    // The credential is personal: each user mints/revokes only their own. The
+    // /agent/token endpoints always act on the logged-in user, so the controls
+    // are meaningful only on your OWN account. On another user's edit screen
+    // (or an unsaved new user) render nothing. Mirrors the WP profile section,
+    // which hides the controls for everyone but the profile owner.
+    const isSelf = !!user && docId != null && String(user.id) === String(docId);
+    const [status, setStatus] = useState(null);
+    const [plaintext, setPlaintext] = useState(null);
+    const [busy, setBusy] = useState(false);
+    const [error, setError] = useState(null);
+    const resolvedInstanceUrl = (instanceUrl || DEFAULT_INSTANCE_URL).replace(/\/$/, '');
+    const mcpEndpoint = `${resolvedInstanceUrl}/mcp`;
+    const resolvedApiUrl = apiUrl || DEFAULT_API_URL;
+    useEffect(() => {
+        if (!isSelf)
+            return;
+        let cancelled = false;
+        fetch(TOKEN_ENDPOINT, { credentials: 'same-origin' })
+            .then((res) => res.json())
+            .then((data) => {
+            if (!cancelled) {
+                setStatus({
+                    exists: Boolean(data?.exists),
+                    created: Number(data?.created || 0),
+                });
+            }
+        })
+            .catch(() => {
+            if (!cancelled)
+                setError('Could not load credential status.');
+        });
+        return () => {
+            cancelled = true;
+        };
+    }, [isSelf]);
+    // Hide the whole section unless viewing your own account.
+    if (!isSelf)
+        return null;
+    const generate = () => {
+        if (!window.confirm('Generate a new credential? Any existing one will stop working.')) {
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        fetch(TOKEN_ENDPOINT, {
+            method: 'POST',
+            credentials: 'same-origin',
+            headers: { 'Content-Type': 'application/json' },
+        })
+            .then((res) => res.json())
+            .then((data) => {
+            setBusy(false);
+            if (data && data.token) {
+                setPlaintext(data.token);
+                setStatus({
+                    exists: true,
+                    created: Number(data.created || Math.floor(Date.now() / 1000)),
+                });
+            }
+            else {
+                setError('Could not generate a credential.');
+            }
+        })
+            .catch(() => {
+            setBusy(false);
+            setError('Could not generate a credential.');
+        });
+    };
+    const revoke = () => {
+        if (!window.confirm('Revoke your agent credential?')) {
+            return;
+        }
+        setBusy(true);
+        setError(null);
+        fetch(TOKEN_ENDPOINT, {
+            method: 'DELETE',
+            credentials: 'same-origin',
+            headers: { 'Content-Type': 'application/json' },
+        })
+            .then(() => {
+            setBusy(false);
+            setPlaintext(null);
+            setStatus({ exists: false, created: 0 });
+        })
+            .catch(() => {
+            setBusy(false);
+            setError('Could not revoke the credential.');
+        });
+    };
+    const hasToken = Boolean(status?.exists);
+    const createdLabel = status ? formatCreated(status.created) : '';
+    return (_jsxs("div", { style: { color: 'var(--theme-text)', maxWidth: 640 }, children: [_jsx("h3", { style: { marginTop: 0 }, children: "Nitrogen AI Agent Access" }), _jsx("p", { style: { color: 'var(--theme-elevation-600)' }, children: "Connect your AI agent (e.g. Claude) to drive the Nitrogen editor as you. The agent can only ever edit on your behalf \u2014 never as another user. The credential is shown once; if you lose it, generate a new one." }), status === null ? (_jsx("p", { style: { color: 'var(--theme-elevation-600)' }, children: "Loading\u2026" })) : (_jsx("p", { children: hasToken
+                    ? `A credential is active${createdLabel ? ` (generated ${createdLabel})` : ''}.`
+                    : 'No credential generated yet.' })), _jsxs("div", { style: { display: 'flex', gap: 8, margin: '12px 0' }, children: [_jsx(Button, { buttonStyle: "primary", margin: false, disabled: busy || status === null, onClick: generate, children: hasToken ? 'Regenerate Credential' : 'Generate Credential' }), hasToken && (_jsx(Button, { buttonStyle: "secondary", margin: false, disabled: busy, onClick: revoke, children: "Revoke" }))] }), error && (_jsx("p", { style: { color: 'var(--theme-error-500, #c00)' }, children: error })), plaintext && (_jsxs("div", { style: { margin: '8px 0' }, children: [_jsx("p", { style: { margin: '0 0 4px' }, children: _jsx("strong", { children: "Copy this now \u2014 it will not be shown again:" }) }), _jsx("input", { type: "text", readOnly: true, value: plaintext, onClick: (e) => e.currentTarget.select(), style: {
+                            width: '100%',
+                            padding: '6px 8px',
+                            fontFamily: 'var(--font-mono, monospace)',
+                            fontSize: 13,
+                        } })] })), _jsx("table", { style: {
+                    width: '100%',
+                    borderCollapse: 'collapse',
+                    marginTop: 16,
+                    border: '1px solid var(--theme-elevation-150)',
+                }, children: _jsxs("tbody", { children: [_jsxs("tr", { style: rowStyle, children: [_jsx("td", { style: cellStyle, children: _jsx("strong", { children: "MCP endpoint" }) }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: mcpEndpoint })] }), _jsxs("tr", { style: rowStyle, children: [_jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "x-nitrogen-api-url" }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: resolvedApiUrl })] }), _jsxs("tr", { children: [_jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "Authorization" }), _jsx("td", { style: { ...cellStyle, ...codeStyle }, children: "Bearer <your credential>" })] })] }) })] }));
+};

package/dist/editor/NitrogenEditorPage.d.ts

@@ -2,7 +2,6 @@ interface NitrogenEditorSearchParams {
     pageId?: string;
     collection?: string;
     development?: string;
-    editorDevelopment?: string;
 }
 /**
  * Creates a standalone editor page that loads the Nitrogen builder.

package/dist/editor/NitrogenEditorPage.js

@@ -1,4 +1,4 @@
-import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
 import { getPayload } from "payload";
 import { headers } from "next/headers";
 import { redirect } from "next/navigation";
@@ -28,9 +28,6 @@ function getSiteUrl(settings, isDevelopment) {
         : settings.frontendDevUrl || settings.developmentUrl;
     return preferredUrl || fallbackUrl || "";
 }
-function getNitrogenEditorDevUrl(settings) {
-    return settings.nitrogenEditorDevUrl || settings.instanceUrl || "";
-}
 /**
  * Creates a standalone editor page that loads the Nitrogen builder.
  *
@@ -71,6 +68,9 @@ export function createNitrogenEditorPage(config) {
                 type: "payload",
                 apiUrl: getNitrogenApiUrl(isPreviewDevelopment),
                 collection: params.collection,
+                // Shown as a "Sign in" button in the editor when the CMS session has
+                // expired (e.g. a save fails with 401/403).
+                loginUrl: "/admin/login",
             },
             siteUrl: siteUrl || "",
             urlMaps: nitrogenConfig.urlMaps || [],
@@ -78,31 +78,20 @@ export function createNitrogenEditorPage(config) {
             cssInjection: nitrogenConfig.cssInjection || "",
         };
         const editId = params.pageId;
-        // Preserve the old localhost flow: `development=true` should still imply
-        // local editor HMR when the editor page itself is served from localhost.
-        // Deployed hosts stay on the built editor unless explicitly opted in.
-        const requestHost = headersList.get("host") || "";
-        const requestHostname = requestHost.split(":")[0];
-        const isLocalRequestHost = requestHostname === "localhost" ||
-            requestHostname === "127.0.0.1" ||
-            requestHostname === "[::1]";
-        const isEditorDevelopment = params.editorDevelopment === "true";
-        const editorDevOrigin = getNitrogenEditorDevUrl(settings).replace(/\/$/, "");
-        const isEditorDev = !!editorDevOrigin &&
-            (isEditorDevelopment ||
-                (isPreviewDevelopment && isLocalRequestHost));
-        const editorAssetsBase = isEditorDev
-            ? editorDevOrigin
-            : "/nitrogen-editor/assets";
+        const editorAssetsBase = "/nitrogen-editor/assets";
         const editorCdnVersion = typeof settings.editorCdnVersion === "string" &&
             settings.editorCdnVersion.trim()
             ? settings.editorCdnVersion.trim()
             : DEFAULT_EDITOR_CDN_VERSION;
         const cdnBase = `https://cdn.jsdelivr.net/npm/@nitrogenbuilder/editor@${editorCdnVersion}`;
-        return (_jsxs(_Fragment, { children: [!isEditorDev && (_jsxs(_Fragment, { children: [_jsx("link", { rel: "preconnect", href: "https://cdn.jsdelivr.net" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "" })] })), isEditorDev ? (_jsxs(_Fragment, { children: [_jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorDevOrigin}/src/index.scss` })] })) : (_jsxs(_Fragment, { children: [_jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${cdnBase}/index.css` })] })), _jsx("script", { dangerouslySetInnerHTML: {
+        return (_jsxs(_Fragment, { children: [_jsx("link", { rel: "preconnect", href: "https://cdn.jsdelivr.net" }), _jsx("link", { rel: "preconnect", href: "https://fonts.gstatic.com", crossOrigin: "" }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/all.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${editorAssetsBase}/fa620pro/css/sharp-solid.css` }), _jsx("link", { rel: "stylesheet", crossOrigin: "", href: `${cdnBase}/index.css` }), _jsx("script", { dangerouslySetInnerHTML: {
                         __html: [
                             `window.nitrogenConfig = ${JSON.stringify(builderConfig)};`,
                             `window.nitrogenEditId = "${editId}";`,
+                            // Identity injected as a global (not via URL) so a copied edit URL
+                            // doesn't carry the original author's id/email. The editor reads
+                            // window.nitrogenUser, falling back to the authorId/author params below.
+                            `window.nitrogenUser = ${JSON.stringify({ id: String(user.id), email: user.email })};`,
                             // Keep both legacy and current author params present for editor builds.
                             `(function(){var u=new URL(window.location.href),a=${JSON.stringify(String(user.id))},changed=false;if(!u.searchParams.has("authorId")){u.searchParams.set("authorId",a);changed=true}if(!u.searchParams.has("author")){u.searchParams.set("author",a);changed=true}if(changed){window.history.replaceState(null,"",u.toString())}})();`,
                         ].join(""),
@@ -114,18 +103,12 @@ export function createNitrogenEditorPage(config) {
                                 alignItems: "center",
                                 justifyContent: "center",
                                 backgroundColor: "#0F1214",
-                            }, children: isEditorDev ? (_jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
-                                    width: "24rem",
-                                    maxWidth: "100%",
-                                    animation: "nitrogen-loader-pulse 3s ease-in-out infinite",
-                                } })) : (_jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
+                            }, children: _jsx("img", { src: `${editorAssetsBase}/logo-white.svg`, alt: "Loading\u2026", style: {
                                     width: "24rem",
                                     maxWidth: "100%",
                                     animation: "nitrogen-loader-pulse 3s ease-in-out infinite",
-                                } })) }), _jsx("style", { dangerouslySetInnerHTML: {
+                                } }) }), _jsx("style", { dangerouslySetInnerHTML: {
                                 __html: `@keyframes nitrogen-loader-pulse{0%{transform:scale(1);opacity:0}50%{opacity:1}100%{transform:scale(1.05);opacity:0}}`,
-                            } })] }), isEditorDev ? (_jsxs(_Fragment, { children: [_jsx("script", { type: "module", dangerouslySetInnerHTML: {
-                                __html: `import RefreshRuntime from "${editorDevOrigin}/@react-refresh";RefreshRuntime.injectIntoGlobalHook(window);window.$RefreshReg$ = () => {};window.$RefreshSig$ = () => (type) => type;window.__vite_plugin_react_preamble_installed__ = true;`,
-                            } }), _jsx("script", { type: "module", src: `${editorDevOrigin}/@vite/client` }), _jsx("script", { type: "module", crossOrigin: "", src: `${editorDevOrigin}/src/main.tsx` })] })) : (_jsx("script", { type: "module", crossOrigin: "", src: `${cdnBase}/index.js` }))] }));
+                            } })] }), _jsx("script", { type: "module", crossOrigin: "", src: `${cdnBase}/index.js` })] }));
     };
 }

package/dist/endpoints/agent-auth.d.ts

@@ -0,0 +1,31 @@
+import type { Endpoint } from 'payload';
+/**
+ * AI-agent (MCP) authentication for the bundled Nitrogen MCP server.
+ *
+ * Port of the WordPress connector's `Agent_Auth` (includes/agent-auth.php). The
+ * cloud MCP server never trusts its caller's claimed identity; for each MCP
+ * session it POSTs the user's agent credential to `/agent/verify` and binds the
+ * session to the verified `{ userId, host }`.
+ *
+ * Credential format: `<userId>:<secret>` (Bearer). We persist only a salted
+ * scrypt hash of `<secret>` on the user, looked up by `<userId>` — so a single
+ * hash check verifies it without scanning every user. Each editor mints their
+ * own from their profile screen; the plaintext is shown exactly once.
+ */
+/** Generate a url-safe credential secret. */
+export declare function generateSecret(): Promise<string>;
+/**
+ * Hash a secret with a random salt using scrypt. Returns `salt:hash` (both hex).
+ */
+export declare function hashSecret(secret: string): Promise<string>;
+/**
+ * Verify a secret against a stored `salt:hash`. Constant-time comparison.
+ * Returns false on any malformed input; never throws.
+ */
+export declare function verifySecret(secret: string, stored: string): Promise<boolean>;
+/**
+ * Build the four agent-auth endpoints bound to a given user collection slug.
+ * The user collection must have fields `nitrogenAgentTokenHash` (text) and
+ * `nitrogenAgentTokenCreated` (number).
+ */
+export declare function createAgentAuthEndpoints(userCollection: string): Endpoint[];

package/dist/endpoints/agent-auth.js

@@ -0,0 +1,210 @@
+import { getNitrogenSettings, requireAuth } from './helpers.js';
+// Load node's crypto lazily via dynamic import so this module's STATIC import
+// graph contains no node-builtin import. Payload's tsx-based `migrate` bin
+// transpiles the config graph at load time and mishandles builtin imports once
+// esbuild normalizes them to `node:crypto` (throws ENOENT on
+// `node:crypto?tsx-namespace=…`). A dynamic import is left to runtime and is
+// only ever evaluated inside a request handler — never during `migrate`.
+async function loadCrypto() {
+    return import('crypto');
+}
+/**
+ * AI-agent (MCP) authentication for the bundled Nitrogen MCP server.
+ *
+ * Port of the WordPress connector's `Agent_Auth` (includes/agent-auth.php). The
+ * cloud MCP server never trusts its caller's claimed identity; for each MCP
+ * session it POSTs the user's agent credential to `/agent/verify` and binds the
+ * session to the verified `{ userId, host }`.
+ *
+ * Credential format: `<userId>:<secret>` (Bearer). We persist only a salted
+ * scrypt hash of `<secret>` on the user, looked up by `<userId>` — so a single
+ * hash check verifies it without scanning every user. Each editor mints their
+ * own from their profile screen; the plaintext is shown exactly once.
+ */
+/** Generate a url-safe credential secret. */
+export async function generateSecret() {
+    const { randomBytes } = await loadCrypto();
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * Hash a secret with a random salt using scrypt. Returns `salt:hash` (both hex).
+ */
+export async function hashSecret(secret) {
+    const { randomBytes, scryptSync } = await loadCrypto();
+    const salt = randomBytes(16);
+    const hash = scryptSync(secret, salt, 64);
+    return `${salt.toString('hex')}:${hash.toString('hex')}`;
+}
+/**
+ * Verify a secret against a stored `salt:hash`. Constant-time comparison.
+ * Returns false on any malformed input; never throws.
+ */
+export async function verifySecret(secret, stored) {
+    try {
+        if (typeof secret !== 'string' || typeof stored !== 'string')
+            return false;
+        const sep = stored.indexOf(':');
+        if (sep <= 0)
+            return false;
+        const saltHex = stored.slice(0, sep);
+        const hashHex = stored.slice(sep + 1);
+        if (!saltHex || !hashHex)
+            return false;
+        const salt = Buffer.from(saltHex, 'hex');
+        const expected = Buffer.from(hashHex, 'hex');
+        if (salt.length === 0 || expected.length === 0)
+            return false;
+        const { scryptSync, timingSafeEqual } = await loadCrypto();
+        const derived = scryptSync(secret, salt, expected.length);
+        if (derived.length !== expected.length)
+            return false;
+        return timingSafeEqual(derived, expected);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Read the bearer credential from the Authorization header. Returns the raw
+ * `<userId>:<secret>` string, or '' if absent/malformed. Some hosts strip the
+ * Authorization header, so an explicit `x-nitrogen-agent-token` fallback is
+ * allowed.
+ */
+function bearerCredential(req) {
+    const header = req.headers.get('authorization');
+    if (!header) {
+        const fallback = req.headers.get('x-nitrogen-agent-token');
+        return fallback ? fallback.trim() : '';
+    }
+    if (/^Bearer /i.test(header)) {
+        return header.slice(7).trim();
+    }
+    return '';
+}
+/** Hostname of the configured frontend URL, or '' if unset/unparseable. */
+function agentHost(frontendUrl) {
+    if (!frontendUrl)
+        return '';
+    try {
+        return new URL(frontendUrl).host;
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Build the four agent-auth endpoints bound to a given user collection slug.
+ * The user collection must have fields `nitrogenAgentTokenHash` (text) and
+ * `nitrogenAgentTokenCreated` (number).
+ */
+export function createAgentAuthEndpoints(userCollection) {
+    return [
+        // POST /agent/verify — identity verification, called by the MCP server, NOT
+        // a browser. Does its own bearer-credential auth, so the gate is open.
+        // Every failure returns an identical 401 (no enumeration).
+        {
+            path: '/nitrogen/v1/agent/verify',
+            method: 'post',
+            handler: async (req) => {
+                const unauthorized = () => Response.json({ error: 'Invalid agent credential.' }, { status: 401 });
+                const credential = bearerCredential(req);
+                const sep = credential.indexOf(':');
+                if (!credential || sep < 0) {
+                    return unauthorized();
+                }
+                const userId = credential.slice(0, sep);
+                const secret = credential.slice(sep + 1);
+                if (!userId || !secret) {
+                    return unauthorized();
+                }
+                const user = (await req.payload.findByID({
+                    collection: userCollection,
+                    id: userId,
+                    overrideAccess: true,
+                    disableErrors: true,
+                }));
+                const storedHash = user?.nitrogenAgentTokenHash;
+                if (!user || !storedHash || !(await verifySecret(secret, storedHash))) {
+                    return unauthorized();
+                }
+                const settings = await getNitrogenSettings(req.payload);
+                return Response.json({
+                    userId: String(userId),
+                    host: agentHost(settings.frontendUrl),
+                    // License key = the websocket room token the editor connects with;
+                    // lets the MCP server scope precisely to this user's room.
+                    token: settings.licenseKey || '',
+                });
+            },
+        },
+        // GET /agent/token — non-secret status of the current user's credential.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'get',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                // Read fresh with overrideAccess: the hash field is access-gated
+                // (read: () => false) and may be stripped from req.user.
+                const user = (await req.payload.findByID({
+                    collection: userCollection,
+                    id: req.user.id,
+                    overrideAccess: true,
+                    disableErrors: true,
+                }));
+                return Response.json({
+                    exists: Boolean(user?.nitrogenAgentTokenHash),
+                    created: Number(user?.nitrogenAgentTokenCreated || 0),
+                });
+            },
+        },
+        // POST /agent/token — mint a fresh credential for the current user,
+        // replacing any existing one. The plaintext is returned ONCE and never
+        // stored; only a salted hash is persisted.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'post',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                const secret = await generateSecret();
+                const created = Math.floor(Date.now() / 1000);
+                await req.payload.update({
+                    collection: userCollection,
+                    id: req.user.id,
+                    data: {
+                        nitrogenAgentTokenHash: await hashSecret(secret),
+                        nitrogenAgentTokenCreated: created,
+                    },
+                    overrideAccess: true,
+                });
+                return Response.json({
+                    token: `${req.user.id}:${secret}`,
+                    created,
+                }, { status: 201 });
+            },
+        },
+        // DELETE /agent/token — revoke the current user's credential.
+        {
+            path: '/nitrogen/v1/agent/token',
+            method: 'delete',
+            handler: async (req) => {
+                const unauth = requireAuth(req);
+                if (unauth)
+                    return unauth;
+                await req.payload.update({
+                    collection: userCollection,
+                    id: req.user.id,
+                    data: {
+                        nitrogenAgentTokenHash: null,
+                        nitrogenAgentTokenCreated: null,
+                    },
+                    overrideAccess: true,
+                });
+                return Response.json({ exists: false });
+            },
+        },
+    ];
+}

package/dist/endpoints/batch.js

@@ -18,6 +18,16 @@ function isTruthyParam(value) {
 function unique(values) {
     return Array.from(new Set(values));
 }
+// Stable signature for a batch request — identical (endpoint, params) requests
+// share one underlying query (mirrors the WP batch dedup, rest-routes.php:542-580).
+// Object keys are sorted so param ordering doesn't defeat the dedup.
+function requestSignature(batchReq) {
+    const params = batchReq.params ?? {};
+    const sortedParams = Object.fromEntries(Object.keys(params)
+        .sort()
+        .map((k) => [k, params[k]]));
+    return JSON.stringify({ endpoint: batchReq.endpoint, params: sortedParams });
+}
 async function resolveRelationshipIds(payload, collection, values) {
     if (values.length === 0)
         return [];
@@ -88,7 +98,22 @@ export const batchEndpoints = [
             }
             const settings = await getNitrogenSettings(payload);
             const results = {};
-            await Promise.all(requests.map(async (batchReq) => {
+            // Dedup: group identical (endpoint, params) requests and run each group's
+            // query once via its first ("representative") request; fan the result out
+            // to the duplicate keys afterward.
+            const groups = new Map();
+            for (const batchReq of requests) {
+                const sig = requestSignature(batchReq);
+                const existing = groups.get(sig);
+                if (existing) {
+                    existing.push(batchReq);
+                }
+                else {
+                    groups.set(sig, [batchReq]);
+                }
+            }
+            await Promise.all(Array.from(groups.values()).map(async (group) => {
+                const batchReq = group[0];
                 const { key, endpoint, params = {} } = batchReq;
                 try {
                     const collectionSlug = resolveCollection(endpoint);
@@ -306,6 +331,13 @@ export const batchEndpoints = [
                     };
                 }
             }));
+            // Fan each representative's result out to the keys that shared its query.
+            for (const group of groups.values()) {
+                const representativeKey = group[0].key;
+                for (let i = 1; i < group.length; i++) {
+                    results[group[i].key] = results[representativeKey];
+                }
+            }
             return Response.json(results);
         },
     },

package/dist/endpoints/collection-endpoints.js

@@ -1,4 +1,5 @@
-import { getNitrogenSettings, buildDynamicData, buildResolvedPageResponse, buildResolvedListItemResponse, getTemplateForType, requireAuth, } from './helpers.js';
+import { getNitrogenSettings, buildDynamicData, buildResolvedPageResponse, buildResolvedListItemResponse, getTemplateForType, requireAuth, canServeDocument, } from './helpers.js';
+import { resolveTemplateForDocument } from './templateConditions.js';
 /**
  * Creates a complete set of CRUD endpoints for a given Payload collection.
  *
@@ -67,13 +68,16 @@ export function createCollectionEndpoints(collectionSlug, endpointPrefix) {
                 const { payload, routeParams } = req;
                 const id = routeParams?.id;
                 try {
-                    const [doc, settings, headerTemplate, footerTemplate, pageTemplate] = await Promise.all([
+                    const [doc, settings, headerTemplate, footerTemplate] = await Promise.all([
                         payload.findByID({ collection, id, depth: 1 }),
                         getNitrogenSettings(payload),
                         getTemplateForType(payload, 'header'),
                         getTemplateForType(payload, 'footer'),
-                        getTemplateForType(payload, collectionSlug),
                     ]);
+                    if (!canServeDocument(req, doc, settings)) {
+                        return Response.json({ error: 'Not found' }, { status: 404 });
+                    }
+                    const pageTemplate = await resolveTemplateForDocument(payload, doc, collectionSlug, settings);
                     const dynamicData = buildDynamicData(doc, settings);
                     const response = await buildResolvedPageResponse(payload, doc, settings, dynamicData, collectionSlug);
                     return Response.json({
@@ -179,17 +183,20 @@ export function createCollectionEndpoints(collectionSlug, endpointPrefix) {
                 if (!slug) {
                     return Response.json({ error: 'Slug is required' }, { status: 400 });
                 }
-                const [result, settings, headerTemplate, footerTemplate, pageTemplate] = await Promise.all([
+                const [result, settings, headerTemplate, footerTemplate] = await Promise.all([
                     payload.find({ collection, where: { slug: { equals: slug } }, limit: 1, depth: 1 }),
                     getNitrogenSettings(payload),
                     getTemplateForType(payload, 'header'),
                     getTemplateForType(payload, 'footer'),
-                    getTemplateForType(payload, collectionSlug),
                 ]);
                 if (!result.docs.length) {
                     return Response.json({ error: 'Not found' }, { status: 404 });
                 }
                 const doc = result.docs[0];
+                if (!canServeDocument(req, doc, settings)) {
+                    return Response.json({ error: 'Not found' }, { status: 404 });
+                }
+                const pageTemplate = await resolveTemplateForDocument(payload, doc, collectionSlug, settings);
                 const dynamicData = buildDynamicData(doc, settings);
                 const response = await buildResolvedPageResponse(payload, doc, settings, dynamicData, collectionSlug);
                 return Response.json({
@@ -207,17 +214,20 @@ export function createCollectionEndpoints(collectionSlug, endpointPrefix) {
             handler: async (req) => {
                 const { payload, routeParams } = req;
                 const slug = routeParams?.slug;
-                const [result, settings, headerTemplate, footerTemplate, pageTemplate] = await Promise.all([
+                const [result, settings, headerTemplate, footerTemplate] = await Promise.all([
                     payload.find({ collection, where: { slug: { equals: slug } }, limit: 1, depth: 1 }),
                     getNitrogenSettings(payload),
                     getTemplateForType(payload, 'header'),
                     getTemplateForType(payload, 'footer'),
-                    getTemplateForType(payload, collectionSlug),
                 ]);
                 if (!result.docs.length) {
                     return Response.json({ error: 'Not found' }, { status: 404 });
                 }
                 const doc = result.docs[0];
+                if (!canServeDocument(req, doc, settings)) {
+                    return Response.json({ error: 'Not found' }, { status: 404 });
+                }
+                const pageTemplate = await resolveTemplateForDocument(payload, doc, collectionSlug, settings);
                 const dynamicData = buildDynamicData(doc, settings);
                 const response = await buildResolvedPageResponse(payload, doc, settings, dynamicData, collectionSlug);
                 return Response.json({

package/dist/endpoints/helpers.d.ts

@@ -141,3 +141,16 @@ export declare function getNitrogenSettings(payload: Payload): Promise<NitrogenS
  */
 export declare function getTemplateForType(payload: Payload, type: string): Promise<TemplateRef | null>;
 export declare function requireAuth(req: PayloadRequest): Response | null;
+/**
+ * True when the request carries the connector token (the `x-nitrogen-token`
+ * header, or `nitrogen-token` query param for iframe URLs) matching the stored
+ * `connectorToken` setting. Lets the staging frontend / editor preview draft &
+ * private docs without a logged-in session. Mirrors WP `preview_token_valid`.
+ */
+export declare function previewTokenValid(req: PayloadRequest, settings: NitrogenSettingsGlobal): boolean;
+/**
+ * Whether a document may be served for a given request. Published docs are
+ * public; non-published (draft/pending/private) docs require either a logged-in
+ * user or a valid preview token. Mirrors the WP status gate in `get_item`.
+ */
+export declare function canServeDocument(req: PayloadRequest, doc: Record<string, unknown> | null | undefined, settings: NitrogenSettingsGlobal): boolean;

package/dist/endpoints/helpers.js

@@ -231,3 +231,49 @@ export function requireAuth(req) {
     }
     return null;
 }
+// Constant-time string compare in pure JS — deliberately avoids importing a
+// node builtin. Payload's tsx-based `migrate` bin transpiles the config graph
+// and chokes when esbuild normalizes a builtin import to `node:crypto`
+// (ENOENT on `node:crypto?tsx-namespace=…`), so nothing reachable from the
+// config at load time may statically import `crypto`.
+function timingSafeStringEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let mismatch = 0;
+    for (let i = 0; i < a.length; i++) {
+        mismatch |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    return mismatch === 0;
+}
+/**
+ * True when the request carries the connector token (the `x-nitrogen-token`
+ * header, or `nitrogen-token` query param for iframe URLs) matching the stored
+ * `connectorToken` setting. Lets the staging frontend / editor preview draft &
+ * private docs without a logged-in session. Mirrors WP `preview_token_valid`.
+ */
+export function previewTokenValid(req, settings) {
+    const expected = settings.connectorToken;
+    if (!expected)
+        return false;
+    let token = req.headers?.get?.('x-nitrogen-token') || '';
+    if (!token) {
+        const url = new URL(req.url || '', 'http://localhost');
+        token = url.searchParams.get('nitrogen-token') || '';
+    }
+    if (!token)
+        return false;
+    return timingSafeStringEqual(String(expected), token);
+}
+/**
+ * Whether a document may be served for a given request. Published docs are
+ * public; non-published (draft/pending/private) docs require either a logged-in
+ * user or a valid preview token. Mirrors the WP status gate in `get_item`.
+ */
+export function canServeDocument(req, doc, settings) {
+    if (!doc)
+        return false;
+    const status = String(doc._status ?? doc.status ?? 'published');
+    if (status === 'published')
+        return true;
+    return !!req.user || previewTokenValid(req, settings);
+}

package/dist/endpoints/sitemap.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Sitemap endpoints — ported from the WordPress connector
+ * (rest-routes.php: get_sitemap_index, get_sitemap_for_post_type,
+ * build_sitemap_urls_for_post_type, resolve_sitemap_locs_for_post).
+ *
+ * PORTING NOTE: in WP a single post could emit MULTIPLE `loc`s — one per
+ * nitrogen_template matching the post, each contributing its own `url_prefix`
+ * (so a post served at both canonical and prefixed URLs appeared multiple
+ * times). The TARGET (Payload) model has exactly one `routePattern` per
+ * registered collection, so we emit ONE canonical URL per document via
+ * `buildRelativePermalink`. Per-template prefix multiplexing is deferred.
+ */
+import type { Endpoint } from 'payload';
+export declare const sitemapEndpoints: Endpoint[];

package/dist/endpoints/sitemap.js

@@ -0,0 +1,109 @@
+/**
+ * Sitemap endpoints — ported from the WordPress connector
+ * (rest-routes.php: get_sitemap_index, get_sitemap_for_post_type,
+ * build_sitemap_urls_for_post_type, resolve_sitemap_locs_for_post).
+ *
+ * PORTING NOTE: in WP a single post could emit MULTIPLE `loc`s — one per
+ * nitrogen_template matching the post, each contributing its own `url_prefix`
+ * (so a post served at both canonical and prefixed URLs appeared multiple
+ * times). The TARGET (Payload) model has exactly one `routePattern` per
+ * registered collection, so we emit ONE canonical URL per document via
+ * `buildRelativePermalink`. Per-template prefix multiplexing is deferred.
+ */
+import { buildRelativePermalink, getRegisteredCollections, resolveCollection, } from '../collection-registry.js';
+import { findAllDocs } from '../inventory/indexing.js';
+/** Internal Nitrogen collections that must never appear in the sitemap. */
+const EXCLUDED_COLLECTIONS = new Set([
+    'nitrogen-templates',
+    'nitrogen-component-catalog',
+    'nitrogen-component-usage',
+]);
+/**
+ * Fetch published docs for a collection selecting only `slug` and `updatedAt`.
+ *
+ * Payload collections may or may not have drafts enabled (the `_status`
+ * field). We first try filtering by `_status: 'published'`; if that throws
+ * (collection has no `_status`), we fall back to fetching all docs.
+ */
+async function fetchPublishedSitemapDocs(payload, collection) {
+    const select = { slug: true, updatedAt: true };
+    try {
+        return await findAllDocs(payload, collection, {
+            where: { _status: { equals: 'published' } },
+            select,
+        });
+    }
+    catch {
+        return findAllDocs(payload, collection, { select });
+    }
+}
+/** Coerce a doc's updatedAt into an ISO-8601 string, or null when absent. */
+function toIsoString(value) {
+    if (!value)
+        return null;
+    const date = new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+export const sitemapEndpoints = [
+    // GET /nitrogen/v1/sitemap — sitemap index (mirror get_sitemap_index)
+    {
+        path: '/nitrogen/v1/sitemap',
+        method: 'get',
+        handler: async (req) => {
+            const { payload } = req;
+            const postTypes = [];
+            for (const { collectionSlug } of getRegisteredCollections()) {
+                if (EXCLUDED_COLLECTIONS.has(collectionSlug))
+                    continue;
+                let docs;
+                try {
+                    docs = await fetchPublishedSitemapDocs(payload, collectionSlug);
+                }
+                catch {
+                    // One bad collection shouldn't 500 the whole index — skip it.
+                    continue;
+                }
+                if (docs.length === 0)
+                    continue;
+                let lastmod = null;
+                for (const doc of docs) {
+                    const iso = toIsoString(doc.updatedAt);
+                    if (iso !== null && (lastmod === null || iso > lastmod)) {
+                        lastmod = iso;
+                    }
+                }
+                postTypes.push({ post_type: collectionSlug, lastmod });
+            }
+            return Response.json({ post_types: postTypes });
+        },
+    },
+    // GET /nitrogen/v1/sitemap/:post_type — URLs for one post type
+    // (mirror get_sitemap_for_post_type)
+    {
+        path: '/nitrogen/v1/sitemap/:post_type',
+        method: 'get',
+        handler: async (req) => {
+            const { payload, routeParams } = req;
+            const postType = String(routeParams?.post_type || '');
+            const collection = resolveCollection(postType);
+            if (EXCLUDED_COLLECTIONS.has(collection)) {
+                return Response.json({ error: 'Post type not eligible for sitemap' }, { status: 404 });
+            }
+            let docs;
+            try {
+                docs = await fetchPublishedSitemapDocs(payload, collection);
+            }
+            catch {
+                return Response.json({ error: 'No URLs for this post type' }, { status: 404 });
+            }
+            const urls = docs.map((doc) => ({
+                loc: buildRelativePermalink(postType, String(doc.slug || '')),
+                lastmod: toIsoString(doc.updatedAt),
+            }));
+            if (urls.length === 0) {
+                return Response.json({ error: 'No URLs for this post type' }, { status: 404 });
+            }
+            return Response.json({ urls });
+        },
+    },
+];

package/dist/endpoints/templateConditions.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Template Conditions — TypeScript port of the WordPress
+ * `Nitrogen\TemplateConditions` scoring engine
+ * (nitrogen-connector/includes/template-conditions.php).
+ *
+ * Resolves the best-matching nitrogen-template for a document by scoring
+ * editor-authored condition groups (OR'd groups, AND'd conditions within a
+ * group) and falling back to a legacy associatedCollection match.
+ *
+ * Everything here is pure/typed and defensive: the evaluators never throw —
+ * malformed input simply yields a non-match (false).
+ */
+import type { Payload } from 'payload';
+import type { JsonObject, NitrogenPageDoc, NitrogenTemplateDoc, NitrogenSettingsGlobal } from '../types.js';
+import { type TemplateRef } from './helpers.js';
+/**
+ * Evaluation context for a single document.
+ *
+ * `dynamic` holds the buildDynamicData() namespace; `post` is the raw document.
+ * The dynamic_data evaluator resolves its dot-path against both (dynamic first,
+ * then post) so editor-authored paths match leniently.
+ */
+export interface TemplateContext {
+    post: NitrogenPageDoc | NitrogenTemplateDoc | Record<string, unknown>;
+    postType: string;
+    postId: string;
+    dynamic: JsonObject;
+}
+/**
+ * Evaluate authored conditions against a context (php:45-100).
+ *
+ * Groups are OR'd; conditions within a group are AND'd. An `exclude` flag
+ * inverts a condition's result. An unknown condition type fails the whole group.
+ *
+ * Returns the matched-condition count (score) of the first matching group, or
+ * false. If there are no conditionGroups, returns false (the caller handles the
+ * legacy fallback).
+ */
+export declare function evaluateConditions(templateConditions: unknown, context: TemplateContext): number | false;
+/**
+ * Build the evaluation context for a document (php:187-216, Payload-adapted).
+ */
+export declare function buildTemplateContext(doc: NitrogenPageDoc | NitrogenTemplateDoc, collectionSlug: string, settings: NitrogenSettingsGlobal): TemplateContext;
+/**
+ * Resolve the best-matching template for a document
+ * (php:140-182 resolve_template + php:106-132 evaluate_legacy).
+ *
+ * Returns a { ID, content } ref with ctrl-links resolved and content
+ * JSON-stringified — the same shape getTemplateForType() returns — or null if
+ * no template matches.
+ */
+export declare function resolveTemplateForDocument(payload: Payload, doc: NitrogenPageDoc | NitrogenTemplateDoc, collectionSlug: string, settings: NitrogenSettingsGlobal): Promise<TemplateRef | null>;

package/dist/endpoints/templateConditions.js

@@ -0,0 +1,297 @@
+/**
+ * Template Conditions — TypeScript port of the WordPress
+ * `Nitrogen\TemplateConditions` scoring engine
+ * (nitrogen-connector/includes/template-conditions.php).
+ *
+ * Resolves the best-matching nitrogen-template for a document by scoring
+ * editor-authored condition groups (OR'd groups, AND'd conditions within a
+ * group) and falling back to a legacy associatedCollection match.
+ *
+ * Everything here is pure/typed and defensive: the evaluators never throw —
+ * malformed input simply yields a non-match (false).
+ */
+import { buildDynamicData } from './helpers.js';
+import { resolveCtrlLinksInNitrogenData } from './ctrlLinkResolver.js';
+// Template types that are resolved separately (header/footer/404) and must be
+// skipped by the document template resolver.
+const RESERVED_TEMPLATE_TYPES = ['header', 'footer', 'not_found'];
+// --- Built-in condition evaluators (php:225-309) -------------------------------
+/**
+ * post_type — compare 'is'/'is_not' against context.postType.
+ * The condition value is a list (single values are coerced to a one-item list).
+ */
+function evaluatePostType(condition, context) {
+    const value = toArray(condition.value).map((v) => String(v));
+    const postType = context.postType ?? '';
+    const compare = condition.compare ?? 'is';
+    const inList = value.includes(postType);
+    return compare === 'is' ? inList : !inList;
+}
+/**
+ * post_id — compare 'is'/'is_not' against context.postId.
+ * Payload ids may be string or number, so everything is coerced to string
+ * for comparison.
+ */
+function evaluatePostId(condition, context) {
+    const value = toArray(condition.value).map((v) => String(v));
+    const postId = String(context.postId ?? '');
+    const compare = condition.compare ?? 'is';
+    const inList = value.includes(postId);
+    return compare === 'is' ? inList : !inList;
+}
+/**
+ * dynamic_data — resolve `field` (a dot-path, optionally wrapped in {{ }}) and
+ * compare it.
+ *
+ * NOTE: the exact dynamic-data path namespace is best-effort — the WP source
+ * resolved against post/acf_fields/taxonomies, whereas the Payload
+ * buildDynamicData() namespace is shaped differently (e.g. `Post.*`,
+ * `Global Variables.*`). To match editor-authored paths leniently we resolve
+ * against BOTH context.dynamic and the raw context.post (dynamic first).
+ *
+ * Compares: equals/not_equals/contains/not_contains/is_empty/is_not_empty.
+ */
+function evaluateDynamicData(condition, context) {
+    let fieldPath = condition.field ?? '';
+    const compare = condition.compare ?? 'equals';
+    const expected = condition.value ?? '';
+    if (!fieldPath) {
+        return false;
+    }
+    // Strip surrounding {{ }} wrappers, e.g. "{{Post.id}}" -> "Post.id".
+    fieldPath = fieldPath.trim().replace(/^\{\{/, '').replace(/\}\}$/, '').trim();
+    if (!fieldPath) {
+        return false;
+    }
+    // Try the dynamic-data namespace first, then fall back to the raw post.
+    let actual = resolveDotPath(context.dynamic, fieldPath);
+    if (actual === null || actual === undefined) {
+        actual = resolveDotPath(context.post, fieldPath);
+    }
+    const actualStr = Array.isArray(actual)
+        ? actual.map((v) => String(v)).join(', ')
+        : String(actual ?? '');
+    const expectedStr = String(expected ?? '');
+    switch (compare) {
+        case 'equals':
+            return actualStr === expectedStr;
+        case 'not_equals':
+            return actualStr !== expectedStr;
+        case 'contains':
+            return actualStr.includes(expectedStr);
+        case 'not_contains':
+            return !actualStr.includes(expectedStr);
+        case 'is_empty':
+            return isEmpty(actual);
+        case 'is_not_empty':
+            return !isEmpty(actual);
+        default:
+            return false;
+    }
+}
+const CONDITION_EVALUATORS = {
+    post_type: evaluatePostType,
+    post_id: evaluatePostId,
+    dynamic_data: evaluateDynamicData,
+};
+// --- Helpers -------------------------------------------------------------------
+function toArray(value) {
+    if (Array.isArray(value))
+        return value;
+    if (value === null || value === undefined)
+        return [];
+    return [value];
+}
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+/**
+ * Mirrors PHP `empty()` closely enough for condition evaluation:
+ * null/undefined, '', '0', 0, false, and empty arrays are "empty".
+ */
+function isEmpty(value) {
+    if (value === null || value === undefined)
+        return true;
+    if (value === false || value === 0)
+        return true;
+    if (value === '' || value === '0')
+        return true;
+    if (Array.isArray(value))
+        return value.length === 0;
+    if (isRecord(value))
+        return Object.keys(value).length === 0;
+    return false;
+}
+/**
+ * Resolve a dot-notation path against a nested object/array.
+ * Returns null if any segment is missing (matching the PHP behaviour).
+ */
+function resolveDotPath(data, path) {
+    const keys = path.split('.');
+    let current = data;
+    for (const key of keys) {
+        if (isRecord(current) && Object.prototype.hasOwnProperty.call(current, key)) {
+            current = current[key];
+        }
+        else if (Array.isArray(current)) {
+            const index = Number(key);
+            if (Number.isInteger(index) && index >= 0 && index < current.length) {
+                current = current[index];
+            }
+            else {
+                return null;
+            }
+        }
+        else {
+            return null;
+        }
+    }
+    return current;
+}
+function parseConditions(templateConditions) {
+    let data = templateConditions;
+    if (typeof data === 'string') {
+        try {
+            data = JSON.parse(data);
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!isRecord(data))
+        return null;
+    return data;
+}
+// --- Public API ----------------------------------------------------------------
+/**
+ * Evaluate authored conditions against a context (php:45-100).
+ *
+ * Groups are OR'd; conditions within a group are AND'd. An `exclude` flag
+ * inverts a condition's result. An unknown condition type fails the whole group.
+ *
+ * Returns the matched-condition count (score) of the first matching group, or
+ * false. If there are no conditionGroups, returns false (the caller handles the
+ * legacy fallback).
+ */
+export function evaluateConditions(templateConditions, context) {
+    const data = parseConditions(templateConditions);
+    if (!data || !Array.isArray(data.conditionGroups) || data.conditionGroups.length === 0) {
+        return false;
+    }
+    for (const group of data.conditionGroups) {
+        const conditions = group?.conditions;
+        if (!Array.isArray(conditions) || conditions.length === 0) {
+            continue;
+        }
+        let groupMatches = true;
+        let groupScore = 0;
+        for (const condition of conditions) {
+            const type = condition?.type ?? '';
+            const evaluator = CONDITION_EVALUATORS[type];
+            if (!evaluator) {
+                // Unknown condition type — treat the group as a non-match.
+                groupMatches = false;
+                break;
+            }
+            let result;
+            try {
+                result = evaluator(condition, context);
+            }
+            catch {
+                result = false;
+            }
+            // The exclude flag inverts the result.
+            if (condition?.exclude) {
+                result = !result;
+            }
+            if (!result) {
+                groupMatches = false;
+                break;
+            }
+            groupScore++;
+        }
+        if (groupMatches) {
+            return groupScore;
+        }
+    }
+    return false;
+}
+/**
+ * Build the evaluation context for a document (php:187-216, Payload-adapted).
+ */
+export function buildTemplateContext(doc, collectionSlug, settings) {
+    return {
+        post: doc,
+        postType: collectionSlug,
+        postId: String(doc.id),
+        dynamic: buildDynamicData(doc, settings),
+    };
+}
+/**
+ * Resolve the best-matching template for a document
+ * (php:140-182 resolve_template + php:106-132 evaluate_legacy).
+ *
+ * Returns a { ID, content } ref with ctrl-links resolved and content
+ * JSON-stringified — the same shape getTemplateForType() returns — or null if
+ * no template matches.
+ */
+export async function resolveTemplateForDocument(payload, doc, collectionSlug, settings) {
+    let templates;
+    try {
+        const result = await payload.find({
+            collection: 'nitrogen-templates',
+            where: {
+                status: { equals: 'published' },
+            },
+            limit: 10000,
+            depth: 0,
+            sort: '-updatedAt',
+        });
+        templates = result.docs;
+    }
+    catch {
+        return null;
+    }
+    if (!templates.length)
+        return null;
+    const context = buildTemplateContext(doc, collectionSlug, settings);
+    let bestMatch = null;
+    let bestScore = -1;
+    for (const template of templates) {
+        const associatedCollection = template.associatedCollection ?? '';
+        // Skip header/footer/not_found templates — resolved separately.
+        if (RESERVED_TEMPLATE_TYPES.includes(associatedCollection)) {
+            continue;
+        }
+        const conditionsData = parseConditions(template.templateConditions);
+        let score;
+        if (conditionsData && Array.isArray(conditionsData.conditionGroups)) {
+            score = evaluateConditions(template.templateConditions, context);
+        }
+        else {
+            // Legacy fallback (php:106-132): match by associatedCollection.
+            score = associatedCollection === collectionSlug ? 1 : false;
+        }
+        // Highest score wins; ties resolve to the first encountered template, which
+        // (thanks to the -updatedAt sort) is the most recently updated.
+        if (score !== false && score > bestScore) {
+            bestScore = score;
+            bestMatch = template;
+        }
+    }
+    if (!bestMatch)
+        return null;
+    let resolved = null;
+    if (bestMatch.nitrogenData) {
+        try {
+            resolved = await resolveCtrlLinksInNitrogenData(payload, bestMatch.nitrogenData, settings);
+        }
+        catch {
+            resolved = null;
+        }
+    }
+    return {
+        ID: bestMatch.id,
+        content: resolved ? JSON.stringify(resolved) : '[]',
+    };
+}

package/dist/globals/NitrogenSettings.js

@@ -27,6 +27,14 @@ export const NitrogenSettings = {
             type: 'text',
             admin: { description: 'Connector token for server communication' },
         },
+        {
+            name: 'nitrogenInstanceUrl',
+            label: 'Nitrogen Instance URL',
+            type: 'text',
+            admin: {
+                description: 'Base URL of the Nitrogen instance hosting the MCP server (the agent endpoint is this + "/mcp"). Leave blank to use the hosted app.',
+            },
+        },
         {
             type: 'row',
             fields: [

package/dist/index.d.ts

@@ -28,6 +28,12 @@ export interface NitrogenConnectorPluginOptions {
      * inventory. These do not need to be editor-enabled.
      */
     indexCollections?: string[];
+    /**
+     * Slug of the auth-enabled collection that owns MCP agent credentials. When
+     * omitted, the first collection with `auth` enabled is used (falling back to
+     * `users`).
+     */
+    userCollection?: string;
 }
 export declare const nitrogenConnectorPlugin: (options?: NitrogenConnectorPluginOptions) => any;
 export { NitrogenTemplates } from "./collections/NitrogenTemplates.js";

package/dist/index.js

@@ -12,6 +12,8 @@ import { menuEndpoints } from "./endpoints/menu.js";
 import { createCollectionEndpoints } from "./endpoints/collection-endpoints.js";
 import { createComponentInventoryEndpoints } from './endpoints/component-inventory.js';
 import { batchEndpoints } from "./endpoints/batch.js";
+import { sitemapEndpoints } from "./endpoints/sitemap.js";
+import { createAgentAuthEndpoints } from "./endpoints/agent-auth.js";
 import { registerCollection } from "./collection-registry.js";
 import { deleteDocumentUsage, reindexDocumentUsage, syncComponentCatalog, } from './inventory/indexing.js';
 /** Fields required by Nitrogen that will be injected into collections if missing */
@@ -42,6 +44,11 @@ export const nitrogenConnectorPlugin = (options = {}) => (incomingConfig) => {
         return incomingConfig;
     }
     const config = { ...incomingConfig };
+    // The auth collection that owns MCP agent credentials. Prefer the explicit
+    // option, else the first auth-enabled collection, else `users`.
+    const userCollectionSlug = options.userCollection ||
+        (incomingConfig.collections || []).find((col) => col.auth)?.slug ||
+        "users";
     const inventoryCollections = Array.from(new Set([
         ...(options.collections || []),
         ...(options.indexCollections || []),
@@ -94,6 +101,8 @@ export const nitrogenConnectorPlugin = (options = {}) => (incomingConfig) => {
         ...collectionsEndpoints,
         ...menuEndpoints,
         ...batchEndpoints,
+        ...sitemapEndpoints,
+        ...createAgentAuthEndpoints(userCollectionSlug),
         ...createComponentInventoryEndpoints({
             collections: inventoryCollections,
             componentManifest: options.componentManifest,
@@ -224,6 +233,55 @@ export const nitrogenConnectorPlugin = (options = {}) => (incomingConfig) => {
         }
         config.collections[existingIndex] = withInventoryHooks(config.collections[existingIndex], slug);
     }
+    // Inject MCP agent-credential storage + management UI onto the auth users
+    // collection. The hashed secret is never exposed via the API.
+    const usersIndex = (config.collections || []).findIndex((col) => col.slug === userCollectionSlug);
+    if (usersIndex === -1) {
+        console.warn(`[@nitrogenbuilder/connector-payload] Users collection "${userCollectionSlug}" not found; ` +
+            `MCP agent credentials cannot be stored. Pass the "userCollection" option if your auth collection differs.`);
+    }
+    else {
+        const usersCol = config.collections[usersIndex];
+        const usersFieldNames = new Set((usersCol.fields || [])
+            .filter((f) => "name" in f && !!f.name)
+            .map((f) => f.name));
+        const agentFields = [];
+        if (!usersFieldNames.has("nitrogenAgentTokenHash")) {
+            agentFields.push({
+                name: "nitrogenAgentTokenHash",
+                type: "text",
+                access: { read: () => false },
+                admin: { hidden: true, readOnly: true },
+            });
+        }
+        if (!usersFieldNames.has("nitrogenAgentTokenCreated")) {
+            agentFields.push({
+                name: "nitrogenAgentTokenCreated",
+                type: "number",
+                admin: { hidden: true, readOnly: true },
+            });
+        }
+        if (!usersFieldNames.has("nitrogenAgentCredentialUI")) {
+            agentFields.push({
+                name: "nitrogenAgentCredentialUI",
+                type: "ui",
+                admin: {
+                    components: {
+                        Field: {
+                            path: "@nitrogenbuilder/connector-payload/components/NitrogenAgentCredential#NitrogenAgentCredential",
+                            clientProps: { apiUrl: "/api/nitrogen/v1" },
+                        },
+                    },
+                },
+            });
+        }
+        if (agentFields.length > 0) {
+            config.collections[usersIndex] = {
+                ...usersCol,
+                fields: [...usersCol.fields, ...agentFields],
+            };
+        }
+    }
     return config;
 };
 // Re-export for consumers who need direct access

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitrogenbuilder/connector-payload",
-  "version": "0.1.44",
+  "version": "0.1.51",
   "description": "Nitrogen page builder connector plugin for Payload CMS 3.x",
   "author": "Leonardo Dentzien <leo@torchmedia.ca>",
   "type": "module",
@@ -56,6 +56,9 @@
     "@nitrogenbuilder/types": "link:../monogen/packages/types"
   },
   "pnpm": {
-    "onlyBuiltDependencies": ["esbuild", "sharp"]
+    "onlyBuiltDependencies": [
+      "esbuild",
+      "sharp"
+    ]
   }
-}
+}