@payloadcms/plugin-mcp 3.90.1 → 3.90.2

package/dist/utils/schemaConversion/convertCollectionSchemaToZod.d.ts

@@ -1,3 +1,4 @@
 import type { JSONSchema4 } from 'json-schema';
-export declare const convertCollectionSchemaToZod: (schema: JSONSchema4) => any;
+import { z } from 'zod';
+export declare const convertCollectionSchemaToZod: (schema: JSONSchema4) => z.ZodObject<any, any, any, any, any>;
 //# sourceMappingURL=convertCollectionSchemaToZod.d.ts.map

package/dist/utils/schemaConversion/convertCollectionSchemaToZod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convertCollectionSchemaToZod.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/convertCollectionSchemaToZod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAU9C,eAAO,MAAM,4BAA4B,WAAY,WAAW,QAyC/D,CAAA"}
+{"version":3,"file":"convertCollectionSchemaToZod.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/convertCollectionSchemaToZod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAI9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,4BAA4B,WAAY,WAAW,yCA6D/D,CAAA"}

package/dist/utils/schemaConversion/convertCollectionSchemaToZod.js

@@ -20,6 +20,19 @@ export const convertCollectionSchemaToZod = (schema)=>{
                 target: ts.ScriptTarget.ES2018
             }
         });
+        // TypeScript 6 prepends a `"use strict";` directive to the transpiled module
+        // output (TypeScript 5 did not). Combined with the `return ${output}` wrapper
+        // below, that becomes `return "use strict"; <schema>`, so the evaluated
+        // function returns the *string* `"use strict"` instead of the Zod schema, and
+        // the create/update tools then throw `convertedFields.partial is not a
+        // function`, aborting MCP tool registration for the entire endpoint.
+        //
+        // Strip the directive AND the whitespace that follows it: the transpiled
+        // output is `"use strict";\n<expr>`, and stripping only the directive leaves
+        // `return \n<expr>`, where ASI inserts a semicolon after `return` — yielding
+        // `undefined` and an empty input schema. Consuming the trailing whitespace
+        // keeps the expression on the `return` line.
+        const transpiledOutput = transpileResult.outputText.replace(/^\s*['"]use strict['"];?\s*/, '');
         /**
      * This Function evaluation is safe because:
      * 1. The input schema comes from Payload's collection configuration, which is controlled by the application developer
@@ -28,15 +41,20 @@ export const convertCollectionSchemaToZod = (schema)=>{
      * 4. The resulting Zod schema is used only for parameter validation in MCP tools, not for data processing
      * 5. No user input or external data is involved in the schema generation process
      */ // eslint-disable-next-line @typescript-eslint/no-implied-eval
-        return new Function('z', `return ${transpileResult.outputText}`)(z);
+        const converted = new Function('z', `return ${transpiledOutput}`)(z);
+        // Callers (the create/update tools) rely on the result being a ZodObject —
+        // they spread `.partial().shape`. If conversion produced anything else, fall
+        // back to a permissive object so tool registration can't crash.
+        return converted instanceof z.ZodObject ? converted : z.object({}).passthrough();
     } catch (error) {
         // If schema conversion fails (e.g., due to Zod v4 toJSONSchema null-check bug
         // with record schemas that have undefined valueType, or bundler transforms
         // stripping Zod internals), return a permissive schema so tools/list doesn't
         // crash entirely. The tool will still be listed but without strict validation.
-        // See: https://github.com/colinhacks/zod/issues/5821
+        // A ZodObject (rather than z.record) is returned so callers that rely on
+        // .partial()/.shape don't throw. See: https://github.com/colinhacks/zod/issues/5821
         console.warn(`[plugin-mcp] Schema conversion failed, using permissive fallback:`, error instanceof Error ? error.message : error);
-        return z.record(z.any());
+        return z.object({}).passthrough();
     }
 };
 

package/dist/utils/schemaConversion/convertCollectionSchemaToZod.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/convertCollectionSchemaToZod.ts"],"sourcesContent":["import type { JSONSchema4 } from 'json-schema'\n\nimport { jsonSchemaToZod } from 'json-schema-to-zod'\nimport * as ts from 'typescript'\nimport { z } from 'zod'\n\nimport { sanitizeJsonSchema } from './sanitizeJsonSchema.js'\nimport { simplifyRelationshipFields } from './simplifyRelationshipFields.js'\nimport { transformPointFieldsForMCP } from './transformPointFields.js'\n\nexport const convertCollectionSchemaToZod = (schema: JSONSchema4) => {\n  try {\n    // Clone to avoid mutating the original schema (used elsewhere for tool listing)\n    const schemaClone = JSON.parse(JSON.stringify(schema)) as JSONSchema4\n\n    const sanitized = sanitizeJsonSchema(schemaClone)\n    const pointTransformed = transformPointFieldsForMCP(sanitized)\n    const zodSchemaAsString = jsonSchemaToZod(simplifyRelationshipFields(pointTransformed))\n\n    // Transpile TypeScript to JavaScript\n    const transpileResult = ts.transpileModule(zodSchemaAsString, {\n      compilerOptions: {\n        module: ts.ModuleKind.CommonJS,\n        removeComments: true,\n        strict: false,\n        target: ts.ScriptTarget.ES2018,\n      },\n    })\n\n    /**\n     * This Function evaluation is safe because:\n     * 1. The input schema comes from Payload's collection configuration, which is controlled by the application developer\n     * 2. The jsonSchemaToZod library converts JSON Schema to Zod schema definitions, producing only type validation code\n     * 3. The transpiled output contains only Zod schema definitions (z.string(), z.number(), etc.) - no executable logic\n     * 4. The resulting Zod schema is used only for parameter validation in MCP tools, not for data processing\n     * 5. No user input or external data is involved in the schema generation process\n     */\n    // eslint-disable-next-line @typescript-eslint/no-implied-eval\n    return new Function('z', `return ${transpileResult.outputText}`)(z)\n  } catch (error) {\n    // If schema conversion fails (e.g., due to Zod v4 toJSONSchema null-check bug\n    // with record schemas that have undefined valueType, or bundler transforms\n    // stripping Zod internals), return a permissive schema so tools/list doesn't\n    // crash entirely. The tool will still be listed but without strict validation.\n    // See: https://github.com/colinhacks/zod/issues/5821\n    console.warn(\n      `[plugin-mcp] Schema conversion failed, using permissive fallback:`,\n      error instanceof Error ? error.message : error,\n    )\n    return z.record(z.any())\n  }\n}\n"],"names":["jsonSchemaToZod","ts","z","sanitizeJsonSchema","simplifyRelationshipFields","transformPointFieldsForMCP","convertCollectionSchemaToZod","schema","schemaClone","JSON","parse","stringify","sanitized","pointTransformed","zodSchemaAsString","transpileResult","transpileModule","compilerOptions","module","ModuleKind","CommonJS","removeComments","strict","target","ScriptTarget","ES2018","Function","outputText","error","console","warn","Error","message","record","any"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qBAAoB;AACpD,YAAYC,QAAQ,aAAY;AAChC,SAASC,CAAC,QAAQ,MAAK;AAEvB,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,0BAA0B,QAAQ,4BAA2B;AAEtE,OAAO,MAAMC,+BAA+B,CAACC;IAC3C,IAAI;QACF,gFAAgF;QAChF,MAAMC,cAAcC,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACJ;QAE9C,MAAMK,YAAYT,mBAAmBK;QACrC,MAAMK,mBAAmBR,2BAA2BO;QACpD,MAAME,oBAAoBd,gBAAgBI,2BAA2BS;QAErE,qCAAqC;QACrC,MAAME,kBAAkBd,GAAGe,eAAe,CAACF,mBAAmB;YAC5DG,iBAAiB;gBACfC,QAAQjB,GAAGkB,UAAU,CAACC,QAAQ;gBAC9BC,gBAAgB;gBAChBC,QAAQ;gBACRC,QAAQtB,GAAGuB,YAAY,CAACC,MAAM;YAChC;QACF;QAEA;;;;;;;KAOC,GACD,8DAA8D;QAC9D,OAAO,IAAIC,SAAS,KAAK,CAAC,OAAO,EAAEX,gBAAgBY,UAAU,EAAE,EAAEzB;IACnE,EAAE,OAAO0B,OAAO;QACd,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,qDAAqD;QACrDC,QAAQC,IAAI,CACV,CAAC,iEAAiE,CAAC,EACnEF,iBAAiBG,QAAQH,MAAMI,OAAO,GAAGJ;QAE3C,OAAO1B,EAAE+B,MAAM,CAAC/B,EAAEgC,GAAG;IACvB;AACF,EAAC"}
+{"version":3,"sources":["../../../src/utils/schemaConversion/convertCollectionSchemaToZod.ts"],"sourcesContent":["import type { JSONSchema4 } from 'json-schema'\n\nimport { jsonSchemaToZod } from 'json-schema-to-zod'\nimport * as ts from 'typescript'\nimport { z } from 'zod'\n\nimport { sanitizeJsonSchema } from './sanitizeJsonSchema.js'\nimport { simplifyRelationshipFields } from './simplifyRelationshipFields.js'\nimport { transformPointFieldsForMCP } from './transformPointFields.js'\n\nexport const convertCollectionSchemaToZod = (schema: JSONSchema4) => {\n  try {\n    // Clone to avoid mutating the original schema (used elsewhere for tool listing)\n    const schemaClone = JSON.parse(JSON.stringify(schema)) as JSONSchema4\n\n    const sanitized = sanitizeJsonSchema(schemaClone)\n    const pointTransformed = transformPointFieldsForMCP(sanitized)\n    const zodSchemaAsString = jsonSchemaToZod(simplifyRelationshipFields(pointTransformed))\n\n    // Transpile TypeScript to JavaScript\n    const transpileResult = ts.transpileModule(zodSchemaAsString, {\n      compilerOptions: {\n        module: ts.ModuleKind.CommonJS,\n        removeComments: true,\n        strict: false,\n        target: ts.ScriptTarget.ES2018,\n      },\n    })\n\n    // TypeScript 6 prepends a `\"use strict\";` directive to the transpiled module\n    // output (TypeScript 5 did not). Combined with the `return ${output}` wrapper\n    // below, that becomes `return \"use strict\"; <schema>`, so the evaluated\n    // function returns the *string* `\"use strict\"` instead of the Zod schema, and\n    // the create/update tools then throw `convertedFields.partial is not a\n    // function`, aborting MCP tool registration for the entire endpoint.\n    //\n    // Strip the directive AND the whitespace that follows it: the transpiled\n    // output is `\"use strict\";\\n<expr>`, and stripping only the directive leaves\n    // `return \\n<expr>`, where ASI inserts a semicolon after `return` — yielding\n    // `undefined` and an empty input schema. Consuming the trailing whitespace\n    // keeps the expression on the `return` line.\n    const transpiledOutput = transpileResult.outputText.replace(/^\\s*['\"]use strict['\"];?\\s*/, '')\n\n    /**\n     * This Function evaluation is safe because:\n     * 1. The input schema comes from Payload's collection configuration, which is controlled by the application developer\n     * 2. The jsonSchemaToZod library converts JSON Schema to Zod schema definitions, producing only type validation code\n     * 3. The transpiled output contains only Zod schema definitions (z.string(), z.number(), etc.) - no executable logic\n     * 4. The resulting Zod schema is used only for parameter validation in MCP tools, not for data processing\n     * 5. No user input or external data is involved in the schema generation process\n     */\n    // eslint-disable-next-line @typescript-eslint/no-implied-eval\n    const converted = new Function('z', `return ${transpiledOutput}`)(z)\n\n    // Callers (the create/update tools) rely on the result being a ZodObject —\n    // they spread `.partial().shape`. If conversion produced anything else, fall\n    // back to a permissive object so tool registration can't crash.\n    return converted instanceof z.ZodObject ? converted : z.object({}).passthrough()\n  } catch (error) {\n    // If schema conversion fails (e.g., due to Zod v4 toJSONSchema null-check bug\n    // with record schemas that have undefined valueType, or bundler transforms\n    // stripping Zod internals), return a permissive schema so tools/list doesn't\n    // crash entirely. The tool will still be listed but without strict validation.\n    // A ZodObject (rather than z.record) is returned so callers that rely on\n    // .partial()/.shape don't throw. See: https://github.com/colinhacks/zod/issues/5821\n    console.warn(\n      `[plugin-mcp] Schema conversion failed, using permissive fallback:`,\n      error instanceof Error ? error.message : error,\n    )\n    return z.object({}).passthrough()\n  }\n}\n"],"names":["jsonSchemaToZod","ts","z","sanitizeJsonSchema","simplifyRelationshipFields","transformPointFieldsForMCP","convertCollectionSchemaToZod","schema","schemaClone","JSON","parse","stringify","sanitized","pointTransformed","zodSchemaAsString","transpileResult","transpileModule","compilerOptions","module","ModuleKind","CommonJS","removeComments","strict","target","ScriptTarget","ES2018","transpiledOutput","outputText","replace","converted","Function","ZodObject","object","passthrough","error","console","warn","Error","message"],"mappings":"AAEA,SAASA,eAAe,QAAQ,qBAAoB;AACpD,YAAYC,QAAQ,aAAY;AAChC,SAASC,CAAC,QAAQ,MAAK;AAEvB,SAASC,kBAAkB,QAAQ,0BAAyB;AAC5D,SAASC,0BAA0B,QAAQ,kCAAiC;AAC5E,SAASC,0BAA0B,QAAQ,4BAA2B;AAEtE,OAAO,MAAMC,+BAA+B,CAACC;IAC3C,IAAI;QACF,gFAAgF;QAChF,MAAMC,cAAcC,KAAKC,KAAK,CAACD,KAAKE,SAAS,CAACJ;QAE9C,MAAMK,YAAYT,mBAAmBK;QACrC,MAAMK,mBAAmBR,2BAA2BO;QACpD,MAAME,oBAAoBd,gBAAgBI,2BAA2BS;QAErE,qCAAqC;QACrC,MAAME,kBAAkBd,GAAGe,eAAe,CAACF,mBAAmB;YAC5DG,iBAAiB;gBACfC,QAAQjB,GAAGkB,UAAU,CAACC,QAAQ;gBAC9BC,gBAAgB;gBAChBC,QAAQ;gBACRC,QAAQtB,GAAGuB,YAAY,CAACC,MAAM;YAChC;QACF;QAEA,6EAA6E;QAC7E,8EAA8E;QAC9E,wEAAwE;QACxE,8EAA8E;QAC9E,uEAAuE;QACvE,qEAAqE;QACrE,EAAE;QACF,yEAAyE;QACzE,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,6CAA6C;QAC7C,MAAMC,mBAAmBX,gBAAgBY,UAAU,CAACC,OAAO,CAAC,+BAA+B;QAE3F;;;;;;;KAOC,GACD,8DAA8D;QAC9D,MAAMC,YAAY,IAAIC,SAAS,KAAK,CAAC,OAAO,EAAEJ,kBAAkB,EAAExB;QAElE,2EAA2E;QAC3E,6EAA6E;QAC7E,gEAAgE;QAChE,OAAO2B,qBAAqB3B,EAAE6B,SAAS,GAAGF,YAAY3B,EAAE8B,MAAM,CAAC,CAAC,GAAGC,WAAW;IAChF,EAAE,OAAOC,OAAO;QACd,8EAA8E;QAC9E,2EAA2E;QAC3E,6EAA6E;QAC7E,+EAA+E;QAC/E,yEAAyE;QACzE,oFAAoF;QACpFC,QAAQC,IAAI,CACV,CAAC,iEAAiE,CAAC,EACnEF,iBAAiBG,QAAQH,MAAMI,OAAO,GAAGJ;QAE3C,OAAOhC,EAAE8B,MAAM,CAAC,CAAC,GAAGC,WAAW;IACjC;AACF,EAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "3.90.1",
+  "version": "3.90.2",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -44,11 +44,11 @@
     "zod": "^3.25.50"
   },
   "devDependencies": {
-    "@payloadcms/eslint-config": "3.28.0",
-    "payload": "3.90.1"
+    "payload": "3.90.2",
+    "@payloadcms/eslint-config": "3.28.0"
   },
   "peerDependencies": {
-    "payload": "3.90.1"
+    "payload": "3.90.2"
   },
   "homepage:": "https://payloadcms.com",
   "scripts": {

package/src/utils/schemaConversion/convertCollectionSchemaToZod.ts

@@ -27,6 +27,20 @@ export const convertCollectionSchemaToZod = (schema: JSONSchema4) => {
       },
     })
 
+    // TypeScript 6 prepends a `"use strict";` directive to the transpiled module
+    // output (TypeScript 5 did not). Combined with the `return ${output}` wrapper
+    // below, that becomes `return "use strict"; <schema>`, so the evaluated
+    // function returns the *string* `"use strict"` instead of the Zod schema, and
+    // the create/update tools then throw `convertedFields.partial is not a
+    // function`, aborting MCP tool registration for the entire endpoint.
+    //
+    // Strip the directive AND the whitespace that follows it: the transpiled
+    // output is `"use strict";\n<expr>`, and stripping only the directive leaves
+    // `return \n<expr>`, where ASI inserts a semicolon after `return` — yielding
+    // `undefined` and an empty input schema. Consuming the trailing whitespace
+    // keeps the expression on the `return` line.
+    const transpiledOutput = transpileResult.outputText.replace(/^\s*['"]use strict['"];?\s*/, '')
+
     /**
      * This Function evaluation is safe because:
      * 1. The input schema comes from Payload's collection configuration, which is controlled by the application developer
@@ -36,17 +50,23 @@ export const convertCollectionSchemaToZod = (schema: JSONSchema4) => {
      * 5. No user input or external data is involved in the schema generation process
      */
     // eslint-disable-next-line @typescript-eslint/no-implied-eval
-    return new Function('z', `return ${transpileResult.outputText}`)(z)
+    const converted = new Function('z', `return ${transpiledOutput}`)(z)
+
+    // Callers (the create/update tools) rely on the result being a ZodObject —
+    // they spread `.partial().shape`. If conversion produced anything else, fall
+    // back to a permissive object so tool registration can't crash.
+    return converted instanceof z.ZodObject ? converted : z.object({}).passthrough()
   } catch (error) {
     // If schema conversion fails (e.g., due to Zod v4 toJSONSchema null-check bug
     // with record schemas that have undefined valueType, or bundler transforms
     // stripping Zod internals), return a permissive schema so tools/list doesn't
     // crash entirely. The tool will still be listed but without strict validation.
-    // See: https://github.com/colinhacks/zod/issues/5821
+    // A ZodObject (rather than z.record) is returned so callers that rely on
+    // .partial()/.shape don't throw. See: https://github.com/colinhacks/zod/issues/5821
     console.warn(
       `[plugin-mcp] Schema conversion failed, using permissive fallback:`,
       error instanceof Error ? error.message : error,
     )
-    return z.record(z.any())
+    return z.object({}).passthrough()
   }
 }