@payloadcms/plugin-mcp 4.0.0-internal.011fd46 → 4.0.0-internal.0731f09

package/src/types.ts

@@ -1,8 +1,9 @@
 import type {
   CallToolResult,
   ContentBlock,
+  Implementation,
   JsonSchemaType,
-  McpServer,
+  McpServerOptions,
   ResourceTemplate,
   ServerContext,
   StandardSchemaWithJSON,
@@ -10,15 +11,14 @@ import type {
 } from '@modelcontextprotocol/server'
 import type {
   AuthCollectionSlug,
-  CollectionConfig,
   CollectionSlug,
-  DefaultDocumentIDType,
   GlobalSlug,
   MaybePromise,
   PayloadRequest,
-  TypedUser,
+  SanitizedPermissions,
 } from 'payload'
 
+import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
 import type {
   MCPCollectionAuthToolName,
   MCPCollectionBuiltinName,
@@ -32,31 +32,11 @@ export type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }
 
 /**
  * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw
- * JSON Schema literal, or a Standard Schema instance (Zod, Valibot, …).
+ * JSON Schema 2020-12 literal, or a Standard Schema instance (Zod, Valibot, …).
+ * Raw schemas may omit `$schema`; when present it must declare the 2020-12 dialect.
  */
 export type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON
 
-/**
- * Serializable mirror of `SanitizedMCPPluginConfig` for client components —
- * the full sanitized config carries functions (tool handlers, etc.) that can't
- * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and
- * passed to the `AccessField` component via `clientProps`.
- *
- * @internal
- */
-export type ClientMCPPluginConfig = {
-  items: Array<{
-    collectionSlug?: string
-    configKey: string
-    description?: string
-    globalSlug?: string
-    /** Admin-UI bucket for collection/global tools: built-in CRUD, auth, or custom. */
-    group?: 'auth' | 'custom' | 'operations'
-    label: string
-    type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool'
-  }>
-}
-
 export type MCPToolResponse = {
   content: ContentBlock[]
   /**
@@ -73,6 +53,13 @@ export type MCPResponseOverride = (
   req: PayloadRequest,
 ) => MCPToolResponse
 
+export type MCPAfterToolCallHook = (args: {
+  input: unknown
+  req: PayloadRequest
+  response: MCPToolResponse
+  toolName: string
+}) => MaybePromise<MCPToolResponse>
+
 /**
  * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets
  * its inferred output; anything else falls back to `Record<string, unknown>`.
@@ -83,6 +70,19 @@ export type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON
     : StandardSchemaWithJSON.InferOutput<TSchema>
   : Record<string, unknown>
 
+export type MCPAccessArgs = {
+  permissions?: SanitizedPermissions
+  req: PayloadRequest
+}
+
+export type CollectionMCPAccessArgs = {
+  slug: CollectionSlug
+} & MCPAccessArgs
+
+export type GlobalMCPAccessArgs = {
+  slug: GlobalSlug
+} & MCPAccessArgs
+
 export type ToolHandlerArgs<TSchema = undefined> = {
   authorizedMCP: AuthorizedMCP
   input: TypedInput<TSchema>
@@ -91,14 +91,20 @@ export type ToolHandlerArgs<TSchema = undefined> = {
 }
 
 export type CollectionToolHandlerArgs<TSchema = undefined> = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & ToolHandlerArgs<TSchema>
 
 export type GlobalToolHandlerArgs<TSchema = undefined> = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  /**
+   * Runs while authorizing each MCP request, before the tool is advertised or called. Return
+   * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`
+   * is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description: string
   handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
@@ -112,12 +118,26 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  /**
+   * Runs while authorizing each MCP request for this collection. Return `false` to reject calls
+   * to this tool for the collection. The shared tool is not advertised when no collections allow
+   * it, but can remain advertised when it is available for another collection. This is skipped
+   * when `overrideAccess` is enabled.
+   */
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
 } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    /**
+     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to
+     * this tool for the global. The shared tool is not advertised when no globals allow it, but
+     * can remain advertised when it is available for another global. This is skipped when
+     * `overrideAccess` is enabled.
+     */
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
     input?: TSchema
   } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
@@ -127,7 +147,24 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a
  * required handler) from being silently accepted at a built-in key slot.
  */
-export type MCPBuiltInToolOverride = {
+export type MCPBuiltInCollectionToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this collection. This is skipped when `overrideAccess` is enabled.
+   */
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
+  description?: string
+  handler?: never
+  overrideResponse?: MCPResponseOverride
+}
+
+export type MCPBuiltInGlobalToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this global. This is skipped when `overrideAccess` is enabled.
+   */
+  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
   handler?: never
@@ -142,13 +179,13 @@ export type MCPBuiltInToolOverride = {
 export type MCPTopLevelToolEntry = Tool
 
 export type MCPCollectionToolsMap = {
-  [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined
 } & {
-  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride
 }
 
 export type MCPAuthCollectionToolsMap = {
-  [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true
+  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true
 } & MCPCollectionToolsMap
 
 /** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */
@@ -157,9 +194,9 @@ export type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends
   : MCPCollectionToolsMap
 
 export type MCPGlobalToolsMap = {
-  [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined
 } & {
-  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride
 }
 
 export type MCPTopLevelToolsMap = Record<string, Tool>
@@ -171,6 +208,12 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  /**
+   * Runs while authorizing each MCP request, before the prompt is advertised or used. Return
+   * `false` to make the prompt unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
   handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{
@@ -188,6 +231,12 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  /**
+   * Runs while authorizing each MCP request, before the resource is advertised or read. Return
+   * `false` to make the resource unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
     contents: Array<{ text: string; uri: string }>
@@ -221,87 +270,123 @@ export type MCPPluginConfig = {
   collections?: {
     [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>
   }
-  /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */
+  /** Skip MCP endpoint registration. */
   disabled?: boolean
   globals?: {
     [Slug in GlobalSlug]?: MCPPluginGlobalConfig
   }
+  hooks?: {
+    /** Transform a tool response after its handler returns */
+    afterToolCall?: MCPAfterToolCallHook[]
+  }
   mcp?: {
+    /**
+     * Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
+     * are answered with `413`. Base64 file uploads count toward this limit.
+     *
+     * @default 4194304 (4 MiB, the MCP SDK default)
+     */
+    maxRequestBodySize?: number
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig
-  /** Replace the default API-key auth with a custom resolver. */
-  overrideAuth?: (args: {
-    getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>
-    getAuthorizedMCP: (args: { apiKeyDoc: MCPAPIKeysDoc }) => AuthorizedMCP
-    pluginConfig: SanitizedMCPPluginConfig
-    req: PayloadRequest
-  }) => MaybePromise<AuthorizedMCP>
+  /**
+   * How MCP clients sign in. MCP requests without an authenticated user get a `401` that points
+   * to the protected resource metadata (RFC 9728). Set to `false` to only accept API keys and
+   * anonymous requests.
+   *
+   * @default { type: 'builtin' }
+   */
+  oauth?: false | MCPOAuthConfig
+  /**
+   * Replace the default MCP authorization resolver.
+   *
+   * This hook replaces the default authentication flow. It must set `req.user` to the
+   * authenticated Payload user, or to `null` for an anonymous caller, before returning.
+   */
+  overrideGetAuthorizedMCP?: (
+    args: {
+      pluginConfig: SanitizedMCPPluginConfig
+    } & GetAuthorizedMCPArgs,
+  ) => MaybePromise<AuthorizedMCP>
   prompts?: Record<string, Prompt>
   resources?: Record<string, Resource>
   /** Cross-cutting tools (not scoped to any collection or global). */
   tools?: MCPTopLevelToolsMap
-  userCollection?: CollectionSlug
 }
 
-export type SanitizedMCPPluginConfig = {
-  items: MCPItem[]
-  userCollection: CollectionSlug
-} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>
-
-export type MCPServerOptions = {
-  options?: ConstructorParameters<typeof McpServer>[1]
-  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>
-}
+export type MCPOAuthConfig = MCPBuiltinOAuthConfig | MCPExternalOAuthConfig
 
 /**
- * Nested access tree as stored in the collection.
- * A `false` leaf disables that tool; missing keys defer to
- * defaults (built-in CRUD is on, opt-in tools are off).
+ * This Payload app is the authorization server. Users sign in to the admin panel and allow the
+ * MCP client, which then gets an access token for them.
  */
-export type MCPAPIKeysDocAccessTree = {
-  collections?: {
-    [CollectionSlug: CollectionSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  globals?: {
-    [GlobalSlug: GlobalSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  prompts?: {
-    [PromptKey: string]: boolean
-  }
-  resources?: {
-    [ResourceKey: string]: boolean
-  }
-  tools?: {
-    [ToolKey: string]: boolean
-  }
+export type MCPBuiltinOAuthConfig = {
+  /**
+   * Creates the access token the MCP client gets when the user clicks Allow. `req` is the user's
+   * own browser request, so `req.user` is the user who allowed it. Pass `authenticate` too if
+   * Payload's auth strategies don't accept the token.
+   *
+   * @default a Payload login token for that user
+   */
+  issueToken?: (args: {
+    req: PayloadRequest
+  }) => MaybePromise<{ accessToken: string; expiresIn?: number }>
+  type: 'builtin'
+} & MCPOAuthSharedConfig
+
+/** Another service, e.g. your identity provider, is the authorization server. */
+export type MCPExternalOAuthConfig = {
+  /**
+   * The authorization servers that issue access tokens for MCP clients. Clients require each one
+   * to exactly match the `issuer` in that server's metadata, so pass a function when the exact
+   * value is only known at runtime, e.g. from the server's OpenID configuration or per host.
+   */
+  authorizationServers: ((args: { req: PayloadRequest }) => MaybePromise<string[]>) | string[]
+  /**
+   * Scopes MCP clients should request, e.g. `['openid', 'email', 'profile']`. Without them,
+   * clients request none, which some authorization servers reject or answer with a token that
+   * doesn't identify the user.
+   */
+  scopes?: string[]
+  type: 'external'
+} & MCPOAuthSharedConfig
+
+type MCPOAuthSharedConfig = {
+  /**
+   * Called on MCP requests with a bearer token that Payload's auth strategies didn't accept.
+   * Return the Payload user, including its `collection`, or `null` to answer with the OAuth challenge.
+   */
+  authenticate?: (args: {
+    req: PayloadRequest
+    token: string
+  }) => MaybePromise<PayloadRequest['user']>
+  /**
+   * The URL clients call to reach the MCP endpoint.
+   *
+   * @default the absolute URL of `/api/mcp`, based on `serverURL` or the request URL
+   */
+  resource?: string
 }
 
-/**
- * Stored on `payload-mcp-api-keys` docs
- */
-export type MCPAPIKeysDoc = {
-  access: MCPAPIKeysDocAccessTree
-  apiKey?: string
-  apiKeyIndex?: string
-  id: DefaultDocumentIDType
-  lastUsed?: string
-  overrideAccess?: boolean
-  user: null | TypedUser
+export type SanitizedMCPPluginConfig = {
+  items: MCPItem[]
+  /** `undefined` when OAuth is turned off. */
+  oauth?: MCPOAuthConfig
+} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
+
+export type MCPServerOptions = {
+  options?: McpServerOptions
+  serverInfo?: Partial<Implementation>
 }
 
 /**
- * One MCP primitive plus the metadata needed for access checks, admin UI, and
+ * One MCP primitive plus the metadata needed for config-driven filtering and
  * registration.
  *
- * - `configKey`: the config/API-key identifier, e.g. `find` or `echo`.
+ * - `configKey`: the config identifier, e.g. `find` or `echo`.
  * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.
- * - `label`: human-readable admin checkbox text.
+ * - `label`: human-readable display text.
  */
 export type MCPItemBase = {
   configKey: string
@@ -338,13 +423,10 @@ export type MCPItem =
   | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]
   overrideAccess: boolean
-  user: null | TypedUser
 }

package/src/utils/getPluginConfig.ts

@@ -5,7 +5,7 @@ import type { SanitizedMCPPluginConfig } from '../types.js'
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */
 export const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({

package/src/utils/toStandardSchema.ts

@@ -5,5 +5,5 @@ import type { ToolInputSchema } from '../types.js'
 /** Normalize a tool/prompt input to a Standard Schema. Raw JSON Schema gets wrapped; Standard Schema instances pass through. */
 export const toStandardSchema = (schema: ToolInputSchema): StandardSchemaWithJSON =>
   typeof schema === 'object' && schema !== null && '~standard' in schema
-    ? (schema as StandardSchemaWithJSON)
+    ? schema
     : fromJsonSchema(schema)

package/dist/collection/getAccessField.d.ts

@@ -1,12 +0,0 @@
-import type { JSONField } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */
-export declare const getAccessField: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => JSONField;
-//# sourceMappingURL=getAccessField.d.ts.map

package/dist/collection/getAccessField.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAccessField.d.ts","sourceRoot":"","sources":["../../src/collection/getAccessField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,KAAK,EAAkC,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAQ3F;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,mBAE5B;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,SAiBH,CAAA"}

package/dist/collection/getAccessField.js

@@ -1,72 +0,0 @@
-import { COLLECTION_AUTH_BUILTINS, COLLECTION_BUILTINS, GLOBAL_BUILTINS } from '../mcp/builtinTools.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */ export const getAccessField = ({ pluginConfig })=>{
-    const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig);
-    return {
-        name: 'access',
-        type: 'json',
-        admin: {
-            components: {
-                Field: {
-                    clientProps: {
-                        pluginConfig: clientPluginConfig
-                    },
-                    path: '@payloadcms/plugin-mcp/client#AccessField'
-                }
-            }
-        },
-        defaultValue: {},
-        label: false
-    };
-};
-/**
- * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,
- * input/argsSchema functions, etc.) so the result is safe to thread to a
- * client component via `clientProps`.
- */ const sanitizeClientPluginConfig = (pluginConfig)=>({
-        items: pluginConfig.items.map((item)=>{
-            const group = itemGroup(item);
-            return {
-                ...item.type === 'collectionTool' ? {
-                    collectionSlug: item.collectionSlug
-                } : {},
-                ...item.type === 'globalTool' ? {
-                    globalSlug: item.globalSlug
-                } : {},
-                type: item.type,
-                configKey: item.configKey,
-                ...group === 'operations' ? {} : {
-                    description: itemDescription(item)
-                },
-                group,
-                label: item.label
-            };
-        })
-    });
-const itemDescription = (item)=>{
-    if (item.type === 'prompt') {
-        return item.prompt.description;
-    }
-    if (item.type === 'resource') {
-        return item.resource.description;
-    }
-    return item.tool.description;
-};
-const itemGroup = (item)=>{
-    if (item.type === 'collectionTool') {
-        if (item.configKey in COLLECTION_BUILTINS) {
-            return 'operations';
-        }
-        return item.configKey in COLLECTION_AUTH_BUILTINS ? 'auth' : 'custom';
-    }
-    if (item.type === 'globalTool') {
-        return item.configKey in GLOBAL_BUILTINS ? 'operations' : 'custom';
-    }
-    return undefined;
-};
-
-//# sourceMappingURL=getAccessField.js.map

package/dist/collection/getAccessField.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/collection/getAccessField.ts"],"sourcesContent":["import type { JSONField } from 'payload'\n\nimport type { ClientMCPPluginConfig, MCPItem, SanitizedMCPPluginConfig } from '../types.js'\n\nimport {\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTINS,\n} from '../mcp/builtinTools.js'\n\n/**\n * Returns the API key collection's `access` field — a JSON field whose value\n * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is\n * a custom client component (`AccessField`) which renders a permissions\n * matrix; the field's stored shape is just the runtime access tree.\n */\nexport const getAccessField = ({\n  pluginConfig,\n}: {\n  pluginConfig: SanitizedMCPPluginConfig\n}): JSONField => {\n  const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig)\n\n  return {\n    name: 'access',\n    type: 'json',\n    admin: {\n      components: {\n        Field: {\n          clientProps: { pluginConfig: clientPluginConfig },\n          path: '@payloadcms/plugin-mcp/client#AccessField',\n        },\n      },\n    },\n    defaultValue: {},\n    label: false,\n  }\n}\n\n/**\n * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,\n * input/argsSchema functions, etc.) so the result is safe to thread to a\n * client component via `clientProps`.\n */\nconst sanitizeClientPluginConfig = (\n  pluginConfig: SanitizedMCPPluginConfig,\n): ClientMCPPluginConfig => ({\n  items: pluginConfig.items.map((item) => {\n    const group = itemGroup(item)\n\n    return {\n      ...(item.type === 'collectionTool' ? { collectionSlug: item.collectionSlug } : {}),\n      ...(item.type === 'globalTool' ? { globalSlug: item.globalSlug } : {}),\n      type: item.type,\n      configKey: item.configKey,\n      ...(group === 'operations' ? {} : { description: itemDescription(item) }),\n      group,\n      label: item.label,\n    }\n  }),\n})\n\nconst itemDescription = (item: MCPItem): string => {\n  if (item.type === 'prompt') {\n    return item.prompt.description\n  }\n  if (item.type === 'resource') {\n    return item.resource.description\n  }\n  return item.tool.description\n}\n\nconst itemGroup = (item: MCPItem): 'auth' | 'custom' | 'operations' | undefined => {\n  if (item.type === 'collectionTool') {\n    if (item.configKey in COLLECTION_BUILTINS) {\n      return 'operations'\n    }\n    return item.configKey in COLLECTION_AUTH_BUILTINS ? 'auth' : 'custom'\n  }\n  if (item.type === 'globalTool') {\n    return item.configKey in GLOBAL_BUILTINS ? 'operations' : 'custom'\n  }\n  return undefined\n}\n"],"names":["COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTINS","GLOBAL_BUILTINS","getAccessField","pluginConfig","clientPluginConfig","sanitizeClientPluginConfig","name","type","admin","components","Field","clientProps","path","defaultValue","label","items","map","item","group","itemGroup","collectionSlug","globalSlug","configKey","description","itemDescription","prompt","resource","tool","undefined"],"mappings":"AAIA,SACEA,wBAAwB,EACxBC,mBAAmB,EACnBC,eAAe,QACV,yBAAwB;AAE/B;;;;;CAKC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,YAAY,EAGb;IACC,MAAMC,qBAAqBC,2BAA2BF;IAEtD,OAAO;QACLG,MAAM;QACNC,MAAM;QACNC,OAAO;YACLC,YAAY;gBACVC,OAAO;oBACLC,aAAa;wBAAER,cAAcC;oBAAmB;oBAChDQ,MAAM;gBACR;YACF;QACF;QACAC,cAAc,CAAC;QACfC,OAAO;IACT;AACF,EAAC;AAED;;;;CAIC,GACD,MAAMT,6BAA6B,CACjCF,eAC2B,CAAA;QAC3BY,OAAOZ,aAAaY,KAAK,CAACC,GAAG,CAAC,CAACC;YAC7B,MAAMC,QAAQC,UAAUF;YAExB,OAAO;gBACL,GAAIA,KAAKV,IAAI,KAAK,mBAAmB;oBAAEa,gBAAgBH,KAAKG,cAAc;gBAAC,IAAI,CAAC,CAAC;gBACjF,GAAIH,KAAKV,IAAI,KAAK,eAAe;oBAAEc,YAAYJ,KAAKI,UAAU;gBAAC,IAAI,CAAC,CAAC;gBACrEd,MAAMU,KAAKV,IAAI;gBACfe,WAAWL,KAAKK,SAAS;gBACzB,GAAIJ,UAAU,eAAe,CAAC,IAAI;oBAAEK,aAAaC,gBAAgBP;gBAAM,CAAC;gBACxEC;gBACAJ,OAAOG,KAAKH,KAAK;YACnB;QACF;IACF,CAAA;AAEA,MAAMU,kBAAkB,CAACP;IACvB,IAAIA,KAAKV,IAAI,KAAK,UAAU;QAC1B,OAAOU,KAAKQ,MAAM,CAACF,WAAW;IAChC;IACA,IAAIN,KAAKV,IAAI,KAAK,YAAY;QAC5B,OAAOU,KAAKS,QAAQ,CAACH,WAAW;IAClC;IACA,OAAON,KAAKU,IAAI,CAACJ,WAAW;AAC9B;AAEA,MAAMJ,YAAY,CAACF;IACjB,IAAIA,KAAKV,IAAI,KAAK,kBAAkB;QAClC,IAAIU,KAAKK,SAAS,IAAItB,qBAAqB;YACzC,OAAO;QACT;QACA,OAAOiB,KAAKK,SAAS,IAAIvB,2BAA2B,SAAS;IAC/D;IACA,IAAIkB,KAAKV,IAAI,KAAK,cAAc;QAC9B,OAAOU,KAAKK,SAAS,IAAIrB,kBAAkB,eAAe;IAC5D;IACA,OAAO2B;AACT"}

package/dist/collection/index.d.ts

@@ -1,6 +0,0 @@
-import type { CollectionConfig } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-export declare const getAPIKeysCollection: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => CollectionConfig;
-//# sourceMappingURL=index.d.ts.map

package/dist/collection/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collection/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAkB3D,eAAO,MAAM,oBAAoB,GAAI,mBAElC;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,gBA8EH,CAAA"}

package/dist/collection/index.js

@@ -1,105 +0,0 @@
-import { createAPIKeyFields } from 'payload';
-import { getAccessField } from './getAccessField.js';
-const apiKeyStorageFields = createAPIKeyFields({
-    apiKeyField: {
-        admin: {
-            components: {
-                Field: '@payloadcms/plugin-mcp/client#APIKeyField'
-            }
-        },
-        required: true
-    },
-    apiKeyIndexField: {
-        index: true,
-        required: true
-    },
-    includeEnableAPIKey: false
-});
-export const getAPIKeysCollection = ({ pluginConfig })=>{
-    const collection = {
-        slug: 'payload-mcp-api-keys',
-        admin: {
-            components: {
-                views: {
-                    list: {
-                        NoResults: '@payloadcms/plugin-mcp/client#APIKeysEmptyState'
-                    }
-                }
-            },
-            defaultColumns: [
-                'label',
-                'lastUsed',
-                'user'
-            ],
-            // Kept out of the main nav — reachable through the user menu's settings instead.
-            group: false,
-            useAsTitle: 'label'
-        },
-        fields: [
-            ...apiKeyStorageFields,
-            getAccessField({
-                pluginConfig
-            }),
-            {
-                name: 'label',
-                type: 'text',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:titleDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('plugin-mcp:title')
-            },
-            {
-                name: 'description',
-                type: 'text',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:descriptionDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('plugin-mcp:description')
-            },
-            {
-                name: 'lastUsed',
-                type: 'date',
-                admin: {
-                    date: {
-                        pickerAppearance: 'dayAndTime'
-                    },
-                    disabled: {
-                        field: true
-                    }
-                },
-                label: ({ t })=>t('plugin-mcp:lastUsed')
-            },
-            {
-                name: 'user',
-                type: 'relationship',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:userDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('general:user'),
-                relationTo: pluginConfig.userCollection,
-                required: true
-            },
-            {
-                name: 'overrideAccess',
-                type: 'checkbox',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:overrideAccessDescription'),
-                    position: 'sidebar'
-                },
-                defaultValue: false,
-                label: ({ t })=>t('plugin-mcp:overrideAccess')
-            }
-        ],
-        labels: {
-            plural: ({ t })=>`${t('plugin-mcp:mcp')} ${t('plugin-mcp:apiKeys')}`,
-            singular: ({ t })=>`${t('plugin-mcp:mcp')} ${t('authentication:apiKey')}`
-        },
-        versions: false
-    };
-    return pluginConfig.overrideApiKeyCollection ? pluginConfig.overrideApiKeyCollection(collection) : collection;
-};
-
-//# sourceMappingURL=index.js.map

package/dist/collection/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/collection/index.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport { createAPIKeyFields } from 'payload'\n\nimport type { SanitizedMCPPluginConfig } from '../types.js'\n\nimport { getAccessField } from './getAccessField.js'\n\nconst apiKeyStorageFields = createAPIKeyFields({\n  apiKeyField: {\n    admin: {\n      components: { Field: '@payloadcms/plugin-mcp/client#APIKeyField' },\n    },\n    required: true,\n  },\n  apiKeyIndexField: {\n    index: true,\n    required: true,\n  },\n  includeEnableAPIKey: false,\n})\n\nexport const getAPIKeysCollection = ({\n  pluginConfig,\n}: {\n  pluginConfig: SanitizedMCPPluginConfig\n}): CollectionConfig => {\n  const collection: CollectionConfig = {\n    slug: 'payload-mcp-api-keys',\n    admin: {\n      components: {\n        views: {\n          list: {\n            NoResults: '@payloadcms/plugin-mcp/client#APIKeysEmptyState',\n          },\n        },\n      },\n      defaultColumns: ['label', 'lastUsed', 'user'],\n      // Kept out of the main nav — reachable through the user menu's settings instead.\n      group: false,\n      useAsTitle: 'label',\n    },\n    fields: [\n      ...apiKeyStorageFields,\n      getAccessField({ pluginConfig }),\n      {\n        name: 'label',\n        type: 'text',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:titleDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('plugin-mcp:title'),\n      },\n      {\n        name: 'description',\n        type: 'text',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:descriptionDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('plugin-mcp:description'),\n      },\n      {\n        name: 'lastUsed',\n        type: 'date',\n        admin: {\n          date: { pickerAppearance: 'dayAndTime' },\n          disabled: { field: true },\n        },\n        label: ({ t }) => t('plugin-mcp:lastUsed'),\n      },\n      {\n        name: 'user',\n        type: 'relationship',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:userDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('general:user'),\n        relationTo: pluginConfig.userCollection,\n        required: true,\n      },\n      {\n        name: 'overrideAccess',\n        type: 'checkbox',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:overrideAccessDescription'),\n          position: 'sidebar',\n        },\n        defaultValue: false,\n        label: ({ t }) => t('plugin-mcp:overrideAccess'),\n      },\n    ],\n    labels: {\n      plural: ({ t }) => `${t('plugin-mcp:mcp')} ${t('plugin-mcp:apiKeys')}`,\n      singular: ({ t }) => `${t('plugin-mcp:mcp')} ${t('authentication:apiKey')}`,\n    },\n    versions: false,\n  }\n\n  return pluginConfig.overrideApiKeyCollection\n    ? pluginConfig.overrideApiKeyCollection(collection)\n    : collection\n}\n"],"names":["createAPIKeyFields","getAccessField","apiKeyStorageFields","apiKeyField","admin","components","Field","required","apiKeyIndexField","index","includeEnableAPIKey","getAPIKeysCollection","pluginConfig","collection","slug","views","list","NoResults","defaultColumns","group","useAsTitle","fields","name","type","description","t","position","label","date","pickerAppearance","disabled","field","relationTo","userCollection","defaultValue","labels","plural","singular","versions","overrideApiKeyCollection"],"mappings":"AAEA,SAASA,kBAAkB,QAAQ,UAAS;AAI5C,SAASC,cAAc,QAAQ,sBAAqB;AAEpD,MAAMC,sBAAsBF,mBAAmB;IAC7CG,aAAa;QACXC,OAAO;YACLC,YAAY;gBAAEC,OAAO;YAA4C;QACnE;QACAC,UAAU;IACZ;IACAC,kBAAkB;QAChBC,OAAO;QACPF,UAAU;IACZ;IACAG,qBAAqB;AACvB;AAEA,OAAO,MAAMC,uBAAuB,CAAC,EACnCC,YAAY,EAGb;IACC,MAAMC,aAA+B;QACnCC,MAAM;QACNV,OAAO;YACLC,YAAY;gBACVU,OAAO;oBACLC,MAAM;wBACJC,WAAW;oBACb;gBACF;YACF;YACAC,gBAAgB;gBAAC;gBAAS;gBAAY;aAAO;YAC7C,iFAAiF;YACjFC,OAAO;YACPC,YAAY;QACd;QACAC,QAAQ;eACHnB;YACHD,eAAe;gBAAEW;YAAa;YAC9B;gBACEU,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLwB,MAAM;wBAAEC,kBAAkB;oBAAa;oBACvCC,UAAU;wBAAEC,OAAO;oBAAK;gBAC1B;gBACAJ,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;gBACpBO,YAAYpB,aAAaqB,cAAc;gBACvC1B,UAAU;YACZ;YACA;gBACEe,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAQ,cAAc;gBACdP,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;SACD;QACDU,QAAQ;YACNC,QAAQ,CAAC,EAAEX,CAAC,EAAE,GAAK,GAAGA,EAAE,kBAAkB,CAAC,EAAEA,EAAE,uBAAuB;YACtEY,UAAU,CAAC,EAAEZ,CAAC,EAAE,GAAK,GAAGA,EAAE,kBAAkB,CAAC,EAAEA,EAAE,0BAA0B;QAC7E;QACAa,UAAU;IACZ;IAEA,OAAO1B,aAAa2B,wBAAwB,GACxC3B,aAAa2B,wBAAwB,CAAC1B,cACtCA;AACN,EAAC"}