@payloadcms/plugin-mcp 4.0.0-internal.011fd46 → 4.0.0-internal.078835b

package/dist/mcp/builtin/collections/deleteTool.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/mcp/builtin/collections/deleteTool.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { defineCollectionTool } from '../../../defineTool.js'\nimport { getLogger } from '../../../utils/getLogger.js'\nimport { localAPIDefaults } from '../../../utils/localAPIDefaults.js'\nimport { whereSchema } from '../../../utils/whereSchema.js'\n\nconst DEFAULT_DESCRIPTION =\n  'Delete documents in any collection by passing the collection slug and ID or where clause.'\n\nexport const deleteDocumentsTool = defineCollectionTool({\n  annotations: {\n    destructiveHint: true,\n    idempotentHint: false,\n    openWorldHint: false,\n    readOnlyHint: false,\n    title: 'Delete Documents',\n  },\n  description: DEFAULT_DESCRIPTION,\n  input: z.object({\n    id: z\n      .union([z.string(), z.number()])\n      .describe('Optional: specific document ID to delete')\n      .optional(),\n    depth: z\n      .number()\n      .int()\n      .min(0)\n      .max(10)\n      .describe('Depth of population for relationships in response')\n      .optional()\n      .default(0),\n    fallbackLocale: z\n      .string()\n      .describe('Optional: fallback locale code to use when requested locale is not available')\n      .optional(),\n    locale: z\n      .string()\n      .describe(\n        'Optional: locale code for the operation (e.g., \"en\", \"es\"). Defaults to the default locale',\n      )\n      .optional(),\n    where: whereSchema\n      .describe(\n        'Optional: where clause to delete multiple documents. Use field names with Payload operators, and/or arrays for grouping. Example: {\"title\":{\"contains\":\"test\"}}',\n      )\n      .optional(),\n  }),\n}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {\n  const payload = req.payload\n  const logger = getLogger({ payload })\n\n  const { id, depth, fallbackLocale, locale, where } = input\n\n  logger.info(\n    `Deleting document from collection: ${collectionSlug}${id ? ` with ID: ${id}` : ' with where clause'}${locale ? `, locale: ${locale}` : ''}`,\n  )\n\n  try {\n    if (!id && !where) {\n      return {\n        content: [{ type: 'text', text: 'Error: Either id or where clause must be provided' }],\n      }\n    }\n\n    const deleteOptions: Record<string, unknown> = {\n      collection: collectionSlug,\n      depth,\n      req,\n      ...localAPIDefaults(authorizedMCP),\n      ...(locale && { locale }),\n      ...(fallbackLocale && { fallbackLocale }),\n    }\n\n    if (id) {\n      deleteOptions.id = id\n    } else {\n      deleteOptions.where = where\n    }\n\n    const result = await payload.delete(deleteOptions as Parameters<typeof payload.delete>[0])\n\n    if (id) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Document deleted successfully from collection \"${collectionSlug}\"!\\nDeleted document:\\n\\`\\`\\`json\\n${JSON.stringify(result)}\\n\\`\\`\\``,\n          },\n        ],\n        doc: result as Record<string, unknown>,\n      }\n    }\n\n    const bulkResult = result as { docs?: unknown[]; errors?: unknown[] }\n    const docs = bulkResult.docs || []\n    const errors = bulkResult.errors || []\n\n    let responseText = `Document deleted successfully from collection \"${collectionSlug}\"!\\nDeleted: ${docs.length} documents\\nErrors: ${errors.length}\\n---`\n    if (docs.length > 0) {\n      responseText += `\\n\\nDeleted documents:\\n\\`\\`\\`json\\n${JSON.stringify(docs)}\\n\\`\\`\\``\n    }\n    if (errors.length > 0) {\n      responseText += `\\n\\nErrors:\\n\\`\\`\\`json\\n${JSON.stringify(errors)}\\n\\`\\`\\``\n    }\n\n    return {\n      content: [{ type: 'text', text: responseText }],\n      doc: { docs, errors } as unknown as Record<string, unknown>,\n    }\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error'\n    logger.error(`Error deleting document from ${collectionSlug}: ${errorMessage}`)\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error deleting document from collection \"${collectionSlug}\": ${errorMessage}`,\n        },\n      ],\n    }\n  }\n})\n"],"names":["z","defineCollectionTool","getLogger","localAPIDefaults","whereSchema","DEFAULT_DESCRIPTION","deleteDocumentsTool","annotations","destructiveHint","idempotentHint","openWorldHint","readOnlyHint","title","description","input","object","id","union","string","number","describe","optional","depth","int","min","max","default","fallbackLocale","locale","where","handler","authorizedMCP","collectionSlug","req","payload","logger","info","content","type","text","deleteOptions","collection","result","delete","JSON","stringify","doc","bulkResult","docs","errors","responseText","length","error","errorMessage","Error","message"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAK;AAEvB,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,SAASC,SAAS,QAAQ,8BAA6B;AACvD,SAASC,gBAAgB,QAAQ,qCAAoC;AACrE,SAASC,WAAW,QAAQ,gCAA+B;AAE3D,MAAMC,sBACJ;AAEF,OAAO,MAAMC,sBAAsBL,qBAAqB;IACtDM,aAAa;QACXC,iBAAiB;QACjBC,gBAAgB;QAChBC,eAAe;QACfC,cAAc;QACdC,OAAO;IACT;IACAC,aAAaR;IACbS,OAAOd,EAAEe,MAAM,CAAC;QACdC,IAAIhB,EACDiB,KAAK,CAAC;YAACjB,EAAEkB,MAAM;YAAIlB,EAAEmB,MAAM;SAAG,EAC9BC,QAAQ,CAAC,4CACTC,QAAQ;QACXC,OAAOtB,EACJmB,MAAM,GACNI,GAAG,GACHC,GAAG,CAAC,GACJC,GAAG,CAAC,IACJL,QAAQ,CAAC,qDACTC,QAAQ,GACRK,OAAO,CAAC;QACXC,gBAAgB3B,EACbkB,MAAM,GACNE,QAAQ,CAAC,gFACTC,QAAQ;QACXO,QAAQ5B,EACLkB,MAAM,GACNE,QAAQ,CACP,8FAEDC,QAAQ;QACXQ,OAAOzB,YACJgB,QAAQ,CACP,mKAEDC,QAAQ;IACb;AACF,GAAGS,OAAO,CAAC,OAAO,EAAEC,aAAa,EAAEC,cAAc,EAAElB,KAAK,EAAEmB,GAAG,EAAE;IAC7D,MAAMC,UAAUD,IAAIC,OAAO;IAC3B,MAAMC,SAASjC,UAAU;QAAEgC;IAAQ;IAEnC,MAAM,EAAElB,EAAE,EAAEM,KAAK,EAAEK,cAAc,EAAEC,MAAM,EAAEC,KAAK,EAAE,GAAGf;IAErDqB,OAAOC,IAAI,CACT,CAAC,mCAAmC,EAAEJ,iBAAiBhB,KAAK,CAAC,UAAU,EAAEA,IAAI,GAAG,uBAAuBY,SAAS,CAAC,UAAU,EAAEA,QAAQ,GAAG,IAAI;IAG9I,IAAI;QACF,IAAI,CAACZ,MAAM,CAACa,OAAO;YACjB,OAAO;gBACLQ,SAAS;oBAAC;wBAAEC,MAAM;wBAAQC,MAAM;oBAAoD;iBAAE;YACxF;QACF;QAEA,MAAMC,gBAAyC;YAC7CC,YAAYT;YACZV;YACAW;YACA,GAAG9B,iBAAiB4B,cAAc;YAClC,GAAIH,UAAU;gBAAEA;YAAO,CAAC;YACxB,GAAID,kBAAkB;gBAAEA;YAAe,CAAC;QAC1C;QAEA,IAAIX,IAAI;YACNwB,cAAcxB,EAAE,GAAGA;QACrB,OAAO;YACLwB,cAAcX,KAAK,GAAGA;QACxB;QAEA,MAAMa,SAAS,MAAMR,QAAQS,MAAM,CAACH;QAEpC,IAAIxB,IAAI;YACN,OAAO;gBACLqB,SAAS;oBACP;wBACEC,MAAM;wBACNC,MAAM,CAAC,+CAA+C,EAAEP,eAAe,mCAAmC,EAAEY,KAAKC,SAAS,CAACH,QAAQ,QAAQ,CAAC;oBAC9I;iBACD;gBACDI,KAAKJ;YACP;QACF;QAEA,MAAMK,aAAaL;QACnB,MAAMM,OAAOD,WAAWC,IAAI,IAAI,EAAE;QAClC,MAAMC,SAASF,WAAWE,MAAM,IAAI,EAAE;QAEtC,IAAIC,eAAe,CAAC,+CAA+C,EAAElB,eAAe,aAAa,EAAEgB,KAAKG,MAAM,CAAC,oBAAoB,EAAEF,OAAOE,MAAM,CAAC,KAAK,CAAC;QACzJ,IAAIH,KAAKG,MAAM,GAAG,GAAG;YACnBD,gBAAgB,CAAC,oCAAoC,EAAEN,KAAKC,SAAS,CAACG,MAAM,QAAQ,CAAC;QACvF;QACA,IAAIC,OAAOE,MAAM,GAAG,GAAG;YACrBD,gBAAgB,CAAC,yBAAyB,EAAEN,KAAKC,SAAS,CAACI,QAAQ,QAAQ,CAAC;QAC9E;QAEA,OAAO;YACLZ,SAAS;gBAAC;oBAAEC,MAAM;oBAAQC,MAAMW;gBAAa;aAAE;YAC/CJ,KAAK;gBAAEE;gBAAMC;YAAO;QACtB;IACF,EAAE,OAAOG,OAAO;QACd,MAAMC,eAAeD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;QAC9DpB,OAAOiB,KAAK,CAAC,CAAC,6BAA6B,EAAEpB,eAAe,EAAE,EAAEqB,cAAc;QAC9E,OAAO;YACLhB,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,yCAAyC,EAAEP,eAAe,GAAG,EAAEqB,cAAc;gBACtF;aACD;QACH;IACF;AACF,GAAE"}
+{"version":3,"sources":["../../../../src/mcp/builtin/collections/deleteTool.ts"],"sourcesContent":["import { z } from 'zod'\n\nimport { defaultAccess } from '../../../defaultAccess.js'\nimport { defineCollectionTool } from '../../../defineTool.js'\nimport { getLogger } from '../../../utils/getLogger.js'\nimport { whereSchema } from '../../../utils/whereSchema.js'\n\nconst DEFAULT_DESCRIPTION =\n  'Delete documents in any collection by passing the collection slug and ID or where clause.'\n\nexport const deleteDocumentsTool = defineCollectionTool({\n  access: (args) =>\n    defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.delete),\n  annotations: {\n    destructiveHint: true,\n    idempotentHint: false,\n    openWorldHint: false,\n    readOnlyHint: false,\n    title: 'Delete Documents',\n  },\n  description: DEFAULT_DESCRIPTION,\n  input: z.object({\n    id: z\n      .union([z.string(), z.number()])\n      .describe('Optional: specific document ID to delete')\n      .optional(),\n    depth: z\n      .number()\n      .int()\n      .min(0)\n      .max(10)\n      .describe('Depth of population for relationships in response')\n      .optional()\n      .default(0),\n    fallbackLocale: z\n      .string()\n      .describe('Optional: fallback locale code to use when requested locale is not available')\n      .optional(),\n    locale: z\n      .string()\n      .describe(\n        'Optional: locale code for the operation (e.g., \"en\", \"es\"). Defaults to the default locale',\n      )\n      .optional(),\n    where: whereSchema\n      .describe(\n        'Optional: where clause to delete multiple documents. Use field names with Payload operators, and/or arrays for grouping. Example: {\"title\":{\"contains\":\"test\"}}',\n      )\n      .optional(),\n  }),\n}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {\n  const payload = req.payload\n  const logger = getLogger({ payload })\n\n  const { id, depth, fallbackLocale, locale, where } = input\n\n  logger.info(\n    `Deleting document from collection: ${collectionSlug}${id ? ` with ID: ${id}` : ' with where clause'}${locale ? `, locale: ${locale}` : ''}`,\n  )\n\n  try {\n    if (!id && !where) {\n      return {\n        content: [{ type: 'text', text: 'Error: Either id or where clause must be provided' }],\n      }\n    }\n\n    const deleteOptions: Record<string, unknown> = {\n      collection: collectionSlug,\n      depth,\n      overrideAccess: authorizedMCP.overrideAccess,\n      req,\n      ...(locale && { locale }),\n      ...(fallbackLocale && { fallbackLocale }),\n    }\n\n    if (id) {\n      deleteOptions.id = id\n    } else {\n      deleteOptions.where = where\n    }\n\n    const result = await payload.delete(deleteOptions as Parameters<typeof payload.delete>[0])\n\n    if (id) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Document deleted successfully from collection \"${collectionSlug}\"!\\nDeleted document:\\n\\`\\`\\`json\\n${JSON.stringify(result)}\\n\\`\\`\\``,\n          },\n        ],\n        doc: result as Record<string, unknown>,\n      }\n    }\n\n    const bulkResult = result as { docs?: unknown[]; errors?: unknown[] }\n    const docs = bulkResult.docs || []\n    const errors = bulkResult.errors || []\n\n    let responseText = `Document deleted successfully from collection \"${collectionSlug}\"!\\nDeleted: ${docs.length} documents\\nErrors: ${errors.length}\\n---`\n    if (docs.length > 0) {\n      responseText += `\\n\\nDeleted documents:\\n\\`\\`\\`json\\n${JSON.stringify(docs)}\\n\\`\\`\\``\n    }\n    if (errors.length > 0) {\n      responseText += `\\n\\nErrors:\\n\\`\\`\\`json\\n${JSON.stringify(errors)}\\n\\`\\`\\``\n    }\n\n    return {\n      content: [{ type: 'text', text: responseText }],\n      doc: { docs, errors } as unknown as Record<string, unknown>,\n    }\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error'\n    logger.error(`Error deleting document from ${collectionSlug}: ${errorMessage}`)\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error deleting document from collection \"${collectionSlug}\": ${errorMessage}`,\n        },\n      ],\n    }\n  }\n})\n"],"names":["z","defaultAccess","defineCollectionTool","getLogger","whereSchema","DEFAULT_DESCRIPTION","deleteDocumentsTool","access","args","Boolean","permissions","collections","collectionSlug","delete","annotations","destructiveHint","idempotentHint","openWorldHint","readOnlyHint","title","description","input","object","id","union","string","number","describe","optional","depth","int","min","max","default","fallbackLocale","locale","where","handler","authorizedMCP","req","payload","logger","info","content","type","text","deleteOptions","collection","overrideAccess","result","JSON","stringify","doc","bulkResult","docs","errors","responseText","length","error","errorMessage","Error","message"],"mappings":"AAAA,SAASA,CAAC,QAAQ,MAAK;AAEvB,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,SAASC,SAAS,QAAQ,8BAA6B;AACvD,SAASC,WAAW,QAAQ,gCAA+B;AAE3D,MAAMC,sBACJ;AAEF,OAAO,MAAMC,sBAAsBJ,qBAAqB;IACtDK,QAAQ,CAACC,OACPP,cAAcO,SAASC,QAAQD,KAAKE,WAAW,EAAEC,aAAa,CAACH,KAAKI,cAAc,CAAC,EAAEC;IACvFC,aAAa;QACXC,iBAAiB;QACjBC,gBAAgB;QAChBC,eAAe;QACfC,cAAc;QACdC,OAAO;IACT;IACAC,aAAaf;IACbgB,OAAOrB,EAAEsB,MAAM,CAAC;QACdC,IAAIvB,EACDwB,KAAK,CAAC;YAACxB,EAAEyB,MAAM;YAAIzB,EAAE0B,MAAM;SAAG,EAC9BC,QAAQ,CAAC,4CACTC,QAAQ;QACXC,OAAO7B,EACJ0B,MAAM,GACNI,GAAG,GACHC,GAAG,CAAC,GACJC,GAAG,CAAC,IACJL,QAAQ,CAAC,qDACTC,QAAQ,GACRK,OAAO,CAAC;QACXC,gBAAgBlC,EACbyB,MAAM,GACNE,QAAQ,CAAC,gFACTC,QAAQ;QACXO,QAAQnC,EACLyB,MAAM,GACNE,QAAQ,CACP,8FAEDC,QAAQ;QACXQ,OAAOhC,YACJuB,QAAQ,CACP,mKAEDC,QAAQ;IACb;AACF,GAAGS,OAAO,CAAC,OAAO,EAAEC,aAAa,EAAE1B,cAAc,EAAES,KAAK,EAAEkB,GAAG,EAAE;IAC7D,MAAMC,UAAUD,IAAIC,OAAO;IAC3B,MAAMC,SAAStC,UAAU;QAAEqC;IAAQ;IAEnC,MAAM,EAAEjB,EAAE,EAAEM,KAAK,EAAEK,cAAc,EAAEC,MAAM,EAAEC,KAAK,EAAE,GAAGf;IAErDoB,OAAOC,IAAI,CACT,CAAC,mCAAmC,EAAE9B,iBAAiBW,KAAK,CAAC,UAAU,EAAEA,IAAI,GAAG,uBAAuBY,SAAS,CAAC,UAAU,EAAEA,QAAQ,GAAG,IAAI;IAG9I,IAAI;QACF,IAAI,CAACZ,MAAM,CAACa,OAAO;YACjB,OAAO;gBACLO,SAAS;oBAAC;wBAAEC,MAAM;wBAAQC,MAAM;oBAAoD;iBAAE;YACxF;QACF;QAEA,MAAMC,gBAAyC;YAC7CC,YAAYnC;YACZiB;YACAmB,gBAAgBV,cAAcU,cAAc;YAC5CT;YACA,GAAIJ,UAAU;gBAAEA;YAAO,CAAC;YACxB,GAAID,kBAAkB;gBAAEA;YAAe,CAAC;QAC1C;QAEA,IAAIX,IAAI;YACNuB,cAAcvB,EAAE,GAAGA;QACrB,OAAO;YACLuB,cAAcV,KAAK,GAAGA;QACxB;QAEA,MAAMa,SAAS,MAAMT,QAAQ3B,MAAM,CAACiC;QAEpC,IAAIvB,IAAI;YACN,OAAO;gBACLoB,SAAS;oBACP;wBACEC,MAAM;wBACNC,MAAM,CAAC,+CAA+C,EAAEjC,eAAe,mCAAmC,EAAEsC,KAAKC,SAAS,CAACF,QAAQ,QAAQ,CAAC;oBAC9I;iBACD;gBACDG,KAAKH;YACP;QACF;QAEA,MAAMI,aAAaJ;QACnB,MAAMK,OAAOD,WAAWC,IAAI,IAAI,EAAE;QAClC,MAAMC,SAASF,WAAWE,MAAM,IAAI,EAAE;QAEtC,IAAIC,eAAe,CAAC,+CAA+C,EAAE5C,eAAe,aAAa,EAAE0C,KAAKG,MAAM,CAAC,oBAAoB,EAAEF,OAAOE,MAAM,CAAC,KAAK,CAAC;QACzJ,IAAIH,KAAKG,MAAM,GAAG,GAAG;YACnBD,gBAAgB,CAAC,oCAAoC,EAAEN,KAAKC,SAAS,CAACG,MAAM,QAAQ,CAAC;QACvF;QACA,IAAIC,OAAOE,MAAM,GAAG,GAAG;YACrBD,gBAAgB,CAAC,yBAAyB,EAAEN,KAAKC,SAAS,CAACI,QAAQ,QAAQ,CAAC;QAC9E;QAEA,OAAO;YACLZ,SAAS;gBAAC;oBAAEC,MAAM;oBAAQC,MAAMW;gBAAa;aAAE;YAC/CJ,KAAK;gBAAEE;gBAAMC;YAAO;QACtB;IACF,EAAE,OAAOG,OAAO;QACd,MAAMC,eAAeD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;QAC9DpB,OAAOiB,KAAK,CAAC,CAAC,6BAA6B,EAAE9C,eAAe,EAAE,EAAE+C,cAAc;QAC9E,OAAO;YACLhB,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,yCAAyC,EAAEjC,eAAe,GAAG,EAAE+C,cAAc;gBACtF;aACD;QACH;IACF;AACF,GAAE"}

package/dist/mcp/builtin/collections/duplicateTool.d.ts

@@ -0,0 +1,2 @@
+export declare const duplicateDocumentTool: import("../../../types.js").CollectionTool;
+//# sourceMappingURL=duplicateTool.d.ts.map

package/dist/mcp/builtin/collections/duplicateTool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"duplicateTool.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/duplicateTool.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,qBAAqB,4CAoHhC,CAAA"}

package/dist/mcp/builtin/collections/duplicateTool.js

@@ -0,0 +1,96 @@
+import { z } from 'zod';
+import { defaultAccess } from '../../../defaultAccess.js';
+import { defineCollectionTool } from '../../../defineTool.js';
+import { getLogger } from '../../../utils/getLogger.js';
+import { getCollectionVirtualFieldNames, stripVirtualFields } from '../../../utils/getVirtualFieldNames.js';
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js';
+import { formatCollectionError } from './formatCollectionError.js';
+const DEFAULT_DESCRIPTION = 'Duplicate a document in any collection by passing the collection slug and source document ID.';
+export const duplicateDocumentTool = defineCollectionTool({
+    access: (args)=>defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.create),
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        readOnlyHint: false,
+        title: 'Duplicate Document'
+    },
+    description: DEFAULT_DESCRIPTION,
+    input: z.object({
+        id: z.union([
+            z.string(),
+            z.number()
+        ]).describe('The ID of the document to duplicate'),
+        data: z.record(z.string(), z.unknown()).describe('Optional: fields to override on the duplicated document').optional(),
+        depth: z.number().int().min(0).max(10).describe('How many levels deep to populate relationships in response').optional().default(0),
+        draft: z.boolean().describe('Whether to create the duplicate as a draft').optional().default(false),
+        fallbackLocale: z.string().describe('Optional: fallback locale code to use when requested locale is not available').optional(),
+        locale: z.string().describe('Optional: locale code to duplicate in (e.g., "en", "es"). Defaults to the default locale').optional(),
+        populate: z.record(z.string(), z.unknown()).describe('Optional: control which fields to include from populated relationship or upload documents.').optional(),
+        select: z.record(z.string(), z.unknown()).describe('Optional: define exactly which fields you\'d like to return in the response, e.g., {"title": true}').optional(),
+        selectedLocales: z.array(z.string()).describe('Optional: localized field locales to include in the duplicated document').optional(),
+        showHiddenFields: z.boolean().describe('Optional: include hidden fields in the duplicated document response').optional()
+    })
+}).handler(async ({ authorizedMCP, collectionSlug, input, req })=>{
+    const payload = req.payload;
+    const logger = getLogger({
+        payload
+    });
+    const { id, data, depth, draft, fallbackLocale, locale, populate, select, selectedLocales, showHiddenFields } = input;
+    logger.info(`Duplicating document in collection: ${collectionSlug} with ID: ${id}`);
+    try {
+        const virtualFieldNames = getCollectionVirtualFieldNames(payload.config, collectionSlug);
+        const inputData = data ? stripVirtualFields(data, virtualFieldNames) : undefined;
+        const parsedData = inputData ? transformPointDataToPayload(inputData) : undefined;
+        const result = await payload.duplicate({
+            id,
+            collection: collectionSlug,
+            depth,
+            draft,
+            overrideAccess: authorizedMCP.overrideAccess,
+            req,
+            ...parsedData ? {
+                data: parsedData
+            } : {},
+            ...locale ? {
+                locale
+            } : {},
+            ...fallbackLocale ? {
+                fallbackLocale
+            } : {},
+            ...populate ? {
+                populate: populate
+            } : {},
+            ...select ? {
+                select: select
+            } : {},
+            ...selectedLocales ? {
+                selectedLocales
+            } : {},
+            ...showHiddenFields !== undefined ? {
+                showHiddenFields
+            } : {}
+        });
+        logger.info(`Successfully duplicated document in ${collectionSlug} from ID: ${id}`);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Document duplicated successfully in collection "${collectionSlug}"!\nDuplicated document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error duplicating document in ${collectionSlug}: ${errorMessage}`);
+        return formatCollectionError({
+            action: 'duplicating',
+            collectionSlug,
+            error,
+            req
+        });
+    }
+});
+
+//# sourceMappingURL=duplicateTool.js.map

package/dist/mcp/builtin/collections/duplicateTool.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/mcp/builtin/collections/duplicateTool.ts"],"sourcesContent":["import type { PopulateType, SelectType } from 'payload'\n\nimport { z } from 'zod'\n\nimport { defaultAccess } from '../../../defaultAccess.js'\nimport { defineCollectionTool } from '../../../defineTool.js'\nimport { getLogger } from '../../../utils/getLogger.js'\nimport {\n  getCollectionVirtualFieldNames,\n  stripVirtualFields,\n} from '../../../utils/getVirtualFieldNames.js'\nimport { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'\nimport { formatCollectionError } from './formatCollectionError.js'\n\nconst DEFAULT_DESCRIPTION =\n  'Duplicate a document in any collection by passing the collection slug and source document ID.'\n\nexport const duplicateDocumentTool = defineCollectionTool({\n  access: (args) =>\n    defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.create),\n  annotations: {\n    destructiveHint: false,\n    idempotentHint: false,\n    openWorldHint: false,\n    readOnlyHint: false,\n    title: 'Duplicate Document',\n  },\n  description: DEFAULT_DESCRIPTION,\n  input: z.object({\n    id: z.union([z.string(), z.number()]).describe('The ID of the document to duplicate'),\n    data: z\n      .record(z.string(), z.unknown())\n      .describe('Optional: fields to override on the duplicated document')\n      .optional(),\n    depth: z\n      .number()\n      .int()\n      .min(0)\n      .max(10)\n      .describe('How many levels deep to populate relationships in response')\n      .optional()\n      .default(0),\n    draft: z\n      .boolean()\n      .describe('Whether to create the duplicate as a draft')\n      .optional()\n      .default(false),\n    fallbackLocale: z\n      .string()\n      .describe('Optional: fallback locale code to use when requested locale is not available')\n      .optional(),\n    locale: z\n      .string()\n      .describe(\n        'Optional: locale code to duplicate in (e.g., \"en\", \"es\"). Defaults to the default locale',\n      )\n      .optional(),\n    populate: z\n      .record(z.string(), z.unknown())\n      .describe(\n        'Optional: control which fields to include from populated relationship or upload documents.',\n      )\n      .optional(),\n    select: z\n      .record(z.string(), z.unknown())\n      .describe(\n        'Optional: define exactly which fields you\\'d like to return in the response, e.g., {\"title\": true}',\n      )\n      .optional(),\n    selectedLocales: z\n      .array(z.string())\n      .describe('Optional: localized field locales to include in the duplicated document')\n      .optional(),\n    showHiddenFields: z\n      .boolean()\n      .describe('Optional: include hidden fields in the duplicated document response')\n      .optional(),\n  }),\n}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {\n  const payload = req.payload\n  const logger = getLogger({ payload })\n  const {\n    id,\n    data,\n    depth,\n    draft,\n    fallbackLocale,\n    locale,\n    populate,\n    select,\n    selectedLocales,\n    showHiddenFields,\n  } = input\n\n  logger.info(`Duplicating document in collection: ${collectionSlug} with ID: ${id}`)\n\n  try {\n    const virtualFieldNames = getCollectionVirtualFieldNames(payload.config, collectionSlug)\n    const inputData = data ? stripVirtualFields(data, virtualFieldNames) : undefined\n    const parsedData = inputData ? transformPointDataToPayload(inputData) : undefined\n\n    const result = await payload.duplicate({\n      id,\n      collection: collectionSlug,\n      depth,\n      draft,\n      overrideAccess: authorizedMCP.overrideAccess,\n      req,\n      ...(parsedData ? { data: parsedData } : {}),\n      ...(locale ? { locale } : {}),\n      ...(fallbackLocale ? { fallbackLocale } : {}),\n      ...(populate ? { populate: populate as PopulateType } : {}),\n      ...(select ? { select: select as SelectType } : {}),\n      ...(selectedLocales ? { selectedLocales } : {}),\n      ...(showHiddenFields !== undefined ? { showHiddenFields } : {}),\n    })\n\n    logger.info(`Successfully duplicated document in ${collectionSlug} from ID: ${id}`)\n\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Document duplicated successfully in collection \"${collectionSlug}\"!\\nDuplicated document:\\n\\`\\`\\`json\\n${JSON.stringify(result)}\\n\\`\\`\\``,\n        },\n      ],\n      doc: result as Record<string, unknown>,\n    }\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error'\n    logger.error(`Error duplicating document in ${collectionSlug}: ${errorMessage}`)\n    return formatCollectionError({ action: 'duplicating', collectionSlug, error, req })\n  }\n})\n"],"names":["z","defaultAccess","defineCollectionTool","getLogger","getCollectionVirtualFieldNames","stripVirtualFields","transformPointDataToPayload","formatCollectionError","DEFAULT_DESCRIPTION","duplicateDocumentTool","access","args","Boolean","permissions","collections","collectionSlug","create","annotations","destructiveHint","idempotentHint","openWorldHint","readOnlyHint","title","description","input","object","id","union","string","number","describe","data","record","unknown","optional","depth","int","min","max","default","draft","boolean","fallbackLocale","locale","populate","select","selectedLocales","array","showHiddenFields","handler","authorizedMCP","req","payload","logger","info","virtualFieldNames","config","inputData","undefined","parsedData","result","duplicate","collection","overrideAccess","content","type","text","JSON","stringify","doc","error","errorMessage","Error","message","action"],"mappings":"AAEA,SAASA,CAAC,QAAQ,MAAK;AAEvB,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,SAASC,SAAS,QAAQ,8BAA6B;AACvD,SACEC,8BAA8B,EAC9BC,kBAAkB,QACb,yCAAwC;AAC/C,SAASC,2BAA2B,QAAQ,gDAA+C;AAC3F,SAASC,qBAAqB,QAAQ,6BAA4B;AAElE,MAAMC,sBACJ;AAEF,OAAO,MAAMC,wBAAwBP,qBAAqB;IACxDQ,QAAQ,CAACC,OACPV,cAAcU,SAASC,QAAQD,KAAKE,WAAW,EAAEC,aAAa,CAACH,KAAKI,cAAc,CAAC,EAAEC;IACvFC,aAAa;QACXC,iBAAiB;QACjBC,gBAAgB;QAChBC,eAAe;QACfC,cAAc;QACdC,OAAO;IACT;IACAC,aAAaf;IACbgB,OAAOxB,EAAEyB,MAAM,CAAC;QACdC,IAAI1B,EAAE2B,KAAK,CAAC;YAAC3B,EAAE4B,MAAM;YAAI5B,EAAE6B,MAAM;SAAG,EAAEC,QAAQ,CAAC;QAC/CC,MAAM/B,EACHgC,MAAM,CAAChC,EAAE4B,MAAM,IAAI5B,EAAEiC,OAAO,IAC5BH,QAAQ,CAAC,2DACTI,QAAQ;QACXC,OAAOnC,EACJ6B,MAAM,GACNO,GAAG,GACHC,GAAG,CAAC,GACJC,GAAG,CAAC,IACJR,QAAQ,CAAC,8DACTI,QAAQ,GACRK,OAAO,CAAC;QACXC,OAAOxC,EACJyC,OAAO,GACPX,QAAQ,CAAC,8CACTI,QAAQ,GACRK,OAAO,CAAC;QACXG,gBAAgB1C,EACb4B,MAAM,GACNE,QAAQ,CAAC,gFACTI,QAAQ;QACXS,QAAQ3C,EACL4B,MAAM,GACNE,QAAQ,CACP,4FAEDI,QAAQ;QACXU,UAAU5C,EACPgC,MAAM,CAAChC,EAAE4B,MAAM,IAAI5B,EAAEiC,OAAO,IAC5BH,QAAQ,CACP,8FAEDI,QAAQ;QACXW,QAAQ7C,EACLgC,MAAM,CAAChC,EAAE4B,MAAM,IAAI5B,EAAEiC,OAAO,IAC5BH,QAAQ,CACP,sGAEDI,QAAQ;QACXY,iBAAiB9C,EACd+C,KAAK,CAAC/C,EAAE4B,MAAM,IACdE,QAAQ,CAAC,2EACTI,QAAQ;QACXc,kBAAkBhD,EACfyC,OAAO,GACPX,QAAQ,CAAC,uEACTI,QAAQ;IACb;AACF,GAAGe,OAAO,CAAC,OAAO,EAAEC,aAAa,EAAEnC,cAAc,EAAES,KAAK,EAAE2B,GAAG,EAAE;IAC7D,MAAMC,UAAUD,IAAIC,OAAO;IAC3B,MAAMC,SAASlD,UAAU;QAAEiD;IAAQ;IACnC,MAAM,EACJ1B,EAAE,EACFK,IAAI,EACJI,KAAK,EACLK,KAAK,EACLE,cAAc,EACdC,MAAM,EACNC,QAAQ,EACRC,MAAM,EACNC,eAAe,EACfE,gBAAgB,EACjB,GAAGxB;IAEJ6B,OAAOC,IAAI,CAAC,CAAC,oCAAoC,EAAEvC,eAAe,UAAU,EAAEW,IAAI;IAElF,IAAI;QACF,MAAM6B,oBAAoBnD,+BAA+BgD,QAAQI,MAAM,EAAEzC;QACzE,MAAM0C,YAAY1B,OAAO1B,mBAAmB0B,MAAMwB,qBAAqBG;QACvE,MAAMC,aAAaF,YAAYnD,4BAA4BmD,aAAaC;QAExE,MAAME,SAAS,MAAMR,QAAQS,SAAS,CAAC;YACrCnC;YACAoC,YAAY/C;YACZoB;YACAK;YACAuB,gBAAgBb,cAAca,cAAc;YAC5CZ;YACA,GAAIQ,aAAa;gBAAE5B,MAAM4B;YAAW,IAAI,CAAC,CAAC;YAC1C,GAAIhB,SAAS;gBAAEA;YAAO,IAAI,CAAC,CAAC;YAC5B,GAAID,iBAAiB;gBAAEA;YAAe,IAAI,CAAC,CAAC;YAC5C,GAAIE,WAAW;gBAAEA,UAAUA;YAAyB,IAAI,CAAC,CAAC;YAC1D,GAAIC,SAAS;gBAAEA,QAAQA;YAAqB,IAAI,CAAC,CAAC;YAClD,GAAIC,kBAAkB;gBAAEA;YAAgB,IAAI,CAAC,CAAC;YAC9C,GAAIE,qBAAqBU,YAAY;gBAAEV;YAAiB,IAAI,CAAC,CAAC;QAChE;QAEAK,OAAOC,IAAI,CAAC,CAAC,oCAAoC,EAAEvC,eAAe,UAAU,EAAEW,IAAI;QAElF,OAAO;YACLsC,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,gDAAgD,EAAEnD,eAAe,sCAAsC,EAAEoD,KAAKC,SAAS,CAACR,QAAQ,QAAQ,CAAC;gBAClJ;aACD;YACDS,KAAKT;QACP;IACF,EAAE,OAAOU,OAAO;QACd,MAAMC,eAAeD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;QAC9DpB,OAAOiB,KAAK,CAAC,CAAC,8BAA8B,EAAEvD,eAAe,EAAE,EAAEwD,cAAc;QAC/E,OAAOhE,sBAAsB;YAAEmE,QAAQ;YAAe3D;YAAgBuD;YAAOnB;QAAI;IACnF;AACF,GAAE"}

package/dist/mcp/builtin/collections/fileInput.d.ts

@@ -0,0 +1,28 @@
+import type { CollectionSlug, File, PayloadRequest } from 'payload';
+import { z } from 'zod';
+export declare const fileInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    name: z.ZodString;
+    data: z.ZodString;
+    mimeType: z.ZodString;
+    source: z.ZodLiteral<"base64">;
+}, z.core.$strip>, z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    source: z.ZodLiteral<"externalURL">;
+    url: z.ZodURL;
+}, z.core.$strip>, z.ZodObject<{
+    file: z.ZodObject<{
+        filename: z.ZodString;
+        mimeType: z.ZodString;
+        size: z.ZodNumber;
+        uploadReference: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strip>;
+    source: z.ZodLiteral<"uploadReference">;
+}, z.core.$strip>], "source">;
+type FileInput = z.infer<typeof fileInputSchema>;
+export declare function resolveFile({ collectionSlug, input, req, }: {
+    collectionSlug: CollectionSlug;
+    input?: FileInput;
+    req: PayloadRequest;
+}): Promise<File | undefined>;
+export {};
+//# sourceMappingURL=fileInput.d.ts.map

package/dist/mcp/builtin/collections/fileInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fileInput.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/fileInput.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAY,cAAc,EAAE,MAAM,SAAS,CAAA;AAK7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAavB,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;6BAoBzB,CAAA;AAEH,KAAK,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEhD,wBAAsB,WAAW,CAAC,EAChC,cAAc,EACd,KAAK,EACL,GAAG,GACJ,EAAE;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAoE5B"}

package/dist/mcp/builtin/collections/fileInput.js

@@ -0,0 +1,117 @@
+import { APIError } from 'payload';
+import { getExternalFile, getFileFromUploadInstructions, isURLAllowed } from 'payload/internal';
+import { sanitizeFilename } from 'payload/shared';
+import { z } from 'zod';
+const mimeTypeSchema = z.string().regex(/^[!#$%&'*+.^`|~\w-]+\/[!#$%&'*+.^`|~\w-]+$/, 'MIME type must use the type/subtype format');
+const uploadFileSchema = z.object({
+    filename: z.string(),
+    mimeType: z.string(),
+    size: z.number().int().nonnegative(),
+    uploadReference: z.record(z.string(), z.unknown())
+});
+export const fileInputSchema = z.discriminatedUnion('source', [
+    z.object({
+        name: z.string().min(1).describe('The file name, including its extension'),
+        data: z.string().describe('The base64-encoded file bytes, without a data URL prefix'),
+        mimeType: mimeTypeSchema.describe('The file MIME type, for example image/png'),
+        source: z.literal('base64')
+    }),
+    z.object({
+        name: z.string().min(1).describe('Optional file name override').optional(),
+        source: z.literal('externalURL'),
+        url: z.url().describe('The http or https URL to download')
+    }),
+    z.object({
+        file: uploadFileSchema.describe('The file value returned by getUploadInstructions'),
+        source: z.literal('uploadReference')
+    })
+]).describe('A file for an upload collection. Use externalURL for an online file, base64 for local file bytes, or uploadReference after following getUploadInstructions. Usage of getUploadInstructions and uploadReference is recommended.');
+export async function resolveFile({ collectionSlug, input, req }) {
+    if (!input) {
+        return undefined;
+    }
+    if (input.source === 'uploadReference') {
+        return getFileFromUploadInstructions({
+            collectionSlug,
+            file: input.file,
+            req
+        });
+    }
+    const uploadConfig = req.payload.collections[collectionSlug]?.config.upload;
+    if (!uploadConfig) {
+        throw new APIError(`Collection "${collectionSlug}" does not support file uploads.`, 400);
+    }
+    const maxFileSize = req.payload.config.upload.limits?.fileSize;
+    let file;
+    if (input.source === 'base64') {
+        const data = decodeBase64({
+            maxFileSize,
+            value: input.data
+        });
+        file = {
+            name: sanitizeFilename(input.name),
+            data,
+            mimetype: input.mimeType,
+            size: data.length
+        };
+    } else {
+        if (uploadConfig.pasteURL === false) {
+            throw new APIError(`Uploading files from URLs is disabled for collection "${collectionSlug}".`, 400);
+        }
+        const url = new URL(input.url);
+        if (![
+            'http:',
+            'https:'
+        ].includes(url.protocol)) {
+            throw new APIError('File URLs must use http or https.', 400);
+        }
+        if (typeof uploadConfig.pasteURL === 'object' && !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)) {
+            throw new APIError('The provided file URL is not allowed.', 400);
+        }
+        file = await getExternalFile({
+            data: {
+                filename: sanitizeFilename(input.name || getURLFilename(url)),
+                url: input.url
+            },
+            req,
+            uploadConfig: {
+                ...uploadConfig,
+                externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (()=>({}))
+            }
+        });
+        file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream';
+        file.size = file.data.length;
+    }
+    if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
+        throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400);
+    }
+    return file;
+}
+function decodeBase64({ maxFileSize, value }) {
+    const normalized = value.replace(/\s/g, '');
+    if (!/^[a-z0-9+/]*={0,2}$/i.test(normalized) || normalized.length % 4 === 1) {
+        throw new APIError('File data must be valid base64.', 400);
+    }
+    if (maxFileSize !== undefined && Number.isFinite(maxFileSize)) {
+        const paddingLength = normalized.endsWith('==') ? 2 : normalized.endsWith('=') ? 1 : 0;
+        const decodedSize = Math.floor(normalized.length * 3 / 4) - paddingLength;
+        if (decodedSize > maxFileSize) {
+            throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400);
+        }
+    }
+    const data = Buffer.from(normalized, 'base64');
+    if (data.toString('base64').replace(/=+$/, '') !== normalized.replace(/=+$/, '')) {
+        throw new APIError('File data must be valid base64.', 400);
+    }
+    return data;
+}
+function getURLFilename(url) {
+    const pathSegment = url.pathname.split('/').pop() || 'upload';
+    try {
+        return decodeURIComponent(pathSegment);
+    } catch  {
+        return pathSegment;
+    }
+}
+
+//# sourceMappingURL=fileInput.js.map

package/dist/mcp/builtin/collections/fileInput.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.ts"],"sourcesContent":["import type { CollectionSlug, File, FileData, PayloadRequest } from 'payload'\n\nimport { APIError } from 'payload'\nimport { getExternalFile, getFileFromUploadInstructions, isURLAllowed } from 'payload/internal'\nimport { sanitizeFilename } from 'payload/shared'\nimport { z } from 'zod'\n\nconst mimeTypeSchema = z\n  .string()\n  .regex(/^[!#$%&'*+.^`|~\\w-]+\\/[!#$%&'*+.^`|~\\w-]+$/, 'MIME type must use the type/subtype format')\n\nconst uploadFileSchema = z.object({\n  filename: z.string(),\n  mimeType: z.string(),\n  size: z.number().int().nonnegative(),\n  uploadReference: z.record(z.string(), z.unknown()),\n})\n\nexport const fileInputSchema = z\n  .discriminatedUnion('source', [\n    z.object({\n      name: z.string().min(1).describe('The file name, including its extension'),\n      data: z.string().describe('The base64-encoded file bytes, without a data URL prefix'),\n      mimeType: mimeTypeSchema.describe('The file MIME type, for example image/png'),\n      source: z.literal('base64'),\n    }),\n    z.object({\n      name: z.string().min(1).describe('Optional file name override').optional(),\n      source: z.literal('externalURL'),\n      url: z.url().describe('The http or https URL to download'),\n    }),\n    z.object({\n      file: uploadFileSchema.describe('The file value returned by getUploadInstructions'),\n      source: z.literal('uploadReference'),\n    }),\n  ])\n  .describe(\n    'A file for an upload collection. Use externalURL for an online file, base64 for local file bytes, or uploadReference after following getUploadInstructions. Usage of getUploadInstructions and uploadReference is recommended.',\n  )\n\ntype FileInput = z.infer<typeof fileInputSchema>\n\nexport async function resolveFile({\n  collectionSlug,\n  input,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  input?: FileInput\n  req: PayloadRequest\n}): Promise<File | undefined> {\n  if (!input) {\n    return undefined\n  }\n\n  if (input.source === 'uploadReference') {\n    return getFileFromUploadInstructions({ collectionSlug, file: input.file, req })\n  }\n\n  const uploadConfig = req.payload.collections[collectionSlug]?.config.upload\n\n  if (!uploadConfig) {\n    throw new APIError(`Collection \"${collectionSlug}\" does not support file uploads.`, 400)\n  }\n\n  const maxFileSize = req.payload.config.upload.limits?.fileSize\n  let file: File\n\n  if (input.source === 'base64') {\n    const data = decodeBase64({ maxFileSize, value: input.data })\n\n    file = {\n      name: sanitizeFilename(input.name),\n      data,\n      mimetype: input.mimeType,\n      size: data.length,\n    }\n  } else {\n    if (uploadConfig.pasteURL === false) {\n      throw new APIError(\n        `Uploading files from URLs is disabled for collection \"${collectionSlug}\".`,\n        400,\n      )\n    }\n\n    const url = new URL(input.url)\n\n    if (!['http:', 'https:'].includes(url.protocol)) {\n      throw new APIError('File URLs must use http or https.', 400)\n    }\n\n    if (\n      typeof uploadConfig.pasteURL === 'object' &&\n      !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)\n    ) {\n      throw new APIError('The provided file URL is not allowed.', 400)\n    }\n\n    file = await getExternalFile({\n      data: {\n        filename: sanitizeFilename(input.name || getURLFilename(url)),\n        url: input.url,\n      } as FileData,\n      req,\n      uploadConfig: {\n        ...uploadConfig,\n        externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (() => ({})),\n      },\n    })\n    file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'\n    file.size = file.data.length\n  }\n\n  if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {\n    throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400)\n  }\n\n  return file\n}\n\nfunction decodeBase64({ maxFileSize, value }: { maxFileSize?: number; value: string }): Buffer {\n  const normalized = value.replace(/\\s/g, '')\n\n  if (!/^[a-z0-9+/]*={0,2}$/i.test(normalized) || normalized.length % 4 === 1) {\n    throw new APIError('File data must be valid base64.', 400)\n  }\n\n  if (maxFileSize !== undefined && Number.isFinite(maxFileSize)) {\n    const paddingLength = normalized.endsWith('==') ? 2 : normalized.endsWith('=') ? 1 : 0\n    const decodedSize = Math.floor((normalized.length * 3) / 4) - paddingLength\n\n    if (decodedSize > maxFileSize) {\n      throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400)\n    }\n  }\n\n  const data = Buffer.from(normalized, 'base64')\n\n  if (data.toString('base64').replace(/=+$/, '') !== normalized.replace(/=+$/, '')) {\n    throw new APIError('File data must be valid base64.', 400)\n  }\n\n  return data\n}\n\nfunction getURLFilename(url: URL): string {\n  const pathSegment = url.pathname.split('/').pop() || 'upload'\n\n  try {\n    return decodeURIComponent(pathSegment)\n  } catch {\n    return pathSegment\n  }\n}\n"],"names":["APIError","getExternalFile","getFileFromUploadInstructions","isURLAllowed","sanitizeFilename","z","mimeTypeSchema","string","regex","uploadFileSchema","object","filename","mimeType","size","number","int","nonnegative","uploadReference","record","unknown","fileInputSchema","discriminatedUnion","name","min","describe","data","source","literal","optional","url","file","resolveFile","collectionSlug","input","req","undefined","uploadConfig","payload","collections","config","upload","maxFileSize","limits","fileSize","decodeBase64","value","mimetype","length","pasteURL","URL","includes","protocol","allowList","getURLFilename","externalFileHeaderFilter","split","Number","isFinite","normalized","replace","test","paddingLength","endsWith","decodedSize","Math","floor","Buffer","from","toString","pathSegment","pathname","pop","decodeURIComponent"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,UAAS;AAClC,SAASC,eAAe,EAAEC,6BAA6B,EAAEC,YAAY,QAAQ,mBAAkB;AAC/F,SAASC,gBAAgB,QAAQ,iBAAgB;AACjD,SAASC,CAAC,QAAQ,MAAK;AAEvB,MAAMC,iBAAiBD,EACpBE,MAAM,GACNC,KAAK,CAAC,8CAA8C;AAEvD,MAAMC,mBAAmBJ,EAAEK,MAAM,CAAC;IAChCC,UAAUN,EAAEE,MAAM;IAClBK,UAAUP,EAAEE,MAAM;IAClBM,MAAMR,EAAES,MAAM,GAAGC,GAAG,GAAGC,WAAW;IAClCC,iBAAiBZ,EAAEa,MAAM,CAACb,EAAEE,MAAM,IAAIF,EAAEc,OAAO;AACjD;AAEA,OAAO,MAAMC,kBAAkBf,EAC5BgB,kBAAkB,CAAC,UAAU;IAC5BhB,EAAEK,MAAM,CAAC;QACPY,MAAMjB,EAAEE,MAAM,GAAGgB,GAAG,CAAC,GAAGC,QAAQ,CAAC;QACjCC,MAAMpB,EAAEE,MAAM,GAAGiB,QAAQ,CAAC;QAC1BZ,UAAUN,eAAekB,QAAQ,CAAC;QAClCE,QAAQrB,EAAEsB,OAAO,CAAC;IACpB;IACAtB,EAAEK,MAAM,CAAC;QACPY,MAAMjB,EAAEE,MAAM,GAAGgB,GAAG,CAAC,GAAGC,QAAQ,CAAC,+BAA+BI,QAAQ;QACxEF,QAAQrB,EAAEsB,OAAO,CAAC;QAClBE,KAAKxB,EAAEwB,GAAG,GAAGL,QAAQ,CAAC;IACxB;IACAnB,EAAEK,MAAM,CAAC;QACPoB,MAAMrB,iBAAiBe,QAAQ,CAAC;QAChCE,QAAQrB,EAAEsB,OAAO,CAAC;IACpB;CACD,EACAH,QAAQ,CACP,kOACD;AAIH,OAAO,eAAeO,YAAY,EAChCC,cAAc,EACdC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAACD,OAAO;QACV,OAAOE;IACT;IAEA,IAAIF,MAAMP,MAAM,KAAK,mBAAmB;QACtC,OAAOxB,8BAA8B;YAAE8B;YAAgBF,MAAMG,MAAMH,IAAI;YAAEI;QAAI;IAC/E;IAEA,MAAME,eAAeF,IAAIG,OAAO,CAACC,WAAW,CAACN,eAAe,EAAEO,OAAOC;IAErE,IAAI,CAACJ,cAAc;QACjB,MAAM,IAAIpC,SAAS,CAAC,YAAY,EAAEgC,eAAe,gCAAgC,CAAC,EAAE;IACtF;IAEA,MAAMS,cAAcP,IAAIG,OAAO,CAACE,MAAM,CAACC,MAAM,CAACE,MAAM,EAAEC;IACtD,IAAIb;IAEJ,IAAIG,MAAMP,MAAM,KAAK,UAAU;QAC7B,MAAMD,OAAOmB,aAAa;YAAEH;YAAaI,OAAOZ,MAAMR,IAAI;QAAC;QAE3DK,OAAO;YACLR,MAAMlB,iBAAiB6B,MAAMX,IAAI;YACjCG;YACAqB,UAAUb,MAAMrB,QAAQ;YACxBC,MAAMY,KAAKsB,MAAM;QACnB;IACF,OAAO;QACL,IAAIX,aAAaY,QAAQ,KAAK,OAAO;YACnC,MAAM,IAAIhD,SACR,CAAC,sDAAsD,EAAEgC,eAAe,EAAE,CAAC,EAC3E;QAEJ;QAEA,MAAMH,MAAM,IAAIoB,IAAIhB,MAAMJ,GAAG;QAE7B,IAAI,CAAC;YAAC;YAAS;SAAS,CAACqB,QAAQ,CAACrB,IAAIsB,QAAQ,GAAG;YAC/C,MAAM,IAAInD,SAAS,qCAAqC;QAC1D;QAEA,IACE,OAAOoC,aAAaY,QAAQ,KAAK,YACjC,CAAC7C,aAAa8B,MAAMJ,GAAG,EAAEO,aAAaY,QAAQ,CAACI,SAAS,GACxD;YACA,MAAM,IAAIpD,SAAS,yCAAyC;QAC9D;QAEA8B,OAAO,MAAM7B,gBAAgB;YAC3BwB,MAAM;gBACJd,UAAUP,iBAAiB6B,MAAMX,IAAI,IAAI+B,eAAexB;gBACxDA,KAAKI,MAAMJ,GAAG;YAChB;YACAK;YACAE,cAAc;gBACZ,GAAGA,YAAY;gBACfkB,0BAA0BlB,aAAakB,wBAAwB,IAAK,CAAA,IAAO,CAAA,CAAC,CAAA,CAAC;YAC/E;QACF;QACAxB,KAAKgB,QAAQ,GAAGhB,KAAKgB,QAAQ,EAAES,MAAM,IAAI,CAAC,EAAE,IAAI;QAChDzB,KAAKjB,IAAI,GAAGiB,KAAKL,IAAI,CAACsB,MAAM;IAC9B;IAEA,IAAIN,gBAAgBN,aAAaqB,OAAOC,QAAQ,CAAChB,gBAAgBX,KAAKjB,IAAI,GAAG4B,aAAa;QACxF,MAAM,IAAIzC,SAAS,CAAC,iBAAiB,EAAEyC,YAAY,mBAAmB,CAAC,EAAE;IAC3E;IAEA,OAAOX;AACT;AAEA,SAASc,aAAa,EAAEH,WAAW,EAAEI,KAAK,EAA2C;IACnF,MAAMa,aAAab,MAAMc,OAAO,CAAC,OAAO;IAExC,IAAI,CAAC,uBAAuBC,IAAI,CAACF,eAAeA,WAAWX,MAAM,GAAG,MAAM,GAAG;QAC3E,MAAM,IAAI/C,SAAS,mCAAmC;IACxD;IAEA,IAAIyC,gBAAgBN,aAAaqB,OAAOC,QAAQ,CAAChB,cAAc;QAC7D,MAAMoB,gBAAgBH,WAAWI,QAAQ,CAAC,QAAQ,IAAIJ,WAAWI,QAAQ,CAAC,OAAO,IAAI;QACrF,MAAMC,cAAcC,KAAKC,KAAK,CAAC,AAACP,WAAWX,MAAM,GAAG,IAAK,KAAKc;QAE9D,IAAIE,cAActB,aAAa;YAC7B,MAAM,IAAIzC,SAAS,CAAC,iBAAiB,EAAEyC,YAAY,mBAAmB,CAAC,EAAE;QAC3E;IACF;IAEA,MAAMhB,OAAOyC,OAAOC,IAAI,CAACT,YAAY;IAErC,IAAIjC,KAAK2C,QAAQ,CAAC,UAAUT,OAAO,CAAC,OAAO,QAAQD,WAAWC,OAAO,CAAC,OAAO,KAAK;QAChF,MAAM,IAAI3D,SAAS,mCAAmC;IACxD;IAEA,OAAOyB;AACT;AAEA,SAAS4B,eAAexB,GAAQ;IAC9B,MAAMwC,cAAcxC,IAAIyC,QAAQ,CAACf,KAAK,CAAC,KAAKgB,GAAG,MAAM;IAErD,IAAI;QACF,OAAOC,mBAAmBH;IAC5B,EAAE,OAAM;QACN,OAAOA;IACT;AACF"}

package/dist/mcp/builtin/collections/fileInput.spec.js

@@ -0,0 +1,86 @@
+import { describe, expect, it } from 'vitest';
+import { fileInputSchema, resolveFile } from './fileInput.js';
+describe('MCP file input', ()=>{
+    it('should reject malformed MIME types', ()=>{
+        const result = fileInputSchema.safeParse({
+            data: 'aGVsbG8=',
+            mimeType: 'text/plain\r\nx-test: value',
+            name: 'hello.txt',
+            source: 'base64'
+        });
+        expect(result.success).toBe(false);
+    });
+    it('should accept a prepared upload', ()=>{
+        const result = fileInputSchema.safeParse({
+            file: {
+                filename: 'image.png',
+                mimeType: 'image/png',
+                size: 123,
+                uploadReference: {
+                    uploadId: 'upload-id'
+                }
+            },
+            source: 'uploadReference'
+        });
+        expect(result.success).toBe(true);
+    });
+    it('should reject oversized base64 files', async ()=>{
+        const req = createRequest({
+            maxFileSize: 4
+        });
+        await expect(resolveFile({
+            collectionSlug: 'media',
+            input: {
+                data: Buffer.from('hello').toString('base64'),
+                mimeType: 'text/plain',
+                name: 'hello.txt',
+                source: 'base64'
+            },
+            req
+        })).rejects.toThrow('File exceeds the 4 byte upload limit.');
+    });
+    it('should reject URLs outside the collection allowlist', async ()=>{
+        const req = createRequest({
+            allowList: [
+                {
+                    hostname: 'assets.example.com',
+                    protocol: 'https'
+                }
+            ]
+        });
+        await expect(resolveFile({
+            collectionSlug: 'media',
+            input: {
+                source: 'externalURL',
+                url: 'https://example.com/image.png'
+            },
+            req
+        })).rejects.toThrow('The provided file URL is not allowed.');
+    });
+});
+function createRequest({ allowList, maxFileSize }) {
+    return {
+        payload: {
+            collections: {
+                media: {
+                    config: {
+                        upload: allowList ? {
+                            pasteURL: {
+                                allowList
+                            }
+                        } : {}
+                    }
+                }
+            },
+            config: {
+                upload: {
+                    limits: {
+                        fileSize: maxFileSize
+                    }
+                }
+            }
+        }
+    };
+}
+
+//# sourceMappingURL=fileInput.spec.js.map

package/dist/mcp/builtin/collections/fileInput.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { fileInputSchema, resolveFile } from './fileInput.js'\n\ndescribe('MCP file input', () => {\n  it('should reject malformed MIME types', () => {\n    const result = fileInputSchema.safeParse({\n      data: 'aGVsbG8=',\n      mimeType: 'text/plain\\r\\nx-test: value',\n      name: 'hello.txt',\n      source: 'base64',\n    })\n\n    expect(result.success).toBe(false)\n  })\n\n  it('should accept a prepared upload', () => {\n    const result = fileInputSchema.safeParse({\n      file: {\n        filename: 'image.png',\n        mimeType: 'image/png',\n        size: 123,\n        uploadReference: { uploadId: 'upload-id' },\n      },\n      source: 'uploadReference',\n    })\n\n    expect(result.success).toBe(true)\n  })\n\n  it('should reject oversized base64 files', async () => {\n    const req = createRequest({ maxFileSize: 4 })\n\n    await expect(\n      resolveFile({\n        collectionSlug: 'media',\n        input: {\n          data: Buffer.from('hello').toString('base64'),\n          mimeType: 'text/plain',\n          name: 'hello.txt',\n          source: 'base64',\n        },\n        req,\n      }),\n    ).rejects.toThrow('File exceeds the 4 byte upload limit.')\n  })\n\n  it('should reject URLs outside the collection allowlist', async () => {\n    const req = createRequest({\n      allowList: [{ hostname: 'assets.example.com', protocol: 'https' }],\n    })\n\n    await expect(\n      resolveFile({\n        collectionSlug: 'media',\n        input: {\n          source: 'externalURL',\n          url: 'https://example.com/image.png',\n        },\n        req,\n      }),\n    ).rejects.toThrow('The provided file URL is not allowed.')\n  })\n})\n\nfunction createRequest({\n  allowList,\n  maxFileSize,\n}: {\n  allowList?: Array<{ hostname: string; protocol: 'http' | 'https' }>\n  maxFileSize?: number\n}): PayloadRequest {\n  return {\n    payload: {\n      collections: {\n        media: {\n          config: {\n            upload: allowList ? { pasteURL: { allowList } } : {},\n          },\n        },\n      },\n      config: {\n        upload: {\n          limits: {\n            fileSize: maxFileSize,\n          },\n        },\n      },\n    },\n  } as unknown as PayloadRequest\n}\n"],"names":["describe","expect","it","fileInputSchema","resolveFile","result","safeParse","data","mimeType","name","source","success","toBe","file","filename","size","uploadReference","uploadId","req","createRequest","maxFileSize","collectionSlug","input","Buffer","from","toString","rejects","toThrow","allowList","hostname","protocol","url","payload","collections","media","config","upload","pasteURL","limits","fileSize"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,eAAe,EAAEC,WAAW,QAAQ,iBAAgB;AAE7DJ,SAAS,kBAAkB;IACzBE,GAAG,sCAAsC;QACvC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCC,MAAM;YACNC,UAAU;YACVC,MAAM;YACNC,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,mCAAmC;QACpC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCO,MAAM;gBACJC,UAAU;gBACVN,UAAU;gBACVO,MAAM;gBACNC,iBAAiB;oBAAEC,UAAU;gBAAY;YAC3C;YACAP,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,wCAAwC;QACzC,MAAMgB,MAAMC,cAAc;YAAEC,aAAa;QAAE;QAE3C,MAAMnB,OACJG,YAAY;YACViB,gBAAgB;YAChBC,OAAO;gBACLf,MAAMgB,OAAOC,IAAI,CAAC,SAASC,QAAQ,CAAC;gBACpCjB,UAAU;gBACVC,MAAM;gBACNC,QAAQ;YACV;YACAQ;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAzB,GAAG,uDAAuD;QACxD,MAAMgB,MAAMC,cAAc;YACxBS,WAAW;gBAAC;oBAAEC,UAAU;oBAAsBC,UAAU;gBAAQ;aAAE;QACpE;QAEA,MAAM7B,OACJG,YAAY;YACViB,gBAAgB;YAChBC,OAAO;gBACLZ,QAAQ;gBACRqB,KAAK;YACP;YACAb;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;AACF;AAEA,SAASR,cAAc,EACrBS,SAAS,EACTR,WAAW,EAIZ;IACC,OAAO;QACLY,SAAS;YACPC,aAAa;gBACXC,OAAO;oBACLC,QAAQ;wBACNC,QAAQR,YAAY;4BAAES,UAAU;gCAAET;4BAAU;wBAAE,IAAI,CAAC;oBACrD;gBACF;YACF;YACAO,QAAQ;gBACNC,QAAQ;oBACNE,QAAQ;wBACNC,UAAUnB;oBACZ;gBACF;YACF;QACF;IACF;AACF"}

package/dist/mcp/builtin/collections/findDistinctTool.d.ts

@@ -0,0 +1,2 @@
+export declare const findDistinctTool: import("../../../types.js").CollectionTool;
+//# sourceMappingURL=findDistinctTool.d.ts.map

package/dist/mcp/builtin/collections/findDistinctTool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"findDistinctTool.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/findDistinctTool.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,gBAAgB,4CA0G3B,CAAA"}

package/dist/mcp/builtin/collections/findDistinctTool.js

@@ -0,0 +1,92 @@
+import { z } from 'zod';
+import { defaultAccess } from '../../../defaultAccess.js';
+import { defineCollectionTool } from '../../../defineTool.js';
+import { getLogger } from '../../../utils/getLogger.js';
+import { whereSchema } from '../../../utils/whereSchema.js';
+const DEFAULT_DESCRIPTION = 'Find distinct values for a field in any collection by passing the collection slug and field path.';
+export const findDistinctTool = defineCollectionTool({
+    access: (args)=>defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.read),
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+        readOnlyHint: true,
+        title: 'Find Distinct'
+    },
+    description: DEFAULT_DESCRIPTION,
+    input: z.object({
+        depth: z.number().int().min(0).max(10).describe('How many levels deep to populate relationships in distinct values').optional().default(0),
+        field: z.string().describe('The field path to get distinct values for'),
+        limit: z.number().int().min(1).max(100).describe('Maximum number of distinct values to return (max: 100)').optional(),
+        locale: z.string().describe('Optional: locale code to retrieve data in (e.g., "en", "es"). Use "all" to retrieve all locales for localized fields').optional(),
+        page: z.number().int().min(1).describe('Page number for pagination').optional(),
+        populate: z.record(z.string(), z.unknown()).describe('Optional: control which fields to include from populated relationship or upload documents.').optional(),
+        showHiddenFields: z.boolean().describe('Optional: include hidden fields in the distinct query').optional(),
+        sort: z.string().describe('Field to sort by (e.g., "createdAt", "-updatedAt" for descending)').optional(),
+        trash: z.boolean().describe('Optional: include soft-deleted documents when trash is enabled on the collection').optional(),
+        where: whereSchema.describe('Optional: where clause for filtering. Use field names with Payload operators, and/or arrays for grouping. Example: {"title":{"contains":"test"}}').optional()
+    })
+}).handler(async ({ authorizedMCP, collectionSlug, input, req })=>{
+    const payload = req.payload;
+    const logger = getLogger({
+        payload
+    });
+    const { depth, field, limit, locale, page, populate, showHiddenFields, sort, trash, where } = input;
+    logger.info(`Finding distinct values in collection: ${collectionSlug}, field: ${field}`);
+    try {
+        const result = await payload.findDistinct({
+            collection: collectionSlug,
+            depth,
+            field,
+            overrideAccess: authorizedMCP.overrideAccess,
+            req,
+            ...limit ? {
+                limit
+            } : {},
+            ...locale ? {
+                locale
+            } : {},
+            ...page ? {
+                page
+            } : {},
+            ...populate ? {
+                populate: populate
+            } : {},
+            ...showHiddenFields !== undefined ? {
+                showHiddenFields
+            } : {},
+            ...sort ? {
+                sort
+            } : {},
+            ...trash !== undefined ? {
+                trash
+            } : {},
+            ...where ? {
+                where
+            } : {}
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `Distinct values for "${field}" in collection "${collectionSlug}":\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error finding distinct values in ${collectionSlug}: ${errorMessage}`);
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `❌ **Error finding distinct values in collection "${collectionSlug}":** ${errorMessage}`
+                }
+            ],
+            isError: true
+        };
+    }
+});
+
+//# sourceMappingURL=findDistinctTool.js.map

package/dist/mcp/builtin/collections/findDistinctTool.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/mcp/builtin/collections/findDistinctTool.ts"],"sourcesContent":["import type { PopulateType } from 'payload'\n\nimport { z } from 'zod'\n\nimport { defaultAccess } from '../../../defaultAccess.js'\nimport { defineCollectionTool } from '../../../defineTool.js'\nimport { getLogger } from '../../../utils/getLogger.js'\nimport { whereSchema } from '../../../utils/whereSchema.js'\n\nconst DEFAULT_DESCRIPTION =\n  'Find distinct values for a field in any collection by passing the collection slug and field path.'\n\nexport const findDistinctTool = defineCollectionTool({\n  access: (args) =>\n    defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.read),\n  annotations: {\n    destructiveHint: false,\n    idempotentHint: true,\n    openWorldHint: false,\n    readOnlyHint: true,\n    title: 'Find Distinct',\n  },\n  description: DEFAULT_DESCRIPTION,\n  input: z.object({\n    depth: z\n      .number()\n      .int()\n      .min(0)\n      .max(10)\n      .describe('How many levels deep to populate relationships in distinct values')\n      .optional()\n      .default(0),\n    field: z.string().describe('The field path to get distinct values for'),\n    limit: z\n      .number()\n      .int()\n      .min(1)\n      .max(100)\n      .describe('Maximum number of distinct values to return (max: 100)')\n      .optional(),\n    locale: z\n      .string()\n      .describe(\n        'Optional: locale code to retrieve data in (e.g., \"en\", \"es\"). Use \"all\" to retrieve all locales for localized fields',\n      )\n      .optional(),\n    page: z.number().int().min(1).describe('Page number for pagination').optional(),\n    populate: z\n      .record(z.string(), z.unknown())\n      .describe(\n        'Optional: control which fields to include from populated relationship or upload documents.',\n      )\n      .optional(),\n    showHiddenFields: z\n      .boolean()\n      .describe('Optional: include hidden fields in the distinct query')\n      .optional(),\n    sort: z\n      .string()\n      .describe('Field to sort by (e.g., \"createdAt\", \"-updatedAt\" for descending)')\n      .optional(),\n    trash: z\n      .boolean()\n      .describe('Optional: include soft-deleted documents when trash is enabled on the collection')\n      .optional(),\n    where: whereSchema\n      .describe(\n        'Optional: where clause for filtering. Use field names with Payload operators, and/or arrays for grouping. Example: {\"title\":{\"contains\":\"test\"}}',\n      )\n      .optional(),\n  }),\n}).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {\n  const payload = req.payload\n  const logger = getLogger({ payload })\n  const { depth, field, limit, locale, page, populate, showHiddenFields, sort, trash, where } =\n    input\n\n  logger.info(`Finding distinct values in collection: ${collectionSlug}, field: ${field}`)\n\n  try {\n    const result = await payload.findDistinct({\n      collection: collectionSlug,\n      depth,\n      field,\n      overrideAccess: authorizedMCP.overrideAccess,\n      req,\n      ...(limit ? { limit } : {}),\n      ...(locale ? { locale } : {}),\n      ...(page ? { page } : {}),\n      ...(populate ? { populate: populate as PopulateType } : {}),\n      ...(showHiddenFields !== undefined ? { showHiddenFields } : {}),\n      ...(sort ? { sort } : {}),\n      ...(trash !== undefined ? { trash } : {}),\n      ...(where ? { where } : {}),\n    })\n\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Distinct values for \"${field}\" in collection \"${collectionSlug}\":\\n\\`\\`\\`json\\n${JSON.stringify(result)}\\n\\`\\`\\``,\n        },\n      ],\n      doc: result as unknown as Record<string, unknown>,\n    }\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : 'Unknown error'\n    logger.error(`Error finding distinct values in ${collectionSlug}: ${errorMessage}`)\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `❌ **Error finding distinct values in collection \"${collectionSlug}\":** ${errorMessage}`,\n        },\n      ],\n      isError: true,\n    }\n  }\n})\n"],"names":["z","defaultAccess","defineCollectionTool","getLogger","whereSchema","DEFAULT_DESCRIPTION","findDistinctTool","access","args","Boolean","permissions","collections","collectionSlug","read","annotations","destructiveHint","idempotentHint","openWorldHint","readOnlyHint","title","description","input","object","depth","number","int","min","max","describe","optional","default","field","string","limit","locale","page","populate","record","unknown","showHiddenFields","boolean","sort","trash","where","handler","authorizedMCP","req","payload","logger","info","result","findDistinct","collection","overrideAccess","undefined","content","type","text","JSON","stringify","doc","error","errorMessage","Error","message","isError"],"mappings":"AAEA,SAASA,CAAC,QAAQ,MAAK;AAEvB,SAASC,aAAa,QAAQ,4BAA2B;AACzD,SAASC,oBAAoB,QAAQ,yBAAwB;AAC7D,SAASC,SAAS,QAAQ,8BAA6B;AACvD,SAASC,WAAW,QAAQ,gCAA+B;AAE3D,MAAMC,sBACJ;AAEF,OAAO,MAAMC,mBAAmBJ,qBAAqB;IACnDK,QAAQ,CAACC,OACPP,cAAcO,SAASC,QAAQD,KAAKE,WAAW,EAAEC,aAAa,CAACH,KAAKI,cAAc,CAAC,EAAEC;IACvFC,aAAa;QACXC,iBAAiB;QACjBC,gBAAgB;QAChBC,eAAe;QACfC,cAAc;QACdC,OAAO;IACT;IACAC,aAAaf;IACbgB,OAAOrB,EAAEsB,MAAM,CAAC;QACdC,OAAOvB,EACJwB,MAAM,GACNC,GAAG,GACHC,GAAG,CAAC,GACJC,GAAG,CAAC,IACJC,QAAQ,CAAC,qEACTC,QAAQ,GACRC,OAAO,CAAC;QACXC,OAAO/B,EAAEgC,MAAM,GAAGJ,QAAQ,CAAC;QAC3BK,OAAOjC,EACJwB,MAAM,GACNC,GAAG,GACHC,GAAG,CAAC,GACJC,GAAG,CAAC,KACJC,QAAQ,CAAC,0DACTC,QAAQ;QACXK,QAAQlC,EACLgC,MAAM,GACNJ,QAAQ,CACP,wHAEDC,QAAQ;QACXM,MAAMnC,EAAEwB,MAAM,GAAGC,GAAG,GAAGC,GAAG,CAAC,GAAGE,QAAQ,CAAC,8BAA8BC,QAAQ;QAC7EO,UAAUpC,EACPqC,MAAM,CAACrC,EAAEgC,MAAM,IAAIhC,EAAEsC,OAAO,IAC5BV,QAAQ,CACP,8FAEDC,QAAQ;QACXU,kBAAkBvC,EACfwC,OAAO,GACPZ,QAAQ,CAAC,yDACTC,QAAQ;QACXY,MAAMzC,EACHgC,MAAM,GACNJ,QAAQ,CAAC,qEACTC,QAAQ;QACXa,OAAO1C,EACJwC,OAAO,GACPZ,QAAQ,CAAC,oFACTC,QAAQ;QACXc,OAAOvC,YACJwB,QAAQ,CACP,oJAEDC,QAAQ;IACb;AACF,GAAGe,OAAO,CAAC,OAAO,EAAEC,aAAa,EAAEjC,cAAc,EAAES,KAAK,EAAEyB,GAAG,EAAE;IAC7D,MAAMC,UAAUD,IAAIC,OAAO;IAC3B,MAAMC,SAAS7C,UAAU;QAAE4C;IAAQ;IACnC,MAAM,EAAExB,KAAK,EAAEQ,KAAK,EAAEE,KAAK,EAAEC,MAAM,EAAEC,IAAI,EAAEC,QAAQ,EAAEG,gBAAgB,EAAEE,IAAI,EAAEC,KAAK,EAAEC,KAAK,EAAE,GACzFtB;IAEF2B,OAAOC,IAAI,CAAC,CAAC,uCAAuC,EAAErC,eAAe,SAAS,EAAEmB,OAAO;IAEvF,IAAI;QACF,MAAMmB,SAAS,MAAMH,QAAQI,YAAY,CAAC;YACxCC,YAAYxC;YACZW;YACAQ;YACAsB,gBAAgBR,cAAcQ,cAAc;YAC5CP;YACA,GAAIb,QAAQ;gBAAEA;YAAM,IAAI,CAAC,CAAC;YAC1B,GAAIC,SAAS;gBAAEA;YAAO,IAAI,CAAC,CAAC;YAC5B,GAAIC,OAAO;gBAAEA;YAAK,IAAI,CAAC,CAAC;YACxB,GAAIC,WAAW;gBAAEA,UAAUA;YAAyB,IAAI,CAAC,CAAC;YAC1D,GAAIG,qBAAqBe,YAAY;gBAAEf;YAAiB,IAAI,CAAC,CAAC;YAC9D,GAAIE,OAAO;gBAAEA;YAAK,IAAI,CAAC,CAAC;YACxB,GAAIC,UAAUY,YAAY;gBAAEZ;YAAM,IAAI,CAAC,CAAC;YACxC,GAAIC,QAAQ;gBAAEA;YAAM,IAAI,CAAC,CAAC;QAC5B;QAEA,OAAO;YACLY,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,qBAAqB,EAAE1B,MAAM,iBAAiB,EAAEnB,eAAe,gBAAgB,EAAE8C,KAAKC,SAAS,CAACT,QAAQ,QAAQ,CAAC;gBAC1H;aACD;YACDU,KAAKV;QACP;IACF,EAAE,OAAOW,OAAO;QACd,MAAMC,eAAeD,iBAAiBE,QAAQF,MAAMG,OAAO,GAAG;QAC9DhB,OAAOa,KAAK,CAAC,CAAC,iCAAiC,EAAEjD,eAAe,EAAE,EAAEkD,cAAc;QAClF,OAAO;YACLP,SAAS;gBACP;oBACEC,MAAM;oBACNC,MAAM,CAAC,iDAAiD,EAAE7C,eAAe,KAAK,EAAEkD,cAAc;gBAChG;aACD;YACDG,SAAS;QACX;IACF;AACF,GAAE"}

package/dist/mcp/builtin/collections/findTool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"findTool.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/findTool.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,iBAAiB,4CAyM5B,CAAA"}
+{"version":3,"file":"findTool.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/findTool.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,iBAAiB,4CA2M5B,CAAA"}

package/dist/mcp/builtin/collections/findTool.js

@@ -1,10 +1,11 @@
 import { z } from 'zod';
+import { defaultAccess } from '../../../defaultAccess.js';
 import { defineCollectionTool } from '../../../defineTool.js';
 import { getLogger } from '../../../utils/getLogger.js';
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js';
 import { whereSchema } from '../../../utils/whereSchema.js';
 const DEFAULT_DESCRIPTION = 'Find documents in any collection by passing the collection slug and optional ID or where clause.';
 export const findDocumentsTool = defineCollectionTool({
+    access: (args)=>defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.read),
     annotations: {
         destructiveHint: false,
         idempotentHint: true,
@@ -19,7 +20,7 @@ export const findDocumentsTool = defineCollectionTool({
             z.number()
         ]).describe('Optional: specific document ID to retrieve. If not provided, returns all documents').optional(),
         depth: z.number().int().min(0).max(10).describe('How many levels deep to populate relationships (default: 0)').optional().default(0),
-        draft: z.boolean().describe('Optional: whether the document should be queried from the versions table/collection or not.').optional(),
+        draft: z.boolean().describe('For versioned collections, true returns the latest draft version when available. False reads the main document.').optional(),
         fallbackLocale: z.string().describe('Optional: fallback locale code to use when requested locale is not available').optional(),
         joins: z.union([
             z.record(z.string(), z.unknown()),
@@ -49,8 +50,8 @@ export const findDocumentsTool = defineCollectionTool({
                     id,
                     collection: collectionSlug,
                     depth,
+                    overrideAccess: authorizedMCP.overrideAccess,
                     req,
-                    ...localAPIDefaults(authorizedMCP),
                     ...select && {
                         select: select
                     },
@@ -98,9 +99,9 @@ export const findDocumentsTool = defineCollectionTool({
             collection: collectionSlug,
             depth,
             limit,
+            overrideAccess: authorizedMCP.overrideAccess,
             page,
             req,
-            ...localAPIDefaults(authorizedMCP),
             ...select && {
                 select: select
             },