@payloadcms/plugin-mcp 4.0.0-internal.011fd46 → 4.0.0-internal.17c13d2

package/src/stdio.ts

@@ -6,8 +6,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url'
 import { createLocalReq, getPayload } from 'payload'
 import { findConfig } from 'payload/node'
 
-import type { AuthorizedMCP, SanitizedMCPPluginConfig } from './types.js'
+import type { SanitizedMCPPluginConfig } from './types.js'
 
+import { getAuthorizedMCP } from './endpoint/access.js'
 import { buildMcpServer } from './mcp/buildMcpServer.js'
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'
 import { getPluginConfig } from './utils/getPluginConfig.js'
@@ -16,8 +17,9 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js'
 /**
  * Stdio adapter for the Payload MCP server.
  *
- * Do not use in production. There's no auth; whoever can spawn the process gets
- * full access to your local data.
+ * Pass PAYLOAD_MCP_AUTHORIZATION when stdio should authenticate with the same
+ * Payload auth header as HTTP. In development, PAYLOAD_MCP_OVERRIDE_ACCESS=true
+ * skips access control for local setup.
  */
 export const runMcpStdio = async (): Promise<void> => {
   /**
@@ -62,14 +64,27 @@ export const runMcpStdio = async (): Promise<void> => {
     ;(payload.config.plugins ??= []).push(fakePluginFn)
   }
 
-  const authorizedMCP: AuthorizedMCP = {
-    items: pluginConfig.items,
-    overrideAccess: true,
-    user: null,
+  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS
+  let overrideAccess = false
+
+  if (overrideAccessEnv === 'true') {
+    overrideAccess = true
+  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {
+    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be "true" or "false".')
+  }
+
+  if (overrideAccess && process.env.NODE_ENV !== 'development') {
+    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')
+  }
+
+  const headers = new Headers()
+  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {
+    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
   }
 
-  const req = await createLocalReq({}, payload)
+  const req = await createLocalReq({ req: { headers } }, payload)
   req.payloadAPI = 'MCP' as const
+  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
 
   const server = buildMcpServer({ authorizedMCP, pluginConfig, req })
 

package/src/types.ts

@@ -10,15 +10,15 @@ import type {
 } from '@modelcontextprotocol/server'
 import type {
   AuthCollectionSlug,
-  CollectionConfig,
   CollectionSlug,
-  DefaultDocumentIDType,
   GlobalSlug,
   MaybePromise,
   PayloadRequest,
+  SanitizedPermissions,
   TypedUser,
 } from 'payload'
 
+import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
 import type {
   MCPCollectionAuthToolName,
   MCPCollectionBuiltinName,
@@ -36,27 +36,6 @@ export type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }
  */
 export type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON
 
-/**
- * Serializable mirror of `SanitizedMCPPluginConfig` for client components —
- * the full sanitized config carries functions (tool handlers, etc.) that can't
- * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and
- * passed to the `AccessField` component via `clientProps`.
- *
- * @internal
- */
-export type ClientMCPPluginConfig = {
-  items: Array<{
-    collectionSlug?: string
-    configKey: string
-    description?: string
-    globalSlug?: string
-    /** Admin-UI bucket for collection/global tools: built-in CRUD, auth, or custom. */
-    group?: 'auth' | 'custom' | 'operations'
-    label: string
-    type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool'
-  }>
-}
-
 export type MCPToolResponse = {
   content: ContentBlock[]
   /**
@@ -83,6 +62,19 @@ export type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON
     : StandardSchemaWithJSON.InferOutput<TSchema>
   : Record<string, unknown>
 
+export type MCPAccessArgs = {
+  permissions?: SanitizedPermissions
+  req: PayloadRequest
+}
+
+export type CollectionMCPAccessArgs = {
+  collectionSlug: CollectionSlug
+} & MCPAccessArgs
+
+export type GlobalMCPAccessArgs = {
+  globalSlug: GlobalSlug
+} & MCPAccessArgs
+
 export type ToolHandlerArgs<TSchema = undefined> = {
   authorizedMCP: AuthorizedMCP
   input: TypedInput<TSchema>
@@ -99,6 +91,7 @@ export type GlobalToolHandlerArgs<TSchema = undefined> = {
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description: string
   handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
@@ -112,12 +105,14 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
 } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
     input?: TSchema
   } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
@@ -127,7 +122,16 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a
  * required handler) from being silently accepted at a built-in key slot.
  */
-export type MCPBuiltInToolOverride = {
+export type MCPBuiltInCollectionToolOverride = {
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
+  description?: string
+  handler?: never
+  overrideResponse?: MCPResponseOverride
+}
+
+export type MCPBuiltInGlobalToolOverride = {
+  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
   annotations?: ToolAnnotations
   description?: string
   handler?: never
@@ -142,13 +146,13 @@ export type MCPBuiltInToolOverride = {
 export type MCPTopLevelToolEntry = Tool
 
 export type MCPCollectionToolsMap = {
-  [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined
 } & {
-  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride
 }
 
 export type MCPAuthCollectionToolsMap = {
-  [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true
+  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true
 } & MCPCollectionToolsMap
 
 /** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */
@@ -157,9 +161,9 @@ export type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends
   : MCPCollectionToolsMap
 
 export type MCPGlobalToolsMap = {
-  [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined
 } & {
-  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride
 }
 
 export type MCPTopLevelToolsMap = Record<string, Tool>
@@ -171,6 +175,7 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
   handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{
@@ -188,6 +193,7 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
     contents: Array<{ text: string; uri: string }>
@@ -221,7 +227,7 @@ export type MCPPluginConfig = {
   collections?: {
     [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>
   }
-  /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */
+  /** Skip MCP endpoint registration. */
   disabled?: boolean
   globals?: {
     [Slug in GlobalSlug]?: MCPPluginGlobalConfig
@@ -230,25 +236,21 @@ export type MCPPluginConfig = {
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig
-  /** Replace the default API-key auth with a custom resolver. */
-  overrideAuth?: (args: {
-    getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>
-    getAuthorizedMCP: (args: { apiKeyDoc: MCPAPIKeysDoc }) => AuthorizedMCP
-    pluginConfig: SanitizedMCPPluginConfig
-    req: PayloadRequest
-  }) => MaybePromise<AuthorizedMCP>
+  /** Replace the default MCP authorization resolver. */
+  overrideGetAuthorizedMCP?: (
+    args: {
+      pluginConfig: SanitizedMCPPluginConfig
+    } & GetAuthorizedMCPArgs,
+  ) => MaybePromise<AuthorizedMCP>
   prompts?: Record<string, Prompt>
   resources?: Record<string, Resource>
   /** Cross-cutting tools (not scoped to any collection or global). */
   tools?: MCPTopLevelToolsMap
-  userCollection?: CollectionSlug
 }
 
 export type SanitizedMCPPluginConfig = {
   items: MCPItem[]
-  userCollection: CollectionSlug
-} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>
+} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideGetAuthorizedMCP'>
 
 export type MCPServerOptions = {
   options?: ConstructorParameters<typeof McpServer>[1]
@@ -256,52 +258,12 @@ export type MCPServerOptions = {
 }
 
 /**
- * Nested access tree as stored in the collection.
- * A `false` leaf disables that tool; missing keys defer to
- * defaults (built-in CRUD is on, opt-in tools are off).
- */
-export type MCPAPIKeysDocAccessTree = {
-  collections?: {
-    [CollectionSlug: CollectionSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  globals?: {
-    [GlobalSlug: GlobalSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  prompts?: {
-    [PromptKey: string]: boolean
-  }
-  resources?: {
-    [ResourceKey: string]: boolean
-  }
-  tools?: {
-    [ToolKey: string]: boolean
-  }
-}
-
-/**
- * Stored on `payload-mcp-api-keys` docs
- */
-export type MCPAPIKeysDoc = {
-  access: MCPAPIKeysDocAccessTree
-  apiKey?: string
-  apiKeyIndex?: string
-  id: DefaultDocumentIDType
-  lastUsed?: string
-  overrideAccess?: boolean
-  user: null | TypedUser
-}
-
-/**
- * One MCP primitive plus the metadata needed for access checks, admin UI, and
+ * One MCP primitive plus the metadata needed for config-driven filtering and
  * registration.
  *
- * - `configKey`: the config/API-key identifier, e.g. `find` or `echo`.
+ * - `configKey`: the config identifier, e.g. `find` or `echo`.
  * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.
- * - `label`: human-readable admin checkbox text.
+ * - `label`: human-readable display text.
  */
 export type MCPItemBase = {
   configKey: string
@@ -338,10 +300,10 @@ export type MCPItem =
   | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The caller's identity + the MCP items authorized for this request. Disabled
+ * items and items blocked by access callbacks or Payload operation access are
+ * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
+ * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]

package/src/utils/getPluginConfig.ts

@@ -5,7 +5,7 @@ import type { SanitizedMCPPluginConfig } from '../types.js'
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */
 export const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({

package/dist/collection/getAccessField.d.ts

@@ -1,12 +0,0 @@
-import type { JSONField } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */
-export declare const getAccessField: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => JSONField;
-//# sourceMappingURL=getAccessField.d.ts.map

package/dist/collection/getAccessField.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAccessField.d.ts","sourceRoot":"","sources":["../../src/collection/getAccessField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,KAAK,EAAkC,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAQ3F;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,mBAE5B;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,SAiBH,CAAA"}

package/dist/collection/getAccessField.js

@@ -1,72 +0,0 @@
-import { COLLECTION_AUTH_BUILTINS, COLLECTION_BUILTINS, GLOBAL_BUILTINS } from '../mcp/builtinTools.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */ export const getAccessField = ({ pluginConfig })=>{
-    const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig);
-    return {
-        name: 'access',
-        type: 'json',
-        admin: {
-            components: {
-                Field: {
-                    clientProps: {
-                        pluginConfig: clientPluginConfig
-                    },
-                    path: '@payloadcms/plugin-mcp/client#AccessField'
-                }
-            }
-        },
-        defaultValue: {},
-        label: false
-    };
-};
-/**
- * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,
- * input/argsSchema functions, etc.) so the result is safe to thread to a
- * client component via `clientProps`.
- */ const sanitizeClientPluginConfig = (pluginConfig)=>({
-        items: pluginConfig.items.map((item)=>{
-            const group = itemGroup(item);
-            return {
-                ...item.type === 'collectionTool' ? {
-                    collectionSlug: item.collectionSlug
-                } : {},
-                ...item.type === 'globalTool' ? {
-                    globalSlug: item.globalSlug
-                } : {},
-                type: item.type,
-                configKey: item.configKey,
-                ...group === 'operations' ? {} : {
-                    description: itemDescription(item)
-                },
-                group,
-                label: item.label
-            };
-        })
-    });
-const itemDescription = (item)=>{
-    if (item.type === 'prompt') {
-        return item.prompt.description;
-    }
-    if (item.type === 'resource') {
-        return item.resource.description;
-    }
-    return item.tool.description;
-};
-const itemGroup = (item)=>{
-    if (item.type === 'collectionTool') {
-        if (item.configKey in COLLECTION_BUILTINS) {
-            return 'operations';
-        }
-        return item.configKey in COLLECTION_AUTH_BUILTINS ? 'auth' : 'custom';
-    }
-    if (item.type === 'globalTool') {
-        return item.configKey in GLOBAL_BUILTINS ? 'operations' : 'custom';
-    }
-    return undefined;
-};
-
-//# sourceMappingURL=getAccessField.js.map

package/dist/collection/getAccessField.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/collection/getAccessField.ts"],"sourcesContent":["import type { JSONField } from 'payload'\n\nimport type { ClientMCPPluginConfig, MCPItem, SanitizedMCPPluginConfig } from '../types.js'\n\nimport {\n  COLLECTION_AUTH_BUILTINS,\n  COLLECTION_BUILTINS,\n  GLOBAL_BUILTINS,\n} from '../mcp/builtinTools.js'\n\n/**\n * Returns the API key collection's `access` field — a JSON field whose value\n * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is\n * a custom client component (`AccessField`) which renders a permissions\n * matrix; the field's stored shape is just the runtime access tree.\n */\nexport const getAccessField = ({\n  pluginConfig,\n}: {\n  pluginConfig: SanitizedMCPPluginConfig\n}): JSONField => {\n  const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig)\n\n  return {\n    name: 'access',\n    type: 'json',\n    admin: {\n      components: {\n        Field: {\n          clientProps: { pluginConfig: clientPluginConfig },\n          path: '@payloadcms/plugin-mcp/client#AccessField',\n        },\n      },\n    },\n    defaultValue: {},\n    label: false,\n  }\n}\n\n/**\n * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,\n * input/argsSchema functions, etc.) so the result is safe to thread to a\n * client component via `clientProps`.\n */\nconst sanitizeClientPluginConfig = (\n  pluginConfig: SanitizedMCPPluginConfig,\n): ClientMCPPluginConfig => ({\n  items: pluginConfig.items.map((item) => {\n    const group = itemGroup(item)\n\n    return {\n      ...(item.type === 'collectionTool' ? { collectionSlug: item.collectionSlug } : {}),\n      ...(item.type === 'globalTool' ? { globalSlug: item.globalSlug } : {}),\n      type: item.type,\n      configKey: item.configKey,\n      ...(group === 'operations' ? {} : { description: itemDescription(item) }),\n      group,\n      label: item.label,\n    }\n  }),\n})\n\nconst itemDescription = (item: MCPItem): string => {\n  if (item.type === 'prompt') {\n    return item.prompt.description\n  }\n  if (item.type === 'resource') {\n    return item.resource.description\n  }\n  return item.tool.description\n}\n\nconst itemGroup = (item: MCPItem): 'auth' | 'custom' | 'operations' | undefined => {\n  if (item.type === 'collectionTool') {\n    if (item.configKey in COLLECTION_BUILTINS) {\n      return 'operations'\n    }\n    return item.configKey in COLLECTION_AUTH_BUILTINS ? 'auth' : 'custom'\n  }\n  if (item.type === 'globalTool') {\n    return item.configKey in GLOBAL_BUILTINS ? 'operations' : 'custom'\n  }\n  return undefined\n}\n"],"names":["COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTINS","GLOBAL_BUILTINS","getAccessField","pluginConfig","clientPluginConfig","sanitizeClientPluginConfig","name","type","admin","components","Field","clientProps","path","defaultValue","label","items","map","item","group","itemGroup","collectionSlug","globalSlug","configKey","description","itemDescription","prompt","resource","tool","undefined"],"mappings":"AAIA,SACEA,wBAAwB,EACxBC,mBAAmB,EACnBC,eAAe,QACV,yBAAwB;AAE/B;;;;;CAKC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,YAAY,EAGb;IACC,MAAMC,qBAAqBC,2BAA2BF;IAEtD,OAAO;QACLG,MAAM;QACNC,MAAM;QACNC,OAAO;YACLC,YAAY;gBACVC,OAAO;oBACLC,aAAa;wBAAER,cAAcC;oBAAmB;oBAChDQ,MAAM;gBACR;YACF;QACF;QACAC,cAAc,CAAC;QACfC,OAAO;IACT;AACF,EAAC;AAED;;;;CAIC,GACD,MAAMT,6BAA6B,CACjCF,eAC2B,CAAA;QAC3BY,OAAOZ,aAAaY,KAAK,CAACC,GAAG,CAAC,CAACC;YAC7B,MAAMC,QAAQC,UAAUF;YAExB,OAAO;gBACL,GAAIA,KAAKV,IAAI,KAAK,mBAAmB;oBAAEa,gBAAgBH,KAAKG,cAAc;gBAAC,IAAI,CAAC,CAAC;gBACjF,GAAIH,KAAKV,IAAI,KAAK,eAAe;oBAAEc,YAAYJ,KAAKI,UAAU;gBAAC,IAAI,CAAC,CAAC;gBACrEd,MAAMU,KAAKV,IAAI;gBACfe,WAAWL,KAAKK,SAAS;gBACzB,GAAIJ,UAAU,eAAe,CAAC,IAAI;oBAAEK,aAAaC,gBAAgBP;gBAAM,CAAC;gBACxEC;gBACAJ,OAAOG,KAAKH,KAAK;YACnB;QACF;IACF,CAAA;AAEA,MAAMU,kBAAkB,CAACP;IACvB,IAAIA,KAAKV,IAAI,KAAK,UAAU;QAC1B,OAAOU,KAAKQ,MAAM,CAACF,WAAW;IAChC;IACA,IAAIN,KAAKV,IAAI,KAAK,YAAY;QAC5B,OAAOU,KAAKS,QAAQ,CAACH,WAAW;IAClC;IACA,OAAON,KAAKU,IAAI,CAACJ,WAAW;AAC9B;AAEA,MAAMJ,YAAY,CAACF;IACjB,IAAIA,KAAKV,IAAI,KAAK,kBAAkB;QAClC,IAAIU,KAAKK,SAAS,IAAItB,qBAAqB;YACzC,OAAO;QACT;QACA,OAAOiB,KAAKK,SAAS,IAAIvB,2BAA2B,SAAS;IAC/D;IACA,IAAIkB,KAAKV,IAAI,KAAK,cAAc;QAC9B,OAAOU,KAAKK,SAAS,IAAIrB,kBAAkB,eAAe;IAC5D;IACA,OAAO2B;AACT"}

package/dist/collection/index.d.ts

@@ -1,6 +0,0 @@
-import type { CollectionConfig } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-export declare const getAPIKeysCollection: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => CollectionConfig;
-//# sourceMappingURL=index.d.ts.map

package/dist/collection/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collection/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAkB3D,eAAO,MAAM,oBAAoB,GAAI,mBAElC;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,gBA8EH,CAAA"}

package/dist/collection/index.js

@@ -1,105 +0,0 @@
-import { createAPIKeyFields } from 'payload';
-import { getAccessField } from './getAccessField.js';
-const apiKeyStorageFields = createAPIKeyFields({
-    apiKeyField: {
-        admin: {
-            components: {
-                Field: '@payloadcms/plugin-mcp/client#APIKeyField'
-            }
-        },
-        required: true
-    },
-    apiKeyIndexField: {
-        index: true,
-        required: true
-    },
-    includeEnableAPIKey: false
-});
-export const getAPIKeysCollection = ({ pluginConfig })=>{
-    const collection = {
-        slug: 'payload-mcp-api-keys',
-        admin: {
-            components: {
-                views: {
-                    list: {
-                        NoResults: '@payloadcms/plugin-mcp/client#APIKeysEmptyState'
-                    }
-                }
-            },
-            defaultColumns: [
-                'label',
-                'lastUsed',
-                'user'
-            ],
-            // Kept out of the main nav — reachable through the user menu's settings instead.
-            group: false,
-            useAsTitle: 'label'
-        },
-        fields: [
-            ...apiKeyStorageFields,
-            getAccessField({
-                pluginConfig
-            }),
-            {
-                name: 'label',
-                type: 'text',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:titleDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('plugin-mcp:title')
-            },
-            {
-                name: 'description',
-                type: 'text',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:descriptionDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('plugin-mcp:description')
-            },
-            {
-                name: 'lastUsed',
-                type: 'date',
-                admin: {
-                    date: {
-                        pickerAppearance: 'dayAndTime'
-                    },
-                    disabled: {
-                        field: true
-                    }
-                },
-                label: ({ t })=>t('plugin-mcp:lastUsed')
-            },
-            {
-                name: 'user',
-                type: 'relationship',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:userDescription'),
-                    position: 'sidebar'
-                },
-                label: ({ t })=>t('general:user'),
-                relationTo: pluginConfig.userCollection,
-                required: true
-            },
-            {
-                name: 'overrideAccess',
-                type: 'checkbox',
-                admin: {
-                    description: ({ t })=>t('plugin-mcp:overrideAccessDescription'),
-                    position: 'sidebar'
-                },
-                defaultValue: false,
-                label: ({ t })=>t('plugin-mcp:overrideAccess')
-            }
-        ],
-        labels: {
-            plural: ({ t })=>`${t('plugin-mcp:mcp')} ${t('plugin-mcp:apiKeys')}`,
-            singular: ({ t })=>`${t('plugin-mcp:mcp')} ${t('authentication:apiKey')}`
-        },
-        versions: false
-    };
-    return pluginConfig.overrideApiKeyCollection ? pluginConfig.overrideApiKeyCollection(collection) : collection;
-};
-
-//# sourceMappingURL=index.js.map

package/dist/collection/index.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/collection/index.ts"],"sourcesContent":["import type { CollectionConfig } from 'payload'\n\nimport { createAPIKeyFields } from 'payload'\n\nimport type { SanitizedMCPPluginConfig } from '../types.js'\n\nimport { getAccessField } from './getAccessField.js'\n\nconst apiKeyStorageFields = createAPIKeyFields({\n  apiKeyField: {\n    admin: {\n      components: { Field: '@payloadcms/plugin-mcp/client#APIKeyField' },\n    },\n    required: true,\n  },\n  apiKeyIndexField: {\n    index: true,\n    required: true,\n  },\n  includeEnableAPIKey: false,\n})\n\nexport const getAPIKeysCollection = ({\n  pluginConfig,\n}: {\n  pluginConfig: SanitizedMCPPluginConfig\n}): CollectionConfig => {\n  const collection: CollectionConfig = {\n    slug: 'payload-mcp-api-keys',\n    admin: {\n      components: {\n        views: {\n          list: {\n            NoResults: '@payloadcms/plugin-mcp/client#APIKeysEmptyState',\n          },\n        },\n      },\n      defaultColumns: ['label', 'lastUsed', 'user'],\n      // Kept out of the main nav — reachable through the user menu's settings instead.\n      group: false,\n      useAsTitle: 'label',\n    },\n    fields: [\n      ...apiKeyStorageFields,\n      getAccessField({ pluginConfig }),\n      {\n        name: 'label',\n        type: 'text',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:titleDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('plugin-mcp:title'),\n      },\n      {\n        name: 'description',\n        type: 'text',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:descriptionDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('plugin-mcp:description'),\n      },\n      {\n        name: 'lastUsed',\n        type: 'date',\n        admin: {\n          date: { pickerAppearance: 'dayAndTime' },\n          disabled: { field: true },\n        },\n        label: ({ t }) => t('plugin-mcp:lastUsed'),\n      },\n      {\n        name: 'user',\n        type: 'relationship',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:userDescription'),\n          position: 'sidebar',\n        },\n        label: ({ t }) => t('general:user'),\n        relationTo: pluginConfig.userCollection,\n        required: true,\n      },\n      {\n        name: 'overrideAccess',\n        type: 'checkbox',\n        admin: {\n          description: ({ t }) => t('plugin-mcp:overrideAccessDescription'),\n          position: 'sidebar',\n        },\n        defaultValue: false,\n        label: ({ t }) => t('plugin-mcp:overrideAccess'),\n      },\n    ],\n    labels: {\n      plural: ({ t }) => `${t('plugin-mcp:mcp')} ${t('plugin-mcp:apiKeys')}`,\n      singular: ({ t }) => `${t('plugin-mcp:mcp')} ${t('authentication:apiKey')}`,\n    },\n    versions: false,\n  }\n\n  return pluginConfig.overrideApiKeyCollection\n    ? pluginConfig.overrideApiKeyCollection(collection)\n    : collection\n}\n"],"names":["createAPIKeyFields","getAccessField","apiKeyStorageFields","apiKeyField","admin","components","Field","required","apiKeyIndexField","index","includeEnableAPIKey","getAPIKeysCollection","pluginConfig","collection","slug","views","list","NoResults","defaultColumns","group","useAsTitle","fields","name","type","description","t","position","label","date","pickerAppearance","disabled","field","relationTo","userCollection","defaultValue","labels","plural","singular","versions","overrideApiKeyCollection"],"mappings":"AAEA,SAASA,kBAAkB,QAAQ,UAAS;AAI5C,SAASC,cAAc,QAAQ,sBAAqB;AAEpD,MAAMC,sBAAsBF,mBAAmB;IAC7CG,aAAa;QACXC,OAAO;YACLC,YAAY;gBAAEC,OAAO;YAA4C;QACnE;QACAC,UAAU;IACZ;IACAC,kBAAkB;QAChBC,OAAO;QACPF,UAAU;IACZ;IACAG,qBAAqB;AACvB;AAEA,OAAO,MAAMC,uBAAuB,CAAC,EACnCC,YAAY,EAGb;IACC,MAAMC,aAA+B;QACnCC,MAAM;QACNV,OAAO;YACLC,YAAY;gBACVU,OAAO;oBACLC,MAAM;wBACJC,WAAW;oBACb;gBACF;YACF;YACAC,gBAAgB;gBAAC;gBAAS;gBAAY;aAAO;YAC7C,iFAAiF;YACjFC,OAAO;YACPC,YAAY;QACd;QACAC,QAAQ;eACHnB;YACHD,eAAe;gBAAEW;YAAa;YAC9B;gBACEU,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLwB,MAAM;wBAAEC,kBAAkB;oBAAa;oBACvCC,UAAU;wBAAEC,OAAO;oBAAK;gBAC1B;gBACAJ,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;YACA;gBACEH,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAC,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;gBACpBO,YAAYpB,aAAaqB,cAAc;gBACvC1B,UAAU;YACZ;YACA;gBACEe,MAAM;gBACNC,MAAM;gBACNnB,OAAO;oBACLoB,aAAa,CAAC,EAAEC,CAAC,EAAE,GAAKA,EAAE;oBAC1BC,UAAU;gBACZ;gBACAQ,cAAc;gBACdP,OAAO,CAAC,EAAEF,CAAC,EAAE,GAAKA,EAAE;YACtB;SACD;QACDU,QAAQ;YACNC,QAAQ,CAAC,EAAEX,CAAC,EAAE,GAAK,GAAGA,EAAE,kBAAkB,CAAC,EAAEA,EAAE,uBAAuB;YACtEY,UAAU,CAAC,EAAEZ,CAAC,EAAE,GAAK,GAAGA,EAAE,kBAAkB,CAAC,EAAEA,EAAE,0BAA0B;QAC7E;QACAa,UAAU;IACZ;IAEA,OAAO1B,aAAa2B,wBAAwB,GACxC3B,aAAa2B,wBAAwB,CAAC1B,cACtCA;AACN,EAAC"}

package/dist/components/APIKeyField/index.client.d.ts

@@ -1,9 +0,0 @@
-import React from 'react';
-import './index.css';
-/**
- * Custom component for the MCP API-keys collection's `apiKey` field:
- * - no key yet: a "Generate new key" button
- * - key set: a dismissible privacy warning + the shared masked-key input
- */
-export declare const APIKeyField: React.FC;
-//# sourceMappingURL=index.client.d.ts.map

package/dist/components/APIKeyField/index.client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.client.d.ts","sourceRoot":"","sources":["../../../src/components/APIKeyField/index.client.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAmB,MAAM,OAAO,CAAA;AAIvC,OAAO,aAAa,CAAA;AAIpB;;;;GAIG;AACH,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,EAmD/B,CAAA"}

package/dist/components/APIKeyField/index.client.js

@@ -1,85 +0,0 @@
-'use client';
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { APIKeyInput, Button, useField, useTranslation, WarningTriangleIcon } from '@payloadcms/ui';
-import React, { useState } from 'react';
-import './index.css';
-const baseClass = 'mcp-api-key-field';
-/**
- * Custom component for the MCP API-keys collection's `apiKey` field:
- * - no key yet: a "Generate new key" button
- * - key set: a dismissible privacy warning + the shared masked-key input
- */ export const APIKeyField = ()=>{
-    const { setValue: setApiKey, value: apiKey } = useField({
-        path: 'apiKey'
-    });
-    const { t } = useTranslation();
-    const [isWarningDismissed, setIsWarningDismissed] = useState(false);
-    const generateKey = ()=>{
-        setApiKey(crypto.randomUUID());
-        setIsWarningDismissed(false);
-    };
-    return /*#__PURE__*/ _jsxs("div", {
-        className: baseClass,
-        children: [
-            /*#__PURE__*/ _jsx("p", {
-                className: `${baseClass}__description`,
-                children: t('plugin-mcp:apiKeyDescription')
-            }),
-            /*#__PURE__*/ _jsxs("div", {
-                className: `${baseClass}__panel`,
-                children: [
-                    /*#__PURE__*/ _jsxs("div", {
-                        className: `${baseClass}__header`,
-                        children: [
-                            /*#__PURE__*/ _jsx("span", {
-                                className: `${baseClass}__title`,
-                                children: t('authentication:apiKey')
-                            }),
-                            !apiKey && /*#__PURE__*/ _jsx(Button, {
-                                buttonStyle: "primary",
-                                className: `${baseClass}__generate`,
-                                onClick: generateKey,
-                                children: t('authentication:generateNewAPIKey')
-                            })
-                        ]
-                    }),
-                    Boolean(apiKey) && /*#__PURE__*/ _jsxs("div", {
-                        className: `${baseClass}__body`,
-                        children: [
-                            !isWarningDismissed && /*#__PURE__*/ _jsxs("div", {
-                                className: `${baseClass}__warning`,
-                                children: [
-                                    /*#__PURE__*/ _jsx(WarningTriangleIcon, {
-                                        className: `${baseClass}__warning-icon`
-                                    }),
-                                    /*#__PURE__*/ _jsxs("p", {
-                                        className: `${baseClass}__warning-text`,
-                                        children: [
-                                            /*#__PURE__*/ _jsx("strong", {
-                                                children: t('plugin-mcp:keepKeyPrivate')
-                                            }),
-                                            ` ${t('plugin-mcp:keyPrivateDescription')}`
-                                        ]
-                                    }),
-                                    /*#__PURE__*/ _jsx("button", {
-                                        "aria-label": t('plugin-mcp:dismiss'),
-                                        className: `${baseClass}__warning-dismiss`,
-                                        onClick: ()=>setIsWarningDismissed(true),
-                                        type: "button",
-                                        children: "×"
-                                    })
-                                ]
-                            }),
-                            /*#__PURE__*/ _jsx(APIKeyInput, {
-                                "aria-label": t('authentication:apiKey'),
-                                value: apiKey
-                            })
-                        ]
-                    })
-                ]
-            })
-        ]
-    });
-};
-
-//# sourceMappingURL=index.client.js.map