@payloadcms/plugin-mcp 4.0.0-internal.40de3ec → 4.0.0-internal.4804abd

package/dist/utils/schemaConversion/buildToolInput.d.ts

@@ -1,29 +0,0 @@
-import type { StandardSchemaWithJSON } from '@modelcontextprotocol/server';
-import { z } from 'zod';
-import type { JsonSchemaType } from '../../types.js';
-/**
- * Builds a create/update tool's `input`: a `data` field (the document's fields) plus controls like
- * `depth` and `draft`. Using just `z.fromJSONSchema(ourJSONSchema)` has a few problems which are mitigated
- * in this function. z.fromJSONSchema is both bigger and lossier (≈40% larger on the lexical schema).
- * Each example below is `what we publish` => `what a plain zod round-trip would publish instead`.
- *
- * @example
- * Bigger - zod inlines shared defs instead of keeping our `$ref`s (and adds junk integer bounds), so a
- * reused def is duplicated at every use:
- * `{ $ref: '#/$defs/author' }` => `{ type: 'object', properties: { id, name }, additionalProperties: false }`
- *
- * @example
- * Lossier - zod drops the `description` on `enum`/`const` fields:
- * `{ enum: ['draft', 'published'], description: 'Publish state' }` → `{ enum: ['draft', 'published'] }`
- */
-export declare const buildToolInput: <TControls extends z.ZodRawShape>({ controls, dataDescription, dataSchema, }: {
-    /** Tool options alongside `data` (depth, draft, where, …) as plain zod - inferred into `input`. */
-    controls: TControls;
-    dataDescription: string;
-    dataSchema: JsonSchemaType;
-}) => StandardSchemaWithJSON<{
-    data: Record<string, unknown>;
-} & Omit<z.output<z.ZodObject<{
-    data: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-} & TControls extends infer T ? { -readonly [P in keyof T]: T[P]; } : never, z.core.$strip>>, "data">>;
-//# sourceMappingURL=buildToolInput.d.ts.map

package/dist/utils/schemaConversion/buildToolInput.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"buildToolInput.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/buildToolInput.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,SAAS,CAAC,CAAC,WAAW,EAAE,4CAI7D;IACD,mGAAmG;IACnG,QAAQ,EAAE,SAAS,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,UAAU,EAAE,cAAc,CAAA;CAC3B,KAkCM,sBAAsB,CACzB;IAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM;;4FAAe,EAAE,MAAM,CAAC,CAE5E,CAAA"}

package/dist/utils/schemaConversion/buildToolInput.js

@@ -1,51 +0,0 @@
-import { z } from 'zod';
-/**
- * Builds a create/update tool's `input`: a `data` field (the document's fields) plus controls like
- * `depth` and `draft`. Using just `z.fromJSONSchema(ourJSONSchema)` has a few problems which are mitigated
- * in this function. z.fromJSONSchema is both bigger and lossier (≈40% larger on the lexical schema).
- * Each example below is `what we publish` => `what a plain zod round-trip would publish instead`.
- *
- * @example
- * Bigger - zod inlines shared defs instead of keeping our `$ref`s (and adds junk integer bounds), so a
- * reused def is duplicated at every use:
- * `{ $ref: '#/$defs/author' }` => `{ type: 'object', properties: { id, name }, additionalProperties: false }`
- *
- * @example
- * Lossier - zod drops the `description` on `enum`/`const` fields:
- * `{ enum: ['draft', 'published'], description: 'Publish state' }` → `{ enum: ['draft', 'published'] }`
- */ export const buildToolInput = ({ controls, dataDescription, dataSchema })=>{
-    // `sanitizeEntitySchema` already emits draft 2020-12 with `$defs`, which is what zod's `fromJSONSchema`
-    // and MCP clients both expect. Drop only the root `$schema` keyword, redundant once it's a sub-schema.
-    const { $schema: _schema, ...entitySchema } = dataSchema;
-    const schema = z.object({
-        data: z.fromJSONSchema(entitySchema),
-        ...controls
-    });
-    const standard = schema['~standard'];
-    return {
-        '~standard': {
-            ...standard,
-            jsonSchema: {
-                ...standard.jsonSchema,
-                input: (options)=>{
-                    // Start from zod's JSON Schema for the whole input, then replace its lossy `data` schema with
-                    // the sanitized entity schema. The entity's `$defs` move to the root so the `$ref`s resolve.
-                    const generated = standard.jsonSchema.input(options);
-                    const { $defs, ...entityBody } = entitySchema;
-                    generated.properties.data = {
-                        ...entityBody,
-                        description: dataDescription
-                    };
-                    if ($defs) {
-                        generated.$defs = $defs;
-                    } else {
-                        delete generated.$defs;
-                    }
-                    return generated;
-                }
-            }
-        }
-    };
-};
-
-//# sourceMappingURL=buildToolInput.js.map

package/dist/utils/schemaConversion/buildToolInput.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/buildToolInput.ts"],"sourcesContent":["import type { StandardSchemaWithJSON } from '@modelcontextprotocol/server'\n\nimport { z } from 'zod'\n\nimport type { JsonSchemaType } from '../../types.js'\n\n/**\n * Builds a create/update tool's `input`: a `data` field (the document's fields) plus controls like\n * `depth` and `draft`. Using just `z.fromJSONSchema(ourJSONSchema)` has a few problems which are mitigated\n * in this function. z.fromJSONSchema is both bigger and lossier (≈40% larger on the lexical schema).\n * Each example below is `what we publish` => `what a plain zod round-trip would publish instead`.\n *\n * @example\n * Bigger - zod inlines shared defs instead of keeping our `$ref`s (and adds junk integer bounds), so a\n * reused def is duplicated at every use:\n * `{ $ref: '#/$defs/author' }` => `{ type: 'object', properties: { id, name }, additionalProperties: false }`\n *\n * @example\n * Lossier - zod drops the `description` on `enum`/`const` fields:\n * `{ enum: ['draft', 'published'], description: 'Publish state' }` → `{ enum: ['draft', 'published'] }`\n */\nexport const buildToolInput = <TControls extends z.ZodRawShape>({\n  controls,\n  dataDescription,\n  dataSchema,\n}: {\n  /** Tool options alongside `data` (depth, draft, where, …) as plain zod - inferred into `input`. */\n  controls: TControls\n  dataDescription: string\n  dataSchema: JsonSchemaType\n}) => {\n  // `sanitizeEntitySchema` already emits draft 2020-12 with `$defs`, which is what zod's `fromJSONSchema`\n  // and MCP clients both expect. Drop only the root `$schema` keyword, redundant once it's a sub-schema.\n  const { $schema: _schema, ...entitySchema } = dataSchema as Record<string, unknown>\n\n  const schema = z.object({\n    data: z.fromJSONSchema(entitySchema as unknown as z.core.JSONSchema.JSONSchema),\n    ...controls,\n  })\n  const standard = (schema as unknown as StandardSchemaWithJSON)['~standard']\n\n  return {\n    '~standard': {\n      ...standard,\n      jsonSchema: {\n        ...standard.jsonSchema,\n        input: (options) => {\n          // Start from zod's JSON Schema for the whole input, then replace its lossy `data` schema with\n          // the sanitized entity schema. The entity's `$defs` move to the root so the `$ref`s resolve.\n          const generated = standard.jsonSchema.input(options)\n          const { $defs, ...entityBody } = entitySchema\n          ;(generated.properties as Record<string, unknown>).data = {\n            ...entityBody,\n            description: dataDescription,\n          }\n          if ($defs) {\n            generated.$defs = $defs as object\n          } else {\n            delete generated.$defs\n          }\n          return generated\n        },\n      },\n    },\n  } as StandardSchemaWithJSON<\n    { data: Record<string, unknown> } & Omit<z.output<typeof schema>, 'data'>\n  >\n}\n"],"names":["z","buildToolInput","controls","dataDescription","dataSchema","$schema","_schema","entitySchema","schema","object","data","fromJSONSchema","standard","jsonSchema","input","options","generated","$defs","entityBody","properties","description"],"mappings":"AAEA,SAASA,CAAC,QAAQ,MAAK;AAIvB;;;;;;;;;;;;;;CAcC,GACD,OAAO,MAAMC,iBAAiB,CAAkC,EAC9DC,QAAQ,EACRC,eAAe,EACfC,UAAU,EAMX;IACC,wGAAwG;IACxG,uGAAuG;IACvG,MAAM,EAAEC,SAASC,OAAO,EAAE,GAAGC,cAAc,GAAGH;IAE9C,MAAMI,SAASR,EAAES,MAAM,CAAC;QACtBC,MAAMV,EAAEW,cAAc,CAACJ;QACvB,GAAGL,QAAQ;IACb;IACA,MAAMU,WAAW,AAACJ,MAA4C,CAAC,YAAY;IAE3E,OAAO;QACL,aAAa;YACX,GAAGI,QAAQ;YACXC,YAAY;gBACV,GAAGD,SAASC,UAAU;gBACtBC,OAAO,CAACC;oBACN,8FAA8F;oBAC9F,6FAA6F;oBAC7F,MAAMC,YAAYJ,SAASC,UAAU,CAACC,KAAK,CAACC;oBAC5C,MAAM,EAAEE,KAAK,EAAE,GAAGC,YAAY,GAAGX;oBAC/BS,UAAUG,UAAU,CAA6BT,IAAI,GAAG;wBACxD,GAAGQ,UAAU;wBACbE,aAAajB;oBACf;oBACA,IAAIc,OAAO;wBACTD,UAAUC,KAAK,GAAGA;oBACpB,OAAO;wBACL,OAAOD,UAAUC,KAAK;oBACxB;oBACA,OAAOD;gBACT;YACF;QACF;IACF;AAGF,EAAC"}

package/dist/utils/schemaConversion/removeVirtualFieldsFromSchema.d.ts

@@ -1,7 +0,0 @@
-import type { JsonSchemaType } from '../../types.js';
-/**
- * Removes virtual fields from a JSON Schema by name so they don't appear
- * in the generated MCP tool input schema.
- */
-export declare function removeVirtualFieldsFromSchema(schema: JsonSchemaType, virtualFieldNames: string[]): JsonSchemaType;
-//# sourceMappingURL=removeVirtualFieldsFromSchema.d.ts.map

package/dist/utils/schemaConversion/removeVirtualFieldsFromSchema.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"removeVirtualFieldsFromSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/removeVirtualFieldsFromSchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,cAAc,EACtB,iBAAiB,EAAE,MAAM,EAAE,GAC1B,cAAc,CAiBhB"}

package/dist/utils/schemaConversion/removeVirtualFieldsFromSchema.js

@@ -1,20 +0,0 @@
-/**
- * Removes virtual fields from a JSON Schema by name so they don't appear
- * in the generated MCP tool input schema.
- */ export function removeVirtualFieldsFromSchema(schema, virtualFieldNames) {
-    if (virtualFieldNames.length === 0) {
-        return schema;
-    }
-    for (const name of virtualFieldNames){
-        delete schema?.properties?.[name];
-    }
-    if (Array.isArray(schema.required)) {
-        schema.required = schema.required.filter((field)=>!virtualFieldNames.includes(field));
-        if (schema.required.length === 0) {
-            delete schema.required;
-        }
-    }
-    return schema;
-}
-
-//# sourceMappingURL=removeVirtualFieldsFromSchema.js.map

package/dist/utils/schemaConversion/removeVirtualFieldsFromSchema.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/removeVirtualFieldsFromSchema.ts"],"sourcesContent":["import type { JsonSchemaType } from '../../types.js'\n\n/**\n * Removes virtual fields from a JSON Schema by name so they don't appear\n * in the generated MCP tool input schema.\n */\nexport function removeVirtualFieldsFromSchema(\n  schema: JsonSchemaType,\n  virtualFieldNames: string[],\n): JsonSchemaType {\n  if (virtualFieldNames.length === 0) {\n    return schema\n  }\n\n  for (const name of virtualFieldNames) {\n    delete schema?.properties?.[name]\n  }\n\n  if (Array.isArray(schema.required)) {\n    schema.required = schema.required.filter((field) => !virtualFieldNames.includes(field))\n    if (schema.required.length === 0) {\n      delete schema.required\n    }\n  }\n\n  return schema\n}\n"],"names":["removeVirtualFieldsFromSchema","schema","virtualFieldNames","length","name","properties","Array","isArray","required","filter","field","includes"],"mappings":"AAEA;;;CAGC,GACD,OAAO,SAASA,8BACdC,MAAsB,EACtBC,iBAA2B;IAE3B,IAAIA,kBAAkBC,MAAM,KAAK,GAAG;QAClC,OAAOF;IACT;IAEA,KAAK,MAAMG,QAAQF,kBAAmB;QACpC,OAAOD,QAAQI,YAAY,CAACD,KAAK;IACnC;IAEA,IAAIE,MAAMC,OAAO,CAACN,OAAOO,QAAQ,GAAG;QAClCP,OAAOO,QAAQ,GAAGP,OAAOO,QAAQ,CAACC,MAAM,CAAC,CAACC,QAAU,CAACR,kBAAkBS,QAAQ,CAACD;QAChF,IAAIT,OAAOO,QAAQ,CAACL,MAAM,KAAK,GAAG;YAChC,OAAOF,OAAOO,QAAQ;QACxB;IACF;IAEA,OAAOP;AACT"}

package/src/collection/getAccessField.ts

@@ -1,64 +0,0 @@
-import type { JSONField } from 'payload'
-
-import type { ClientMCPPluginConfig, MCPItem, SanitizedMCPPluginConfig } from '../types.js'
-
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */
-export const getAccessField = ({
-  pluginConfig,
-}: {
-  pluginConfig: SanitizedMCPPluginConfig
-}): JSONField => {
-  const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig)
-
-  return {
-    name: 'access',
-    type: 'json',
-    admin: {
-      components: {
-        Field: {
-          clientProps: { pluginConfig: clientPluginConfig },
-          path: '@payloadcms/plugin-mcp/client#AccessField',
-        },
-      },
-      // TODO: needs i18n once design is finalized
-      description: 'Access for this API key — uncheck to revoke individual tools.',
-      position: 'sidebar',
-    },
-    defaultValue: {},
-    // TODO: needs i18n once design is finalized
-    label: 'Access',
-  }
-}
-
-/**
- * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,
- * input/argsSchema functions, etc.) so the result is safe to thread to a
- * client component via `clientProps`.
- */
-const sanitizeClientPluginConfig = (
-  pluginConfig: SanitizedMCPPluginConfig,
-): ClientMCPPluginConfig => ({
-  items: pluginConfig.items.map((item) => ({
-    ...(item.type === 'collectionTool' ? { collectionSlug: item.collectionSlug } : {}),
-    ...(item.type === 'globalTool' ? { globalSlug: item.globalSlug } : {}),
-    type: item.type,
-    description: itemDescription(item),
-    key: item.key,
-    label: item.label,
-  })),
-})
-
-const itemDescription = (item: MCPItem): string => {
-  if (item.type === 'prompt') {
-    return item.prompt.description
-  }
-  if (item.type === 'resource') {
-    return item.resource.description
-  }
-  return item.tool.description
-}

package/src/collection/index.ts

@@ -1,64 +0,0 @@
-import type { CollectionConfig } from 'payload'
-
-import type { SanitizedMCPPluginConfig } from '../types.js'
-
-import { getAccessField } from './getAccessField.js'
-
-export const getAPIKeysCollection = ({
-  pluginConfig,
-}: {
-  pluginConfig: SanitizedMCPPluginConfig
-}): CollectionConfig => {
-  const collection: CollectionConfig = {
-    slug: 'payload-mcp-api-keys',
-    admin: {
-      description:
-        'API keys control which collections, resources, tools, and prompts MCP clients can access',
-      group: 'MCP',
-      useAsTitle: 'label',
-    },
-    auth: {
-      disableLocalStrategy: true,
-      useAPIKey: true,
-    },
-    fields: [
-      {
-        name: 'user',
-        type: 'relationship',
-        admin: { description: 'The user that the API key is associated with.' },
-        relationTo: pluginConfig.userCollection,
-        required: true,
-      },
-      {
-        name: 'label',
-        type: 'text',
-        admin: { description: 'A useful label for the API key.' },
-      },
-      {
-        name: 'description',
-        type: 'text',
-        admin: { description: 'The purpose of the API key.' },
-      },
-      {
-        name: 'overrideAccess',
-        type: 'checkbox',
-        admin: {
-          description:
-            'When checked, this key bypasses Payload access control on every operation it performs. Leave unchecked unless you have a specific reason.',
-        },
-        defaultValue: false,
-        label: 'Override access control',
-      },
-      getAccessField({ pluginConfig }),
-    ],
-    labels: {
-      plural: 'API Keys',
-      singular: 'API Key',
-    },
-    versions: false,
-  }
-
-  return pluginConfig.overrideApiKeyCollection
-    ? pluginConfig.overrideApiKeyCollection(collection)
-    : collection
-}

package/src/components/AccessField/index.client.tsx

@@ -1,344 +0,0 @@
-'use client'
-
-import type { JSONFieldClientProps } from 'payload'
-
-import { CheckboxInput, Collapsible, useField } from '@payloadcms/ui'
-import React from 'react'
-
-import type { ClientMCPPluginConfig, MCPAPIKeysDocAccessTree } from '../../types.js'
-
-import './index.css'
-
-const baseClass = 'mcp-access-field'
-
-type ClientItem = ClientMCPPluginConfig['items'][number]
-type ScopeKey = 'collections' | 'globals'
-type FlatKey = 'prompts' | 'resources' | 'tools'
-
-type Props = {
-  pluginConfig: ClientMCPPluginConfig
-} & JSONFieldClientProps
-
-/** Drop a key from an object and return a new object — or `undefined` if it'd be empty. */
-const without = <T extends Record<string, unknown>>(
-  obj: T | undefined,
-  key: string,
-): T | undefined => {
-  if (!obj || !(key in obj)) {
-    return obj
-  }
-  const { [key]: _omitted, ...rest } = obj
-  return Object.keys(rest).length === 0 ? undefined : (rest as T)
-}
-
-const setKey = <T extends Record<string, unknown>>(
-  obj: T | undefined,
-  key: string,
-  value: unknown,
-): T => ({ ...(obj ?? {}), [key]: value }) as T
-
-export const AccessField: React.FC<Props> = ({ path, pluginConfig }) => {
-  const { setValue, value } = useField<MCPAPIKeysDocAccessTree>({ path })
-  const access = value ?? {}
-
-  // Bucket items for rendering. (Bucketing is cheap and runs once per render;
-  // memoizing would mean managing inputs/refs for marginal benefit.)
-  const collectionsBySlug: Record<string, ClientItem[]> = {}
-  const globalsBySlug: Record<string, ClientItem[]> = {}
-  const tools: ClientItem[] = []
-  const prompts: ClientItem[] = []
-  const resources: ClientItem[] = []
-  for (const item of pluginConfig.items) {
-    switch (item.type) {
-      case 'collectionTool':
-        ;(collectionsBySlug[item.collectionSlug!] ??= []).push(item)
-        break
-      case 'globalTool':
-        ;(globalsBySlug[item.globalSlug!] ??= []).push(item)
-        break
-      case 'prompt':
-        prompts.push(item)
-        break
-      case 'resource':
-        resources.push(item)
-        break
-      case 'tool':
-        tools.push(item)
-        break
-    }
-  }
-
-  const isScopedAllowed = (scope: ScopeKey, slug: string, key: string): boolean =>
-    access[scope]?.[slug]?.[key] !== false
-
-  const isFlatAllowed = (scope: FlatKey, key: string): boolean => access[scope]?.[key] !== false
-
-  const toggleScoped = (scope: ScopeKey, slug: string, key: string, allow: boolean) => {
-    if (allow) {
-      const slugBucket = without(access[scope]?.[slug], key)
-      const scopeBucket = slugBucket
-        ? setKey(access[scope], slug, slugBucket)
-        : without(access[scope], slug)
-      setValue(scopeBucket ? setKey(access, scope, scopeBucket) : (without(access, scope) ?? {}))
-    } else {
-      setValue(
-        setKey(
-          access,
-          scope,
-          setKey(access[scope], slug, setKey(access[scope]?.[slug], key, false)),
-        ),
-      )
-    }
-  }
-
-  const toggleFlat = (scope: FlatKey, key: string, allow: boolean) => {
-    if (allow) {
-      const bucket = without(access[scope], key)
-      setValue(bucket ? setKey(access, scope, bucket) : (without(access, scope) ?? {}))
-    } else {
-      setValue(setKey(access, scope, setKey(access[scope], key, false)))
-    }
-  }
-
-  const setAllScoped = (scope: ScopeKey, slug: string, leaves: ClientItem[], allow: boolean) => {
-    if (allow) {
-      const scopeBucket = without(access[scope], slug)
-      setValue(scopeBucket ? setKey(access, scope, scopeBucket) : (without(access, scope) ?? {}))
-    } else {
-      const slugBucket = leaves.reduce<Record<string, boolean>>(
-        (acc, leaf) => ({ ...acc, [leaf.key]: false }),
-        {},
-      )
-      setValue(setKey(access, scope, setKey(access[scope], slug, slugBucket)))
-    }
-  }
-
-  const setAllFlat = (scope: FlatKey, leaves: ClientItem[], allow: boolean) => {
-    if (allow) {
-      setValue(without(access, scope) ?? {})
-    } else {
-      const bucket = leaves.reduce<Record<string, boolean>>(
-        (acc, leaf) => ({ ...acc, [leaf.key]: false }),
-        {},
-      )
-      setValue(setKey(access, scope, bucket))
-    }
-  }
-
-  const collectionSlugs = Object.keys(collectionsBySlug)
-  const globalSlugs = Object.keys(globalsBySlug)
-
-  return (
-    <div className={baseClass}>
-      {collectionSlugs.length > 0 && (
-        <section className={`${baseClass}__section`}>
-          <header className={`${baseClass}__section-header`}>
-            {/* TODO: needs i18n once design is finalized */}
-            <h4>Collection-level permissions</h4>
-            {/* TODO: needs i18n once design is finalized */}
-            <p>Allow MCP clients to perform the following actions within these collections:</p>
-          </header>
-          {collectionSlugs.map((slug) => {
-            const leaves = collectionsBySlug[slug]!
-            return (
-              <Collapsible
-                actions={
-                  <GroupActions
-                    onSetAll={(allow) => setAllScoped('collections', slug, leaves, allow)}
-                  />
-                }
-                className={`${baseClass}__group`}
-                header={<span className={`${baseClass}__group-label`}>{titleCase(slug)}</span>}
-                initCollapsed
-                key={`collection-${slug}`}
-              >
-                <ul className={`${baseClass}__list`}>
-                  {leaves.map((leaf) => (
-                    <li key={leaf.key}>
-                      <CheckboxInput
-                        checked={isScopedAllowed('collections', slug, leaf.key)}
-                        id={`${path}.collections.${slug}.${leaf.key}`}
-                        label={leaf.label}
-                        onToggle={(e) =>
-                          toggleScoped('collections', slug, leaf.key, e.target.checked)
-                        }
-                        tooltip={leaf.description}
-                      />
-                    </li>
-                  ))}
-                </ul>
-              </Collapsible>
-            )
-          })}
-        </section>
-      )}
-
-      {globalSlugs.length > 0 && (
-        <section className={`${baseClass}__section`}>
-          <header className={`${baseClass}__section-header`}>
-            {/* TODO: needs i18n once design is finalized */}
-            <h4>Global-level permissions</h4>
-            {/* TODO: needs i18n once design is finalized */}
-            <p>Allow MCP clients to perform the following actions on these globals:</p>
-          </header>
-          {globalSlugs.map((slug) => {
-            const leaves = globalsBySlug[slug]!
-            return (
-              <Collapsible
-                actions={
-                  <GroupActions
-                    onSetAll={(allow) => setAllScoped('globals', slug, leaves, allow)}
-                  />
-                }
-                className={`${baseClass}__group`}
-                header={<span className={`${baseClass}__group-label`}>{titleCase(slug)}</span>}
-                initCollapsed
-                key={`global-${slug}`}
-              >
-                <ul className={`${baseClass}__list`}>
-                  {leaves.map((leaf) => (
-                    <li key={leaf.key}>
-                      <CheckboxInput
-                        checked={isScopedAllowed('globals', slug, leaf.key)}
-                        id={`${path}.globals.${slug}.${leaf.key}`}
-                        label={leaf.label}
-                        onToggle={(e) => toggleScoped('globals', slug, leaf.key, e.target.checked)}
-                        tooltip={leaf.description}
-                      />
-                    </li>
-                  ))}
-                </ul>
-              </Collapsible>
-            )
-          })}
-        </section>
-      )}
-
-      {(tools.length > 0 || prompts.length > 0 || resources.length > 0) && (
-        <section className={`${baseClass}__section`}>
-          <header className={`${baseClass}__section-header`}>
-            {/* TODO: needs i18n once design is finalized */}
-            <h4>Project-level permissions</h4>
-            {/* TODO: needs i18n once design is finalized */}
-            <p>Cross-cutting tools, prompts, and resources not scoped to a single collection.</p>
-          </header>
-          {tools.length > 0 && (
-            <Collapsible
-              actions={<GroupActions onSetAll={(allow) => setAllFlat('tools', tools, allow)} />}
-              className={`${baseClass}__group`}
-              header={
-                /* TODO: needs i18n once design is finalized */
-                <span className={`${baseClass}__group-label`}>Tools</span>
-              }
-              initCollapsed
-            >
-              <ul className={`${baseClass}__list`}>
-                {tools.map((leaf) => (
-                  <li key={leaf.key}>
-                    <CheckboxInput
-                      checked={isFlatAllowed('tools', leaf.key)}
-                      id={`${path}.tools.${leaf.key}`}
-                      label={leaf.label}
-                      onToggle={(e) => toggleFlat('tools', leaf.key, e.target.checked)}
-                      tooltip={leaf.description}
-                    />
-                  </li>
-                ))}
-              </ul>
-            </Collapsible>
-          )}
-          {prompts.length > 0 && (
-            <Collapsible
-              actions={<GroupActions onSetAll={(allow) => setAllFlat('prompts', prompts, allow)} />}
-              className={`${baseClass}__group`}
-              header={
-                /* TODO: needs i18n once design is finalized */
-                <span className={`${baseClass}__group-label`}>Prompts</span>
-              }
-              initCollapsed
-            >
-              <ul className={`${baseClass}__list`}>
-                {prompts.map((leaf) => (
-                  <li key={leaf.key}>
-                    <CheckboxInput
-                      checked={isFlatAllowed('prompts', leaf.key)}
-                      id={`${path}.prompts.${leaf.key}`}
-                      label={leaf.label}
-                      onToggle={(e) => toggleFlat('prompts', leaf.key, e.target.checked)}
-                      tooltip={leaf.description}
-                    />
-                  </li>
-                ))}
-              </ul>
-            </Collapsible>
-          )}
-          {resources.length > 0 && (
-            <Collapsible
-              actions={
-                <GroupActions onSetAll={(allow) => setAllFlat('resources', resources, allow)} />
-              }
-              className={`${baseClass}__group`}
-              header={
-                /* TODO: needs i18n once design is finalized */
-                <span className={`${baseClass}__group-label`}>Resources</span>
-              }
-              initCollapsed
-            >
-              <ul className={`${baseClass}__list`}>
-                {resources.map((leaf) => (
-                  <li key={leaf.key}>
-                    <CheckboxInput
-                      checked={isFlatAllowed('resources', leaf.key)}
-                      id={`${path}.resources.${leaf.key}`}
-                      label={leaf.label}
-                      onToggle={(e) => toggleFlat('resources', leaf.key, e.target.checked)}
-                      tooltip={leaf.description}
-                    />
-                  </li>
-                ))}
-              </ul>
-            </Collapsible>
-          )}
-        </section>
-      )}
-    </div>
-  )
-}
-
-const GroupActions: React.FC<{ onSetAll: (allow: boolean) => void }> = ({ onSetAll }) => (
-  // TODO: button labels + aria-labels need i18n once design is finalized
-  <div className={`${baseClass}__group-actions`}>
-    <button
-      aria-label="Select all"
-      className={`${baseClass}__action`}
-      onClick={(e) => {
-        e.stopPropagation()
-        onSetAll(true)
-      }}
-      title="Select all"
-      type="button"
-    >
-      all
-    </button>
-    <span aria-hidden className={`${baseClass}__action-sep`}>
-      /
-    </span>
-    <button
-      aria-label="Clear all"
-      className={`${baseClass}__action`}
-      onClick={(e) => {
-        e.stopPropagation()
-        onSetAll(false)
-      }}
-      title="Clear all"
-      type="button"
-    >
-      none
-    </button>
-  </div>
-)
-
-const titleCase = (slug: string): string =>
-  slug.replace(/(^|[-_])(.)/g, (_, sep: string, ch: string) =>
-    sep ? ` ${ch.toUpperCase()}` : ch.toUpperCase(),
-  )