@payloadcms/plugin-mcp 4.0.0-internal.532221d → 4.0.0-internal.567a487

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js

@@ -0,0 +1,133 @@
+import { describe, expect, it } from 'vitest';
+import { sanitizeEntitySchema } from './sanitizeEntitySchema.js';
+describe('sanitizeEntitySchema', ()=>{
+    it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', ()=>{
+        // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field
+        // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant
+        // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to
+        // reduce here (the variant did that upstream), so sanitize leaves the value untouched.
+        const standalone = {
+            type: 'object',
+            $defs: {
+                LexicalNodes_ABCDEF12: {
+                    oneOf: [
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'paragraph'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        },
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'relationship'
+                                },
+                                value: {
+                                    type: 'string',
+                                    description: 'The related document ID.'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        }
+                    ]
+                }
+            },
+            properties: {
+                id: {
+                    type: 'string'
+                },
+                content: {
+                    type: 'object',
+                    properties: {
+                        root: {
+                            type: 'object',
+                            properties: {
+                                children: {
+                                    type: 'array',
+                                    items: {
+                                        $ref: '#/$defs/LexicalNodes_ABCDEF12'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        };
+        expect(sanitizeEntitySchema(standalone)).toStrictEqual({
+            type: 'object',
+            $defs: {
+                // The node union is renamed to a short, readable `node`, and stays a strict discriminated
+                // `oneOf` - not loosened to `anyOf`.
+                node: {
+                    oneOf: [
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'paragraph'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        },
+                        {
+                            type: 'object',
+                            additionalProperties: false,
+                            properties: {
+                                type: {
+                                    const: 'relationship'
+                                },
+                                // The value is already ID-only from the input variant - left as-is.
+                                value: {
+                                    type: 'string',
+                                    description: 'The related document ID.'
+                                }
+                            },
+                            required: [
+                                'type'
+                            ]
+                        }
+                    ]
+                }
+            },
+            properties: {
+                // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's
+                // a valid optional input (a client may supply a custom ID).
+                id: {
+                    type: 'string'
+                },
+                content: {
+                    type: 'object',
+                    properties: {
+                        root: {
+                            type: 'object',
+                            properties: {
+                                children: {
+                                    type: 'array',
+                                    items: {
+                                        $ref: '#/$defs/node'
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        });
+    });
+});
+
+//# sourceMappingURL=sanitizeEntitySchema.spec.js.map

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n  it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {\n    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field\n    // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant\n    // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to\n    // reduce here (the variant did that upstream), so sanitize leaves the value untouched.\n    const standalone: JsonSchemaType = {\n      type: 'object',\n      $defs: {\n        LexicalNodes_ABCDEF12: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n              },\n            },\n          },\n        },\n      },\n    }\n\n    expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n      type: 'object',\n      $defs: {\n        // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n        // `oneOf` - not loosened to `anyOf`.\n        node: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                // The value is already ID-only from the input variant - left as-is.\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's\n        // a valid optional input (a client may supply a custom ID).\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/node' } },\n              },\n            },\n          },\n        },\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","description","id","content","root","children","items","$ref","toStrictEqual","node"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,yFAAyF;QAC1F,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,uFAAuF;QACvF,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACVK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAnB,OAAOE,qBAAqBC,aAAaiB,aAAa,CAAC;YACrDhB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,qCAAqC;gBACrCgB,MAAM;oBACJd,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,oEAAoE;gCACpEE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACV,2FAA2F;gBAC3F,4DAA4D;gBAC5DK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}

package/dist/utils/transformPointDataToPayload.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Transforms incoming MCP tool data from object format to tuple array format.
+ * Converts { longitude: number, latitude: number } back to [longitude, latitude]
+ * for Payload's internal point field representation.
+ */
+export declare function transformPointDataToPayload(data: Record<string, unknown>): Record<string, unknown>;
+//# sourceMappingURL=transformPointDataToPayload.d.ts.map

package/dist/utils/transformPointDataToPayload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transformPointDataToPayload.d.ts","sourceRoot":"","sources":["../../src/utils/transformPointDataToPayload.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB"}

package/dist/utils/transformPointDataToPayload.js

@@ -0,0 +1,28 @@
+/**
+ * Transforms incoming MCP tool data from object format to tuple array format.
+ * Converts { longitude: number, latitude: number } back to [longitude, latitude]
+ * for Payload's internal point field representation.
+ */ export function transformPointDataToPayload(data) {
+    if (!data || typeof data !== 'object') {
+        return data;
+    }
+    const transformed = {};
+    for (const [key, value] of Object.entries(data)){
+        if (value && typeof value === 'object' && 'longitude' in value && 'latitude' in value && typeof value.longitude === 'number' && typeof value.latitude === 'number') {
+            // Transform to tuple array [longitude, latitude]
+            transformed[key] = [
+                value.longitude,
+                value.latitude
+            ];
+        } else if (Array.isArray(value)) {
+            transformed[key] = value.map((item)=>typeof item === 'object' ? transformPointDataToPayload(item) : item);
+        } else if (value && typeof value === 'object') {
+            transformed[key] = transformPointDataToPayload(value);
+        } else {
+            transformed[key] = value;
+        }
+    }
+    return transformed;
+}
+
+//# sourceMappingURL=transformPointDataToPayload.js.map

package/dist/utils/transformPointDataToPayload.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/utils/transformPointDataToPayload.ts"],"sourcesContent":["/**\n * Transforms incoming MCP tool data from object format to tuple array format.\n * Converts { longitude: number, latitude: number } back to [longitude, latitude]\n * for Payload's internal point field representation.\n */\nexport function transformPointDataToPayload(\n  data: Record<string, unknown>,\n): Record<string, unknown> {\n  if (!data || typeof data !== 'object') {\n    return data\n  }\n\n  const transformed: Record<string, unknown> = {}\n\n  for (const [key, value] of Object.entries(data)) {\n    if (\n      value &&\n      typeof value === 'object' &&\n      'longitude' in value &&\n      'latitude' in value &&\n      typeof value.longitude === 'number' &&\n      typeof value.latitude === 'number'\n    ) {\n      // Transform to tuple array [longitude, latitude]\n      transformed[key] = [value.longitude, value.latitude]\n    } else if (Array.isArray(value)) {\n      transformed[key] = value.map((item) =>\n        typeof item === 'object'\n          ? transformPointDataToPayload(item as Record<string, unknown>)\n          : item,\n      )\n    } else if (value && typeof value === 'object') {\n      transformed[key] = transformPointDataToPayload(value as Record<string, unknown>)\n    } else {\n      transformed[key] = value\n    }\n  }\n\n  return transformed\n}\n"],"names":["transformPointDataToPayload","data","transformed","key","value","Object","entries","longitude","latitude","Array","isArray","map","item"],"mappings":"AAAA;;;;CAIC,GACD,OAAO,SAASA,4BACdC,IAA6B;IAE7B,IAAI,CAACA,QAAQ,OAAOA,SAAS,UAAU;QACrC,OAAOA;IACT;IAEA,MAAMC,cAAuC,CAAC;IAE9C,KAAK,MAAM,CAACC,KAAKC,MAAM,IAAIC,OAAOC,OAAO,CAACL,MAAO;QAC/C,IACEG,SACA,OAAOA,UAAU,YACjB,eAAeA,SACf,cAAcA,SACd,OAAOA,MAAMG,SAAS,KAAK,YAC3B,OAAOH,MAAMI,QAAQ,KAAK,UAC1B;YACA,iDAAiD;YACjDN,WAAW,CAACC,IAAI,GAAG;gBAACC,MAAMG,SAAS;gBAAEH,MAAMI,QAAQ;aAAC;QACtD,OAAO,IAAIC,MAAMC,OAAO,CAACN,QAAQ;YAC/BF,WAAW,CAACC,IAAI,GAAGC,MAAMO,GAAG,CAAC,CAACC,OAC5B,OAAOA,SAAS,WACZZ,4BAA4BY,QAC5BA;QAER,OAAO,IAAIR,SAAS,OAAOA,UAAU,UAAU;YAC7CF,WAAW,CAACC,IAAI,GAAGH,4BAA4BI;QACjD,OAAO;YACLF,WAAW,CAACC,IAAI,GAAGC;QACrB;IACF;IAEA,OAAOF;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.532221d",
+  "version": "4.0.0-internal.567a487",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -61,10 +61,10 @@
   },
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-internal.532221d"
+    "payload": "4.0.0-internal.567a487"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.532221d"
+    "payload": "4.0.0-internal.567a487"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/mcp/builtin/collections/createTool.ts

@@ -1,15 +1,15 @@
 import type { SelectType } from 'payload'
 
-import {
-  getCollectionVirtualFieldNames,
-  stripVirtualFields,
-  transformPointDataToPayload,
-} from 'payload'
 import { z } from 'zod'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
+import {
+  getCollectionVirtualFieldNames,
+  stripVirtualFields,
+} from '../../../utils/getVirtualFieldNames.js'
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateCollectionData } from '../validateEntityData.js'
 import { fileInputSchema, resolveFile } from './fileInput.js'
 import { formatCollectionError } from './formatCollectionError.js'

package/src/mcp/builtin/collections/duplicateTool.ts

@@ -1,15 +1,15 @@
 import type { PopulateType, SelectType } from 'payload'
 
-import {
-  getCollectionVirtualFieldNames,
-  stripVirtualFields,
-  transformPointDataToPayload,
-} from 'payload'
 import { z } from 'zod'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
+import {
+  getCollectionVirtualFieldNames,
+  stripVirtualFields,
+} from '../../../utils/getVirtualFieldNames.js'
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { formatCollectionError } from './formatCollectionError.js'
 
 const DEFAULT_DESCRIPTION =

package/src/mcp/builtin/collections/formatCollectionError.ts

@@ -1,9 +1,9 @@
 import type { CollectionSlug, PayloadRequest } from 'payload'
 
-import { getCollectionInputSchema } from 'payload'
-
 import type { MCPToolResponse } from '../../../types.js'
 
+import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
+
 const getValidationErrors = (error: unknown): undefined | unknown[] => {
   if (!error || typeof error !== 'object') {
     return undefined

package/src/mcp/builtin/collections/getCollectionSchemaTool.ts

@@ -1,7 +1,8 @@
-import { getAccessResults, getCollectionInputSchema } from 'payload'
+import { getAccessResults } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
+import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 
 export const getCollectionSchemaTool = defineCollectionTool({
   access: (args) => {

package/src/mcp/builtin/collections/updateTool.ts

@@ -1,16 +1,16 @@
 import type { SelectType, Where } from 'payload'
 
-import {
-  getCollectionInputSchema,
-  getCollectionVirtualFieldNames,
-  stripVirtualFields,
-  transformPointDataToPayload,
-} from 'payload'
 import { z } from 'zod'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
+import {
+  getCollectionVirtualFieldNames,
+  stripVirtualFields,
+} from '../../../utils/getVirtualFieldNames.js'
+import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 import { validateCollectionData } from '../validateEntityData.js'
 import { fileInputSchema, resolveFile } from './fileInput.js'

package/src/mcp/builtin/globals/getGlobalSchemaTool.ts

@@ -1,7 +1,8 @@
-import { getAccessResults, getGlobalInputSchema } from 'payload'
+import { getAccessResults } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
+import { getGlobalInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 
 export const getGlobalSchemaTool = defineGlobalTool({
   access: (args) => {

package/src/mcp/builtin/globals/updateTool.ts

@@ -1,15 +1,15 @@
 import type { SelectType } from 'payload'
 
-import {
-  getGlobalVirtualFieldNames,
-  stripVirtualFields,
-  transformPointDataToPayload,
-} from 'payload'
 import { z } from 'zod'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
+import {
+  getGlobalVirtualFieldNames,
+  stripVirtualFields,
+} from '../../../utils/getVirtualFieldNames.js'
+import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateGlobalData } from '../validateEntityData.js'
 
 const DEFAULT_DESCRIPTION = 'Update any Payload global by passing the global slug and data.'

package/src/mcp/builtin/validateEntityData.ts

@@ -1,10 +1,14 @@
 import type { CollectionSlug, GlobalSlug, PayloadRequest, SanitizedConfig } from 'payload'
 
 import { CfWorkerJsonSchemaValidator } from '@modelcontextprotocol/server/validators/cf-worker'
-import { getCollectionInputSchema, getGlobalInputSchema } from 'payload'
 
 import type { JsonSchemaType, MCPToolResponse } from '../../types.js'
 
+import {
+  getCollectionInputSchema,
+  getGlobalInputSchema,
+} from '../../utils/schemaConversion/getEntityInputSchema.js'
+
 /**
  * Keep the default `shortcircuit: true` - `false` makes validating nested rich text exponentially slow.
  */
@@ -34,7 +38,7 @@ export const validateCollectionData = ({
 }): MCPToolResponse | null =>
   validateData({
     slug: collectionSlug,
-    buildSchema: () => getCollectionInputSchema({ collectionSlug, req }) as JsonSchemaType | null,
+    buildSchema: () => getCollectionInputSchema({ collectionSlug, req }),
     data,
     entity: 'collection',
     partial,
@@ -52,7 +56,7 @@ export const validateGlobalData = ({
 }): MCPToolResponse | null =>
   validateData({
     slug: globalSlug,
-    buildSchema: () => getGlobalInputSchema({ globalSlug, req }) as JsonSchemaType | null,
+    buildSchema: () => getGlobalInputSchema({ globalSlug, req }),
     data,
     entity: 'global',
     partial: true,

package/src/utils/getVirtualFieldNames.ts

@@ -0,0 +1,53 @@
+import type { SanitizedConfig } from 'payload'
+
+import { fieldIsVirtual } from 'payload/shared'
+
+/**
+ * Returns the names of all top-level virtual fields for a given collection slug.
+ */
+export function getCollectionVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {
+  const collection = config.collections.find((c) => c.slug === slug)
+
+  if (!collection) {
+    return []
+  }
+
+  return collection.flattenedFields
+    .filter((field) => 'name' in field && fieldIsVirtual(field))
+    .map((field) => (field as { name: string }).name)
+}
+
+/**
+ * Returns the names of all top-level virtual fields for a given global slug.
+ */
+export function getGlobalVirtualFieldNames(config: SanitizedConfig, slug: string): string[] {
+  const global = config.globals.find((g) => g.slug === slug)
+
+  if (!global) {
+    return []
+  }
+
+  return global.flattenedFields
+    .filter((field) => 'name' in field && fieldIsVirtual(field))
+    .map((field) => (field as { name: string }).name)
+}
+
+/**
+ * Strips virtual field values from a data object given a list of virtual field names.
+ */
+export function stripVirtualFields(
+  data: Record<string, unknown>,
+  virtualFieldNames: string[],
+): Record<string, unknown> {
+  if (virtualFieldNames.length === 0) {
+    return data
+  }
+
+  const stripped = { ...data }
+
+  for (const name of virtualFieldNames) {
+    delete stripped[name]
+  }
+
+  return stripped
+}

package/src/utils/schemaConversion/filterFieldsByAccess.ts

@@ -0,0 +1,123 @@
+import type {
+  FlattenedBlock,
+  FlattenedField,
+  Operation,
+  SanitizedDocumentPermissions,
+  SanitizedFieldsPermissions,
+} from 'payload'
+
+type FieldOperation = Exclude<Operation, 'delete'>
+type AllowedFieldOperations = Record<FieldOperation, boolean>
+
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */
+export const filterFieldsByAccess = ({
+  blocks,
+  fields,
+  permissions,
+  shouldExcludeField,
+}: {
+  blocks?: FlattenedBlock[]
+  fields: FlattenedField[]
+  permissions: SanitizedDocumentPermissions
+  shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean
+}): FlattenedField[] => {
+  const filterFields = (
+    nestedFields: FlattenedField[],
+    nestedPermissions: SanitizedFieldsPermissions | undefined,
+    parentAllowedOperations: AllowedFieldOperations,
+  ): FlattenedField[] => {
+    const accessibleFields: FlattenedField[] = []
+
+    for (const field of nestedFields) {
+      const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name]
+      const isOperationAllowed = (operation: FieldOperation): boolean =>
+        parentAllowedOperations[operation] &&
+        (fieldPermissions === true || fieldPermissions?.[operation] === true)
+      const allowedOperations: AllowedFieldOperations = {
+        create: isOperationAllowed('create'),
+        read: isOperationAllowed('read'),
+        update: isOperationAllowed('update'),
+      }
+
+      if (shouldExcludeField(allowedOperations)) {
+        continue
+      }
+
+      if (field.type === 'blocks') {
+        const accessibleBlocks: (FlattenedBlock | string)[] = []
+
+        for (const blockOrReference of field.blocks) {
+          const block =
+            typeof blockOrReference === 'string'
+              ? blocks?.find(({ slug }) => slug === blockOrReference)
+              : blockOrReference
+
+          if (!block) {
+            continue
+          }
+
+          const blockPermissions =
+            fieldPermissions === true
+              ? true
+              : fieldPermissions?.blocks === true
+                ? true
+                : fieldPermissions?.blocks?.[block.slug]
+
+          accessibleBlocks.push({
+            ...block,
+            flattenedFields: filterFields(
+              block.flattenedFields,
+              blockPermissions === true ? true : blockPermissions?.fields,
+              allowedOperations,
+            ),
+          })
+        }
+
+        if (accessibleBlocks.length === 0) {
+          continue
+        }
+
+        accessibleFields.push({ ...field, blocks: accessibleBlocks })
+        continue
+      }
+
+      if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {
+        accessibleFields.push({
+          ...field,
+          flattenedFields: filterFields(
+            field.flattenedFields,
+            fieldPermissions === true ? true : fieldPermissions?.fields,
+            allowedOperations,
+          ),
+        })
+        continue
+      }
+
+      accessibleFields.push(field)
+    }
+
+    return accessibleFields
+  }
+
+  return filterFields(fields, permissions.fields, {
+    create: 'create' in permissions && permissions.create === true,
+    read: permissions.read === true,
+    update: permissions.update === true,
+  })
+}

package/src/utils/schemaConversion/getEntityInputSchema.ts

@@ -0,0 +1,96 @@
+import {
+  type CollectionSlug,
+  entityToStandaloneJSONSchema,
+  type FlattenedField,
+  type GlobalSlug,
+  type PayloadRequest,
+  type SanitizedCollectionConfig,
+  type SanitizedCollectionPermission,
+  type SanitizedGlobalConfig,
+  type SanitizedGlobalPermission,
+} from 'payload'
+
+import type { JsonSchemaType } from '../../types.js'
+
+import { filterFieldsByAccess } from './filterFieldsByAccess.js'
+import { sanitizeEntitySchema } from './sanitizeEntitySchema.js'
+
+export const getCollectionInputSchema = ({
+  collectionSlug,
+  permissions,
+  req,
+}: {
+  collectionSlug: CollectionSlug
+  permissions?: SanitizedCollectionPermission
+  req: PayloadRequest
+}): JsonSchemaType | null => {
+  const collection = req.payload.collections[collectionSlug]?.config
+
+  if (!collection) {
+    return null
+  }
+
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: collection, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: collection.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: collection, fields: fieldsAllowedByAccess, req })
+}
+
+export const getGlobalInputSchema = ({
+  globalSlug,
+  permissions,
+  req,
+}: {
+  globalSlug: GlobalSlug
+  permissions?: SanitizedGlobalPermission
+  req: PayloadRequest
+}): JsonSchemaType | null => {
+  const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)
+
+  if (!global) {
+    return null
+  }
+
+  if (!permissions) {
+    return buildEntityInputSchema({ entity: global, req })
+  }
+
+  const fieldsAllowedByAccess = filterFieldsByAccess({
+    blocks: req.payload.config.blocks,
+    fields: global.flattenedFields,
+    permissions,
+    shouldExcludeField: ({ create, update }) => !create && !update,
+  })
+
+  return buildEntityInputSchema({ entity: global, fields: fieldsAllowedByAccess, req })
+}
+
+const buildEntityInputSchema = ({
+  entity,
+  fields = entity.flattenedFields,
+  req,
+}: {
+  entity: SanitizedCollectionConfig | SanitizedGlobalConfig
+  fields?: FlattenedField[]
+  req: PayloadRequest
+}): JsonSchemaType => {
+  // The core schema generator reads flattenedFields from the entity and has no fields argument.
+  const entityForSchema = { ...entity, flattenedFields: fields }
+  const schema = entityToStandaloneJSONSchema({
+    config: req.payload.config,
+    defaultIDType: req.payload.db.defaultIDType,
+    entity: entityForSchema,
+    i18n: req.i18n,
+    variant: 'input',
+  }) as unknown as JsonSchemaType
+
+  return sanitizeEntitySchema(schema)
+}