@payloadcms/plugin-mcp 4.0.0-internal.688c4d0 → 4.0.0-internal.bc5cf8c

package/dist/defaultAccess.d.ts

@@ -0,0 +1,3 @@
+import type { MCPAccessArgs } from './types.js';
+export declare const defaultAccess: ({ req }: MCPAccessArgs) => boolean;
+//# sourceMappingURL=defaultAccess.d.ts.map

package/dist/defaultAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultAccess.d.ts","sourceRoot":"","sources":["../src/defaultAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,eAAO,MAAM,aAAa,GAAI,SAAS,aAAa,KAAG,OAA4B,CAAA"}

package/dist/defaultAccess.js

@@ -0,0 +1,3 @@
+export const defaultAccess = ({ req })=>Boolean(req.user);
+
+//# sourceMappingURL=defaultAccess.js.map

package/dist/defaultAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/defaultAccess.ts"],"sourcesContent":["import type { MCPAccessArgs } from './types.js'\n\nexport const defaultAccess = ({ req }: MCPAccessArgs): boolean => Boolean(req.user)\n"],"names":["defaultAccess","req","Boolean","user"],"mappings":"AAEA,OAAO,MAAMA,gBAAgB,CAAC,EAAEC,GAAG,EAAiB,GAAcC,QAAQD,IAAIE,IAAI,EAAC"}

package/dist/endpoint/access.d.ts

@@ -1,10 +1,22 @@
 import type { PayloadRequest } from 'payload';
-import type { AuthorizedMCP } from '../types.js';
+import type { AuthorizedMCP, MCPItem } from '../types.js';
+export type GetAuthorizedMCPArgs = {
+    overrideAccess: boolean;
+    req: PayloadRequest;
+};
 /**
- * Resolves the API key (or dev-mode session) and returns the items the caller
- * may use. Denied items are dropped from the array.
+ * Resolves the MCP caller and returns the MCP surface authorized for that request.
+ *
+ * Authorization has two layers:
+ * 1. Payload collection/global permissions determine whether built-in operation tools are shown.
+ * 2. MCP `access` callbacks can further hide any configured tool, prompt, or resource.
+ *
+ * Like Payload core operations, `overrideAccess` skips both layers.
  */
-export declare const getAuthorizedMCP: (args: {
+export declare const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP>;
+export declare const filterMCPItems: ({ items, overrideAccess, req, }: {
+    items: MCPItem[];
+    overrideAccess: boolean;
     req: PayloadRequest;
-}) => Promise<AuthorizedMCP>;
+}) => Promise<MCPItem[]>;
 //# sourceMappingURL=access.d.ts.map

package/dist/endpoint/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/endpoint/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAa,MAAM,SAAS,CAAA;AAK/E,OAAO,KAAK,EAAE,aAAa,EAAiB,MAAM,aAAa,CAAA;AAK/D;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,IAAI,EAAE;IAAE,GAAG,EAAE,cAAc,CAAA;CAAE,KAAK,OAAO,CAAC,aAAa,CAiDtF,CAAA"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/endpoint/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAwB,MAAM,SAAS,CAAA;AAInE,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAIzD,MAAM,MAAM,oBAAoB,GAAG;IACjC,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,EAAE,CAAC,IAAI,EAAE,oBAAoB,KAAK,OAAO,CAAC,aAAa,CAmCnF,CAAA;AAED,eAAO,MAAM,cAAc,GAAU,iCAIlC;IACD,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,OAAO,CAAC,OAAO,EAAE,CAmBpB,CAAA"}

package/dist/endpoint/access.js

@@ -1,122 +1,100 @@
-import crypto from 'crypto';
-import { UnauthorizedError } from 'payload';
-import { getLogger } from '../utils/getLogger.js';
+import { getAccessResults, UnauthorizedError } from 'payload';
 import { getPluginConfig } from '../utils/getPluginConfig.js';
 /**
- * Resolves the API key (or dev-mode session) and returns the items the caller
- * may use. Denied items are dropped from the array.
- */ export const getAuthorizedMCP = async ({ req })=>{
-    const logger = getLogger({
-        payload: req.payload
-    });
+ * Resolves the MCP caller and returns the MCP surface authorized for that request.
+ *
+ * Authorization has two layers:
+ * 1. Payload collection/global permissions determine whether built-in operation tools are shown.
+ * 2. MCP `access` callbacks can further hide any configured tool, prompt, or resource.
+ *
+ * Like Payload core operations, `overrideAccess` skips both layers.
+ */ export const getAuthorizedMCP = async ({ overrideAccess, req })=>{
     const pluginConfig = getPluginConfig({
         config: req.payload.config
     });
-    const authHeader = req.headers.get('Authorization');
-    const hasBearerToken = authHeader?.startsWith('Bearer ');
-    const buildAuthorized = (apiKeyDoc)=>({
-            items: pluginConfig.items.filter((item)=>{
-                switch(item.type){
-                    case 'collectionTool':
-                        return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.configKey] !== false;
-                    case 'globalTool':
-                        return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.configKey] !== false;
-                    case 'prompt':
-                        return apiKeyDoc.access.prompts?.[item.configKey] !== false;
-                    case 'resource':
-                        return apiKeyDoc.access.resources?.[item.configKey] !== false;
-                    case 'tool':
-                        return apiKeyDoc.access.tools?.[item.configKey] !== false;
-                }
-            }),
-            overrideAccess: typeof apiKeyDoc.overrideAccess === 'boolean' ? apiKeyDoc.overrideAccess : false,
-            user: apiKeyDoc.user
-        });
-    if (pluginConfig.overrideAuth) {
-        return await pluginConfig.overrideAuth({
-            getAPIKeyDoc: (overrideApiKey)=>getAPIKeyDoc({
-                    logger,
-                    overrideApiKey,
-                    pluginConfig,
-                    req
-                }),
-            getAuthorizedMCP: ({ apiKeyDoc })=>buildAuthorized(apiKeyDoc),
+    if (pluginConfig.overrideGetAuthorizedMCP) {
+        return await pluginConfig.overrideGetAuthorizedMCP({
+            overrideAccess,
             pluginConfig,
             req
         });
     }
-    if (process.env.NODE_ENV === 'development' && !hasBearerToken) {
-        logger.info('Dev mode: skipping API key check, using session user');
-        return buildAuthorized({
-            id: -1,
-            access: {},
-            overrideAccess: true,
-            user: req.user ?? null
-        });
+    if (req.headers) {
+        const headers = new Headers(req.headers);
+        const hasAuthorization = headers.has('Authorization');
+        headers.set('DisableAutologin', 'true');
+        req.user = (await req.payload.auth({
+            headers,
+            req
+        })).user;
+        if (hasAuthorization && !req.user) {
+            throw new UnauthorizedError(req.t);
+        }
     }
-    return buildAuthorized(await getAPIKeyDoc({
-        logger,
-        pluginConfig,
-        req
-    }));
+    return {
+        items: await filterMCPItems({
+            items: pluginConfig.items,
+            overrideAccess,
+            req
+        }),
+        overrideAccess,
+        user: req.user
+    };
 };
-const getAPIKeyDoc = async ({ logger, overrideApiKey, pluginConfig, req })=>{
-    const authHeader = req.headers.get('Authorization');
-    const hasBearerToken = authHeader?.startsWith('Bearer ');
-    const apiKey = overrideApiKey ?? (hasBearerToken ? authHeader?.replace('Bearer ', '').trim() || null : null);
-    if (!apiKey) {
-        throw new UnauthorizedError();
+export const filterMCPItems = async ({ items, overrideAccess, req })=>{
+    // Match Payload core: overrideAccess bypasses access evaluation instead of
+    // forcing each access function to return true.
+    if (overrideAccess) {
+        return items;
     }
-    const sha256APIKeyIndex = crypto.createHmac('sha256', req.payload.secret).update(apiKey).digest('hex');
-    const doc = await req.payload.db.findOne({
-        collection: 'payload-mcp-api-keys',
-        req,
-        where: {
-            apiKeyIndex: {
-                equals: sha256APIKeyIndex
-            }
-        }
-    });
-    if (!doc || !doc.user) {
-        throw new UnauthorizedError();
-    }
-    logger.info('API Key is valid');
-    const userRef = doc.user;
-    const userID = typeof userRef === 'object' && userRef !== null && 'id' in userRef ? userRef.id : userRef;
-    const user = await req.payload.findByID({
-        id: userID,
-        collection: pluginConfig.userCollection,
-        depth: 0,
-        disableErrors: true,
+    const authorizedItems = [];
+    const permissions = await getAccessResults({
         req
     });
-    if (!user) {
-        throw new UnauthorizedError();
+    for (const item of items){
+        if (!await checkItemAccess({
+            item,
+            permissions,
+            req
+        })) {
+            continue;
+        }
+        authorizedItems.push(item);
     }
-    try {
-        await req.payload.db.updateOne({
-            id: doc.id,
-            collection: 'payload-mcp-api-keys',
-            data: {
-                lastUsed: new Date().toISOString()
-            },
-            req,
-            returning: false
-        });
-    } catch (err) {
-        logger.warn({
-            err,
-            msg: 'Failed to update MCP API key last-used timestamp'
-        });
+    return authorizedItems;
+};
+/**
+ * Runs MCP item access callbacks
+ */ const checkItemAccess = async ({ item, permissions, req })=>{
+    switch(item.type){
+        case 'collectionTool':
+            return !item.tool.access || await item.tool.access({
+                collectionSlug: item.collectionSlug,
+                permissions,
+                req
+            });
+        case 'globalTool':
+            return !item.tool.access || await item.tool.access({
+                globalSlug: item.globalSlug,
+                permissions,
+                req
+            });
+        case 'prompt':
+            return !item.prompt.access || await item.prompt.access({
+                permissions,
+                req
+            });
+        case 'resource':
+            return !item.resource.access || await item.resource.access({
+                permissions,
+                req
+            });
+        case 'tool':
+            return !item.tool.access || await item.tool.access({
+                permissions,
+                req
+            });
     }
-    return {
-        ...doc,
-        user: {
-            ...user,
-            _strategy: 'mcp-api-key',
-            collection: pluginConfig.userCollection
-        }
-    };
 };
 
 //# sourceMappingURL=access.js.map

package/dist/endpoint/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { DefaultDocumentIDType, PayloadRequest, TypedUser } from 'payload'\n\nimport crypto from 'crypto'\nimport { UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPAPIKeysDoc } from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\n/**\n * Resolves the API key (or dev-mode session) and returns the items the caller\n * may use. Denied items are dropped from the array.\n */\nexport const getAuthorizedMCP: (args: { req: PayloadRequest }) => Promise<AuthorizedMCP> = async ({\n  req,\n}) => {\n  const logger = getLogger({ payload: req.payload })\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const buildAuthorized = (apiKeyDoc: MCPAPIKeysDoc): AuthorizedMCP => ({\n    items: pluginConfig.items.filter((item) => {\n      switch (item.type) {\n        case 'collectionTool':\n          return apiKeyDoc.access.collections?.[item.collectionSlug]?.[item.configKey] !== false\n        case 'globalTool':\n          return apiKeyDoc.access.globals?.[item.globalSlug]?.[item.configKey] !== false\n        case 'prompt':\n          return apiKeyDoc.access.prompts?.[item.configKey] !== false\n        case 'resource':\n          return apiKeyDoc.access.resources?.[item.configKey] !== false\n        case 'tool':\n          return apiKeyDoc.access.tools?.[item.configKey] !== false\n      }\n    }),\n    overrideAccess:\n      typeof apiKeyDoc.overrideAccess === 'boolean' ? apiKeyDoc.overrideAccess : false,\n    user: apiKeyDoc.user,\n  })\n\n  if (pluginConfig.overrideAuth) {\n    return await pluginConfig.overrideAuth({\n      getAPIKeyDoc: (overrideApiKey) => getAPIKeyDoc({ logger, overrideApiKey, pluginConfig, req }),\n      getAuthorizedMCP: ({ apiKeyDoc }) => buildAuthorized(apiKeyDoc),\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (process.env.NODE_ENV === 'development' && !hasBearerToken) {\n    logger.info('Dev mode: skipping API key check, using session user')\n    return buildAuthorized({\n      id: -1,\n      access: {},\n      overrideAccess: true,\n      user: req.user ?? null,\n    })\n  }\n\n  return buildAuthorized(await getAPIKeyDoc({ logger, pluginConfig, req }))\n}\n\nconst getAPIKeyDoc = async ({\n  logger,\n  overrideApiKey,\n  pluginConfig,\n  req,\n}: {\n  logger: ReturnType<typeof getLogger>\n  overrideApiKey?: string\n  pluginConfig: ReturnType<typeof getPluginConfig>\n  req: PayloadRequest\n}): Promise<MCPAPIKeysDoc> => {\n  const authHeader = req.headers.get('Authorization')\n  const hasBearerToken = authHeader?.startsWith('Bearer ')\n\n  const apiKey =\n    overrideApiKey ?? (hasBearerToken ? authHeader?.replace('Bearer ', '').trim() || null : null)\n\n  if (!apiKey) {\n    throw new UnauthorizedError()\n  }\n\n  const sha256APIKeyIndex = crypto\n    .createHmac('sha256', req.payload.secret)\n    .update(apiKey)\n    .digest('hex')\n\n  const doc = await req.payload.db.findOne<MCPAPIKeysDoc>({\n    collection: 'payload-mcp-api-keys',\n    req,\n    where: {\n      apiKeyIndex: { equals: sha256APIKeyIndex },\n    },\n  })\n\n  if (!doc || !doc.user) {\n    throw new UnauthorizedError()\n  }\n\n  logger.info('API Key is valid')\n\n  const userRef = doc.user\n  const userID =\n    typeof userRef === 'object' && userRef !== null && 'id' in userRef\n      ? userRef.id\n      : (userRef as unknown as DefaultDocumentIDType)\n\n  const user = (await req.payload.findByID({\n    id: userID,\n    collection: pluginConfig.userCollection,\n    depth: 0,\n    disableErrors: true,\n    req,\n  })) as null | TypedUser\n\n  if (!user) {\n    throw new UnauthorizedError()\n  }\n\n  try {\n    await req.payload.db.updateOne({\n      id: doc.id,\n      collection: 'payload-mcp-api-keys',\n      data: { lastUsed: new Date().toISOString() },\n      req,\n      returning: false,\n    })\n  } catch (err) {\n    logger.warn({ err, msg: 'Failed to update MCP API key last-used timestamp' })\n  }\n\n  return {\n    ...doc,\n    user: {\n      ...user,\n      _strategy: 'mcp-api-key' as const,\n      collection: pluginConfig.userCollection,\n    },\n  }\n}\n"],"names":["crypto","UnauthorizedError","getLogger","getPluginConfig","getAuthorizedMCP","req","logger","payload","pluginConfig","config","authHeader","headers","get","hasBearerToken","startsWith","buildAuthorized","apiKeyDoc","items","filter","item","type","access","collections","collectionSlug","configKey","globals","globalSlug","prompts","resources","tools","overrideAccess","user","overrideAuth","getAPIKeyDoc","overrideApiKey","process","env","NODE_ENV","info","id","apiKey","replace","trim","sha256APIKeyIndex","createHmac","secret","update","digest","doc","db","findOne","collection","where","apiKeyIndex","equals","userRef","userID","findByID","userCollection","depth","disableErrors","updateOne","data","lastUsed","Date","toISOString","returning","err","warn","msg","_strategy"],"mappings":"AAEA,OAAOA,YAAY,SAAQ;AAC3B,SAASC,iBAAiB,QAAQ,UAAS;AAI3C,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,eAAe,QAAQ,8BAA6B;AAE7D;;;CAGC,GACD,OAAO,MAAMC,mBAA8E,OAAO,EAChGC,GAAG,EACJ;IACC,MAAMC,SAASJ,UAAU;QAAEK,SAASF,IAAIE,OAAO;IAAC;IAChD,MAAMC,eAAeL,gBAAgB;QAAEM,QAAQJ,IAAIE,OAAO,CAACE,MAAM;IAAC;IAElE,MAAMC,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAMC,kBAAkB,CAACC,YAA6C,CAAA;YACpEC,OAAOT,aAAaS,KAAK,CAACC,MAAM,CAAC,CAACC;gBAChC,OAAQA,KAAKC,IAAI;oBACf,KAAK;wBACH,OAAOJ,UAAUK,MAAM,CAACC,WAAW,EAAE,CAACH,KAAKI,cAAc,CAAC,EAAE,CAACJ,KAAKK,SAAS,CAAC,KAAK;oBACnF,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACI,OAAO,EAAE,CAACN,KAAKO,UAAU,CAAC,EAAE,CAACP,KAAKK,SAAS,CAAC,KAAK;oBAC3E,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACM,OAAO,EAAE,CAACR,KAAKK,SAAS,CAAC,KAAK;oBACxD,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACO,SAAS,EAAE,CAACT,KAAKK,SAAS,CAAC,KAAK;oBAC1D,KAAK;wBACH,OAAOR,UAAUK,MAAM,CAACQ,KAAK,EAAE,CAACV,KAAKK,SAAS,CAAC,KAAK;gBACxD;YACF;YACAM,gBACE,OAAOd,UAAUc,cAAc,KAAK,YAAYd,UAAUc,cAAc,GAAG;YAC7EC,MAAMf,UAAUe,IAAI;QACtB,CAAA;IAEA,IAAIvB,aAAawB,YAAY,EAAE;QAC7B,OAAO,MAAMxB,aAAawB,YAAY,CAAC;YACrCC,cAAc,CAACC,iBAAmBD,aAAa;oBAAE3B;oBAAQ4B;oBAAgB1B;oBAAcH;gBAAI;YAC3FD,kBAAkB,CAAC,EAAEY,SAAS,EAAE,GAAKD,gBAAgBC;YACrDR;YACAH;QACF;IACF;IAEA,IAAI8B,QAAQC,GAAG,CAACC,QAAQ,KAAK,iBAAiB,CAACxB,gBAAgB;QAC7DP,OAAOgC,IAAI,CAAC;QACZ,OAAOvB,gBAAgB;YACrBwB,IAAI,CAAC;YACLlB,QAAQ,CAAC;YACTS,gBAAgB;YAChBC,MAAM1B,IAAI0B,IAAI,IAAI;QACpB;IACF;IAEA,OAAOhB,gBAAgB,MAAMkB,aAAa;QAAE3B;QAAQE;QAAcH;IAAI;AACxE,EAAC;AAED,MAAM4B,eAAe,OAAO,EAC1B3B,MAAM,EACN4B,cAAc,EACd1B,YAAY,EACZH,GAAG,EAMJ;IACC,MAAMK,aAAaL,IAAIM,OAAO,CAACC,GAAG,CAAC;IACnC,MAAMC,iBAAiBH,YAAYI,WAAW;IAE9C,MAAM0B,SACJN,kBAAmBrB,CAAAA,iBAAiBH,YAAY+B,QAAQ,WAAW,IAAIC,UAAU,OAAO,IAAG;IAE7F,IAAI,CAACF,QAAQ;QACX,MAAM,IAAIvC;IACZ;IAEA,MAAM0C,oBAAoB3C,OACvB4C,UAAU,CAAC,UAAUvC,IAAIE,OAAO,CAACsC,MAAM,EACvCC,MAAM,CAACN,QACPO,MAAM,CAAC;IAEV,MAAMC,MAAM,MAAM3C,IAAIE,OAAO,CAAC0C,EAAE,CAACC,OAAO,CAAgB;QACtDC,YAAY;QACZ9C;QACA+C,OAAO;YACLC,aAAa;gBAAEC,QAAQX;YAAkB;QAC3C;IACF;IAEA,IAAI,CAACK,OAAO,CAACA,IAAIjB,IAAI,EAAE;QACrB,MAAM,IAAI9B;IACZ;IAEAK,OAAOgC,IAAI,CAAC;IAEZ,MAAMiB,UAAUP,IAAIjB,IAAI;IACxB,MAAMyB,SACJ,OAAOD,YAAY,YAAYA,YAAY,QAAQ,QAAQA,UACvDA,QAAQhB,EAAE,GACTgB;IAEP,MAAMxB,OAAQ,MAAM1B,IAAIE,OAAO,CAACkD,QAAQ,CAAC;QACvClB,IAAIiB;QACJL,YAAY3C,aAAakD,cAAc;QACvCC,OAAO;QACPC,eAAe;QACfvD;IACF;IAEA,IAAI,CAAC0B,MAAM;QACT,MAAM,IAAI9B;IACZ;IAEA,IAAI;QACF,MAAMI,IAAIE,OAAO,CAAC0C,EAAE,CAACY,SAAS,CAAC;YAC7BtB,IAAIS,IAAIT,EAAE;YACVY,YAAY;YACZW,MAAM;gBAAEC,UAAU,IAAIC,OAAOC,WAAW;YAAG;YAC3C5D;YACA6D,WAAW;QACb;IACF,EAAE,OAAOC,KAAK;QACZ7D,OAAO8D,IAAI,CAAC;YAAED;YAAKE,KAAK;QAAmD;IAC7E;IAEA,OAAO;QACL,GAAGrB,GAAG;QACNjB,MAAM;YACJ,GAAGA,IAAI;YACPuC,WAAW;YACXnB,YAAY3C,aAAakD,cAAc;QACzC;IACF;AACF"}
+{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { PayloadRequest, SanitizedPermissions } from 'payload'\n\nimport { getAccessResults, UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPItem } from '../types.js'\n\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\nexport type GetAuthorizedMCPArgs = {\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\n/**\n * Resolves the MCP caller and returns the MCP surface authorized for that request.\n *\n * Authorization has two layers:\n * 1. Payload collection/global permissions determine whether built-in operation tools are shown.\n * 2. MCP `access` callbacks can further hide any configured tool, prompt, or resource.\n *\n * Like Payload core operations, `overrideAccess` skips both layers.\n */\nexport const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP> = async ({\n  overrideAccess,\n  req,\n}) => {\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  if (pluginConfig.overrideGetAuthorizedMCP) {\n    return await pluginConfig.overrideGetAuthorizedMCP({\n      overrideAccess,\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (req.headers) {\n    const headers = new Headers(req.headers)\n    const hasAuthorization = headers.has('Authorization')\n\n    headers.set('DisableAutologin', 'true')\n    req.user = (await req.payload.auth({ headers, req })).user\n\n    if (hasAuthorization && !req.user) {\n      throw new UnauthorizedError(req.t)\n    }\n  }\n\n  return {\n    items: await filterMCPItems({\n      items: pluginConfig.items,\n      overrideAccess,\n      req,\n    }),\n    overrideAccess,\n    user: req.user,\n  }\n}\n\nexport const filterMCPItems = async ({\n  items,\n  overrideAccess,\n  req,\n}: {\n  items: MCPItem[]\n  overrideAccess: boolean\n  req: PayloadRequest\n}): Promise<MCPItem[]> => {\n  // Match Payload core: overrideAccess bypasses access evaluation instead of\n  // forcing each access function to return true.\n  if (overrideAccess) {\n    return items\n  }\n\n  const authorizedItems: MCPItem[] = []\n\n  const permissions = await getAccessResults({ req })\n\n  for (const item of items) {\n    if (!(await checkItemAccess({ item, permissions, req }))) {\n      continue\n    }\n    authorizedItems.push(item)\n  }\n\n  return authorizedItems\n}\n\n/**\n * Runs MCP item access callbacks\n */\nconst checkItemAccess = async ({\n  item,\n  permissions,\n  req,\n}: {\n  item: MCPItem\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}): Promise<boolean> => {\n  switch (item.type) {\n    case 'collectionTool':\n      return (\n        !item.tool.access ||\n        (await item.tool.access({ collectionSlug: item.collectionSlug, permissions, req }))\n      )\n    case 'globalTool':\n      return (\n        !item.tool.access ||\n        (await item.tool.access({ globalSlug: item.globalSlug, permissions, req }))\n      )\n    case 'prompt':\n      return !item.prompt.access || (await item.prompt.access({ permissions, req }))\n    case 'resource':\n      return !item.resource.access || (await item.resource.access({ permissions, req }))\n    case 'tool':\n      return !item.tool.access || (await item.tool.access({ permissions, req }))\n  }\n}\n"],"names":["getAccessResults","UnauthorizedError","getPluginConfig","getAuthorizedMCP","overrideAccess","req","pluginConfig","config","payload","overrideGetAuthorizedMCP","headers","Headers","hasAuthorization","has","set","user","auth","t","items","filterMCPItems","authorizedItems","permissions","item","checkItemAccess","push","type","tool","access","collectionSlug","globalSlug","prompt","resource"],"mappings":"AAEA,SAASA,gBAAgB,EAAEC,iBAAiB,QAAQ,UAAS;AAI7D,SAASC,eAAe,QAAQ,8BAA6B;AAO7D;;;;;;;;CAQC,GACD,OAAO,MAAMC,mBAA2E,OAAO,EAC7FC,cAAc,EACdC,GAAG,EACJ;IACC,MAAMC,eAAeJ,gBAAgB;QAAEK,QAAQF,IAAIG,OAAO,CAACD,MAAM;IAAC;IAElE,IAAID,aAAaG,wBAAwB,EAAE;QACzC,OAAO,MAAMH,aAAaG,wBAAwB,CAAC;YACjDL;YACAE;YACAD;QACF;IACF;IAEA,IAAIA,IAAIK,OAAO,EAAE;QACf,MAAMA,UAAU,IAAIC,QAAQN,IAAIK,OAAO;QACvC,MAAME,mBAAmBF,QAAQG,GAAG,CAAC;QAErCH,QAAQI,GAAG,CAAC,oBAAoB;QAChCT,IAAIU,IAAI,GAAG,AAAC,CAAA,MAAMV,IAAIG,OAAO,CAACQ,IAAI,CAAC;YAAEN;YAASL;QAAI,EAAC,EAAGU,IAAI;QAE1D,IAAIH,oBAAoB,CAACP,IAAIU,IAAI,EAAE;YACjC,MAAM,IAAId,kBAAkBI,IAAIY,CAAC;QACnC;IACF;IAEA,OAAO;QACLC,OAAO,MAAMC,eAAe;YAC1BD,OAAOZ,aAAaY,KAAK;YACzBd;YACAC;QACF;QACAD;QACAW,MAAMV,IAAIU,IAAI;IAChB;AACF,EAAC;AAED,OAAO,MAAMI,iBAAiB,OAAO,EACnCD,KAAK,EACLd,cAAc,EACdC,GAAG,EAKJ;IACC,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAID,gBAAgB;QAClB,OAAOc;IACT;IAEA,MAAME,kBAA6B,EAAE;IAErC,MAAMC,cAAc,MAAMrB,iBAAiB;QAAEK;IAAI;IAEjD,KAAK,MAAMiB,QAAQJ,MAAO;QACxB,IAAI,CAAE,MAAMK,gBAAgB;YAAED;YAAMD;YAAahB;QAAI,IAAK;YACxD;QACF;QACAe,gBAAgBI,IAAI,CAACF;IACvB;IAEA,OAAOF;AACT,EAAC;AAED;;CAEC,GACD,MAAMG,kBAAkB,OAAO,EAC7BD,IAAI,EACJD,WAAW,EACXhB,GAAG,EAKJ;IACC,OAAQiB,KAAKG,IAAI;QACf,KAAK;YACH,OACE,CAACH,KAAKI,IAAI,CAACC,MAAM,IAChB,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEC,gBAAgBN,KAAKM,cAAc;gBAAEP;gBAAahB;YAAI;QAEpF,KAAK;YACH,OACE,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAChB,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEE,YAAYP,KAAKO,UAAU;gBAAER;gBAAahB;YAAI;QAE5E,KAAK;YACH,OAAO,CAACiB,KAAKQ,MAAM,CAACH,MAAM,IAAK,MAAML,KAAKQ,MAAM,CAACH,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QAC7E,KAAK;YACH,OAAO,CAACiB,KAAKS,QAAQ,CAACJ,MAAM,IAAK,MAAML,KAAKS,QAAQ,CAACJ,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QACjF,KAAK;YACH,OAAO,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAAK,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;IAC3E;AACF"}

package/dist/endpoint/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoint/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAMvD,eAAO,MAAM,WAAW,EAAE,cA2BzB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoint/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAMvD,eAAO,MAAM,WAAW,EAAE,cAwCzB,CAAA"}

package/dist/endpoint/index.js

@@ -11,7 +11,18 @@ export const mcpEndpoint = async (req)=>{
     const pluginConfig = getPluginConfig({
         config: req.payload.config
     });
+    const overrideAccessParam = new URL(req.url).searchParams.get('overrideAccess');
+    if (overrideAccessParam !== null && process.env.NODE_ENV !== 'development') {
+        throw new APIError('MCP overrideAccess is only available in development.', 400);
+    }
+    let overrideAccess = false;
+    if (overrideAccessParam === 'true') {
+        overrideAccess = true;
+    } else if (overrideAccessParam !== null && overrideAccessParam !== 'false') {
+        throw new APIError('MCP overrideAccess must be "true" or "false".', 400);
+    }
     const authorizedMCP = await getAuthorizedMCP({
+        overrideAccess,
         req
     });
     const server = buildMcpServer({

package/dist/endpoint/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoint/index.ts"],"sourcesContent":["import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server'\nimport { APIError, type PayloadHandler } from 'payload'\n\nimport { buildMcpServer } from '../mcp/buildMcpServer.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\nimport { getAuthorizedMCP } from './access.js'\n\nexport const mcpEndpoint: PayloadHandler = async (req) => {\n  if (!req.url) {\n    throw new APIError('Missing request URL', 400)\n  }\n\n  req.payloadAPI = 'MCP' as const\n\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n  const authorizedMCP = await getAuthorizedMCP({ req })\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    enableJsonResponse: true,\n    sessionIdGenerator: undefined, // stateless mode\n  })\n\n  await server.connect(transport)\n\n  const mcpRequest = new Request(req.url, {\n    body: req.body,\n    duplex: 'half',\n    headers: req.headers,\n    method: req.method,\n  } as { duplex: 'half' } & RequestInit)\n\n  return await transport.handleRequest(mcpRequest)\n}\n"],"names":["WebStandardStreamableHTTPServerTransport","APIError","buildMcpServer","getPluginConfig","getAuthorizedMCP","mcpEndpoint","req","url","payloadAPI","pluginConfig","config","payload","authorizedMCP","server","transport","enableJsonResponse","sessionIdGenerator","undefined","connect","mcpRequest","Request","body","duplex","headers","method","handleRequest"],"mappings":"AAAA,SAASA,wCAAwC,QAAQ,+BAA8B;AACvF,SAASC,QAAQ,QAA6B,UAAS;AAEvD,SAASC,cAAc,QAAQ,2BAA0B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,gBAAgB,QAAQ,cAAa;AAE9C,OAAO,MAAMC,cAA8B,OAAOC;IAChD,IAAI,CAACA,IAAIC,GAAG,EAAE;QACZ,MAAM,IAAIN,SAAS,uBAAuB;IAC5C;IAEAK,IAAIE,UAAU,GAAG;IAEjB,MAAMC,eAAeN,gBAAgB;QAAEO,QAAQJ,IAAIK,OAAO,CAACD,MAAM;IAAC;IAClE,MAAME,gBAAgB,MAAMR,iBAAiB;QAAEE;IAAI;IAEnD,MAAMO,SAASX,eAAe;QAAEU;QAAeH;QAAcH;IAAI;IAEjE,MAAMQ,YAAY,IAAId,yCAAyC;QAC7De,oBAAoB;QACpBC,oBAAoBC;IACtB;IAEA,MAAMJ,OAAOK,OAAO,CAACJ;IAErB,MAAMK,aAAa,IAAIC,QAAQd,IAAIC,GAAG,EAAE;QACtCc,MAAMf,IAAIe,IAAI;QACdC,QAAQ;QACRC,SAASjB,IAAIiB,OAAO;QACpBC,QAAQlB,IAAIkB,MAAM;IACpB;IAEA,OAAO,MAAMV,UAAUW,aAAa,CAACN;AACvC,EAAC"}
+{"version":3,"sources":["../../src/endpoint/index.ts"],"sourcesContent":["import { WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server'\nimport { APIError, type PayloadHandler } from 'payload'\n\nimport { buildMcpServer } from '../mcp/buildMcpServer.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\nimport { getAuthorizedMCP } from './access.js'\n\nexport const mcpEndpoint: PayloadHandler = async (req) => {\n  if (!req.url) {\n    throw new APIError('Missing request URL', 400)\n  }\n\n  req.payloadAPI = 'MCP' as const\n\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n  const overrideAccessParam = new URL(req.url).searchParams.get('overrideAccess')\n\n  if (overrideAccessParam !== null && process.env.NODE_ENV !== 'development') {\n    throw new APIError('MCP overrideAccess is only available in development.', 400)\n  }\n\n  let overrideAccess = false\n  if (overrideAccessParam === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessParam !== null && overrideAccessParam !== 'false') {\n    throw new APIError('MCP overrideAccess must be \"true\" or \"false\".', 400)\n  }\n\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n  const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n\n  const transport = new WebStandardStreamableHTTPServerTransport({\n    enableJsonResponse: true,\n    sessionIdGenerator: undefined, // stateless mode\n  })\n\n  await server.connect(transport)\n\n  const mcpRequest = new Request(req.url, {\n    body: req.body,\n    duplex: 'half',\n    headers: req.headers,\n    method: req.method,\n  } as { duplex: 'half' } & RequestInit)\n\n  return await transport.handleRequest(mcpRequest)\n}\n"],"names":["WebStandardStreamableHTTPServerTransport","APIError","buildMcpServer","getPluginConfig","getAuthorizedMCP","mcpEndpoint","req","url","payloadAPI","pluginConfig","config","payload","overrideAccessParam","URL","searchParams","get","process","env","NODE_ENV","overrideAccess","authorizedMCP","server","transport","enableJsonResponse","sessionIdGenerator","undefined","connect","mcpRequest","Request","body","duplex","headers","method","handleRequest"],"mappings":"AAAA,SAASA,wCAAwC,QAAQ,+BAA8B;AACvF,SAASC,QAAQ,QAA6B,UAAS;AAEvD,SAASC,cAAc,QAAQ,2BAA0B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,gBAAgB,QAAQ,cAAa;AAE9C,OAAO,MAAMC,cAA8B,OAAOC;IAChD,IAAI,CAACA,IAAIC,GAAG,EAAE;QACZ,MAAM,IAAIN,SAAS,uBAAuB;IAC5C;IAEAK,IAAIE,UAAU,GAAG;IAEjB,MAAMC,eAAeN,gBAAgB;QAAEO,QAAQJ,IAAIK,OAAO,CAACD,MAAM;IAAC;IAClE,MAAME,sBAAsB,IAAIC,IAAIP,IAAIC,GAAG,EAAEO,YAAY,CAACC,GAAG,CAAC;IAE9D,IAAIH,wBAAwB,QAAQI,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe;QAC1E,MAAM,IAAIjB,SAAS,wDAAwD;IAC7E;IAEA,IAAIkB,iBAAiB;IACrB,IAAIP,wBAAwB,QAAQ;QAClCO,iBAAiB;IACnB,OAAO,IAAIP,wBAAwB,QAAQA,wBAAwB,SAAS;QAC1E,MAAM,IAAIX,SAAS,iDAAiD;IACtE;IAEA,MAAMmB,gBAAgB,MAAMhB,iBAAiB;QAAEe;QAAgBb;IAAI;IAEnE,MAAMe,SAASnB,eAAe;QAAEkB;QAAeX;QAAcH;IAAI;IAEjE,MAAMgB,YAAY,IAAItB,yCAAyC;QAC7DuB,oBAAoB;QACpBC,oBAAoBC;IACtB;IAEA,MAAMJ,OAAOK,OAAO,CAACJ;IAErB,MAAMK,aAAa,IAAIC,QAAQtB,IAAIC,GAAG,EAAE;QACtCsB,MAAMvB,IAAIuB,IAAI;QACdC,QAAQ;QACRC,SAASzB,IAAIyB,OAAO;QACpBC,QAAQ1B,IAAI0B,MAAM;IACpB;IAEA,OAAO,MAAMV,UAAUW,aAAa,CAACN;AACvC,EAAC"}

package/dist/exports/client.d.ts

@@ -1,5 +1,2 @@
-export { AccessField } from '../components/AccessField/index.client.js';
-export { APIKeyField } from '../components/APIKeyField/index.client.js';
-export { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js';
-export { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js';
+export {};
 //# sourceMappingURL=client.d.ts.map

package/dist/exports/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAA;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,2CAA2C,CAAA;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAA;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAA"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/exports/client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAA"}

package/dist/exports/client.js

@@ -1,7 +1,4 @@
 'use client';
-export { AccessField } from '../components/AccessField/index.client.js';
-export { APIKeyField } from '../components/APIKeyField/index.client.js';
-export { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js';
-export { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js';
+export { };
 
 //# sourceMappingURL=client.js.map

package/dist/exports/client.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["'use client'\nexport { AccessField } from '../components/AccessField/index.client.js'\nexport { APIKeyField } from '../components/APIKeyField/index.client.js'\nexport { APIKeysEmptyState } from '../components/APIKeysEmptyState/index.client.js'\nexport { MCPSettingsMenu } from '../components/SettingsMenu/index.client.js'\n"],"names":["AccessField","APIKeyField","APIKeysEmptyState","MCPSettingsMenu"],"mappings":"AAAA;AACA,SAASA,WAAW,QAAQ,4CAA2C;AACvE,SAASC,WAAW,QAAQ,4CAA2C;AACvE,SAASC,iBAAiB,QAAQ,kDAAiD;AACnF,SAASC,eAAe,QAAQ,6CAA4C"}
+{"version":3,"sources":["../../src/exports/client.ts"],"sourcesContent":["'use client'\n\nexport {}\n"],"names":[],"mappings":"AAAA;AAEA,WAAS"}

package/dist/exports/internal.d.ts

@@ -0,0 +1,2 @@
+export { filterMCPItems, getAuthorizedMCP } from '../endpoint/access.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/exports/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/exports/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/exports/internal.js

@@ -0,0 +1,3 @@
+export { filterMCPItems, getAuthorizedMCP } from '../endpoint/access.js';
+
+//# sourceMappingURL=internal.js.map

package/dist/exports/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/exports/internal.ts"],"sourcesContent":["export { filterMCPItems, getAuthorizedMCP } from '../endpoint/access.js'\n"],"names":["filterMCPItems","getAuthorizedMCP"],"mappings":"AAAA,SAASA,cAAc,EAAEC,gBAAgB,QAAQ,wBAAuB"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAO1F,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAiB,cAAc;QAC7B,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;KACjD;IACD,UAAU,iBAAiB;QACzB,uFAAuF;QACvF,wBAAwB,EAAE,eAAe,CAAA;KAC1C;CACF;AAED,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;AAExE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAElG,eAAO,MAAM,SAAS,wDAkFpB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAA;AAK1F,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAiB,cAAc;QAC7B,UAAU,EAAE,SAAS,GAAG,OAAO,GAAG,KAAK,GAAG,MAAM,CAAA;KACjD;IACD,UAAU,iBAAiB;QACzB,uFAAuF;QACvF,wBAAwB,EAAE,eAAe,CAAA;KAC1C;CACF;AAED,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,wBAAwB,EAAE,CAAA;AAExE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAElG,eAAO,MAAM,SAAS,wDAiCpB,CAAA"}

package/dist/index.js

@@ -1,22 +1,11 @@
-import { defaultUserCollection, definePlugin } from 'payload';
-import { getAPIKeysCollection } from './collection/index.js';
+import { definePlugin } from 'payload';
 import { mcpEndpoint } from './endpoint/index.js';
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
-import { translations } from './translations/index.js';
 export { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js';
 export const mcpPlugin = definePlugin({
     slug: '@payloadcms/plugin-mcp',
     order: 10,
     plugin: ({ config, plugins, ...rawConfig })=>{
-        // If a project has no auth collection yet, add the default users collection
-        // so the relationship target and default `userCollection` exist.
-        if (!config.admin?.user) {
-            const firstCollectionWithAuth = (config.collections ?? []).find(({ auth })=>Boolean(auth));
-            if (!firstCollectionWithAuth) {
-                ;
-                (config.collections ??= []).push(defaultUserCollection);
-            }
-        }
         const pluginConfig = sanitizeMCPConfig({
             config,
             pluginConfig: rawConfig
@@ -27,48 +16,11 @@ export const mcpPlugin = definePlugin({
             // @ts-expect-error
             registered.sanitizedOptions = pluginConfig;
         }
-        ;
-        (config.collections ??= []).push(getAPIKeysCollection({
-            pluginConfig
-        }));
-        if (!config.i18n) {
-            config.i18n = {};
-        }
-        if (!config.i18n.translations) {
-            config.i18n.translations = {};
-        }
-        const supportedLanguageKeys = config.i18n.supportedLanguages ? Object.keys(config.i18n.supportedLanguages) : [
-            'en'
-        ];
-        for (const lang of supportedLanguageKeys){
-            const pluginEntry = translations[lang];
-            if (!pluginEntry) {
-                continue;
-            }
-            const typedLocale = lang;
-            const existing = config.i18n.translations[typedLocale] ?? {};
-            config.i18n.translations[typedLocale] = {
-                ...existing,
-                'plugin-mcp': pluginEntry.translations['plugin-mcp']
-            };
-        }
-        // Keep the API-keys collection registered even when disabled, so DB schema
-        // and generated types don't drift between enabled/disabled environments.
         if (pluginConfig.disabled) {
             return config;
         }
         return {
             ...config,
-            admin: {
-                ...config.admin,
-                components: {
-                    ...config.admin?.components,
-                    userMenuSettingsItems: [
-                        ...config.admin?.components?.userMenuSettingsItems ?? [],
-                        '@payloadcms/plugin-mcp/client#MCPSettingsMenu'
-                    ]
-                }
-            },
             endpoints: [
                 ...config.endpoints ?? [],
                 // Payload prefixes /api, so the full path is /api/mcp.

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import type { AcceptedLanguages } from '@payloadcms/translations'\n\nimport { defaultUserCollection, definePlugin } from 'payload'\n\nimport type { PluginDefaultTranslationsObject } from './translations/types.js'\nimport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAPIKeysCollection } from './collection/index.js'\nimport { mcpEndpoint } from './endpoint/index.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { translations } from './translations/index.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequest {\n    payloadAPI: 'GraphQL' | 'local' | 'MCP' | 'REST'\n  }\n  interface RegisteredPlugins {\n    /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nexport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }\n\nexport { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'\n\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, plugins, ...rawConfig }) => {\n    // If a project has no auth collection yet, add the default users collection\n    // so the relationship target and default `userCollection` exist.\n    if (!config.admin?.user) {\n      const firstCollectionWithAuth = (config.collections ?? []).find(({ auth }) => Boolean(auth))\n      if (!firstCollectionWithAuth) {\n        ;(config.collections ??= []).push(defaultUserCollection)\n      }\n    }\n\n    const pluginConfig = sanitizeMCPConfig({ config, pluginConfig: rawConfig })\n\n    // Stash the sanitized config on plugin options so `getPluginConfig()` reads it.\n    const registered = plugins['@payloadcms/plugin-mcp']\n    if (registered) {\n      // @ts-expect-error\n      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options\n    }\n\n    ;(config.collections ??= []).push(getAPIKeysCollection({ pluginConfig }))\n\n    if (!config.i18n) {\n      config.i18n = {}\n    }\n\n    if (!config.i18n.translations) {\n      config.i18n.translations = {}\n    }\n\n    const supportedLanguageKeys = config.i18n.supportedLanguages\n      ? Object.keys(config.i18n.supportedLanguages)\n      : ['en']\n\n    for (const lang of supportedLanguageKeys) {\n      const pluginEntry = translations[lang as keyof typeof translations]\n      if (!pluginEntry) {\n        continue\n      }\n\n      const typedLocale = lang as AcceptedLanguages\n      const existing = (config.i18n.translations[typedLocale] ?? {}) as Record<string, unknown>\n      config.i18n.translations[typedLocale] = {\n        ...existing,\n        'plugin-mcp': pluginEntry.translations['plugin-mcp'],\n      } as PluginDefaultTranslationsObject\n    }\n\n    // Keep the API-keys collection registered even when disabled, so DB schema\n    // and generated types don't drift between enabled/disabled environments.\n    if (pluginConfig.disabled) {\n      return config\n    }\n\n    return {\n      ...config,\n      admin: {\n        ...config.admin,\n        components: {\n          ...config.admin?.components,\n          userMenuSettingsItems: [\n            ...(config.admin?.components?.userMenuSettingsItems ?? []),\n            '@payloadcms/plugin-mcp/client#MCPSettingsMenu',\n          ],\n        },\n      },\n      endpoints: [\n        ...(config.endpoints ?? []),\n        // Payload prefixes /api, so the full path is /api/mcp.\n        { handler: mcpEndpoint, method: 'post', path: '/mcp' },\n        // Streamable HTTP's optional server=>client GET stream. We don't offer\n        // one, so answer 405 per spec-— clients then skip it cleanly\n        {\n          handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),\n          method: 'get',\n          path: '/mcp',\n        },\n      ],\n    }\n  },\n})\n"],"names":["defaultUserCollection","definePlugin","getAPIKeysCollection","mcpEndpoint","sanitizeMCPConfig","translations","defineCollectionTool","defineGlobalTool","definePrompt","defineTool","mcpPlugin","slug","order","plugin","config","plugins","rawConfig","admin","user","firstCollectionWithAuth","collections","find","auth","Boolean","push","pluginConfig","registered","sanitizedOptions","i18n","supportedLanguageKeys","supportedLanguages","Object","keys","lang","pluginEntry","typedLocale","existing","disabled","components","userMenuSettingsItems","endpoints","handler","method","path","Response","headers","Allow","status"],"mappings":"AAEA,SAASA,qBAAqB,EAAEC,YAAY,QAAQ,UAAS;AAK7D,SAASC,oBAAoB,QAAQ,wBAAuB;AAC5D,SAASC,WAAW,QAAQ,sBAAqB;AACjD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,YAAY,QAAQ,0BAAyB;AActD,SAASC,oBAAoB,EAAEC,gBAAgB,EAAEC,YAAY,EAAEC,UAAU,QAAQ,kBAAiB;AAElG,OAAO,MAAMC,YAAYT,aAA8B;IACrDU,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGC,WAAW;QACxC,4EAA4E;QAC5E,iEAAiE;QACjE,IAAI,CAACF,OAAOG,KAAK,EAAEC,MAAM;YACvB,MAAMC,0BAA0B,AAACL,CAAAA,OAAOM,WAAW,IAAI,EAAE,AAAD,EAAGC,IAAI,CAAC,CAAC,EAAEC,IAAI,EAAE,GAAKC,QAAQD;YACtF,IAAI,CAACH,yBAAyB;;gBAC1BL,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACxB;YACpC;QACF;QAEA,MAAMyB,eAAerB,kBAAkB;YAAEU;YAAQW,cAAcT;QAAU;QAEzE,gFAAgF;QAChF,MAAMU,aAAaX,OAAO,CAAC,yBAAyB;QACpD,IAAIW,YAAY;YACd,mBAAmB;YACnBA,WAAWC,gBAAgB,GAAGF;QAChC;;QAEEX,CAAAA,OAAOM,WAAW,KAAK,EAAE,AAAD,EAAGI,IAAI,CAACtB,qBAAqB;YAAEuB;QAAa;QAEtE,IAAI,CAACX,OAAOc,IAAI,EAAE;YAChBd,OAAOc,IAAI,GAAG,CAAC;QACjB;QAEA,IAAI,CAACd,OAAOc,IAAI,CAACvB,YAAY,EAAE;YAC7BS,OAAOc,IAAI,CAACvB,YAAY,GAAG,CAAC;QAC9B;QAEA,MAAMwB,wBAAwBf,OAAOc,IAAI,CAACE,kBAAkB,GACxDC,OAAOC,IAAI,CAAClB,OAAOc,IAAI,CAACE,kBAAkB,IAC1C;YAAC;SAAK;QAEV,KAAK,MAAMG,QAAQJ,sBAAuB;YACxC,MAAMK,cAAc7B,YAAY,CAAC4B,KAAkC;YACnE,IAAI,CAACC,aAAa;gBAChB;YACF;YAEA,MAAMC,cAAcF;YACpB,MAAMG,WAAYtB,OAAOc,IAAI,CAACvB,YAAY,CAAC8B,YAAY,IAAI,CAAC;YAC5DrB,OAAOc,IAAI,CAACvB,YAAY,CAAC8B,YAAY,GAAG;gBACtC,GAAGC,QAAQ;gBACX,cAAcF,YAAY7B,YAAY,CAAC,aAAa;YACtD;QACF;QAEA,2EAA2E;QAC3E,yEAAyE;QACzE,IAAIoB,aAAaY,QAAQ,EAAE;YACzB,OAAOvB;QACT;QAEA,OAAO;YACL,GAAGA,MAAM;YACTG,OAAO;gBACL,GAAGH,OAAOG,KAAK;gBACfqB,YAAY;oBACV,GAAGxB,OAAOG,KAAK,EAAEqB,UAAU;oBAC3BC,uBAAuB;2BACjBzB,OAAOG,KAAK,EAAEqB,YAAYC,yBAAyB,EAAE;wBACzD;qBACD;gBACH;YACF;YACAC,WAAW;mBACL1B,OAAO0B,SAAS,IAAI,EAAE;gBAC1B,uDAAuD;gBACvD;oBAAEC,SAAStC;oBAAauC,QAAQ;oBAAQC,MAAM;gBAAO;gBACrD,uEAAuE;gBACvE,6DAA6D;gBAC7D;oBACEF,SAAS,IAAM,IAAIG,SAAS,MAAM;4BAAEC,SAAS;gCAAEC,OAAO;4BAAO;4BAAGC,QAAQ;wBAAI;oBAC5EL,QAAQ;oBACRC,MAAM;gBACR;aACD;QACH;IACF;AACF,GAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { definePlugin } from 'payload'\n\nimport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'\n\nimport { mcpEndpoint } from './endpoint/index.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequest {\n    payloadAPI: 'GraphQL' | 'local' | 'MCP' | 'REST'\n  }\n  interface RegisteredPlugins {\n    /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nexport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }\n\nexport { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'\n\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, plugins, ...rawConfig }) => {\n    const pluginConfig = sanitizeMCPConfig({ config, pluginConfig: rawConfig })\n\n    // Stash the sanitized config on plugin options so `getPluginConfig()` reads it.\n    const registered = plugins['@payloadcms/plugin-mcp']\n    if (registered) {\n      // @ts-expect-error\n      registered.sanitizedOptions = pluginConfig as unknown as typeof registered.options\n    }\n\n    if (pluginConfig.disabled) {\n      return config\n    }\n\n    return {\n      ...config,\n      endpoints: [\n        ...(config.endpoints ?? []),\n        // Payload prefixes /api, so the full path is /api/mcp.\n        { handler: mcpEndpoint, method: 'post', path: '/mcp' },\n        // Streamable HTTP's optional server=>client GET stream. We don't offer\n        // one, so answer 405 per spec-— clients then skip it cleanly\n        {\n          handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),\n          method: 'get',\n          path: '/mcp',\n        },\n      ],\n    }\n  },\n})\n"],"names":["definePlugin","mcpEndpoint","sanitizeMCPConfig","defineCollectionTool","defineGlobalTool","definePrompt","defineTool","mcpPlugin","slug","order","plugin","config","plugins","rawConfig","pluginConfig","registered","sanitizedOptions","disabled","endpoints","handler","method","path","Response","headers","Allow","status"],"mappings":"AAAA,SAASA,YAAY,QAAQ,UAAS;AAItC,SAASC,WAAW,QAAQ,sBAAqB;AACjD,SAASC,iBAAiB,QAAQ,6BAA4B;AAc9D,SAASC,oBAAoB,EAAEC,gBAAgB,EAAEC,YAAY,EAAEC,UAAU,QAAQ,kBAAiB;AAElG,OAAO,MAAMC,YAAYP,aAA8B;IACrDQ,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAE,GAAGC,WAAW;QACxC,MAAMC,eAAeZ,kBAAkB;YAAES;YAAQG,cAAcD;QAAU;QAEzE,gFAAgF;QAChF,MAAME,aAAaH,OAAO,CAAC,yBAAyB;QACpD,IAAIG,YAAY;YACd,mBAAmB;YACnBA,WAAWC,gBAAgB,GAAGF;QAChC;QAEA,IAAIA,aAAaG,QAAQ,EAAE;YACzB,OAAON;QACT;QAEA,OAAO;YACL,GAAGA,MAAM;YACTO,WAAW;mBACLP,OAAOO,SAAS,IAAI,EAAE;gBAC1B,uDAAuD;gBACvD;oBAAEC,SAASlB;oBAAamB,QAAQ;oBAAQC,MAAM;gBAAO;gBACrD,uEAAuE;gBACvE,6DAA6D;gBAC7D;oBACEF,SAAS,IAAM,IAAIG,SAAS,MAAM;4BAAEC,SAAS;gCAAEC,OAAO;4BAAO;4BAAGC,QAAQ;wBAAI;oBAC5EL,QAAQ;oBACRC,MAAM;gBACR;aACD;QACH;IACF;AACF,GAAE"}

package/dist/mcp/buildMcpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAGvD,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,uCAI5B;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAuLH,CAAA"}
+{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAGvD,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,GAAI,uCAI5B;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SA8LH,CAAA"}

package/dist/mcp/buildMcpServer.js

@@ -94,6 +94,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                             input: item.tool.input
                         });
                         server.registerTool(item.mcpName, {
+                            annotations: item.tool.annotations,
                             description: item.tool.description,
                             inputSchema: toStandardSchema(inputSchema)
                         }, async (input, ctx)=>callEntityTool({
@@ -147,6 +148,7 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                     {
                         const tool = item.tool;
                         server.registerTool(item.mcpName, {
+                            annotations: tool.annotations,
                             description: tool.description,
                             inputSchema: tool.input ? toStandardSchema(tool.input) : undefined
                         }, async (input, ctx)=>finalizeToolResponse(await tool.handler({

package/dist/mcp/buildMcpServer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/buildMcpServer.ts"],"sourcesContent":["import { McpServer, type ServerContext } from '@modelcontextprotocol/server'\nimport { APIError, type PayloadRequest } from 'payload'\nimport { z } from 'zod'\n\nimport type {\n  AuthorizedMCP,\n  CollectionMCPItem,\n  GlobalMCPItem,\n  JsonSchemaType,\n  MCPResponseOverride,\n  MCPToolResponse,\n  SanitizedMCPPluginConfig,\n  ToolInputSchema,\n} from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { toStandardSchema } from '../utils/toStandardSchema.js'\n\n/**\n * Transport-agnostic core: registers every authorized MCP item onto a fresh\n * `McpServer` and returns it. The caller is responsible for picking a transport\n * (`WebStandardStreamableHTTPServerTransport`, `StdioServerTransport`, …) and\n * calling `server.connect(transport)`.\n *\n * `req` is the request context handlers see. For HTTP it's the live\n * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a\n * synthesized one built via `createLocalReq`.\n */\nexport const buildMcpServer = ({\n  authorizedMCP,\n  pluginConfig,\n  req,\n}: {\n  authorizedMCP: AuthorizedMCP\n  pluginConfig: SanitizedMCPPluginConfig\n  req: PayloadRequest\n}): McpServer => {\n  const serverOptions = pluginConfig.mcp?.serverOptions || {}\n  const server = new McpServer(\n    { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },\n    serverOptions.options,\n  )\n\n  const logger = getLogger({ payload: req.payload })\n\n  /**\n   * Wrap a tool handler's response with the tool's `overrideResponse`, then\n   * strip the internal `doc` field so it doesn't leak onto the wire.\n   */\n  const finalizeToolResponse = (\n    response: MCPToolResponse,\n    overrideResponse?: MCPResponseOverride,\n  ): MCPToolResponse => {\n    const overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response\n    const { doc: _doc, ...rest } = overridden\n    return rest\n  }\n\n  /**\n   * Runs a collection/global tool call:\n   * - reads `collectionSlug` / `globalSlug` from the input\n   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug\n   * - runs the tool handler and finalizes its response\n   */\n  const callEntityTool = async ({\n    input,\n    item,\n    serverContext,\n  }: {\n    input: unknown\n    item: CollectionMCPItem | GlobalMCPItem\n    serverContext: ServerContext\n  }): Promise<MCPToolResponse> => {\n    const entity = item.type === 'collectionTool' ? 'collection' : 'global'\n    const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug'\n    const toolInput = (input ?? {}) as Record<string, unknown>\n    const slug = toolInput[slugKey] as string | undefined\n\n    if (!slug) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: \"${item.mcpName}\" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const match = authorizedMCP.items.find(\n      (candidate): candidate is CollectionMCPItem | GlobalMCPItem =>\n        candidate.type === item.type &&\n        candidate.mcpName === item.mcpName &&\n        (candidate.type === 'collectionTool'\n          ? candidate.collectionSlug === slug\n          : candidate.type === 'globalTool' && candidate.globalSlug === slug),\n    )\n\n    if (!match) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: MCP access to \"${item.mcpName}\" is not enabled for ${entity} \"${slug}\"`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const handlerArgs = { authorizedMCP, input: toolInput, req, serverContext }\n    const response = await (match.type === 'collectionTool'\n      ? match.tool.handler({ ...handlerArgs, collectionSlug: slug })\n      : match.tool.handler({ ...handlerArgs, globalSlug: slug }))\n\n    return finalizeToolResponse(response, match.tool.overrideResponse)\n  }\n\n  try {\n    const registeredEntityTools = new Set<string>()\n\n    for (const item of authorizedMCP.items) {\n      switch (item.type) {\n        case 'collectionTool':\n        case 'globalTool': {\n          if (registeredEntityTools.has(item.mcpName)) {\n            break\n          }\n          registeredEntityTools.add(item.mcpName)\n\n          const inputSchema = withSlugInput({\n            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',\n            input: item.tool.input,\n          })\n\n          server.registerTool(\n            item.mcpName,\n            {\n              description: item.tool.description,\n              inputSchema: toStandardSchema(inputSchema),\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              callEntityTool({ input, item, serverContext: ctx }),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n        case 'prompt': {\n          const prompt = item.prompt\n          server.registerPrompt(\n            item.mcpName,\n            {\n              argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,\n              description: prompt.description,\n              title: prompt.title,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              prompt.handler({\n                input: (input ?? {}) as Record<string, unknown>,\n                req,\n                serverContext: ctx,\n              }),\n          )\n          logger.info(`✅ Prompt: ${prompt.title} Registered.`)\n          break\n        }\n        case 'resource': {\n          const resource = item.resource\n          server.registerResource(\n            item.mcpName,\n            // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)\n            resource.uri,\n            {\n              description: resource.description,\n              mimeType: resource.mimeType,\n              title: resource.title,\n            },\n            // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).\n            // The rest-params shape lets us collect either signature uniformly.\n            async (...sdkArgs: unknown[]) => {\n              const ctx = sdkArgs[sdkArgs.length - 1] as ServerContext\n              const uri = sdkArgs[0] as URL\n              const params = (sdkArgs.length > 2 ? sdkArgs[1] : {}) as Record<string, string>\n              return resource.handler({ params, req, serverContext: ctx, uri })\n            },\n          )\n          logger.info(`✅ Resource: ${resource.title} Registered.`)\n          break\n        }\n        case 'tool': {\n          const tool = item.tool\n          server.registerTool(\n            item.mcpName,\n            {\n              description: tool.description,\n              inputSchema: tool.input ? toStandardSchema(tool.input) : undefined,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              finalizeToolResponse(\n                await tool.handler({\n                  authorizedMCP,\n                  input: (input ?? {}) as Record<string, unknown>,\n                  req,\n                  serverContext: ctx,\n                }),\n                tool.overrideResponse,\n              ),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n      }\n    }\n  } catch (error) {\n    throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500)\n  }\n\n  return server\n}\n\nconst withSlugInput = ({\n  name,\n  input,\n}: {\n  input?: ToolInputSchema\n  name: 'collectionSlug' | 'globalSlug'\n}): ToolInputSchema => {\n  const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug'\n  const slugSchema = z.string().describe(description)\n\n  if (!input) {\n    return z.object({ [name]: slugSchema })\n  }\n\n  if (input instanceof z.ZodObject) {\n    return input.extend({ [name]: slugSchema })\n  }\n\n  const schema = input as {\n    properties?: Record<string, JsonSchemaType>\n    required?: string[]\n  } & JsonSchemaType\n\n  return {\n    ...schema,\n    type: 'object',\n    properties: {\n      ...schema.properties,\n      [name]: {\n        type: 'string',\n        description,\n      },\n    },\n    required: Array.from(new Set([name, ...(schema.required ?? [])])),\n  }\n}\n"],"names":["McpServer","APIError","z","getLogger","toStandardSchema","buildMcpServer","authorizedMCP","pluginConfig","req","serverOptions","mcp","server","name","version","serverInfo","options","logger","payload","finalizeToolResponse","response","overrideResponse","overridden","doc","_doc","rest","callEntityTool","input","item","serverContext","entity","type","slugKey","toolInput","slug","content","text","mcpName","isError","match","items","find","candidate","collectionSlug","globalSlug","handlerArgs","tool","handler","registeredEntityTools","Set","has","add","inputSchema","withSlugInput","registerTool","description","ctx","info","prompt","registerPrompt","argsSchema","undefined","title","resource","registerResource","uri","mimeType","sdkArgs","length","params","error","String","slugSchema","string","describe","object","ZodObject","extend","schema","properties","required","Array","from"],"mappings":"AAAA,SAASA,SAAS,QAA4B,+BAA8B;AAC5E,SAASC,QAAQ,QAA6B,UAAS;AACvD,SAASC,CAAC,QAAQ,MAAK;AAavB,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,aAAa,EACbC,YAAY,EACZC,GAAG,EAKJ;IACC,MAAMC,gBAAgBF,aAAaG,GAAG,EAAED,iBAAiB,CAAC;IAC1D,MAAME,SAAS,IAAIX,UACjB;QAAEY,MAAM;QAAsBC,SAAS;QAAS,GAAGJ,cAAcK,UAAU;IAAC,GAC5EL,cAAcM,OAAO;IAGvB,MAAMC,SAASb,UAAU;QAAEc,SAAST,IAAIS,OAAO;IAAC;IAEhD;;;GAGC,GACD,MAAMC,uBAAuB,CAC3BC,UACAC;QAEA,MAAMC,aAAaD,mBAAmBD,UAAUA,SAASG,GAAG,IAAI,CAAC,GAAGd,QAAQW;QAC5E,MAAM,EAAEG,KAAKC,IAAI,EAAE,GAAGC,MAAM,GAAGH;QAC/B,OAAOG;IACT;IAEA;;;;;GAKC,GACD,MAAMC,iBAAiB,OAAO,EAC5BC,KAAK,EACLC,IAAI,EACJC,aAAa,EAKd;QACC,MAAMC,SAASF,KAAKG,IAAI,KAAK,mBAAmB,eAAe;QAC/D,MAAMC,UAAUJ,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;QACpE,MAAME,YAAaN,SAAS,CAAC;QAC7B,MAAMO,OAAOD,SAAS,CAACD,QAAQ;QAE/B,IAAI,CAACE,MAAM;YACT,OAAO;gBACLC,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,QAAQ,EAAER,KAAKS,OAAO,CAAC,WAAW,EAAEL,QAAQ,+BAA+B,EAAEF,OAAO,OAAO,CAAC;oBACrG;iBACD;gBACDQ,SAAS;YACX;QACF;QAEA,MAAMC,QAAQhC,cAAciC,KAAK,CAACC,IAAI,CACpC,CAACC,YACCA,UAAUX,IAAI,KAAKH,KAAKG,IAAI,IAC5BW,UAAUL,OAAO,KAAKT,KAAKS,OAAO,IACjCK,CAAAA,UAAUX,IAAI,KAAK,mBAChBW,UAAUC,cAAc,KAAKT,OAC7BQ,UAAUX,IAAI,KAAK,gBAAgBW,UAAUE,UAAU,KAAKV,IAAG;QAGvE,IAAI,CAACK,OAAO;YACV,OAAO;gBACLJ,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,sBAAsB,EAAER,KAAKS,OAAO,CAAC,qBAAqB,EAAEP,OAAO,EAAE,EAAEI,KAAK,CAAC,CAAC;oBACvF;iBACD;gBACDI,SAAS;YACX;QACF;QAEA,MAAMO,cAAc;YAAEtC;YAAeoB,OAAOM;YAAWxB;YAAKoB;QAAc;QAC1E,MAAMT,WAAW,MAAOmB,CAAAA,MAAMR,IAAI,KAAK,mBACnCQ,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEF,gBAAgBT;QAAK,KAC1DK,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAED,YAAYV;QAAK,EAAC;QAE3D,OAAOf,qBAAqBC,UAAUmB,MAAMO,IAAI,CAACzB,gBAAgB;IACnE;IAEA,IAAI;QACF,MAAM2B,wBAAwB,IAAIC;QAElC,KAAK,MAAMrB,QAAQrB,cAAciC,KAAK,CAAE;YACtC,OAAQZ,KAAKG,IAAI;gBACf,KAAK;gBACL,KAAK;oBAAc;wBACjB,IAAIiB,sBAAsBE,GAAG,CAACtB,KAAKS,OAAO,GAAG;4BAC3C;wBACF;wBACAW,sBAAsBG,GAAG,CAACvB,KAAKS,OAAO;wBAEtC,MAAMe,cAAcC,cAAc;4BAChCxC,MAAMe,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;4BAC1DJ,OAAOC,KAAKkB,IAAI,CAACnB,KAAK;wBACxB;wBAEAf,OAAO0C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAa3B,KAAKkB,IAAI,CAACS,WAAW;4BAClCH,aAAa/C,iBAAiB+C;wBAChC,GACA,OAAOzB,OAAgB6B,MACrB9B,eAAe;gCAAEC;gCAAOC;gCAAMC,eAAe2B;4BAAI;wBAErDvC,OAAOwC,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;gBACA,KAAK;oBAAU;wBACb,MAAMqB,SAAS9B,KAAK8B,MAAM;wBAC1B9C,OAAO+C,cAAc,CACnB/B,KAAKS,OAAO,EACZ;4BACEuB,YAAYF,OAAOE,UAAU,GAAGvD,iBAAiBqD,OAAOE,UAAU,IAAIC;4BACtEN,aAAaG,OAAOH,WAAW;4BAC/BO,OAAOJ,OAAOI,KAAK;wBACrB,GACA,OAAOnC,OAAgB6B,MACrBE,OAAOX,OAAO,CAAC;gCACbpB,OAAQA,SAAS,CAAC;gCAClBlB;gCACAoB,eAAe2B;4BACjB;wBAEJvC,OAAOwC,IAAI,CAAC,CAAC,UAAU,EAAEC,OAAOI,KAAK,CAAC,YAAY,CAAC;wBACnD;oBACF;gBACA,KAAK;oBAAY;wBACf,MAAMC,WAAWnC,KAAKmC,QAAQ;wBAC9BnD,OAAOoD,gBAAgB,CACrBpC,KAAKS,OAAO,EACZ,mFAAmF;wBACnF0B,SAASE,GAAG,EACZ;4BACEV,aAAaQ,SAASR,WAAW;4BACjCW,UAAUH,SAASG,QAAQ;4BAC3BJ,OAAOC,SAASD,KAAK;wBACvB,GACA,0EAA0E;wBAC1E,oEAAoE;wBACpE,OAAO,GAAGK;4BACR,MAAMX,MAAMW,OAAO,CAACA,QAAQC,MAAM,GAAG,EAAE;4BACvC,MAAMH,MAAME,OAAO,CAAC,EAAE;4BACtB,MAAME,SAAUF,QAAQC,MAAM,GAAG,IAAID,OAAO,CAAC,EAAE,GAAG,CAAC;4BACnD,OAAOJ,SAAShB,OAAO,CAAC;gCAAEsB;gCAAQ5D;gCAAKoB,eAAe2B;gCAAKS;4BAAI;wBACjE;wBAEFhD,OAAOwC,IAAI,CAAC,CAAC,YAAY,EAAEM,SAASD,KAAK,CAAC,YAAY,CAAC;wBACvD;oBACF;gBACA,KAAK;oBAAQ;wBACX,MAAMhB,OAAOlB,KAAKkB,IAAI;wBACtBlC,OAAO0C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAaT,KAAKS,WAAW;4BAC7BH,aAAaN,KAAKnB,KAAK,GAAGtB,iBAAiByC,KAAKnB,KAAK,IAAIkC;wBAC3D,GACA,OAAOlC,OAAgB6B,MACrBrC,qBACE,MAAM2B,KAAKC,OAAO,CAAC;gCACjBxC;gCACAoB,OAAQA,SAAS,CAAC;gCAClBlB;gCACAoB,eAAe2B;4BACjB,IACAV,KAAKzB,gBAAgB;wBAG3BJ,OAAOwC,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;YACF;QACF;IACF,EAAE,OAAOiC,OAAO;QACd,MAAM,IAAIpE,SAAS,CAAC,gCAAgC,EAAEqE,OAAOD,QAAQ,EAAE;IACzE;IAEA,OAAO1D;AACT,EAAC;AAED,MAAMyC,gBAAgB,CAAC,EACrBxC,IAAI,EACJc,KAAK,EAIN;IACC,MAAM4B,cAAc1C,SAAS,mBAAmB,wBAAwB;IACxE,MAAM2D,aAAarE,EAAEsE,MAAM,GAAGC,QAAQ,CAACnB;IAEvC,IAAI,CAAC5B,OAAO;QACV,OAAOxB,EAAEwE,MAAM,CAAC;YAAE,CAAC9D,KAAK,EAAE2D;QAAW;IACvC;IAEA,IAAI7C,iBAAiBxB,EAAEyE,SAAS,EAAE;QAChC,OAAOjD,MAAMkD,MAAM,CAAC;YAAE,CAAChE,KAAK,EAAE2D;QAAW;IAC3C;IAEA,MAAMM,SAASnD;IAKf,OAAO;QACL,GAAGmD,MAAM;QACT/C,MAAM;QACNgD,YAAY;YACV,GAAGD,OAAOC,UAAU;YACpB,CAAClE,KAAK,EAAE;gBACNkB,MAAM;gBACNwB;YACF;QACF;QACAyB,UAAUC,MAAMC,IAAI,CAAC,IAAIjC,IAAI;YAACpC;eAAUiE,OAAOE,QAAQ,IAAI,EAAE;SAAE;IACjE;AACF"}
+{"version":3,"sources":["../../src/mcp/buildMcpServer.ts"],"sourcesContent":["import { McpServer, type ServerContext } from '@modelcontextprotocol/server'\nimport { APIError, type PayloadRequest } from 'payload'\nimport { z } from 'zod'\n\nimport type {\n  AuthorizedMCP,\n  CollectionMCPItem,\n  GlobalMCPItem,\n  JsonSchemaType,\n  MCPResponseOverride,\n  MCPToolResponse,\n  SanitizedMCPPluginConfig,\n  ToolInputSchema,\n} from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { toStandardSchema } from '../utils/toStandardSchema.js'\n\n/**\n * Transport-agnostic core: registers every authorized MCP item onto a fresh\n * `McpServer` and returns it. The caller is responsible for picking a transport\n * (`WebStandardStreamableHTTPServerTransport`, `StdioServerTransport`, …) and\n * calling `server.connect(transport)`.\n *\n * `req` is the request context handlers see. For HTTP it's the live\n * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a\n * synthesized one built via `createLocalReq`.\n */\nexport const buildMcpServer = ({\n  authorizedMCP,\n  pluginConfig,\n  req,\n}: {\n  authorizedMCP: AuthorizedMCP\n  pluginConfig: SanitizedMCPPluginConfig\n  req: PayloadRequest\n}): McpServer => {\n  const serverOptions = pluginConfig.mcp?.serverOptions || {}\n  const server = new McpServer(\n    { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },\n    serverOptions.options,\n  )\n\n  const logger = getLogger({ payload: req.payload })\n\n  /**\n   * Wrap a tool handler's response with the tool's `overrideResponse`, then\n   * strip the internal `doc` field so it doesn't leak onto the wire.\n   */\n  const finalizeToolResponse = (\n    response: MCPToolResponse,\n    overrideResponse?: MCPResponseOverride,\n  ): MCPToolResponse => {\n    const overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response\n    const { doc: _doc, ...rest } = overridden\n    return rest\n  }\n\n  /**\n   * Runs a collection/global tool call:\n   * - reads `collectionSlug` / `globalSlug` from the input\n   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug\n   * - runs the tool handler and finalizes its response\n   */\n  const callEntityTool = async ({\n    input,\n    item,\n    serverContext,\n  }: {\n    input: unknown\n    item: CollectionMCPItem | GlobalMCPItem\n    serverContext: ServerContext\n  }): Promise<MCPToolResponse> => {\n    const entity = item.type === 'collectionTool' ? 'collection' : 'global'\n    const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug'\n    const toolInput = (input ?? {}) as Record<string, unknown>\n    const slug = toolInput[slugKey] as string | undefined\n\n    if (!slug) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: \"${item.mcpName}\" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const match = authorizedMCP.items.find(\n      (candidate): candidate is CollectionMCPItem | GlobalMCPItem =>\n        candidate.type === item.type &&\n        candidate.mcpName === item.mcpName &&\n        (candidate.type === 'collectionTool'\n          ? candidate.collectionSlug === slug\n          : candidate.type === 'globalTool' && candidate.globalSlug === slug),\n    )\n\n    if (!match) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: MCP access to \"${item.mcpName}\" is not enabled for ${entity} \"${slug}\"`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const handlerArgs = {\n      authorizedMCP,\n      input: toolInput,\n      req,\n      serverContext,\n    }\n    const response = await (match.type === 'collectionTool'\n      ? match.tool.handler({ ...handlerArgs, collectionSlug: slug })\n      : match.tool.handler({ ...handlerArgs, globalSlug: slug }))\n\n    return finalizeToolResponse(response, match.tool.overrideResponse)\n  }\n\n  try {\n    const registeredEntityTools = new Set<string>()\n\n    for (const item of authorizedMCP.items) {\n      switch (item.type) {\n        case 'collectionTool':\n        case 'globalTool': {\n          if (registeredEntityTools.has(item.mcpName)) {\n            break\n          }\n          registeredEntityTools.add(item.mcpName)\n\n          const inputSchema = withSlugInput({\n            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',\n            input: item.tool.input,\n          })\n\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: item.tool.annotations,\n              description: item.tool.description,\n              inputSchema: toStandardSchema(inputSchema),\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              callEntityTool({ input, item, serverContext: ctx }),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n        case 'prompt': {\n          const prompt = item.prompt\n          server.registerPrompt(\n            item.mcpName,\n            {\n              argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,\n              description: prompt.description,\n              title: prompt.title,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              prompt.handler({\n                input: (input ?? {}) as Record<string, unknown>,\n                req,\n                serverContext: ctx,\n              }),\n          )\n          logger.info(`✅ Prompt: ${prompt.title} Registered.`)\n          break\n        }\n        case 'resource': {\n          const resource = item.resource\n          server.registerResource(\n            item.mcpName,\n            // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)\n            resource.uri,\n            {\n              description: resource.description,\n              mimeType: resource.mimeType,\n              title: resource.title,\n            },\n            // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).\n            // The rest-params shape lets us collect either signature uniformly.\n            async (...sdkArgs: unknown[]) => {\n              const ctx = sdkArgs[sdkArgs.length - 1] as ServerContext\n              const uri = sdkArgs[0] as URL\n              const params = (sdkArgs.length > 2 ? sdkArgs[1] : {}) as Record<string, string>\n              return resource.handler({ params, req, serverContext: ctx, uri })\n            },\n          )\n          logger.info(`✅ Resource: ${resource.title} Registered.`)\n          break\n        }\n        case 'tool': {\n          const tool = item.tool\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: tool.annotations,\n              description: tool.description,\n              inputSchema: tool.input ? toStandardSchema(tool.input) : undefined,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              finalizeToolResponse(\n                await tool.handler({\n                  authorizedMCP,\n                  input: (input ?? {}) as Record<string, unknown>,\n                  req,\n                  serverContext: ctx,\n                }),\n                tool.overrideResponse,\n              ),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n      }\n    }\n  } catch (error) {\n    throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500)\n  }\n\n  return server\n}\n\nconst withSlugInput = ({\n  name,\n  input,\n}: {\n  input?: ToolInputSchema\n  name: 'collectionSlug' | 'globalSlug'\n}): ToolInputSchema => {\n  const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug'\n  const slugSchema = z.string().describe(description)\n\n  if (!input) {\n    return z.object({ [name]: slugSchema })\n  }\n\n  if (input instanceof z.ZodObject) {\n    return input.extend({ [name]: slugSchema })\n  }\n\n  const schema = input as {\n    properties?: Record<string, JsonSchemaType>\n    required?: string[]\n  } & JsonSchemaType\n\n  return {\n    ...schema,\n    type: 'object',\n    properties: {\n      ...schema.properties,\n      [name]: {\n        type: 'string',\n        description,\n      },\n    },\n    required: Array.from(new Set([name, ...(schema.required ?? [])])),\n  }\n}\n"],"names":["McpServer","APIError","z","getLogger","toStandardSchema","buildMcpServer","authorizedMCP","pluginConfig","req","serverOptions","mcp","server","name","version","serverInfo","options","logger","payload","finalizeToolResponse","response","overrideResponse","overridden","doc","_doc","rest","callEntityTool","input","item","serverContext","entity","type","slugKey","toolInput","slug","content","text","mcpName","isError","match","items","find","candidate","collectionSlug","globalSlug","handlerArgs","tool","handler","registeredEntityTools","Set","has","add","inputSchema","withSlugInput","registerTool","annotations","description","ctx","info","prompt","registerPrompt","argsSchema","undefined","title","resource","registerResource","uri","mimeType","sdkArgs","length","params","error","String","slugSchema","string","describe","object","ZodObject","extend","schema","properties","required","Array","from"],"mappings":"AAAA,SAASA,SAAS,QAA4B,+BAA8B;AAC5E,SAASC,QAAQ,QAA6B,UAAS;AACvD,SAASC,CAAC,QAAQ,MAAK;AAavB,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,aAAa,EACbC,YAAY,EACZC,GAAG,EAKJ;IACC,MAAMC,gBAAgBF,aAAaG,GAAG,EAAED,iBAAiB,CAAC;IAC1D,MAAME,SAAS,IAAIX,UACjB;QAAEY,MAAM;QAAsBC,SAAS;QAAS,GAAGJ,cAAcK,UAAU;IAAC,GAC5EL,cAAcM,OAAO;IAGvB,MAAMC,SAASb,UAAU;QAAEc,SAAST,IAAIS,OAAO;IAAC;IAEhD;;;GAGC,GACD,MAAMC,uBAAuB,CAC3BC,UACAC;QAEA,MAAMC,aAAaD,mBAAmBD,UAAUA,SAASG,GAAG,IAAI,CAAC,GAAGd,QAAQW;QAC5E,MAAM,EAAEG,KAAKC,IAAI,EAAE,GAAGC,MAAM,GAAGH;QAC/B,OAAOG;IACT;IAEA;;;;;GAKC,GACD,MAAMC,iBAAiB,OAAO,EAC5BC,KAAK,EACLC,IAAI,EACJC,aAAa,EAKd;QACC,MAAMC,SAASF,KAAKG,IAAI,KAAK,mBAAmB,eAAe;QAC/D,MAAMC,UAAUJ,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;QACpE,MAAME,YAAaN,SAAS,CAAC;QAC7B,MAAMO,OAAOD,SAAS,CAACD,QAAQ;QAE/B,IAAI,CAACE,MAAM;YACT,OAAO;gBACLC,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,QAAQ,EAAER,KAAKS,OAAO,CAAC,WAAW,EAAEL,QAAQ,+BAA+B,EAAEF,OAAO,OAAO,CAAC;oBACrG;iBACD;gBACDQ,SAAS;YACX;QACF;QAEA,MAAMC,QAAQhC,cAAciC,KAAK,CAACC,IAAI,CACpC,CAACC,YACCA,UAAUX,IAAI,KAAKH,KAAKG,IAAI,IAC5BW,UAAUL,OAAO,KAAKT,KAAKS,OAAO,IACjCK,CAAAA,UAAUX,IAAI,KAAK,mBAChBW,UAAUC,cAAc,KAAKT,OAC7BQ,UAAUX,IAAI,KAAK,gBAAgBW,UAAUE,UAAU,KAAKV,IAAG;QAGvE,IAAI,CAACK,OAAO;YACV,OAAO;gBACLJ,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,sBAAsB,EAAER,KAAKS,OAAO,CAAC,qBAAqB,EAAEP,OAAO,EAAE,EAAEI,KAAK,CAAC,CAAC;oBACvF;iBACD;gBACDI,SAAS;YACX;QACF;QAEA,MAAMO,cAAc;YAClBtC;YACAoB,OAAOM;YACPxB;YACAoB;QACF;QACA,MAAMT,WAAW,MAAOmB,CAAAA,MAAMR,IAAI,KAAK,mBACnCQ,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEF,gBAAgBT;QAAK,KAC1DK,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAED,YAAYV;QAAK,EAAC;QAE3D,OAAOf,qBAAqBC,UAAUmB,MAAMO,IAAI,CAACzB,gBAAgB;IACnE;IAEA,IAAI;QACF,MAAM2B,wBAAwB,IAAIC;QAElC,KAAK,MAAMrB,QAAQrB,cAAciC,KAAK,CAAE;YACtC,OAAQZ,KAAKG,IAAI;gBACf,KAAK;gBACL,KAAK;oBAAc;wBACjB,IAAIiB,sBAAsBE,GAAG,CAACtB,KAAKS,OAAO,GAAG;4BAC3C;wBACF;wBACAW,sBAAsBG,GAAG,CAACvB,KAAKS,OAAO;wBAEtC,MAAMe,cAAcC,cAAc;4BAChCxC,MAAMe,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;4BAC1DJ,OAAOC,KAAKkB,IAAI,CAACnB,KAAK;wBACxB;wBAEAf,OAAO0C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAa3B,KAAKkB,IAAI,CAACS,WAAW;4BAClCC,aAAa5B,KAAKkB,IAAI,CAACU,WAAW;4BAClCJ,aAAa/C,iBAAiB+C;wBAChC,GACA,OAAOzB,OAAgB8B,MACrB/B,eAAe;gCAAEC;gCAAOC;gCAAMC,eAAe4B;4BAAI;wBAErDxC,OAAOyC,IAAI,CAAC,CAAC,QAAQ,EAAE9B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;gBACA,KAAK;oBAAU;wBACb,MAAMsB,SAAS/B,KAAK+B,MAAM;wBAC1B/C,OAAOgD,cAAc,CACnBhC,KAAKS,OAAO,EACZ;4BACEwB,YAAYF,OAAOE,UAAU,GAAGxD,iBAAiBsD,OAAOE,UAAU,IAAIC;4BACtEN,aAAaG,OAAOH,WAAW;4BAC/BO,OAAOJ,OAAOI,KAAK;wBACrB,GACA,OAAOpC,OAAgB8B,MACrBE,OAAOZ,OAAO,CAAC;gCACbpB,OAAQA,SAAS,CAAC;gCAClBlB;gCACAoB,eAAe4B;4BACjB;wBAEJxC,OAAOyC,IAAI,CAAC,CAAC,UAAU,EAAEC,OAAOI,KAAK,CAAC,YAAY,CAAC;wBACnD;oBACF;gBACA,KAAK;oBAAY;wBACf,MAAMC,WAAWpC,KAAKoC,QAAQ;wBAC9BpD,OAAOqD,gBAAgB,CACrBrC,KAAKS,OAAO,EACZ,mFAAmF;wBACnF2B,SAASE,GAAG,EACZ;4BACEV,aAAaQ,SAASR,WAAW;4BACjCW,UAAUH,SAASG,QAAQ;4BAC3BJ,OAAOC,SAASD,KAAK;wBACvB,GACA,0EAA0E;wBAC1E,oEAAoE;wBACpE,OAAO,GAAGK;4BACR,MAAMX,MAAMW,OAAO,CAACA,QAAQC,MAAM,GAAG,EAAE;4BACvC,MAAMH,MAAME,OAAO,CAAC,EAAE;4BACtB,MAAME,SAAUF,QAAQC,MAAM,GAAG,IAAID,OAAO,CAAC,EAAE,GAAG,CAAC;4BACnD,OAAOJ,SAASjB,OAAO,CAAC;gCAAEuB;gCAAQ7D;gCAAKoB,eAAe4B;gCAAKS;4BAAI;wBACjE;wBAEFjD,OAAOyC,IAAI,CAAC,CAAC,YAAY,EAAEM,SAASD,KAAK,CAAC,YAAY,CAAC;wBACvD;oBACF;gBACA,KAAK;oBAAQ;wBACX,MAAMjB,OAAOlB,KAAKkB,IAAI;wBACtBlC,OAAO0C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAaT,KAAKS,WAAW;4BAC7BC,aAAaV,KAAKU,WAAW;4BAC7BJ,aAAaN,KAAKnB,KAAK,GAAGtB,iBAAiByC,KAAKnB,KAAK,IAAImC;wBAC3D,GACA,OAAOnC,OAAgB8B,MACrBtC,qBACE,MAAM2B,KAAKC,OAAO,CAAC;gCACjBxC;gCACAoB,OAAQA,SAAS,CAAC;gCAClBlB;gCACAoB,eAAe4B;4BACjB,IACAX,KAAKzB,gBAAgB;wBAG3BJ,OAAOyC,IAAI,CAAC,CAAC,QAAQ,EAAE9B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;YACF;QACF;IACF,EAAE,OAAOkC,OAAO;QACd,MAAM,IAAIrE,SAAS,CAAC,gCAAgC,EAAEsE,OAAOD,QAAQ,EAAE;IACzE;IAEA,OAAO3D;AACT,EAAC;AAED,MAAMyC,gBAAgB,CAAC,EACrBxC,IAAI,EACJc,KAAK,EAIN;IACC,MAAM6B,cAAc3C,SAAS,mBAAmB,wBAAwB;IACxE,MAAM4D,aAAatE,EAAEuE,MAAM,GAAGC,QAAQ,CAACnB;IAEvC,IAAI,CAAC7B,OAAO;QACV,OAAOxB,EAAEyE,MAAM,CAAC;YAAE,CAAC/D,KAAK,EAAE4D;QAAW;IACvC;IAEA,IAAI9C,iBAAiBxB,EAAE0E,SAAS,EAAE;QAChC,OAAOlD,MAAMmD,MAAM,CAAC;YAAE,CAACjE,KAAK,EAAE4D;QAAW;IAC3C;IAEA,MAAMM,SAASpD;IAKf,OAAO;QACL,GAAGoD,MAAM;QACThD,MAAM;QACNiD,YAAY;YACV,GAAGD,OAAOC,UAAU;YACpB,CAACnE,KAAK,EAAE;gBACNkB,MAAM;gBACNyB;YACF;QACF;QACAyB,UAAUC,MAAMC,IAAI,CAAC,IAAIlC,IAAI;YAACpC;eAAUkE,OAAOE,QAAQ,IAAI,EAAE;SAAE;IACjE;AACF"}