npm - @payloadcms/plugin-mcp - Versions diffs - 4.0.0-internal.697830c → 4.0.0-internal.7e57eed - Mend

@payloadcms/plugin-mcp 4.0.0-internal.697830c → 4.0.0-internal.7e57eed

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (61) hide show

package/dist/mcp/sanitizeMCPConfig.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n CollectionConfig,\n Config,\n GlobalConfig,\n SanitizedCollectionConfig,\n SanitizedConfig,\n SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n CollectionMCPItem,\n CollectionTool,\n GlobalMCPItem,\n GlobalTool,\n MCPItem,\n MCPPluginConfig,\n SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport { defaultAccess } from '../defaultAccess.js'\nimport {\n COLLECTION_AUTH_BUILTIN_ENTRIES,\n COLLECTION_AUTH_BUILTINS,\n COLLECTION_BUILTIN_ENTRIES,\n COLLECTION_BUILTINS,\n GLOBAL_BUILTIN_ENTRIES,\n GLOBAL_BUILTINS,\n TOOL_BUILTIN_ENTRIES,\n TOOL_BUILTINS,\n} from './builtinTools.js'\n\n/*\n Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n * - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n * tool maps into a single `items` array.\n * - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n \n Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n /\nexport const sanitizeMCPConfig = ({\n config,\n pluginConfig,\n}: {\n config: Config \| SanitizedConfig\n pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n const items: MCPItem[] = []\n\n for (const collection of config.collections ?? []) {\n items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n }\n\n for (const global of config.globals ?? []) {\n items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n }\n\n for (const [configKey, { mcpName, tool }] of TOOL_BUILTIN_ENTRIES) {\n items.push({\n type: 'tool',\n configKey,\n label: tool.annotations?.title ?? configKey,\n mcpName,\n tool: { ...tool, access: tool.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})) {\n if (configKey in TOOL_BUILTINS) {\n continue\n }\n items.push({\n type: 'tool',\n configKey,\n label: tool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...tool, access: tool.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n items.push({\n type: 'prompt',\n configKey,\n label: prompt.title ?? configKey,\n mcpName: configKey,\n prompt: { ...prompt, access: prompt.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})) {\n items.push({\n type: 'resource',\n configKey,\n label: resource.title ?? configKey,\n mcpName: configKey,\n resource: { ...resource, access: resource.access ?? defaultAccess },\n })\n }\n\n return {\n disabled: pluginConfig.disabled,\n hooks: pluginConfig.hooks,\n items,\n mcp: pluginConfig.mcp,\n overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,\n }\n}\n\nconst sanitizeCollectionConfig = ({\n collection,\n pluginConfig,\n}: {\n collection: CollectionConfig \| SanitizedCollectionConfig\n pluginConfig: MCPPluginConfig\n}): CollectionMCPItem[] => {\n const slug = collection.slug\n const collectionPluginConfig = pluginConfig.collections?.[slug]\n const items: CollectionMCPItem[] = []\n /\n Payload disables duplicate for auth collections by default unless the\n * collection explicitly opts back in with `disableDuplicate: false`.\n */\n const isDuplicateDisabled =\n collection.disableDuplicate === true \|\|\n (Boolean(collection.auth) && collection.disableDuplicate !== false)\n\n for (const [\n toolKey,\n { mcpName, requiresDuplicateEnabled, requiresVersions, tool },\n ] of COLLECTION_BUILTIN_ENTRIES) {\n if (requiresVersions && !collection.versions) {\n continue\n }\n if (requiresDuplicateEnabled && isDuplicateDisabled) {\n continue\n }\n const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n if (matchedConfigEntry === false) {\n continue\n }\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey: toolKey,\n label: annotations.title ?? toolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n collectionPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n\n if (collection.auth) {\n for (const [authToolKey, { mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n if (!matchedConfigEntry) {\n continue\n }\n // `true` means \"enable, no override\"; only the object form carries fields.\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey: authToolKey,\n label: annotations.title ?? authToolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n collectionPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n }\n\n // Cast: builtin keys are filtered out below, so the remaining values are\n // always custom tools (`CollectionTool`) or undefined\n const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n [string, CollectionTool \| undefined]\n >\n for (const [configKey, customTool] of customEntries) {\n if (configKey in COLLECTION_BUILTINS \|\| configKey in COLLECTION_AUTH_BUILTINS) {\n continue\n }\n if (!customTool) {\n continue\n }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey,\n label: customTool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...customTool, access: customTool.access ?? defaultAccess },\n })\n }\n\n return items\n}\n\nconst sanitizeGlobalConfig = ({\n global,\n pluginConfig,\n}: {\n global: GlobalConfig \| SanitizedGlobalConfig\n pluginConfig: MCPPluginConfig\n}): GlobalMCPItem[] => {\n const slug = global.slug\n const globalPluginConfig = pluginConfig.globals?.[slug]\n const items: GlobalMCPItem[] = []\n\n for (const [toolKey, { mcpName, requiresVersions, tool }] of GLOBAL_BUILTIN_ENTRIES) {\n if (requiresVersions && !global.versions) {\n continue\n }\n const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n if (matchedConfigEntry === false) {\n continue\n }\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'globalTool',\n configKey: toolKey,\n globalSlug: slug,\n label: annotations.title ?? toolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n globalPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n\n const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n [string, GlobalTool \| undefined]\n >\n for (const [configKey, customTool] of customEntries) {\n if (configKey in GLOBAL_BUILTINS) {\n continue\n }\n if (!customTool) {\n continue\n }\n items.push({\n type: 'globalTool',\n configKey,\n globalSlug: slug,\n label: customTool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...customTool, access: customTool.access ?? defaultAccess },\n })\n }\n\n return items\n}\n"],"names":["defaultAccess","COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","TOOL_BUILTIN_ENTRIES","TOOL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","configKey","mcpName","tool","type","label","annotations","title","access","Object","entries","tools","prompt","prompts","resource","resources","disabled","hooks","mcp","overrideGetAuthorizedMCP","slug","collectionPluginConfig","isDuplicateDisabled","disableDuplicate","Boolean","auth","toolKey","requiresDuplicateEnabled","requiresVersions","versions","matchedConfigEntry","override","undefined","collectionSlug","description","overrideResponse","authToolKey","customEntries","customTool","globalPluginConfig","globalSlug"],"mappings":"AAmBA,SAASA,aAAa,QAAQ,sBAAqB;AACnD,SACEC,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,EACfC,oBAAoB,EACpBC,aAAa,QACR,oBAAmB;AAE1B;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,WAAW,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIf,qBAAsB;QACjEK,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC;YACAC,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWE,KAAK,IAAIM,OAAOC,OAAO,CAAClB,aAAamB,KAAK,IAAI,CAAC,GAAI;QACxE,IAAIV,aAAaZ,eAAe;YAC9B;QACF;QACAI,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC,SAASD;YACTE,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWW,OAAO,IAAIH,OAAOC,OAAO,CAAClB,aAAaqB,OAAO,IAAI,CAAC,GAAI;QAC5EpB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOO,OAAOL,KAAK,IAAIN;YACvBC,SAASD;YACTW,QAAQ;gBAAE,GAAGA,MAAM;gBAAEJ,QAAQI,OAAOJ,MAAM,IAAI3B;YAAc;QAC9D;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWa,SAAS,IAAIL,OAAOC,OAAO,CAAClB,aAAauB,SAAS,IAAI,CAAC,GAAI;QAChFtB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOS,SAASP,KAAK,IAAIN;YACzBC,SAASD;YACTa,UAAU;gBAAE,GAAGA,QAAQ;gBAAEN,QAAQM,SAASN,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAO;QACLmC,UAAUxB,aAAawB,QAAQ;QAC/BC,OAAOzB,aAAayB,KAAK;QACzBxB;QACAyB,KAAK1B,aAAa0B,GAAG;QACrBC,0BAA0B3B,aAAa2B,wBAAwB;IACjE;AACF,EAAC;AAED,MAAMtB,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,MAAM4B,OAAO1B,WAAW0B,IAAI;IAC5B,MAAMC,yBAAyB7B,aAAaG,WAAW,EAAE,CAACyB,KAAK;IAC/D,MAAM3B,QAA6B,EAAE;IACrC;;;GAGC,GACD,MAAM6B,sBACJ5B,WAAW6B,gBAAgB,KAAK,QAC/BC,QAAQ9B,WAAW+B,IAAI,KAAK/B,WAAW6B,gBAAgB,KAAK;IAE/D,KAAK,MAAM,CACTG,SACA,EAAExB,OAAO,EAAEyB,wBAAwB,EAAEC,gBAAgB,EAAEzB,IAAI,EAAE,CAC9D,IAAInB,2BAA4B;QAC/B,IAAI4C,oBAAoB,CAAClC,WAAWmC,QAAQ,EAAE;YAC5C;QACF;QACA,IAAIF,4BAA4BL,qBAAqB;YACnD;QACF;QACA,MAAMQ,qBAAqBT,wBAAwBV,OAAO,CAACe,QAAQ;QACnE,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAM1B,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGyB,UAAUzB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN6B,gBAAgBb;YAChBnB,WAAWyB;YACXrB,OAAOC,YAAYC,KAAK,IAAImB;YAC5BxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQuB,UAAUvB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA4B,aAAaH,UAAUG,eAAe/B,KAAK+B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxBhC,KAAKgC,gBAAgB;YACzB;QACF;IACF;IAEA,IAAIzC,WAAW+B,IAAI,EAAE;QACnB,KAAK,MAAM,CAACW,aAAa,EAAElC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIrB,gCAAiC;YAC9E,MAAMgD,qBAAqBT,wBAAwBV,OAAO,CAACyB,YAAY;YACvE,IAAI,CAACN,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;YAC/E,MAAM1B,cAAc;gBAAE,GAAGH,KAAKG,WAAW;gBAAE,GAAGyB,UAAUzB,WAAW;YAAC;YACpEb,MAAMG,IAAI,CAAC;gBACTQ,MAAM;gBACN6B,gBAAgBb;gBAChBnB,WAAWmC;gBACX/B,OAAOC,YAAYC,KAAK,IAAI6B;gBAC5BlC;gBACAC,MAAM;oBACJ,GAAGA,IAAI;oBACPK,QAAQuB,UAAUvB,UAAUL,KAAKK,MAAM,IAAI3B;oBAC3CyB;oBACA4B,aAAaH,UAAUG,eAAe/B,KAAK+B,WAAW;oBACtDC,kBACEJ,UAAUI,oBACVd,wBAAwBc,oBACxBhC,KAAKgC,gBAAgB;gBACzB;YACF;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAME,gBAAgB5B,OAAOC,OAAO,CAACW,wBAAwBV,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACV,WAAWqC,WAAW,IAAID,cAAe;QACnD,IAAIpC,aAAahB,uBAAuBgB,aAAalB,0BAA0B;YAC7E;QACF;QACA,IAAI,CAACuD,YAAY;YACf;QACF;QACA7C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN6B,gBAAgBb;YAChBnB;YACAI,OAAOiC,WAAWhC,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGmC,UAAU;gBAAE9B,QAAQ8B,WAAW9B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAM4B,OAAOtB,OAAOsB,IAAI;IACxB,MAAMmB,qBAAqB/C,aAAaO,OAAO,EAAE,CAACqB,KAAK;IACvD,MAAM3B,QAAyB,EAAE;IAEjC,KAAK,MAAM,CAACiC,SAAS,EAAExB,OAAO,EAAE0B,gBAAgB,EAAEzB,IAAI,EAAE,CAAC,IAAIjB,uBAAwB;QACnF,IAAI0C,oBAAoB,CAAC9B,OAAO+B,QAAQ,EAAE;YACxC;QACF;QACA,MAAMC,qBAAqBS,oBAAoB5B,OAAO,CAACe,QAAQ;QAC/D,IAAII,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAM1B,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAGyB,UAAUzB,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH,WAAWyB;YACXc,YAAYpB;YACZf,OAAOC,YAAYC,KAAK,IAAImB;YAC5BxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQuB,UAAUvB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA4B,aAAaH,UAAUG,eAAe/B,KAAK+B,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVI,oBAAoBJ,oBACpBhC,KAAKgC,gBAAgB;YACzB;QACF;IACF;IAEA,MAAME,gBAAgB5B,OAAOC,OAAO,CAAC6B,oBAAoB5B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACV,WAAWqC,WAAW,IAAID,cAAe;QACnD,IAAIpC,aAAad,iBAAiB;YAChC;QACF;QACA,IAAI,CAACmD,YAAY;YACf;QACF;QACA7C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAuC,YAAYpB;YACZf,OAAOiC,WAAWhC,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGmC,UAAU;gBAAE9B,QAAQ8B,WAAW9B,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT"}
1	+ {"version":3,"sources":["../../src/mcp/sanitizeMCPConfig.ts"],"sourcesContent":["import type {\n CollectionConfig,\n Config,\n GlobalConfig,\n SanitizedCollectionConfig,\n SanitizedConfig,\n SanitizedGlobalConfig,\n} from 'payload'\n\nimport type {\n CollectionMCPItem,\n CollectionTool,\n GlobalMCPItem,\n GlobalTool,\n MCPItem,\n MCPPluginConfig,\n SanitizedMCPPluginConfig,\n} from '../types.js'\n\nimport { defaultAccess } from '../defaultAccess.js'\nimport {\n COLLECTION_AUTH_BUILTIN_ENTRIES,\n COLLECTION_AUTH_BUILTINS,\n COLLECTION_BUILTIN_ENTRIES,\n COLLECTION_BUILTINS,\n GLOBAL_BUILTIN_ENTRIES,\n GLOBAL_BUILTINS,\n TOOL_BUILTIN_ENTRIES,\n TOOL_BUILTINS,\n} from './builtinTools.js'\n\n/*\n Converts the user-configured `MCPPluginConfig` into a `SanitizedMCPPluginConfig`:\n * - Flattens `tools` / `prompts` / `resources` / per-collection / per-global\n * tool maps into a single `items` array.\n * - Applies built-in tools for collections and globals, respecting opt-out user overrides.\n \n Called once during plugin init. After that, `plugins['@payloadcms/plugin-mcp']\n * ?.options` holds the sanitized result\n /\nexport const sanitizeMCPConfig = ({\n config,\n pluginConfig,\n}: {\n config: Config \| SanitizedConfig\n pluginConfig: MCPPluginConfig\n}): SanitizedMCPPluginConfig => {\n const items: MCPItem[] = []\n\n for (const collection of config.collections ?? []) {\n items.push(...sanitizeCollectionConfig({ collection, pluginConfig }))\n }\n\n for (const global of config.globals ?? []) {\n items.push(...sanitizeGlobalConfig({ global, pluginConfig }))\n }\n\n for (const [configKey, { mcpName, tool }] of TOOL_BUILTIN_ENTRIES) {\n items.push({\n type: 'tool',\n configKey,\n label: tool.annotations?.title ?? configKey,\n mcpName,\n tool: { ...tool, access: tool.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, tool] of Object.entries(pluginConfig.tools ?? {})) {\n if (configKey in TOOL_BUILTINS) {\n continue\n }\n items.push({\n type: 'tool',\n configKey,\n label: tool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...tool, access: tool.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, prompt] of Object.entries(pluginConfig.prompts ?? {})) {\n items.push({\n type: 'prompt',\n configKey,\n label: prompt.title ?? configKey,\n mcpName: configKey,\n prompt: { ...prompt, access: prompt.access ?? defaultAccess },\n })\n }\n\n for (const [configKey, resource] of Object.entries(pluginConfig.resources ?? {})) {\n items.push({\n type: 'resource',\n configKey,\n label: resource.title ?? configKey,\n mcpName: configKey,\n resource: { ...resource, access: resource.access ?? defaultAccess },\n })\n }\n\n return {\n disabled: pluginConfig.disabled,\n hooks: pluginConfig.hooks,\n items,\n mcp: pluginConfig.mcp,\n overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,\n }\n}\n\nconst sanitizeCollectionConfig = ({\n collection,\n pluginConfig,\n}: {\n collection: CollectionConfig \| SanitizedCollectionConfig\n pluginConfig: MCPPluginConfig\n}): CollectionMCPItem[] => {\n const slug = collection.slug\n const collectionPluginConfig = pluginConfig.collections?.[slug]\n const items: CollectionMCPItem[] = []\n /\n Payload disables duplicate for auth collections by default unless the\n * collection explicitly opts back in with `disableDuplicate: false`.\n */\n const isDuplicateDisabled =\n collection.disableDuplicate === true \|\|\n (Boolean(collection.auth) && collection.disableDuplicate !== false)\n\n for (const [\n toolKey,\n { mcpName, requiresDuplicateEnabled, requiresUpload, requiresVersions, tool },\n ] of COLLECTION_BUILTIN_ENTRIES) {\n if (requiresVersions && !collection.versions) {\n continue\n }\n if (requiresDuplicateEnabled && isDuplicateDisabled) {\n continue\n }\n if (requiresUpload && !collection.upload) {\n continue\n }\n const matchedConfigEntry = collectionPluginConfig?.tools?.[toolKey]\n if (matchedConfigEntry === false) {\n continue\n }\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey: toolKey,\n label: annotations.title ?? toolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n collectionPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n\n if (collection.auth) {\n for (const [authToolKey, { mcpName, tool }] of COLLECTION_AUTH_BUILTIN_ENTRIES) {\n const matchedConfigEntry = collectionPluginConfig?.tools?.[authToolKey]\n if (!matchedConfigEntry) {\n continue\n }\n // `true` means \"enable, no override\"; only the object form carries fields.\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey: authToolKey,\n label: annotations.title ?? authToolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n collectionPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n }\n\n // Cast: builtin keys are filtered out below, so the remaining values are\n // always custom tools (`CollectionTool`) or undefined\n const customEntries = Object.entries(collectionPluginConfig?.tools ?? {}) as Array<\n [string, CollectionTool \| undefined]\n >\n for (const [configKey, customTool] of customEntries) {\n if (configKey in COLLECTION_BUILTINS \|\| configKey in COLLECTION_AUTH_BUILTINS) {\n continue\n }\n if (!customTool) {\n continue\n }\n items.push({\n type: 'collectionTool',\n collectionSlug: slug,\n configKey,\n label: customTool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...customTool, access: customTool.access ?? defaultAccess },\n })\n }\n\n return items\n}\n\nconst sanitizeGlobalConfig = ({\n global,\n pluginConfig,\n}: {\n global: GlobalConfig \| SanitizedGlobalConfig\n pluginConfig: MCPPluginConfig\n}): GlobalMCPItem[] => {\n const slug = global.slug\n const globalPluginConfig = pluginConfig.globals?.[slug]\n const items: GlobalMCPItem[] = []\n\n for (const [toolKey, { mcpName, requiresVersions, tool }] of GLOBAL_BUILTIN_ENTRIES) {\n if (requiresVersions && !global.versions) {\n continue\n }\n const matchedConfigEntry = globalPluginConfig?.tools?.[toolKey]\n if (matchedConfigEntry === false) {\n continue\n }\n const override = typeof matchedConfigEntry === 'object' ? matchedConfigEntry : undefined\n const annotations = { ...tool.annotations, ...override?.annotations }\n items.push({\n type: 'globalTool',\n configKey: toolKey,\n globalSlug: slug,\n label: annotations.title ?? toolKey,\n mcpName,\n tool: {\n ...tool,\n access: override?.access ?? tool.access ?? defaultAccess,\n annotations,\n description: override?.description ?? tool.description,\n overrideResponse:\n override?.overrideResponse ??\n globalPluginConfig?.overrideResponse ??\n tool.overrideResponse,\n },\n })\n }\n\n const customEntries = Object.entries(globalPluginConfig?.tools ?? {}) as Array<\n [string, GlobalTool \| undefined]\n >\n for (const [configKey, customTool] of customEntries) {\n if (configKey in GLOBAL_BUILTINS) {\n continue\n }\n if (!customTool) {\n continue\n }\n items.push({\n type: 'globalTool',\n configKey,\n globalSlug: slug,\n label: customTool.annotations?.title ?? configKey,\n mcpName: configKey,\n tool: { ...customTool, access: customTool.access ?? defaultAccess },\n })\n }\n\n return items\n}\n"],"names":["defaultAccess","COLLECTION_AUTH_BUILTIN_ENTRIES","COLLECTION_AUTH_BUILTINS","COLLECTION_BUILTIN_ENTRIES","COLLECTION_BUILTINS","GLOBAL_BUILTIN_ENTRIES","GLOBAL_BUILTINS","TOOL_BUILTIN_ENTRIES","TOOL_BUILTINS","sanitizeMCPConfig","config","pluginConfig","items","collection","collections","push","sanitizeCollectionConfig","global","globals","sanitizeGlobalConfig","configKey","mcpName","tool","type","label","annotations","title","access","Object","entries","tools","prompt","prompts","resource","resources","disabled","hooks","mcp","overrideGetAuthorizedMCP","slug","collectionPluginConfig","isDuplicateDisabled","disableDuplicate","Boolean","auth","toolKey","requiresDuplicateEnabled","requiresUpload","requiresVersions","versions","upload","matchedConfigEntry","override","undefined","collectionSlug","description","overrideResponse","authToolKey","customEntries","customTool","globalPluginConfig","globalSlug"],"mappings":"AAmBA,SAASA,aAAa,QAAQ,sBAAqB;AACnD,SACEC,+BAA+B,EAC/BC,wBAAwB,EACxBC,0BAA0B,EAC1BC,mBAAmB,EACnBC,sBAAsB,EACtBC,eAAe,EACfC,oBAAoB,EACpBC,aAAa,QACR,oBAAmB;AAE1B;;;;;;;;CAQC,GACD,OAAO,MAAMC,oBAAoB,CAAC,EAChCC,MAAM,EACNC,YAAY,EAIb;IACC,MAAMC,QAAmB,EAAE;IAE3B,KAAK,MAAMC,cAAcH,OAAOI,WAAW,IAAI,EAAE,CAAE;QACjDF,MAAMG,IAAI,IAAIC,yBAAyB;YAAEH;YAAYF;QAAa;IACpE;IAEA,KAAK,MAAMM,UAAUP,OAAOQ,OAAO,IAAI,EAAE,CAAE;QACzCN,MAAMG,IAAI,IAAII,qBAAqB;YAAEF;YAAQN;QAAa;IAC5D;IAEA,KAAK,MAAM,CAACS,WAAW,EAAEC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIf,qBAAsB;QACjEK,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC;YACAC,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWE,KAAK,IAAIM,OAAOC,OAAO,CAAClB,aAAamB,KAAK,IAAI,CAAC,GAAI;QACxE,IAAIV,aAAaZ,eAAe;YAC9B;QACF;QACAI,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOF,KAAKG,WAAW,EAAEC,SAASN;YAClCC,SAASD;YACTE,MAAM;gBAAE,GAAGA,IAAI;gBAAEK,QAAQL,KAAKK,MAAM,IAAI3B;YAAc;QACxD;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWW,OAAO,IAAIH,OAAOC,OAAO,CAAClB,aAAaqB,OAAO,IAAI,CAAC,GAAI;QAC5EpB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOO,OAAOL,KAAK,IAAIN;YACvBC,SAASD;YACTW,QAAQ;gBAAE,GAAGA,MAAM;gBAAEJ,QAAQI,OAAOJ,MAAM,IAAI3B;YAAc;QAC9D;IACF;IAEA,KAAK,MAAM,CAACoB,WAAWa,SAAS,IAAIL,OAAOC,OAAO,CAAClB,aAAauB,SAAS,IAAI,CAAC,GAAI;QAChFtB,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAI,OAAOS,SAASP,KAAK,IAAIN;YACzBC,SAASD;YACTa,UAAU;gBAAE,GAAGA,QAAQ;gBAAEN,QAAQM,SAASN,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAO;QACLmC,UAAUxB,aAAawB,QAAQ;QAC/BC,OAAOzB,aAAayB,KAAK;QACzBxB;QACAyB,KAAK1B,aAAa0B,GAAG;QACrBC,0BAA0B3B,aAAa2B,wBAAwB;IACjE;AACF,EAAC;AAED,MAAMtB,2BAA2B,CAAC,EAChCH,UAAU,EACVF,YAAY,EAIb;IACC,MAAM4B,OAAO1B,WAAW0B,IAAI;IAC5B,MAAMC,yBAAyB7B,aAAaG,WAAW,EAAE,CAACyB,KAAK;IAC/D,MAAM3B,QAA6B,EAAE;IACrC;;;GAGC,GACD,MAAM6B,sBACJ5B,WAAW6B,gBAAgB,KAAK,QAC/BC,QAAQ9B,WAAW+B,IAAI,KAAK/B,WAAW6B,gBAAgB,KAAK;IAE/D,KAAK,MAAM,CACTG,SACA,EAAExB,OAAO,EAAEyB,wBAAwB,EAAEC,cAAc,EAAEC,gBAAgB,EAAE1B,IAAI,EAAE,CAC9E,IAAInB,2BAA4B;QAC/B,IAAI6C,oBAAoB,CAACnC,WAAWoC,QAAQ,EAAE;YAC5C;QACF;QACA,IAAIH,4BAA4BL,qBAAqB;YACnD;QACF;QACA,IAAIM,kBAAkB,CAAClC,WAAWqC,MAAM,EAAE;YACxC;QACF;QACA,MAAMC,qBAAqBX,wBAAwBV,OAAO,CAACe,QAAQ;QACnE,IAAIM,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAM5B,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAG2B,UAAU3B,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN+B,gBAAgBf;YAChBnB,WAAWyB;YACXrB,OAAOC,YAAYC,KAAK,IAAImB;YAC5BxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQyB,UAAUzB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA8B,aAAaH,UAAUG,eAAejC,KAAKiC,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVhB,wBAAwBgB,oBACxBlC,KAAKkC,gBAAgB;YACzB;QACF;IACF;IAEA,IAAI3C,WAAW+B,IAAI,EAAE;QACnB,KAAK,MAAM,CAACa,aAAa,EAAEpC,OAAO,EAAEC,IAAI,EAAE,CAAC,IAAIrB,gCAAiC;YAC9E,MAAMkD,qBAAqBX,wBAAwBV,OAAO,CAAC2B,YAAY;YACvE,IAAI,CAACN,oBAAoB;gBACvB;YACF;YACA,2EAA2E;YAC3E,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;YAC/E,MAAM5B,cAAc;gBAAE,GAAGH,KAAKG,WAAW;gBAAE,GAAG2B,UAAU3B,WAAW;YAAC;YACpEb,MAAMG,IAAI,CAAC;gBACTQ,MAAM;gBACN+B,gBAAgBf;gBAChBnB,WAAWqC;gBACXjC,OAAOC,YAAYC,KAAK,IAAI+B;gBAC5BpC;gBACAC,MAAM;oBACJ,GAAGA,IAAI;oBACPK,QAAQyB,UAAUzB,UAAUL,KAAKK,MAAM,IAAI3B;oBAC3CyB;oBACA8B,aAAaH,UAAUG,eAAejC,KAAKiC,WAAW;oBACtDC,kBACEJ,UAAUI,oBACVhB,wBAAwBgB,oBACxBlC,KAAKkC,gBAAgB;gBACzB;YACF;QACF;IACF;IAEA,yEAAyE;IACzE,sDAAsD;IACtD,MAAME,gBAAgB9B,OAAOC,OAAO,CAACW,wBAAwBV,SAAS,CAAC;IAGvE,KAAK,MAAM,CAACV,WAAWuC,WAAW,IAAID,cAAe;QACnD,IAAItC,aAAahB,uBAAuBgB,aAAalB,0BAA0B;YAC7E;QACF;QACA,IAAI,CAACyD,YAAY;YACf;QACF;QACA/C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACN+B,gBAAgBf;YAChBnB;YACAI,OAAOmC,WAAWlC,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGqC,UAAU;gBAAEhC,QAAQgC,WAAWhC,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT;AAEA,MAAMO,uBAAuB,CAAC,EAC5BF,MAAM,EACNN,YAAY,EAIb;IACC,MAAM4B,OAAOtB,OAAOsB,IAAI;IACxB,MAAMqB,qBAAqBjD,aAAaO,OAAO,EAAE,CAACqB,KAAK;IACvD,MAAM3B,QAAyB,EAAE;IAEjC,KAAK,MAAM,CAACiC,SAAS,EAAExB,OAAO,EAAE2B,gBAAgB,EAAE1B,IAAI,EAAE,CAAC,IAAIjB,uBAAwB;QACnF,IAAI2C,oBAAoB,CAAC/B,OAAOgC,QAAQ,EAAE;YACxC;QACF;QACA,MAAME,qBAAqBS,oBAAoB9B,OAAO,CAACe,QAAQ;QAC/D,IAAIM,uBAAuB,OAAO;YAChC;QACF;QACA,MAAMC,WAAW,OAAOD,uBAAuB,WAAWA,qBAAqBE;QAC/E,MAAM5B,cAAc;YAAE,GAAGH,KAAKG,WAAW;YAAE,GAAG2B,UAAU3B,WAAW;QAAC;QACpEb,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH,WAAWyB;YACXgB,YAAYtB;YACZf,OAAOC,YAAYC,KAAK,IAAImB;YAC5BxB;YACAC,MAAM;gBACJ,GAAGA,IAAI;gBACPK,QAAQyB,UAAUzB,UAAUL,KAAKK,MAAM,IAAI3B;gBAC3CyB;gBACA8B,aAAaH,UAAUG,eAAejC,KAAKiC,WAAW;gBACtDC,kBACEJ,UAAUI,oBACVI,oBAAoBJ,oBACpBlC,KAAKkC,gBAAgB;YACzB;QACF;IACF;IAEA,MAAME,gBAAgB9B,OAAOC,OAAO,CAAC+B,oBAAoB9B,SAAS,CAAC;IAGnE,KAAK,MAAM,CAACV,WAAWuC,WAAW,IAAID,cAAe;QACnD,IAAItC,aAAad,iBAAiB;YAChC;QACF;QACA,IAAI,CAACqD,YAAY;YACf;QACF;QACA/C,MAAMG,IAAI,CAAC;YACTQ,MAAM;YACNH;YACAyC,YAAYtB;YACZf,OAAOmC,WAAWlC,WAAW,EAAEC,SAASN;YACxCC,SAASD;YACTE,MAAM;gBAAE,GAAGqC,UAAU;gBAAEhC,QAAQgC,WAAWhC,MAAM,IAAI3B;YAAc;QACpE;IACF;IAEA,OAAOY;AACT"}

package/dist/stdio.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,~~CA2GhD~~,CAAA"}
1	+ {"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CA4GhD,CAAA"}

package/dist/stdio.js CHANGED Viewed

@@ -1,7 +1,7 @@
 /* eslint-disable no-console */ import { serveStdio } from '@modelcontextprotocol/server/stdio';
 import { fileURLToPath, pathToFileURL } from 'node:url';
 import { createLocalReq, getPayload } from 'payload';
-import { findConfig } from 'payload/node';
+import { findConfig, loadEnv } from 'payload/node';
 import { getAuthorizedMCP } from './endpoint/access.js';
 import { buildMcpServer } from './mcp/buildMcpServer.js';
 import { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js';
@@ -19,6 +19,7 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
     if (projectRoot) {
         process.chdir(projectRoot);
     }
+    loadEnv();
     const configPath = findConfig();
     const configModule = await import(pathToFileURL(configPath).toString());
     const config = await (configModule.default ?? configModule);

package/dist/stdio.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { Config, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console /\nimport { serveStdio } from '@modelcontextprotocol/server/stdio'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/\n Starts Payload's MCP server over stdin and stdout.\n \n Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,\n * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.\n /\nexport const runMcpStdio = async (): Promise<void> => {\n // MCP clients may start this command from another folder. Move to the Payload\n // project so findConfig() can find the config.\n const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n if (projectRoot) {\n process.chdir(projectRoot)\n }\n\n const configPath = findConfig()\n const configModule = await import(pathToFileURL(configPath).toString())\n const config = (await (configModule.default ?? configModule)) as SanitizedConfig\n\n /\n stdout is only for MCP messages. The spec says the server must not write\n * logs there and may write them to stderr instead.\n \n The 2.0 client library recovers from stray stdout logs, but that behavior is not\n * guaranteed. Move Payload logs to stderr so Payload does not add invalid data\n * to stdout. Keep options from configurable loggers. Replace pre-built loggers\n * because their output cannot be redirected.\n \n @see https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#stdio\n */\n const loggerConfig: { logger?: Config['logger'] } = config\n if (\n loggerConfig.logger &&\n typeof loggerConfig.logger === 'object' &&\n 'options' in loggerConfig.logger\n ) {\n loggerConfig.logger.destination = process.stderr\n } else {\n loggerConfig.logger = { destination: process.stderr, options: {} }\n }\n\n const payload = await getPayload({ config, cron: false, disableOnInit: true })\n\n let pluginConfig: SanitizedMCPPluginConfig\n try {\n pluginConfig = getPluginConfig({ config: payload.config })\n } catch {\n // The command also works when mcpPlugin() is not in the Payload config.\n pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n const fallbackPlugin: Plugin = (config) => config\n Object.assign(fallbackPlugin, {\n slug: '@payloadcms/plugin-mcp',\n sanitizedOptions: pluginConfig,\n })\n payload.config.plugins ??= []\n payload.config.plugins.push(fallbackPlugin)\n }\n\n const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n let overrideAccess = false\n\n if (overrideAccessEnv === 'true') {\n overrideAccess = true\n } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n }\n\n if (overrideAccess && process.env.NODE_ENV !== 'development') {\n throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n }\n\n const headers = new Headers()\n if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n }\n\n const req = await createLocalReq({ req: { headers } }, payload)\n req.payloadAPI = 'MCP' as const\n const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n const stdioServer = serveStdio(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n onerror: (err) => {\n // MCP messages use stdout, so write SDK errors to stderr.\n console.error('[payload-mcp] error serving MCP over stdio:', err)\n },\n })\n\n // Close the MCP server and Payload when the client disconnects or the process stops.\n let isShuttingDown = false\n const shutdown = async () => {\n if (isShuttingDown) {\n return\n }\n isShuttingDown = true\n\n try {\n await stdioServer.close()\n } catch (err) {\n console.error('[payload-mcp] error closing server:', err)\n }\n\n try {\n await payload.destroy()\n } catch (err) {\n console.error('[payload-mcp] error destroying payload:', err)\n }\n\n process.exit(0)\n }\n\n process.once('SIGINT', () => void shutdown())\n process.once('SIGTERM', () => void shutdown())\n process.stdin.once('close', () => void shutdown())\n}\n"],"names":["serveStdio","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","loggerConfig","logger","destination","stderr","options","payload","cron","disableOnInit","pluginConfig","fallbackPlugin","Object","assign","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","stdioServer","onerror","err","console","error","isShuttingDown","shutdown","close","destroy","exit","once","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,UAAU,QAAQ,qCAAoC;AAC/D,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;~~AAIzC~~,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAMC,cAAcF,~~mBAAmBT~~,cAAc,~~YAAYY~~,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;~~IAEA~~,~~MAAMI~~,~~aAAaX~~;IACnB,~~MAAMY~~,eAAe,MAAM,MAAM,~~CAACf~~,~~cAAcc~~,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D;;;;;;;;;;GAUC,GACD,MAAMI,eAA8CF;IACpD,IACEE,aAAaC,MAAM,IACnB,OAAOD,aAAaC,MAAM,KAAK,YAC/B,aAAaD,aAAaC,MAAM,EAChC;QACAD,aAAaC,MAAM,CAACC,WAAW,GAAGT,QAAQU,MAAM;IAClD,OAAO;QACLH,aAAaC,MAAM,GAAG;YAAEC,aAAaT,QAAQU,MAAM;YAAEC,SAAS,CAAC;QAAE;IACnE;IAEA,MAAMC,UAAU,~~MAAMtB~~,WAAW;~~QAAEe~~;QAAQQ,MAAM;QAAOC,eAAe;IAAK;IAE5E,IAAIC;IACJ,IAAI;QACFA,eAAepB,gBAAgB;YAAEU,QAAQO,QAAQP,MAAM;QAAC;IAC1D,EAAE,OAAM;QACN,wEAAwE;QACxEU,eAAerB,kBAAkB;YAAEW,QAAQO,QAAQP,MAAM;YAAEU,cAAc,CAAC;QAAE;QAE5E,MAAMC,iBAAyB,CAACX,SAAWA;QAC3CY,OAAOC,MAAM,CAACF,gBAAgB;YAC5BG,MAAM;YACNC,kBAAkBL;QACpB;QACAH,QAAQP,MAAM,CAACgB,OAAO,KAAK,EAAE;QAC7BT,QAAQP,MAAM,CAACgB,OAAO,CAACC,IAAI,CAACN;IAC9B;IAEA,MAAMO,oBAAoBvB,QAAQwB,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkB1B,QAAQwB,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAI9B,QAAQwB,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBhC,QAAQwB,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,~~MAAM5C~~,eAAe;~~QAAE4C~~,KAAK;YAAEJ;QAAQ;IAAE,GAAGjB;IACvDqB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAM3C,iBAAiB;QAAEkC;QAAgBO;IAAI;IAEnE,MAAMG,~~cAAclD~~,WAAW,~~IAAMO~~,eAAe;YAAE0C;YAAepB;YAAckB;QAAI,IAAI;QACzFI,SAAS,CAACC;YACR,0DAA0D;YAC1DC,QAAQC,KAAK,CAAC,+CAA+CF;QAC/D;IACF;IAEA,qFAAqF;IACrF,IAAIG,iBAAiB;IACrB,MAAMC,WAAW;QACf,IAAID,gBAAgB;YAClB;QACF;QACAA,iBAAiB;QAEjB,IAAI;YACF,MAAML,YAAYO,KAAK;QACzB,EAAE,OAAOL,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QAEA,IAAI;YACF,MAAM1B,QAAQgC,OAAO;QACvB,EAAE,OAAON,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QAEAtC,QAAQ6C,IAAI,CAAC;IACf;IAEA7C,QAAQ8C,IAAI,CAAC,UAAU,IAAM,KAAKJ;IAClC1C,QAAQ8C,IAAI,CAAC,WAAW,IAAM,KAAKJ;IACnC1C,QAAQ+C,KAAK,CAACD,IAAI,CAAC,SAAS,IAAM,KAAKJ;AACzC,EAAC"}
1	+ {"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { Config, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console /\nimport { serveStdio } from '@modelcontextprotocol/server/stdio'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig, loadEnv } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/\n Starts Payload's MCP server over stdin and stdout.\n \n Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,\n * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.\n /\nexport const runMcpStdio = async (): Promise<void> => {\n // MCP clients may start this command from another folder. Move to the Payload\n // project so findConfig() can find the config.\n const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n if (projectRoot) {\n process.chdir(projectRoot)\n }\n\n loadEnv()\n const configPath = findConfig()\n const configModule = await import(pathToFileURL(configPath).toString())\n const config = (await (configModule.default ?? configModule)) as SanitizedConfig\n\n /\n stdout is only for MCP messages. The spec says the server must not write\n * logs there and may write them to stderr instead.\n \n The 2.0 client library recovers from stray stdout logs, but that behavior is not\n * guaranteed. Move Payload logs to stderr so Payload does not add invalid data\n * to stdout. Keep options from configurable loggers. Replace pre-built loggers\n * because their output cannot be redirected.\n \n @see https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#stdio\n */\n const loggerConfig: { logger?: Config['logger'] } = config\n if (\n loggerConfig.logger &&\n typeof loggerConfig.logger === 'object' &&\n 'options' in loggerConfig.logger\n ) {\n loggerConfig.logger.destination = process.stderr\n } else {\n loggerConfig.logger = { destination: process.stderr, options: {} }\n }\n\n const payload = await getPayload({ config, cron: false, disableOnInit: true })\n\n let pluginConfig: SanitizedMCPPluginConfig\n try {\n pluginConfig = getPluginConfig({ config: payload.config })\n } catch {\n // The command also works when mcpPlugin() is not in the Payload config.\n pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n const fallbackPlugin: Plugin = (config) => config\n Object.assign(fallbackPlugin, {\n slug: '@payloadcms/plugin-mcp',\n sanitizedOptions: pluginConfig,\n })\n payload.config.plugins ??= []\n payload.config.plugins.push(fallbackPlugin)\n }\n\n const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n let overrideAccess = false\n\n if (overrideAccessEnv === 'true') {\n overrideAccess = true\n } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n }\n\n if (overrideAccess && process.env.NODE_ENV !== 'development') {\n throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n }\n\n const headers = new Headers()\n if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n }\n\n const req = await createLocalReq({ req: { headers } }, payload)\n req.payloadAPI = 'MCP' as const\n const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n const stdioServer = serveStdio(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n onerror: (err) => {\n // MCP messages use stdout, so write SDK errors to stderr.\n console.error('[payload-mcp] error serving MCP over stdio:', err)\n },\n })\n\n // Close the MCP server and Payload when the client disconnects or the process stops.\n let isShuttingDown = false\n const shutdown = async () => {\n if (isShuttingDown) {\n return\n }\n isShuttingDown = true\n\n try {\n await stdioServer.close()\n } catch (err) {\n console.error('[payload-mcp] error closing server:', err)\n }\n\n try {\n await payload.destroy()\n } catch (err) {\n console.error('[payload-mcp] error destroying payload:', err)\n }\n\n process.exit(0)\n }\n\n process.once('SIGINT', () => void shutdown())\n process.once('SIGTERM', () => void shutdown())\n process.stdin.once('close', () => void shutdown())\n}\n"],"names":["serveStdio","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","loadEnv","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","loggerConfig","logger","destination","stderr","options","payload","cron","disableOnInit","pluginConfig","fallbackPlugin","Object","assign","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","stdioServer","onerror","err","console","error","isShuttingDown","shutdown","close","destroy","exit","once","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,UAAU,QAAQ,qCAAoC;AAC/D,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,EAAEC,OAAO,QAAQ,eAAc;AAIlD,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAMC,cAAcF,mBAAmBV,cAAc,YAAYa,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEAP;IACA,MAAMW,aAAaZ;IACnB,MAAMa,eAAe,MAAM,MAAM,CAAChB,cAAce,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D;;;;;;;;;;GAUC,GACD,MAAMI,eAA8CF;IACpD,IACEE,aAAaC,MAAM,IACnB,OAAOD,aAAaC,MAAM,KAAK,YAC/B,aAAaD,aAAaC,MAAM,EAChC;QACAD,aAAaC,MAAM,CAACC,WAAW,GAAGT,QAAQU,MAAM;IAClD,OAAO;QACLH,aAAaC,MAAM,GAAG;YAAEC,aAAaT,QAAQU,MAAM;YAAEC,SAAS,CAAC;QAAE;IACnE;IAEA,MAAMC,UAAU,MAAMvB,WAAW;QAAEgB;QAAQQ,MAAM;QAAOC,eAAe;IAAK;IAE5E,IAAIC;IACJ,IAAI;QACFA,eAAepB,gBAAgB;YAAEU,QAAQO,QAAQP,MAAM;QAAC;IAC1D,EAAE,OAAM;QACN,wEAAwE;QACxEU,eAAerB,kBAAkB;YAAEW,QAAQO,QAAQP,MAAM;YAAEU,cAAc,CAAC;QAAE;QAE5E,MAAMC,iBAAyB,CAACX,SAAWA;QAC3CY,OAAOC,MAAM,CAACF,gBAAgB;YAC5BG,MAAM;YACNC,kBAAkBL;QACpB;QACAH,QAAQP,MAAM,CAACgB,OAAO,KAAK,EAAE;QAC7BT,QAAQP,MAAM,CAACgB,OAAO,CAACC,IAAI,CAACN;IAC9B;IAEA,MAAMO,oBAAoBvB,QAAQwB,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkB1B,QAAQwB,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAI9B,QAAQwB,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBhC,QAAQwB,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,MAAM7C,eAAe;QAAE6C,KAAK;YAAEJ;QAAQ;IAAE,GAAGjB;IACvDqB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAM3C,iBAAiB;QAAEkC;QAAgBO;IAAI;IAEnE,MAAMG,cAAcnD,WAAW,IAAMQ,eAAe;YAAE0C;YAAepB;YAAckB;QAAI,IAAI;QACzFI,SAAS,CAACC;YACR,0DAA0D;YAC1DC,QAAQC,KAAK,CAAC,+CAA+CF;QAC/D;IACF;IAEA,qFAAqF;IACrF,IAAIG,iBAAiB;IACrB,MAAMC,WAAW;QACf,IAAID,gBAAgB;YAClB;QACF;QACAA,iBAAiB;QAEjB,IAAI;YACF,MAAML,YAAYO,KAAK;QACzB,EAAE,OAAOL,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QAEA,IAAI;YACF,MAAM1B,QAAQgC,OAAO;QACvB,EAAE,OAAON,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QAEAtC,QAAQ6C,IAAI,CAAC;IACf;IAEA7C,QAAQ8C,IAAI,CAAC,UAAU,IAAM,KAAKJ;IAClC1C,QAAQ8C,IAAI,CAAC,WAAW,IAAM,KAAKJ;IACnC1C,QAAQ+C,KAAK,CAACD,IAAI,CAAC,SAAS,IAAM,KAAKJ;AACzC,EAAC"}

package/dist/utils/camelCase.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,~~GAAI~~,~~KAAK,~~MAAM,KAAG,MAIzC,CAAA"}
1	+ {"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,QAAS,MAAM,KAAG,MAIzC,CAAA"}

package/dist/utils/resolveProjectRoot.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,~~GAAI~~,~~UAAU,~~MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}
1	+ {"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}

package/dist/utils/schemaConversion/filterFieldsByAccess.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"filterFieldsByAccess.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,4BAA4B,EAE7B,MAAM,SAAS,CAAA;AAEhB,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAClD,KAAK,sBAAsB,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,~~GAAI,sDAKlC~~;IACD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,WAAW,EAAE,4BAA4B,CAAA;IACzC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,OAAO,CAAA;CAC3E,KAAG,cAAc,EAoFjB,CAAA"}
1	+ {"version":3,"file":"filterFieldsByAccess.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,4BAA4B,EAE7B,MAAM,SAAS,CAAA;AAEhB,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAClD,KAAK,sBAAsB,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,yDAK9B;IACD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,WAAW,EAAE,4BAA4B,CAAA;IACzC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,OAAO,CAAA;CAC3E,KAAG,cAAc,EAoFjB,CAAA"}

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,~~GAAI,uCAItC~~;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,~~GAAI,mCAIlC~~;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}
1	+ {"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,0CAIlC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,sCAI9B;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}

package/dist/utils/schemaConversion/sanitizeEntitySchema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,~~GAAI~~,~~QAAQ,~~cAAc,KAAG,cA0B7D,CAAA"}
1	+ {"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,WAAY,cAAc,KAAG,cA0B7D,CAAA"}

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js CHANGED Viewed

@@ -104,8 +104,8 @@ describe('sanitizeEntitySchema', ()=>{
                 }
             },
             properties: {
-                // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;
-                // `id` stays because it's a valid optional input (a client may supply a custom ID).
+                // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's
+                // a valid optional input (a client may supply a custom ID).
                 id: {
                     type: 'string'
                 },

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {\n // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field\n // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant\n // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to\n // reduce here (the variant did that upstream), so sanitize leaves the value untouched.\n const standalone: JsonSchemaType = {\n type: 'object',\n $defs: {\n LexicalNodes_ABCDEF12: {\n oneOf: [\n {\n type: 'object',\n additionalProperties: false,\n properties: { type: { const: 'paragraph' } },\n required: ['type'],\n },\n {\n type: 'object',\n additionalProperties: false,\n properties: {\n type: { const: 'relationship' },\n value: { type: 'string', description: 'The related document ID.' },\n },\n required: ['type'],\n },\n ],\n },\n },\n properties: {\n id: { type: 'string' },\n content: {\n type: 'object',\n properties: {\n root: {\n type: 'object',\n properties: {\n children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n },\n },\n },\n },\n },\n }\n\n expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n type: 'object',\n $defs: {\n // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n // `oneOf` - not loosened to `anyOf`.\n node: {\n oneOf: [\n {\n type: 'object',\n additionalProperties: false,\n properties: { type: { const: 'paragraph' } },\n required: ['type'],\n },\n {\n type: 'object',\n additionalProperties: false,\n properties: {\n type: { const: 'relationship' },\n // The value is already ID-only from the input variant - left as-is.\n value: { type: 'string', description: 'The related document ID.' },\n },\n required: ['type'],\n },\n ],\n },\n },\n properties: {\n // Managed ~~fields~~ ~~(createdAt/updatedAt/_status)~~ are excluded upstream by the `input` variant~~;\n //~~ `id` stays because it's a valid optional input (a client may supply a custom ID).\n id: { type: 'string' },\n content: {\n type: 'object',\n properties: {\n root: {\n type: 'object',\n properties: {\n children: { type: 'array', items: { $ref: '#/$defs/node' } },\n },\n },\n },\n },\n },\n })\n })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","description","id","content","root","children","items","$ref","toStrictEqual","node"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,yFAAyF;QAC1F,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,uFAAuF;QACvF,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACVK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAnB,OAAOE,qBAAqBC,aAAaiB,aAAa,CAAC;YACrDhB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,qCAAqC;gBACrCgB,MAAM;oBACJd,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,oEAAoE;gCACpEE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACV,~~6FAA6F~~;~~gBAC7F~~,~~oFAAoF~~;~~gBACpFK~~,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}
1	+ {"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {\n // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field\n // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant\n // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to\n // reduce here (the variant did that upstream), so sanitize leaves the value untouched.\n const standalone: JsonSchemaType = {\n type: 'object',\n $defs: {\n LexicalNodes_ABCDEF12: {\n oneOf: [\n {\n type: 'object',\n additionalProperties: false,\n properties: { type: { const: 'paragraph' } },\n required: ['type'],\n },\n {\n type: 'object',\n additionalProperties: false,\n properties: {\n type: { const: 'relationship' },\n value: { type: 'string', description: 'The related document ID.' },\n },\n required: ['type'],\n },\n ],\n },\n },\n properties: {\n id: { type: 'string' },\n content: {\n type: 'object',\n properties: {\n root: {\n type: 'object',\n properties: {\n children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n },\n },\n },\n },\n },\n }\n\n expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n type: 'object',\n $defs: {\n // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n // `oneOf` - not loosened to `anyOf`.\n node: {\n oneOf: [\n {\n type: 'object',\n additionalProperties: false,\n properties: { type: { const: 'paragraph' } },\n required: ['type'],\n },\n {\n type: 'object',\n additionalProperties: false,\n properties: {\n type: { const: 'relationship' },\n // The value is already ID-only from the input variant - left as-is.\n value: { type: 'string', description: 'The related document ID.' },\n },\n required: ['type'],\n },\n ],\n },\n },\n properties: {\n // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's\n // a valid optional input (a client may supply a custom ID).\n id: { type: 'string' },\n content: {\n type: 'object',\n properties: {\n root: {\n type: 'object',\n properties: {\n children: { type: 'array', items: { $ref: '#/$defs/node' } },\n },\n },\n },\n },\n },\n })\n })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","description","id","content","root","children","items","$ref","toStrictEqual","node"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,yFAAyF;QAC1F,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,uFAAuF;QACvF,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACVK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAnB,OAAOE,qBAAqBC,aAAaiB,aAAa,CAAC;YACrDhB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,qCAAqC;gBACrCgB,MAAM;oBACJd,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,oEAAoE;gCACpEE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACV,2FAA2F;gBAC3F,4DAA4D;gBAC5DK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}

package/dist/utils/toStandardSchema.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,~~GAAI~~,~~QAAQ,~~eAAe,KAAG,sBAG/B,CAAA"}
1	+ {"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,WAAY,eAAe,KAAG,sBAG/B,CAAA"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.697830c",
+  "version": "4.0.0-internal.7e57eed",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -55,16 +55,16 @@
     "bin.js"
   ],
   "dependencies": {
-    "@modelcontextprotocol/server": "2.0.0-beta.2",
+    "@modelcontextprotocol/server": "2.0.0",
     "tsx": "4.22.4",
     "zod": "^4.2.0"
   },
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-internal.697830c"
+    "payload": "4.0.0-internal.7e57eed"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.697830c"
+    "payload": "4.0.0-internal.7e57eed"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/mcp/builtin/collections/createTool.ts CHANGED Viewed

@@ -11,12 +11,13 @@ import {
 } from '../../../utils/getVirtualFieldNames.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateCollectionData } from '../validateEntityData.js'
+import { fileInputSchema, resolveFile } from './fileInput.js'
 import { formatCollectionError } from './formatCollectionError.js'
 const DEFAULT_DESCRIPTION =
-  'Create a document in any collection by passing the collection slug and data.'
+  'Create one or more documents. Each can have different data or a file. Prefer uploadReference after upload, externalURL for URLs, or base64 for small local files.'
-export const createDocumentTool = defineCollectionTool({
+export const createDocumentsTool = defineCollectionTool({
   access: (args) =>
     defaultAccess(args) && Boolean(args.permissions?.collections?.[args.collectionSlug]?.create),
   annotations: {
@@ -24,11 +25,10 @@ export const createDocumentTool = defineCollectionTool({
     idempotentHint: false,
     openWorldHint: false,
     readOnlyHint: false,
-    title: 'Create Document',
+    title: 'Create Documents',
   },
   description: DEFAULT_DESCRIPTION,
   input: z.object({
-    data: z.record(z.string(), z.unknown()).describe('The document fields to create'),
     depth: z
       .number()
       .int()
@@ -37,9 +37,24 @@ export const createDocumentTool = defineCollectionTool({
       .describe('How many levels deep to populate relationships in response')
       .optional()
       .default(0),
+    documents: z
+      .array(
+        z.object({
+          data: z
+            .record(z.string(), z.unknown())
+            .describe(
+              'The document fields to create. Only include fields permitted by the schema returned by getCollectionSchema.',
+            ),
+          file: fileInputSchema.optional(),
+        }),
+      )
+      .min(1)
+      .describe('The documents to create, in order'),
     draft: z
       .boolean()
-      .describe('Whether to create the document as a draft')
+      .describe(
+        'Only if getCollectionSchema includes _status; otherwise _status does not exist. true forces data._status to "draft"; with false, data._status controls draft or published.',
+      )
       .optional()
       .default(false),
     fallbackLocale: z
@@ -49,7 +64,7 @@ export const createDocumentTool = defineCollectionTool({
     locale: z
       .string()
       .describe(
-        'Optional: locale code to create the document in (e.g., "en", "es"). Defaults to the default locale',
+        'Optional: locale code to create the documents in (e.g., "en", "es"). Defaults to the default locale',
       )
       .optional(),
     select: z
@@ -62,50 +77,92 @@ export const createDocumentTool = defineCollectionTool({
 }).handler(async ({ authorizedMCP, collectionSlug, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
+  const { depth, documents, draft, fallbackLocale, locale, select } = input
-  const { data, depth, draft, fallbackLocale, locale, select } = input
-  logger.info(
-    `Creating document in collection: ${collectionSlug}${locale ? ` with locale: ${locale}` : ''}`,
-  )
+  logger.info(`Creating ${documents.length} documents in collection: ${collectionSlug}`)
   try {
     const virtualFieldNames = getCollectionVirtualFieldNames(payload.config, collectionSlug)
-    const inputData = stripVirtualFields(data, virtualFieldNames)
-    const validationError = validateCollectionData({ collectionSlug, data: inputData, req })
+    const docs: Array<{ doc: Record<string, unknown>; index: number }> = []
+    const errors: Array<{ index: number; message: string }> = []
+    let validationSchema: Record<string, unknown> | undefined
-    if (validationError) {
-      return validationError
-    }
+    for (const [index, document] of documents.entries()) {
+      try {
+        const inputData = stripVirtualFields(document.data, virtualFieldNames)
+        const validationError = validateCollectionData({ collectionSlug, data: inputData, req })
+        if (validationError) {
+          const firstContent = validationError.content[0]
+          const validationContent = validationError.structuredContent as
+            | Record<string, unknown>
+            | undefined
+          const schema = validationContent?.schema
-    const parsedData = transformPointDataToPayload(inputData)
+          if (!validationSchema && schema && typeof schema === 'object') {
+            validationSchema = schema as Record<string, unknown>
+          }
-    const result = await payload.create({
-      collection: collectionSlug,
-      data: parsedData,
-      depth,
-      draft,
-      overrideAccess: authorizedMCP.overrideAccess,
-      req,
-      ...(locale ? { locale } : {}),
-      ...(fallbackLocale ? { fallbackLocale } : {}),
-      ...(select ? { select: select as SelectType } : {}),
-    })
+          errors.push({
+            index,
+            message:
+              firstContent?.type === 'text'
+                ? (firstContent.text.split('\n\nUse this schema')[0] ?? 'Invalid document data')
+                : 'Invalid document data',
+          })
+          continue
+        }
-    logger.info(`Successfully created document in ${collectionSlug} with ID: ${result.id}`)
+        const parsedData = transformPointDataToPayload(inputData)
+        const file = await resolveFile({ collectionSlug, input: document.file, req })
+        const result = await payload.create({
+          collection: collectionSlug,
+          data: parsedData,
+          depth,
+          draft,
+          overrideAccess: authorizedMCP.overrideAccess,
+          req,
+          ...(file ? { file } : {}),
+          ...(locale ? { locale } : {}),
+          ...(fallbackLocale ? { fallbackLocale } : {}),
+          ...(select ? { select: select as SelectType } : {}),
+        })
+        docs.push({ doc: result as Record<string, unknown>, index })
+      } catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown error'
+        logger.error(`Error creating document at index ${index} in ${collectionSlug}: ${message}`)
+        errors.push({ index, message })
+      }
+    }
+    const batchResult = { docs, errors }
+    const retryMessage = errors.length > 0 ? '\nRetry failed indexes only.' : ''
+    const schemaMessage = validationSchema
+      ? `\n\nUse this schema for data:\n\`\`\`json\n${JSON.stringify(validationSchema)}\n\`\`\``
+      : ''
+    const structuredContent = validationSchema
+      ? { ...batchResult, schema: validationSchema }
+      : batchResult
+    logger.info(`Created ${docs.length} of ${documents.length} documents in ${collectionSlug}`)
     return {
       content: [
         {
           type: 'text',
-          text: `Document created successfully in collection "${collectionSlug}"!\nCreated document:\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+          text: `Created ${docs.length} of ${documents.length} documents in collection "${collectionSlug}".${retryMessage}\nResults:\n\`\`\`json\n${JSON.stringify(batchResult)}\n\`\`\`${schemaMessage}`,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: structuredContent as unknown as Record<string, unknown>,
+      isError: docs.length === 0 && errors.length > 0,
+      structuredContent,
     }
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
-    logger.error(`Error creating document in ${collectionSlug}: ${errorMessage}`)
+    const message = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error creating documents in ${collectionSlug}: ${message}`)
     return formatCollectionError({ action: 'creating', collectionSlug, error, req })
   }
 })

package/src/mcp/builtin/collections/fileInput.spec.ts ADDED Viewed

@@ -0,0 +1,93 @@
+import type { PayloadRequest } from 'payload'
+import { describe, expect, it } from 'vitest'
+import { fileInputSchema, resolveFile } from './fileInput.js'
+describe('MCP file input', () => {
+  it('should reject malformed MIME types', () => {
+    const result = fileInputSchema.safeParse({
+      data: 'aGVsbG8=',
+      mimeType: 'text/plain\r\nx-test: value',
+      name: 'hello.txt',
+      source: 'base64',
+    })
+    expect(result.success).toBe(false)
+  })
+  it('should accept a prepared upload', () => {
+    const result = fileInputSchema.safeParse({
+      file: {
+        filename: 'image.png',
+        mimeType: 'image/png',
+        size: 123,
+        uploadReference: { uploadId: 'upload-id' },
+      },
+      source: 'uploadReference',
+    })
+    expect(result.success).toBe(true)
+  })
+  it('should reject oversized base64 files', async () => {
+    const req = createRequest({ maxFileSize: 4 })
+    await expect(
+      resolveFile({
+        collectionSlug: 'media',
+        input: {
+          data: Buffer.from('hello').toString('base64'),
+          mimeType: 'text/plain',
+          name: 'hello.txt',
+          source: 'base64',
+        },
+        req,
+      }),
+    ).rejects.toThrow('File exceeds the 4 byte upload limit.')
+  })
+  it('should reject URLs outside the collection allowlist', async () => {
+    const req = createRequest({
+      allowList: [{ hostname: 'assets.example.com', protocol: 'https' }],
+    })
+    await expect(
+      resolveFile({
+        collectionSlug: 'media',
+        input: {
+          source: 'externalURL',
+          url: 'https://example.com/image.png',
+        },
+        req,
+      }),
+    ).rejects.toThrow('The provided file URL is not allowed.')
+  })
+})
+function createRequest({
+  allowList,
+  maxFileSize,
+}: {
+  allowList?: Array<{ hostname: string; protocol: 'http' | 'https' }>
+  maxFileSize?: number
+}): PayloadRequest {
+  return {
+    payload: {
+      collections: {
+        media: {
+          config: {
+            upload: allowList ? { pasteURL: { allowList } } : {},
+          },
+        },
+      },
+      config: {
+        upload: {
+          limits: {
+            fileSize: maxFileSize,
+          },
+        },
+      },
+    },
+  } as unknown as PayloadRequest
+}