@payloadcms/plugin-mcp 4.0.0-internal.811e0a4 → 4.0.0-internal.8867dba

package/dist/types.d.ts

@@ -1,5 +1,5 @@
 import type { CallToolResult, ContentBlock, JsonSchemaType, McpServer, ResourceTemplate, ServerContext, StandardSchemaWithJSON, ToolAnnotations } from '@modelcontextprotocol/server';
-import type { AuthCollectionSlug, CollectionSlug, GlobalSlug, MaybePromise, PayloadRequest, SanitizedPermissions, User } from 'payload';
+import type { AuthCollectionSlug, CollectionSlug, GlobalSlug, MaybePromise, PayloadRequest, SanitizedPermissions } from 'payload';
 import type { GetAuthorizedMCPArgs } from './endpoint/access.js';
 import type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName } from './mcp/builtinTools.js';
 export type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName };
@@ -55,6 +55,11 @@ export type GlobalToolHandlerArgs<TSchema = undefined> = {
     globalSlug: GlobalSlug;
 } & ToolHandlerArgs<TSchema>;
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    /**
+     * Runs while authorizing each MCP request, before the tool is advertised or called. Return
+     * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`
+     * is enabled.
+     */
     access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
     annotations?: ToolAnnotations;
     description: string;
@@ -66,11 +71,23 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
     overrideResponse?: MCPResponseOverride;
 };
 export type CollectionTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    /**
+     * Runs while authorizing each MCP request for this collection. Return `false` to reject calls
+     * to this tool for the collection. The shared tool is not advertised when no collections allow
+     * it, but can remain advertised when it is available for another collection. This is skipped
+     * when `overrideAccess` is enabled.
+     */
     access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>;
     handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>;
     input?: TSchema;
 } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>;
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+    /**
+     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to
+     * this tool for the global. The shared tool is not advertised when no globals allow it, but
+     * can remain advertised when it is available for another global. This is skipped when
+     * `overrideAccess` is enabled.
+     */
     access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>;
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>;
     input?: TSchema;
@@ -81,6 +98,10 @@ export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSc
  * required handler) from being silently accepted at a built-in key slot.
  */
 export type MCPBuiltInCollectionToolOverride = {
+    /**
+     * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+     * this collection. This is skipped when `overrideAccess` is enabled.
+     */
     access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>;
     annotations?: ToolAnnotations;
     description?: string;
@@ -88,6 +109,10 @@ export type MCPBuiltInCollectionToolOverride = {
     overrideResponse?: MCPResponseOverride;
 };
 export type MCPBuiltInGlobalToolOverride = {
+    /**
+     * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+     * this global. This is skipped when `overrideAccess` is enabled.
+     */
     access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>;
     annotations?: ToolAnnotations;
     description?: string;
@@ -122,6 +147,11 @@ export type PromptHandlerArgs<TSchema = undefined> = {
     serverContext: ServerContext;
 };
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+    /**
+     * Runs while authorizing each MCP request, before the prompt is advertised or used. Return
+     * `false` to make the prompt unavailable for that request. This is skipped when
+     * `overrideAccess` is enabled.
+     */
     access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
     argsSchema: TSchema;
     description: string;
@@ -144,6 +174,11 @@ export type ResourceHandlerArgs = {
     uri: URL;
 };
 export type Resource = {
+    /**
+     * Runs while authorizing each MCP request, before the resource is advertised or read. Return
+     * `false` to make the resource unavailable for that request. This is skipped when
+     * `overrideAccess` is enabled.
+     */
     access?: (args: MCPAccessArgs) => MaybePromise<boolean>;
     description: string;
     handler: (args: ResourceHandlerArgs) => MaybePromise<{
@@ -191,7 +226,12 @@ export type MCPPluginConfig = {
         serverOptions?: MCPServerOptions;
         verboseLogs?: boolean;
     };
-    /** Replace the default MCP authorization resolver. */
+    /**
+     * Replace the default MCP authorization resolver.
+     *
+     * This hook replaces the default authentication flow. It must set `req.user` to the
+     * authenticated Payload user, or to `null` for an anonymous caller, before returning.
+     */
     overrideGetAuthorizedMCP?: (args: {
         pluginConfig: SanitizedMCPPluginConfig;
     } & GetAuthorizedMCPArgs) => MaybePromise<AuthorizedMCP>;
@@ -241,14 +281,11 @@ export type MCPItem = ({
     type: 'tool';
 } & MCPItemBase) | CollectionMCPItem | GlobalMCPItem;
 /**
- * The caller's identity + the MCP items authorized for this request. Disabled
- * items and items blocked by access callbacks or Payload operation access are
- * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
- * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */
 export type AuthorizedMCP = {
     items: MCPItem[];
     overrideAccess: boolean;
-    user: null | User;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,eAAe,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,IAAI,EACL,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAA;AAEzF,gGAAgG;AAChG,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAA;AAEvE;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,eAAe,CAAA;AAEpB,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,QAAQ,EAAE,eAAe,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;AAEnC;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,OAAO,SAAS,sBAAsB,GACpE,sBAAsB,SAAS,OAAO,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,eAAe,CAAC,OAAO,GAAG,SAAS,IAAI;IACjD,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,SAAS,IAAI;IAC3D,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,qBAAqB,CAAC,OAAO,GAAG,SAAS,IAAI;IACvD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,IAAI,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAAI;IAC5F,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,cAAc,CACxB,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IACvE;IACF,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,OAAO,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IACpF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAElE,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAC9F;IACE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAChF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAEpE;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEvC,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,cAAc,GAAG,gCAAgC,GAAG,SAAS,CAAA;CAClG,GAAG;KACD,CAAC,IAAI,wBAAwB,CAAC,CAAC,EAAE,KAAK,GAAG,gCAAgC;CAC3E,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;KACrC,CAAC,IAAI,yBAAyB,CAAC,CAAC,EAAE,gCAAgC,GAAG,IAAI;CAC3E,GAAG,qBAAqB,CAAA;AAEzB,sFAAsF;AACtF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,cAAc,IAAI,IAAI,SAAS,kBAAkB,GAC/F,yBAAyB,GACzB,qBAAqB,CAAA;AAEzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,4BAA4B,GAAG,SAAS,CAAA;CAC1F,GAAG;KACD,CAAC,IAAI,oBAAoB,CAAC,CAAC,EAAE,KAAK,GAAG,4BAA4B;CACnE,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAEtD,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,SAAS,IAAI;IACnD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe,IAAI;IACtE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC;QAC1D,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KACzF,CAAC,CAAA;IACF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;IAC5B,GAAG,EAAE,GAAG,CAAA;CACT,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC/C,CAAC,CAAA;IACF,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,SAAS,cAAc,IAAI;IACpE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,CAAC,EAAE;SACX,IAAI,IAAI,cAAc,CAAC,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC;KAC3D,CAAA;IACD,sCAAsC;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE;SACP,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,qBAAqB;KAC7C,CAAA;IACD,KAAK,CAAC,EAAE;QACN,0DAA0D;QAC1D,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAA;KACvC,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,gBAAgB,CAAA;QAChC,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,CAAA;IACD,sDAAsD;IACtD,wBAAwB,CAAC,EAAE,CACzB,IAAI,EAAE;QACJ,YAAY,EAAE,wBAAwB,CAAA;KACvC,GAAG,oBAAoB,KACrB,YAAY,CAAC,aAAa,CAAC,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,oEAAoE;IACpE,KAAK,CAAC,EAAE,mBAAmB,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,OAAO,EAAE,CAAA;CACjB,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,0BAA0B,CAAC,CAAA;AAEpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CACjE,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,IAAI,EAAE,gBAAgB,CAAA;CACvB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;CACnB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,OAAO,GACf,CAAC;IACC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,WAAW,CAAC,GAChB,iBAAiB,GACjB,aAAa,CAAA;AAEjB;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,IAAI,EAAE,IAAI,GAAG,IAAI,CAAA;CAClB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,eAAe,EAChB,MAAM,8BAA8B,CAAA;AACrC,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,YAAY,EACZ,cAAc,EACd,oBAAoB,EACrB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAChE,OAAO,KAAK,EACV,yBAAyB,EACzB,wBAAwB,EACxB,oBAAoB,EACrB,MAAM,uBAAuB,CAAA;AAE9B,YAAY,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,CAAA;AAEzF,gGAAgG;AAChG,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,CAAA;AAEvE;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,sBAAsB,CAAA;AAErE,MAAM,MAAM,eAAe,GAAG;IAC5B,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC9B,GAAG,IAAI,CAAC,cAAc,EAAE,OAAO,GAAG,SAAS,GAAG,mBAAmB,CAAC,CAAA;AAEnE,MAAM,MAAM,mBAAmB,GAAG,CAChC,QAAQ,EAAE,eAAe,EACzB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,GAAG,EAAE,cAAc,KAChB,eAAe,CAAA;AAEpB,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE;IACxC,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;IACnB,QAAQ,EAAE,eAAe,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;AAEnC;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,OAAO,IAAI,OAAO,SAAS,sBAAsB,GACpE,sBAAsB,SAAS,OAAO,GACpC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACvB,sBAAsB,CAAC,WAAW,CAAC,OAAO,CAAC,GAC7C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B,MAAM,MAAM,aAAa,GAAG;IAC1B,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAClC,GAAG,EAAE,cAAc,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,aAAa,CAAA;AAEjB,MAAM,MAAM,eAAe,CAAC,OAAO,GAAG,SAAS,IAAI;IACjD,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,OAAO,GAAG,SAAS,IAAI;IAC3D,cAAc,EAAE,cAAc,CAAA;CAC/B,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,qBAAqB,CAAC,OAAO,GAAG,SAAS,IAAI;IACvD,UAAU,EAAE,UAAU,CAAA;CACvB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;AAE5B,MAAM,MAAM,IAAI,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAAI;IAC5F;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAA;IACf;;OAEG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,cAAc,CACxB,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IACvE;IACF;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,OAAO,EAAE,CAAC,IAAI,EAAE,yBAAyB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IACpF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAElE,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAC9F;IACE;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,eAAe,CAAC,CAAA;IAChF,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,GAAG,kBAAkB,CAAC,CAAA;AAEpE;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG;IAC7C;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACjE,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED,MAAM,MAAM,4BAA4B,GAAG;IACzC;;;OAGG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IAC7D,WAAW,CAAC,EAAE,eAAe,CAAA;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,KAAK,CAAA;IACf,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;CACvC,CAAA;AAED;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAA;AAEvC,MAAM,MAAM,qBAAqB,GAAG;IAClC,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,cAAc,GAAG,gCAAgC,GAAG,SAAS,CAAA;CAClG,GAAG;KACD,CAAC,IAAI,wBAAwB,CAAC,CAAC,EAAE,KAAK,GAAG,gCAAgC;CAC3E,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;KACrC,CAAC,IAAI,yBAAyB,CAAC,CAAC,EAAE,gCAAgC,GAAG,IAAI;CAC3E,GAAG,qBAAqB,CAAA;AAEzB,sFAAsF;AACtF,MAAM,MAAM,wBAAwB,CAAC,IAAI,SAAS,cAAc,IAAI,IAAI,SAAS,kBAAkB,GAC/F,yBAAyB,GACzB,qBAAqB,CAAA;AAEzB,MAAM,MAAM,iBAAiB,GAAG;IAC9B,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,GAAG,4BAA4B,GAAG,SAAS,CAAA;CAC1F,GAAG;KACD,CAAC,IAAI,oBAAoB,CAAC,CAAC,EAAE,KAAK,GAAG,4BAA4B;CACnE,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;AAEtD,MAAM,MAAM,iBAAiB,CAAC,OAAO,GAAG,SAAS,IAAI;IACnD,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAA;IAC1B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;CAC7B,CAAA;AAED,MAAM,MAAM,MAAM,CAAC,OAAO,SAAS,eAAe,GAAG,eAAe,IAAI;IACtE;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC;QAC1D,QAAQ,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE;gBAAE,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAA;aAAE,CAAC;YAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KACzF,CAAC,CAAA;IACF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;IACnB,aAAa,EAAE,aAAa,CAAA;IAC5B,GAAG,EAAE,GAAG,CAAA;CACT,CAAA;AAED,MAAM,MAAM,QAAQ,GAAG;IACrB;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,CAAC,OAAO,CAAC,CAAA;IACvD,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,YAAY,CAAC;QACnD,QAAQ,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAC/C,CAAC,CAAA;IACF,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,gBAAgB,GAAG,MAAM,CAAA;CAC/B,CAAA;AAED,MAAM,MAAM,yBAAyB,CAAC,KAAK,SAAS,cAAc,IAAI;IACpE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,wBAAwB,CAAC,KAAK,CAAC,CAAA;CACxC,CAAA;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,gBAAgB,CAAC,EAAE,mBAAmB,CAAA;IACtC,KAAK,CAAC,EAAE,iBAAiB,CAAA;CAC1B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,CAAC,EAAE;SACX,IAAI,IAAI,cAAc,CAAC,CAAC,EAAE,yBAAyB,CAAC,IAAI,CAAC;KAC3D,CAAA;IACD,sCAAsC;IACtC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE;SACP,IAAI,IAAI,UAAU,CAAC,CAAC,EAAE,qBAAqB;KAC7C,CAAA;IACD,KAAK,CAAC,EAAE;QACN,0DAA0D;QAC1D,aAAa,CAAC,EAAE,oBAAoB,EAAE,CAAA;KACvC,CAAA;IACD,GAAG,CAAC,EAAE;QACJ,aAAa,CAAC,EAAE,gBAAgB,CAAA;QAChC,WAAW,CAAC,EAAE,OAAO,CAAA;KACtB,CAAA;IACD;;;;;OAKG;IACH,wBAAwB,CAAC,EAAE,CACzB,IAAI,EAAE;QACJ,YAAY,EAAE,wBAAwB,CAAA;KACvC,GAAG,oBAAoB,KACrB,YAAY,CAAC,aAAa,CAAC,CAAA;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,oEAAoE;IACpE,KAAK,CAAC,EAAE,mBAAmB,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,KAAK,EAAE,OAAO,EAAE,CAAA;CACjB,GAAG,IAAI,CAAC,eAAe,EAAE,UAAU,GAAG,OAAO,GAAG,KAAK,GAAG,0BAA0B,CAAC,CAAA;AAEpF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;IACpD,UAAU,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;CACjE,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,cAAc,EAAE,cAAc,CAAA;IAC9B,IAAI,EAAE,cAAc,CAAA;IACpB,IAAI,EAAE,gBAAgB,CAAA;CACvB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,UAAU,CAAA;IACtB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;CACnB,GAAG,WAAW,CAAA;AAEf,MAAM,MAAM,OAAO,GACf,CAAC;IACC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;CACjB,GAAG,WAAW,CAAC,GAChB,CAAC;IACC,IAAI,EAAE,IAAI,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,WAAW,CAAC,GAChB,iBAAiB,GACjB,aAAa,CAAA;AAEjB;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,OAAO,EAAE,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;CACxB,CAAA"}

package/dist/types.js

@@ -1,8 +1,6 @@
 /**
- * The caller's identity + the MCP items authorized for this request. Disabled
- * items and items blocked by access callbacks or Payload operation access are
- * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so
- * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */ export { };
 
 //# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CallToolResult,\n  ContentBlock,\n  JsonSchemaType,\n  McpServer,\n  ResourceTemplate,\n  ServerContext,\n  StandardSchemaWithJSON,\n  ToolAnnotations,\n} from '@modelcontextprotocol/server'\nimport type {\n  AuthCollectionSlug,\n  CollectionSlug,\n  GlobalSlug,\n  MaybePromise,\n  PayloadRequest,\n  SanitizedPermissions,\n  User,\n} from 'payload'\n\nimport type { GetAuthorizedMCPArgs } from './endpoint/access.js'\nimport type {\n  MCPCollectionAuthToolName,\n  MCPCollectionBuiltinName,\n  MCPGlobalBuiltinName,\n} from './mcp/builtinTools.js'\n\nexport type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName }\n\n/** Re-exported from `@modelcontextprotocol/server` — common MCP types used in plugin config. */\nexport type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }\n\n/**\n * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw\n * JSON Schema 2020-12 literal, or a Standard Schema instance (Zod, Valibot, …).\n * Raw schemas may omit `$schema`; when present it must declare the 2020-12 dialect.\n */\nexport type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON\n\nexport type MCPToolResponse = {\n  content: ContentBlock[]\n  /**\n   * If available, return the document fetched within the\n   * mcp tool. This is threaded as an additional argument to\n   * overrideResponse functions and stripped before going on the wire.\n   */\n  doc?: Record<string, unknown>\n} & Pick<CallToolResult, '_meta' | 'isError' | 'structuredContent'>\n\nexport type MCPResponseOverride = (\n  response: MCPToolResponse,\n  doc: Record<string, unknown>,\n  req: PayloadRequest,\n) => MCPToolResponse\n\nexport type MCPAfterToolCallHook = (args: {\n  input: unknown\n  req: PayloadRequest\n  response: MCPToolResponse\n  toolName: string\n}) => MaybePromise<MCPToolResponse>\n\n/**\n * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets\n * its inferred output; anything else falls back to `Record<string, unknown>`.\n */\nexport type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON\n  ? StandardSchemaWithJSON extends TSchema\n    ? Record<string, unknown>\n    : StandardSchemaWithJSON.InferOutput<TSchema>\n  : Record<string, unknown>\n\nexport type MCPAccessArgs = {\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}\n\nexport type CollectionMCPAccessArgs = {\n  collectionSlug: CollectionSlug\n} & MCPAccessArgs\n\nexport type GlobalMCPAccessArgs = {\n  globalSlug: GlobalSlug\n} & MCPAccessArgs\n\nexport type ToolHandlerArgs<TSchema = undefined> = {\n  authorizedMCP: AuthorizedMCP\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type CollectionToolHandlerArgs<TSchema = undefined> = {\n  collectionSlug: CollectionSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type GlobalToolHandlerArgs<TSchema = undefined> = {\n  globalSlug: GlobalSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description: string\n  handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n  /**\n   * Override the return value of the tool handler\n   */\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type CollectionTool<\n  TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,\n> = {\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\nexport type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =\n  {\n    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n    handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n    input?: TSchema\n  } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\n/**\n * Configures (or disables) a built-in tool without replacing it.\n * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a\n * required handler) from being silently accepted at a built-in key slot.\n */\nexport type MCPBuiltInCollectionToolOverride = {\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type MCPBuiltInGlobalToolOverride = {\n  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\n/**\n * Value at a custom (non-built-in) tool key. Either the tool itself, or `false`\n * to disable it (useful when one plugin defines a custom tool and another\n * wants to opt out per-collection).\n */\nexport type MCPTopLevelToolEntry = Tool\n\nexport type MCPCollectionToolsMap = {\n  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined\n} & {\n  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride\n}\n\nexport type MCPAuthCollectionToolsMap = {\n  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true\n} & MCPCollectionToolsMap\n\n/** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */\nexport type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends AuthCollectionSlug\n  ? MCPAuthCollectionToolsMap\n  : MCPCollectionToolsMap\n\nexport type MCPGlobalToolsMap = {\n  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined\n} & {\n  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride\n}\n\nexport type MCPTopLevelToolsMap = Record<string, Tool>\n\nexport type PromptHandlerArgs<TSchema = undefined> = {\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  argsSchema: TSchema\n  description: string\n  handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{\n    messages: Array<{ content: { text: string; type: 'text' }; role: 'assistant' | 'user' }>\n  }>\n  title: string\n}\n\nexport type ResourceHandlerArgs = {\n  /** Variables extracted from a `ResourceTemplate` URI. Empty for static-URI resources. */\n  params: Record<string, string>\n  req: PayloadRequest\n  serverContext: ServerContext\n  uri: URL\n}\n\nexport type Resource = {\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  description: string\n  handler: (args: ResourceHandlerArgs) => MaybePromise<{\n    contents: Array<{ text: string; uri: string }>\n  }>\n  mimeType: string\n  title: string\n  uri: ResourceTemplate | string\n}\n\nexport type MCPPluginCollectionConfig<TSlug extends CollectionSlug> = {\n  description?: string\n  /** Fallback for built-in tools that don't set their own `overrideResponse`. */\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPToolsMapForCollection<TSlug>\n}\n\nexport type MCPPluginGlobalConfig = {\n  description?: string\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPGlobalToolsMap\n}\n\n/**\n * The user-facing config shape passed to `mcpPlugin({ ... })`. Tools, prompts,\n * resources, and per-collection/global tool maps live in their own nested\n * fields. `sanitizeMCPConfig` flattens those into `items` and applies defaults\n * to produce a `SanitizedMCPPluginConfig` — the form every internal consumer\n * actually works with.\n */\nexport type MCPPluginConfig = {\n  collections?: {\n    [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>\n  }\n  /** Skip MCP endpoint registration. */\n  disabled?: boolean\n  globals?: {\n    [Slug in GlobalSlug]?: MCPPluginGlobalConfig\n  }\n  hooks?: {\n    /** Transform a tool response after its handler returns */\n    afterToolCall?: MCPAfterToolCallHook[]\n  }\n  mcp?: {\n    serverOptions?: MCPServerOptions\n    verboseLogs?: boolean\n  }\n  /** Replace the default MCP authorization resolver. */\n  overrideGetAuthorizedMCP?: (\n    args: {\n      pluginConfig: SanitizedMCPPluginConfig\n    } & GetAuthorizedMCPArgs,\n  ) => MaybePromise<AuthorizedMCP>\n  prompts?: Record<string, Prompt>\n  resources?: Record<string, Resource>\n  /** Cross-cutting tools (not scoped to any collection or global). */\n  tools?: MCPTopLevelToolsMap\n}\n\nexport type SanitizedMCPPluginConfig = {\n  items: MCPItem[]\n} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>\n\nexport type MCPServerOptions = {\n  options?: ConstructorParameters<typeof McpServer>[1]\n  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>\n}\n\n/**\n * One MCP primitive plus the metadata needed for config-driven filtering and\n * registration.\n *\n * - `configKey`: the config identifier, e.g. `find` or `echo`.\n * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.\n * - `label`: human-readable display text.\n */\nexport type MCPItemBase = {\n  configKey: string\n  label: string\n  mcpName: string\n}\n\nexport type CollectionMCPItem = {\n  collectionSlug: CollectionSlug\n  tool: CollectionTool\n  type: 'collectionTool'\n} & MCPItemBase\n\nexport type GlobalMCPItem = {\n  globalSlug: GlobalSlug\n  tool: GlobalTool\n  type: 'globalTool'\n} & MCPItemBase\n\nexport type MCPItem =\n  | ({\n      prompt: Prompt\n      type: 'prompt'\n    } & MCPItemBase)\n  | ({\n      resource: Resource\n      type: 'resource'\n    } & MCPItemBase)\n  | ({\n      tool: Tool\n      type: 'tool'\n    } & MCPItemBase)\n  | CollectionMCPItem\n  | GlobalMCPItem\n\n/**\n * The caller's identity + the MCP items authorized for this request. Disabled\n * items and items blocked by access callbacks or Payload operation access are\n * absent from `items`. Tool handlers receive this via `args.authorizedMCP` so\n * they can spread `localAPIDefaults(authorizedMCP)` into every local API call.\n */\nexport type AuthorizedMCP = {\n  items: MCPItem[]\n  overrideAccess: boolean\n  user: null | User\n}\n"],"names":[],"mappings":"AAyTA;;;;;CAKC,GACD,WAIC"}
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type {\n  CallToolResult,\n  ContentBlock,\n  JsonSchemaType,\n  McpServer,\n  ResourceTemplate,\n  ServerContext,\n  StandardSchemaWithJSON,\n  ToolAnnotations,\n} from '@modelcontextprotocol/server'\nimport type {\n  AuthCollectionSlug,\n  CollectionSlug,\n  GlobalSlug,\n  MaybePromise,\n  PayloadRequest,\n  SanitizedPermissions,\n} from 'payload'\n\nimport type { GetAuthorizedMCPArgs } from './endpoint/access.js'\nimport type {\n  MCPCollectionAuthToolName,\n  MCPCollectionBuiltinName,\n  MCPGlobalBuiltinName,\n} from './mcp/builtinTools.js'\n\nexport type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName }\n\n/** Re-exported from `@modelcontextprotocol/server` — common MCP types used in plugin config. */\nexport type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }\n\n/**\n * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw\n * JSON Schema 2020-12 literal, or a Standard Schema instance (Zod, Valibot, …).\n * Raw schemas may omit `$schema`; when present it must declare the 2020-12 dialect.\n */\nexport type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON\n\nexport type MCPToolResponse = {\n  content: ContentBlock[]\n  /**\n   * If available, return the document fetched within the\n   * mcp tool. This is threaded as an additional argument to\n   * overrideResponse functions and stripped before going on the wire.\n   */\n  doc?: Record<string, unknown>\n} & Pick<CallToolResult, '_meta' | 'isError' | 'structuredContent'>\n\nexport type MCPResponseOverride = (\n  response: MCPToolResponse,\n  doc: Record<string, unknown>,\n  req: PayloadRequest,\n) => MCPToolResponse\n\nexport type MCPAfterToolCallHook = (args: {\n  input: unknown\n  req: PayloadRequest\n  response: MCPToolResponse\n  toolName: string\n}) => MaybePromise<MCPToolResponse>\n\n/**\n * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets\n * its inferred output; anything else falls back to `Record<string, unknown>`.\n */\nexport type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON\n  ? StandardSchemaWithJSON extends TSchema\n    ? Record<string, unknown>\n    : StandardSchemaWithJSON.InferOutput<TSchema>\n  : Record<string, unknown>\n\nexport type MCPAccessArgs = {\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}\n\nexport type CollectionMCPAccessArgs = {\n  collectionSlug: CollectionSlug\n} & MCPAccessArgs\n\nexport type GlobalMCPAccessArgs = {\n  globalSlug: GlobalSlug\n} & MCPAccessArgs\n\nexport type ToolHandlerArgs<TSchema = undefined> = {\n  authorizedMCP: AuthorizedMCP\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type CollectionToolHandlerArgs<TSchema = undefined> = {\n  collectionSlug: CollectionSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type GlobalToolHandlerArgs<TSchema = undefined> = {\n  globalSlug: GlobalSlug\n} & ToolHandlerArgs<TSchema>\n\nexport type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {\n  /**\n   * Runs while authorizing each MCP request, before the tool is advertised or called. Return\n   * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`\n   * is enabled.\n   */\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description: string\n  handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n  /**\n   * Override the return value of the tool handler\n   */\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type CollectionTool<\n  TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,\n> = {\n  /**\n   * Runs while authorizing each MCP request for this collection. Return `false` to reject calls\n   * to this tool for the collection. The shared tool is not advertised when no collections allow\n   * it, but can remain advertised when it is available for another collection. This is skipped\n   * when `overrideAccess` is enabled.\n   */\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n  input?: TSchema\n} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\nexport type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =\n  {\n    /**\n     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to\n     * this tool for the global. The shared tool is not advertised when no globals allow it, but\n     * can remain advertised when it is available for another global. This is skipped when\n     * `overrideAccess` is enabled.\n     */\n    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n    handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>\n    input?: TSchema\n  } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>\n\n/**\n * Configures (or disables) a built-in tool without replacing it.\n * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a\n * required handler) from being silently accepted at a built-in key slot.\n */\nexport type MCPBuiltInCollectionToolOverride = {\n  /**\n   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for\n   * this collection. This is skipped when `overrideAccess` is enabled.\n   */\n  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\nexport type MCPBuiltInGlobalToolOverride = {\n  /**\n   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for\n   * this global. This is skipped when `overrideAccess` is enabled.\n   */\n  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>\n  annotations?: ToolAnnotations\n  description?: string\n  handler?: never\n  overrideResponse?: MCPResponseOverride\n}\n\n/**\n * Value at a custom (non-built-in) tool key. Either the tool itself, or `false`\n * to disable it (useful when one plugin defines a custom tool and another\n * wants to opt out per-collection).\n */\nexport type MCPTopLevelToolEntry = Tool\n\nexport type MCPCollectionToolsMap = {\n  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined\n} & {\n  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride\n}\n\nexport type MCPAuthCollectionToolsMap = {\n  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true\n} & MCPCollectionToolsMap\n\n/** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */\nexport type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends AuthCollectionSlug\n  ? MCPAuthCollectionToolsMap\n  : MCPCollectionToolsMap\n\nexport type MCPGlobalToolsMap = {\n  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined\n} & {\n  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride\n}\n\nexport type MCPTopLevelToolsMap = Record<string, Tool>\n\nexport type PromptHandlerArgs<TSchema = undefined> = {\n  input: TypedInput<TSchema>\n  req: PayloadRequest\n  serverContext: ServerContext\n}\n\nexport type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {\n  /**\n   * Runs while authorizing each MCP request, before the prompt is advertised or used. Return\n   * `false` to make the prompt unavailable for that request. This is skipped when\n   * `overrideAccess` is enabled.\n   */\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  argsSchema: TSchema\n  description: string\n  handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{\n    messages: Array<{ content: { text: string; type: 'text' }; role: 'assistant' | 'user' }>\n  }>\n  title: string\n}\n\nexport type ResourceHandlerArgs = {\n  /** Variables extracted from a `ResourceTemplate` URI. Empty for static-URI resources. */\n  params: Record<string, string>\n  req: PayloadRequest\n  serverContext: ServerContext\n  uri: URL\n}\n\nexport type Resource = {\n  /**\n   * Runs while authorizing each MCP request, before the resource is advertised or read. Return\n   * `false` to make the resource unavailable for that request. This is skipped when\n   * `overrideAccess` is enabled.\n   */\n  access?: (args: MCPAccessArgs) => MaybePromise<boolean>\n  description: string\n  handler: (args: ResourceHandlerArgs) => MaybePromise<{\n    contents: Array<{ text: string; uri: string }>\n  }>\n  mimeType: string\n  title: string\n  uri: ResourceTemplate | string\n}\n\nexport type MCPPluginCollectionConfig<TSlug extends CollectionSlug> = {\n  description?: string\n  /** Fallback for built-in tools that don't set their own `overrideResponse`. */\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPToolsMapForCollection<TSlug>\n}\n\nexport type MCPPluginGlobalConfig = {\n  description?: string\n  overrideResponse?: MCPResponseOverride\n  tools?: MCPGlobalToolsMap\n}\n\n/**\n * The user-facing config shape passed to `mcpPlugin({ ... })`. Tools, prompts,\n * resources, and per-collection/global tool maps live in their own nested\n * fields. `sanitizeMCPConfig` flattens those into `items` and applies defaults\n * to produce a `SanitizedMCPPluginConfig` — the form every internal consumer\n * actually works with.\n */\nexport type MCPPluginConfig = {\n  collections?: {\n    [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>\n  }\n  /** Skip MCP endpoint registration. */\n  disabled?: boolean\n  globals?: {\n    [Slug in GlobalSlug]?: MCPPluginGlobalConfig\n  }\n  hooks?: {\n    /** Transform a tool response after its handler returns */\n    afterToolCall?: MCPAfterToolCallHook[]\n  }\n  mcp?: {\n    serverOptions?: MCPServerOptions\n    verboseLogs?: boolean\n  }\n  /**\n   * Replace the default MCP authorization resolver.\n   *\n   * This hook replaces the default authentication flow. It must set `req.user` to the\n   * authenticated Payload user, or to `null` for an anonymous caller, before returning.\n   */\n  overrideGetAuthorizedMCP?: (\n    args: {\n      pluginConfig: SanitizedMCPPluginConfig\n    } & GetAuthorizedMCPArgs,\n  ) => MaybePromise<AuthorizedMCP>\n  prompts?: Record<string, Prompt>\n  resources?: Record<string, Resource>\n  /** Cross-cutting tools (not scoped to any collection or global). */\n  tools?: MCPTopLevelToolsMap\n}\n\nexport type SanitizedMCPPluginConfig = {\n  items: MCPItem[]\n} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>\n\nexport type MCPServerOptions = {\n  options?: ConstructorParameters<typeof McpServer>[1]\n  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>\n}\n\n/**\n * One MCP primitive plus the metadata needed for config-driven filtering and\n * registration.\n *\n * - `configKey`: the config identifier, e.g. `find` or `echo`.\n * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.\n * - `label`: human-readable display text.\n */\nexport type MCPItemBase = {\n  configKey: string\n  label: string\n  mcpName: string\n}\n\nexport type CollectionMCPItem = {\n  collectionSlug: CollectionSlug\n  tool: CollectionTool\n  type: 'collectionTool'\n} & MCPItemBase\n\nexport type GlobalMCPItem = {\n  globalSlug: GlobalSlug\n  tool: GlobalTool\n  type: 'globalTool'\n} & MCPItemBase\n\nexport type MCPItem =\n  | ({\n      prompt: Prompt\n      type: 'prompt'\n    } & MCPItemBase)\n  | ({\n      resource: Resource\n      type: 'resource'\n    } & MCPItemBase)\n  | ({\n      tool: Tool\n      type: 'tool'\n    } & MCPItemBase)\n  | CollectionMCPItem\n  | GlobalMCPItem\n\n/**\n * The MCP items and access mode authorized for this request. The authenticated user is available\n * as `req.user`.\n */\nexport type AuthorizedMCP = {\n  items: MCPItem[]\n  overrideAccess: boolean\n}\n"],"names":[],"mappings":"AAgWA;;;CAGC,GACD,WAGC"}

package/dist/utils/camelCase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAIzC,CAAA"}
+{"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,QAAS,MAAM,KAAG,MAIzC,CAAA"}

package/dist/utils/resolveProjectRoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}
+{"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}

package/dist/utils/schemaConversion/filterFieldsByAccess.d.ts

@@ -0,0 +1,28 @@
+import type { FlattenedBlock, FlattenedField, Operation, SanitizedDocumentPermissions } from 'payload';
+type FieldOperation = Exclude<Operation, 'delete'>;
+type AllowedFieldOperations = Record<FieldOperation, boolean>;
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */
+export declare const filterFieldsByAccess: ({ blocks, fields, permissions, shouldExcludeField, }: {
+    blocks?: FlattenedBlock[];
+    fields: FlattenedField[];
+    permissions: SanitizedDocumentPermissions;
+    shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean;
+}) => FlattenedField[];
+export {};
+//# sourceMappingURL=filterFieldsByAccess.d.ts.map

package/dist/utils/schemaConversion/filterFieldsByAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filterFieldsByAccess.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,4BAA4B,EAE7B,MAAM,SAAS,CAAA;AAEhB,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAClD,KAAK,sBAAsB,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,yDAK9B;IACD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,WAAW,EAAE,4BAA4B,CAAA;IACzC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,OAAO,CAAA;CAC3E,KAAG,cAAc,EAoFjB,CAAA"}

package/dist/utils/schemaConversion/filterFieldsByAccess.js

@@ -0,0 +1,71 @@
+/**
+ * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the
+ * operations allowed by the entity, field, and its parents and decides whether to remove the
+ * field.
+ *
+ * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are
+ * flattened by Payload, so their children are filtered at the containing level.
+ *
+ * @example Include fields writable through any collection operation the user can perform.
+ * ```ts
+ * filterFieldsByAccess({
+ *   fields,
+ *   permissions: collectionPermissions,
+ *   shouldExcludeField: ({ create, update }) => !create && !update,
+ * })
+ * ```
+ */ export const filterFieldsByAccess = ({ blocks, fields, permissions, shouldExcludeField })=>{
+    const filterFields = (nestedFields, nestedPermissions, parentAllowedOperations)=>{
+        const accessibleFields = [];
+        for (const field of nestedFields){
+            const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name];
+            const isOperationAllowed = (operation)=>parentAllowedOperations[operation] && (fieldPermissions === true || fieldPermissions?.[operation] === true);
+            const allowedOperations = {
+                create: isOperationAllowed('create'),
+                read: isOperationAllowed('read'),
+                update: isOperationAllowed('update')
+            };
+            if (shouldExcludeField(allowedOperations)) {
+                continue;
+            }
+            if (field.type === 'blocks') {
+                const accessibleBlocks = [];
+                for (const blockOrReference of field.blocks){
+                    const block = typeof blockOrReference === 'string' ? blocks?.find(({ slug })=>slug === blockOrReference) : blockOrReference;
+                    if (!block) {
+                        continue;
+                    }
+                    const blockPermissions = fieldPermissions === true ? true : fieldPermissions?.blocks === true ? true : fieldPermissions?.blocks?.[block.slug];
+                    accessibleBlocks.push({
+                        ...block,
+                        flattenedFields: filterFields(block.flattenedFields, blockPermissions === true ? true : blockPermissions?.fields, allowedOperations)
+                    });
+                }
+                if (accessibleBlocks.length === 0) {
+                    continue;
+                }
+                accessibleFields.push({
+                    ...field,
+                    blocks: accessibleBlocks
+                });
+                continue;
+            }
+            if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {
+                accessibleFields.push({
+                    ...field,
+                    flattenedFields: filterFields(field.flattenedFields, fieldPermissions === true ? true : fieldPermissions?.fields, allowedOperations)
+                });
+                continue;
+            }
+            accessibleFields.push(field);
+        }
+        return accessibleFields;
+    };
+    return filterFields(fields, permissions.fields, {
+        create: 'create' in permissions && permissions.create === true,
+        read: permissions.read === true,
+        update: permissions.update === true
+    });
+};
+
+//# sourceMappingURL=filterFieldsByAccess.js.map

package/dist/utils/schemaConversion/filterFieldsByAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"sourcesContent":["import type {\n  FlattenedBlock,\n  FlattenedField,\n  Operation,\n  SanitizedDocumentPermissions,\n  SanitizedFieldsPermissions,\n} from 'payload'\n\ntype FieldOperation = Exclude<Operation, 'delete'>\ntype AllowedFieldOperations = Record<FieldOperation, boolean>\n\n/**\n * Filters fields using the access results in `permissions`. `shouldExcludeField` receives the\n * operations allowed by the entity, field, and its parents and decides whether to remove the\n * field.\n *\n * Arrays, groups, named tabs, and blocks are filtered recursively. Rows and unnamed tabs are\n * flattened by Payload, so their children are filtered at the containing level.\n *\n * @example Include fields writable through any collection operation the user can perform.\n * ```ts\n * filterFieldsByAccess({\n *   fields,\n *   permissions: collectionPermissions,\n *   shouldExcludeField: ({ create, update }) => !create && !update,\n * })\n * ```\n */\nexport const filterFieldsByAccess = ({\n  blocks,\n  fields,\n  permissions,\n  shouldExcludeField,\n}: {\n  blocks?: FlattenedBlock[]\n  fields: FlattenedField[]\n  permissions: SanitizedDocumentPermissions\n  shouldExcludeField: (allowedOperations: AllowedFieldOperations) => boolean\n}): FlattenedField[] => {\n  const filterFields = (\n    nestedFields: FlattenedField[],\n    nestedPermissions: SanitizedFieldsPermissions | undefined,\n    parentAllowedOperations: AllowedFieldOperations,\n  ): FlattenedField[] => {\n    const accessibleFields: FlattenedField[] = []\n\n    for (const field of nestedFields) {\n      const fieldPermissions = nestedPermissions === true ? true : nestedPermissions?.[field.name]\n      const isOperationAllowed = (operation: FieldOperation): boolean =>\n        parentAllowedOperations[operation] &&\n        (fieldPermissions === true || fieldPermissions?.[operation] === true)\n      const allowedOperations: AllowedFieldOperations = {\n        create: isOperationAllowed('create'),\n        read: isOperationAllowed('read'),\n        update: isOperationAllowed('update'),\n      }\n\n      if (shouldExcludeField(allowedOperations)) {\n        continue\n      }\n\n      if (field.type === 'blocks') {\n        const accessibleBlocks: (FlattenedBlock | string)[] = []\n\n        for (const blockOrReference of field.blocks) {\n          const block =\n            typeof blockOrReference === 'string'\n              ? blocks?.find(({ slug }) => slug === blockOrReference)\n              : blockOrReference\n\n          if (!block) {\n            continue\n          }\n\n          const blockPermissions =\n            fieldPermissions === true\n              ? true\n              : fieldPermissions?.blocks === true\n                ? true\n                : fieldPermissions?.blocks?.[block.slug]\n\n          accessibleBlocks.push({\n            ...block,\n            flattenedFields: filterFields(\n              block.flattenedFields,\n              blockPermissions === true ? true : blockPermissions?.fields,\n              allowedOperations,\n            ),\n          })\n        }\n\n        if (accessibleBlocks.length === 0) {\n          continue\n        }\n\n        accessibleFields.push({ ...field, blocks: accessibleBlocks })\n        continue\n      }\n\n      if (field.type === 'array' || field.type === 'group' || field.type === 'tab') {\n        accessibleFields.push({\n          ...field,\n          flattenedFields: filterFields(\n            field.flattenedFields,\n            fieldPermissions === true ? true : fieldPermissions?.fields,\n            allowedOperations,\n          ),\n        })\n        continue\n      }\n\n      accessibleFields.push(field)\n    }\n\n    return accessibleFields\n  }\n\n  return filterFields(fields, permissions.fields, {\n    create: 'create' in permissions && permissions.create === true,\n    read: permissions.read === true,\n    update: permissions.update === true,\n  })\n}\n"],"names":["filterFieldsByAccess","blocks","fields","permissions","shouldExcludeField","filterFields","nestedFields","nestedPermissions","parentAllowedOperations","accessibleFields","field","fieldPermissions","name","isOperationAllowed","operation","allowedOperations","create","read","update","type","accessibleBlocks","blockOrReference","block","find","slug","blockPermissions","push","flattenedFields","length"],"mappings":"AAWA;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMA,uBAAuB,CAAC,EACnCC,MAAM,EACNC,MAAM,EACNC,WAAW,EACXC,kBAAkB,EAMnB;IACC,MAAMC,eAAe,CACnBC,cACAC,mBACAC;QAEA,MAAMC,mBAAqC,EAAE;QAE7C,KAAK,MAAMC,SAASJ,aAAc;YAChC,MAAMK,mBAAmBJ,sBAAsB,OAAO,OAAOA,mBAAmB,CAACG,MAAME,IAAI,CAAC;YAC5F,MAAMC,qBAAqB,CAACC,YAC1BN,uBAAuB,CAACM,UAAU,IACjCH,CAAAA,qBAAqB,QAAQA,kBAAkB,CAACG,UAAU,KAAK,IAAG;YACrE,MAAMC,oBAA4C;gBAChDC,QAAQH,mBAAmB;gBAC3BI,MAAMJ,mBAAmB;gBACzBK,QAAQL,mBAAmB;YAC7B;YAEA,IAAIT,mBAAmBW,oBAAoB;gBACzC;YACF;YAEA,IAAIL,MAAMS,IAAI,KAAK,UAAU;gBAC3B,MAAMC,mBAAgD,EAAE;gBAExD,KAAK,MAAMC,oBAAoBX,MAAMT,MAAM,CAAE;oBAC3C,MAAMqB,QACJ,OAAOD,qBAAqB,WACxBpB,QAAQsB,KAAK,CAAC,EAAEC,IAAI,EAAE,GAAKA,SAASH,oBACpCA;oBAEN,IAAI,CAACC,OAAO;wBACV;oBACF;oBAEA,MAAMG,mBACJd,qBAAqB,OACjB,OACAA,kBAAkBV,WAAW,OAC3B,OACAU,kBAAkBV,QAAQ,CAACqB,MAAME,IAAI,CAAC;oBAE9CJ,iBAAiBM,IAAI,CAAC;wBACpB,GAAGJ,KAAK;wBACRK,iBAAiBtB,aACfiB,MAAMK,eAAe,EACrBF,qBAAqB,OAAO,OAAOA,kBAAkBvB,QACrDa;oBAEJ;gBACF;gBAEA,IAAIK,iBAAiBQ,MAAM,KAAK,GAAG;oBACjC;gBACF;gBAEAnB,iBAAiBiB,IAAI,CAAC;oBAAE,GAAGhB,KAAK;oBAAET,QAAQmB;gBAAiB;gBAC3D;YACF;YAEA,IAAIV,MAAMS,IAAI,KAAK,WAAWT,MAAMS,IAAI,KAAK,WAAWT,MAAMS,IAAI,KAAK,OAAO;gBAC5EV,iBAAiBiB,IAAI,CAAC;oBACpB,GAAGhB,KAAK;oBACRiB,iBAAiBtB,aACfK,MAAMiB,eAAe,EACrBhB,qBAAqB,OAAO,OAAOA,kBAAkBT,QACrDa;gBAEJ;gBACA;YACF;YAEAN,iBAAiBiB,IAAI,CAAChB;QACxB;QAEA,OAAOD;IACT;IAEA,OAAOJ,aAAaH,QAAQC,YAAYD,MAAM,EAAE;QAC9Cc,QAAQ,YAAYb,eAAeA,YAAYa,MAAM,KAAK;QAC1DC,MAAMd,YAAYc,IAAI,KAAK;QAC3BC,QAAQf,YAAYe,MAAM,KAAK;IACjC;AACF,EAAC"}

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts

@@ -1,11 +1,13 @@
-import { type CollectionSlug, type GlobalSlug, type PayloadRequest } from 'payload';
+import { type CollectionSlug, type GlobalSlug, type PayloadRequest, type SanitizedCollectionPermission, type SanitizedGlobalPermission } from 'payload';
 import type { JsonSchemaType } from '../../types.js';
-export declare const getCollectionInputSchema: ({ collectionSlug, req, }: {
+export declare const getCollectionInputSchema: ({ collectionSlug, permissions, req, }: {
     collectionSlug: CollectionSlug;
+    permissions?: SanitizedCollectionPermission;
     req: PayloadRequest;
 }) => JsonSchemaType | null;
-export declare const getGlobalInputSchema: ({ globalSlug, req, }: {
+export declare const getGlobalInputSchema: ({ globalSlug, permissions, req, }: {
     globalSlug: GlobalSlug;
+    permissions?: SanitizedGlobalPermission;
     req: PayloadRequest;
 }) => JsonSchemaType | null;
 //# sourceMappingURL=getEntityInputSchema.d.ts.map

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAEnB,KAAK,UAAU,EACf,KAAK,cAAc,EAGpB,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAIpD,eAAO,MAAM,wBAAwB,GAAI,0BAGtC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAQpB,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,sBAGlC;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAQpB,CAAA"}
+{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,0CAIlC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,sCAI9B;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}

package/dist/utils/schemaConversion/getEntityInputSchema.js

@@ -1,32 +1,66 @@
 import { entityToStandaloneJSONSchema } from 'payload';
+import { filterFieldsByAccess } from './filterFieldsByAccess.js';
 import { sanitizeEntitySchema } from './sanitizeEntitySchema.js';
-export const getCollectionInputSchema = ({ collectionSlug, req })=>{
+export const getCollectionInputSchema = ({ collectionSlug, permissions, req })=>{
     const collection = req.payload.collections[collectionSlug]?.config;
     if (!collection) {
         return null;
     }
+    if (!permissions) {
+        return buildEntityInputSchema({
+            entity: collection,
+            req
+        });
+    }
+    const fieldsAllowedByAccess = filterFieldsByAccess({
+        blocks: req.payload.config.blocks,
+        fields: collection.flattenedFields,
+        permissions,
+        shouldExcludeField: ({ create, update })=>!create && !update
+    });
     return buildEntityInputSchema({
         entity: collection,
+        fields: fieldsAllowedByAccess,
         req
     });
 };
-export const getGlobalInputSchema = ({ globalSlug, req })=>{
+export const getGlobalInputSchema = ({ globalSlug, permissions, req })=>{
     const global = req.payload.config.globals.find((globalConfig)=>globalConfig.slug === globalSlug);
     if (!global) {
         return null;
     }
+    if (!permissions) {
+        return buildEntityInputSchema({
+            entity: global,
+            req
+        });
+    }
+    const fieldsAllowedByAccess = filterFieldsByAccess({
+        blocks: req.payload.config.blocks,
+        fields: global.flattenedFields,
+        permissions,
+        shouldExcludeField: ({ create, update })=>!create && !update
+    });
     return buildEntityInputSchema({
         entity: global,
+        fields: fieldsAllowedByAccess,
         req
     });
 };
-const buildEntityInputSchema = ({ entity, req })=>// The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.
-    sanitizeEntitySchema(entityToStandaloneJSONSchema({
+const buildEntityInputSchema = ({ entity, fields = entity.flattenedFields, req })=>{
+    // The core schema generator reads flattenedFields from the entity and has no fields argument.
+    const entityForSchema = {
+        ...entity,
+        flattenedFields: fields
+    };
+    const schema = entityToStandaloneJSONSchema({
         config: req.payload.config,
         defaultIDType: req.payload.db.defaultIDType,
-        entity,
+        entity: entityForSchema,
         i18n: req.i18n,
         variant: 'input'
-    }));
+    });
+    return sanitizeEntitySchema(schema);
+};
 
 //# sourceMappingURL=getEntityInputSchema.js.map

package/dist/utils/schemaConversion/getEntityInputSchema.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"sourcesContent":["import {\n  type CollectionSlug,\n  entityToStandaloneJSONSchema,\n  type GlobalSlug,\n  type PayloadRequest,\n  type SanitizedCollectionConfig,\n  type SanitizedGlobalConfig,\n} from 'payload'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\nexport const getCollectionInputSchema = ({\n  collectionSlug,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const collection = req.payload.collections[collectionSlug]?.config\n\n  if (!collection) {\n    return null\n  }\n\n  return buildEntityInputSchema({ entity: collection, req })\n}\n\nexport const getGlobalInputSchema = ({\n  globalSlug,\n  req,\n}: {\n  globalSlug: GlobalSlug\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)\n\n  if (!global) {\n    return null\n  }\n\n  return buildEntityInputSchema({ entity: global, req })\n}\n\nconst buildEntityInputSchema = ({\n  entity,\n  req,\n}: {\n  entity: SanitizedCollectionConfig | SanitizedGlobalConfig\n  req: PayloadRequest\n}): JsonSchemaType =>\n  // The `input` variant is already the write shape; sanitizeEntitySchema only adds MCP-specific passes.\n  sanitizeEntitySchema(\n    entityToStandaloneJSONSchema({\n      config: req.payload.config,\n      defaultIDType: req.payload.db.defaultIDType,\n      entity,\n      i18n: req.i18n,\n      variant: 'input',\n    }) as unknown as JsonSchemaType,\n  )\n"],"names":["entityToStandaloneJSONSchema","sanitizeEntitySchema","getCollectionInputSchema","collectionSlug","req","collection","payload","collections","config","buildEntityInputSchema","entity","getGlobalInputSchema","globalSlug","global","globals","find","globalConfig","slug","defaultIDType","db","i18n","variant"],"mappings":"AAAA,SAEEA,4BAA4B,QAKvB,UAAS;AAIhB,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhE,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,cAAc,EACdC,GAAG,EAIJ;IACC,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACJ,eAAe,EAAEK;IAE5D,IAAI,CAACH,YAAY;QACf,OAAO;IACT;IAEA,OAAOI,uBAAuB;QAAEC,QAAQL;QAAYD;IAAI;AAC1D,EAAC;AAED,OAAO,MAAMO,uBAAuB,CAAC,EACnCC,UAAU,EACVR,GAAG,EAIJ;IACC,MAAMS,SAAST,IAAIE,OAAO,CAACE,MAAM,CAACM,OAAO,CAACC,IAAI,CAAC,CAACC,eAAiBA,aAAaC,IAAI,KAAKL;IAEvF,IAAI,CAACC,QAAQ;QACX,OAAO;IACT;IAEA,OAAOJ,uBAAuB;QAAEC,QAAQG;QAAQT;IAAI;AACtD,EAAC;AAED,MAAMK,yBAAyB,CAAC,EAC9BC,MAAM,EACNN,GAAG,EAIJ,GACC,sGAAsG;IACtGH,qBACED,6BAA6B;QAC3BQ,QAAQJ,IAAIE,OAAO,CAACE,MAAM;QAC1BU,eAAed,IAAIE,OAAO,CAACa,EAAE,CAACD,aAAa;QAC3CR;QACAU,MAAMhB,IAAIgB,IAAI;QACdC,SAAS;IACX"}
+{"version":3,"sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"sourcesContent":["import {\n  type CollectionSlug,\n  entityToStandaloneJSONSchema,\n  type FlattenedField,\n  type GlobalSlug,\n  type PayloadRequest,\n  type SanitizedCollectionConfig,\n  type SanitizedCollectionPermission,\n  type SanitizedGlobalConfig,\n  type SanitizedGlobalPermission,\n} from 'payload'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { filterFieldsByAccess } from './filterFieldsByAccess.js'\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\nexport const getCollectionInputSchema = ({\n  collectionSlug,\n  permissions,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  permissions?: SanitizedCollectionPermission\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const collection = req.payload.collections[collectionSlug]?.config\n\n  if (!collection) {\n    return null\n  }\n\n  if (!permissions) {\n    return buildEntityInputSchema({ entity: collection, req })\n  }\n\n  const fieldsAllowedByAccess = filterFieldsByAccess({\n    blocks: req.payload.config.blocks,\n    fields: collection.flattenedFields,\n    permissions,\n    shouldExcludeField: ({ create, update }) => !create && !update,\n  })\n\n  return buildEntityInputSchema({ entity: collection, fields: fieldsAllowedByAccess, req })\n}\n\nexport const getGlobalInputSchema = ({\n  globalSlug,\n  permissions,\n  req,\n}: {\n  globalSlug: GlobalSlug\n  permissions?: SanitizedGlobalPermission\n  req: PayloadRequest\n}): JsonSchemaType | null => {\n  const global = req.payload.config.globals.find((globalConfig) => globalConfig.slug === globalSlug)\n\n  if (!global) {\n    return null\n  }\n\n  if (!permissions) {\n    return buildEntityInputSchema({ entity: global, req })\n  }\n\n  const fieldsAllowedByAccess = filterFieldsByAccess({\n    blocks: req.payload.config.blocks,\n    fields: global.flattenedFields,\n    permissions,\n    shouldExcludeField: ({ create, update }) => !create && !update,\n  })\n\n  return buildEntityInputSchema({ entity: global, fields: fieldsAllowedByAccess, req })\n}\n\nconst buildEntityInputSchema = ({\n  entity,\n  fields = entity.flattenedFields,\n  req,\n}: {\n  entity: SanitizedCollectionConfig | SanitizedGlobalConfig\n  fields?: FlattenedField[]\n  req: PayloadRequest\n}): JsonSchemaType => {\n  // The core schema generator reads flattenedFields from the entity and has no fields argument.\n  const entityForSchema = { ...entity, flattenedFields: fields }\n  const schema = entityToStandaloneJSONSchema({\n    config: req.payload.config,\n    defaultIDType: req.payload.db.defaultIDType,\n    entity: entityForSchema,\n    i18n: req.i18n,\n    variant: 'input',\n  }) as unknown as JsonSchemaType\n\n  return sanitizeEntitySchema(schema)\n}\n"],"names":["entityToStandaloneJSONSchema","filterFieldsByAccess","sanitizeEntitySchema","getCollectionInputSchema","collectionSlug","permissions","req","collection","payload","collections","config","buildEntityInputSchema","entity","fieldsAllowedByAccess","blocks","fields","flattenedFields","shouldExcludeField","create","update","getGlobalInputSchema","globalSlug","global","globals","find","globalConfig","slug","entityForSchema","schema","defaultIDType","db","i18n","variant"],"mappings":"AAAA,SAEEA,4BAA4B,QAQvB,UAAS;AAIhB,SAASC,oBAAoB,QAAQ,4BAA2B;AAChE,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhE,OAAO,MAAMC,2BAA2B,CAAC,EACvCC,cAAc,EACdC,WAAW,EACXC,GAAG,EAKJ;IACC,MAAMC,aAAaD,IAAIE,OAAO,CAACC,WAAW,CAACL,eAAe,EAAEM;IAE5D,IAAI,CAACH,YAAY;QACf,OAAO;IACT;IAEA,IAAI,CAACF,aAAa;QAChB,OAAOM,uBAAuB;YAAEC,QAAQL;YAAYD;QAAI;IAC1D;IAEA,MAAMO,wBAAwBZ,qBAAqB;QACjDa,QAAQR,IAAIE,OAAO,CAACE,MAAM,CAACI,MAAM;QACjCC,QAAQR,WAAWS,eAAe;QAClCX;QACAY,oBAAoB,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK,CAACD,UAAU,CAACC;IAC1D;IAEA,OAAOR,uBAAuB;QAAEC,QAAQL;QAAYQ,QAAQF;QAAuBP;IAAI;AACzF,EAAC;AAED,OAAO,MAAMc,uBAAuB,CAAC,EACnCC,UAAU,EACVhB,WAAW,EACXC,GAAG,EAKJ;IACC,MAAMgB,SAAShB,IAAIE,OAAO,CAACE,MAAM,CAACa,OAAO,CAACC,IAAI,CAAC,CAACC,eAAiBA,aAAaC,IAAI,KAAKL;IAEvF,IAAI,CAACC,QAAQ;QACX,OAAO;IACT;IAEA,IAAI,CAACjB,aAAa;QAChB,OAAOM,uBAAuB;YAAEC,QAAQU;YAAQhB;QAAI;IACtD;IAEA,MAAMO,wBAAwBZ,qBAAqB;QACjDa,QAAQR,IAAIE,OAAO,CAACE,MAAM,CAACI,MAAM;QACjCC,QAAQO,OAAON,eAAe;QAC9BX;QACAY,oBAAoB,CAAC,EAAEC,MAAM,EAAEC,MAAM,EAAE,GAAK,CAACD,UAAU,CAACC;IAC1D;IAEA,OAAOR,uBAAuB;QAAEC,QAAQU;QAAQP,QAAQF;QAAuBP;IAAI;AACrF,EAAC;AAED,MAAMK,yBAAyB,CAAC,EAC9BC,MAAM,EACNG,SAASH,OAAOI,eAAe,EAC/BV,GAAG,EAKJ;IACC,8FAA8F;IAC9F,MAAMqB,kBAAkB;QAAE,GAAGf,MAAM;QAAEI,iBAAiBD;IAAO;IAC7D,MAAMa,SAAS5B,6BAA6B;QAC1CU,QAAQJ,IAAIE,OAAO,CAACE,MAAM;QAC1BmB,eAAevB,IAAIE,OAAO,CAACsB,EAAE,CAACD,aAAa;QAC3CjB,QAAQe;QACRI,MAAMzB,IAAIyB,IAAI;QACdC,SAAS;IACX;IAEA,OAAO9B,qBAAqB0B;AAC9B"}

package/dist/utils/schemaConversion/sanitizeEntitySchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,cAAc,KAAG,cA0B7D,CAAA"}
+{"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,WAAY,cAAc,KAAG,cA0B7D,CAAA"}

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js

@@ -104,8 +104,8 @@ describe('sanitizeEntitySchema', ()=>{
                 }
             },
             properties: {
-                // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;
-                // `id` stays because it's a valid optional input (a client may supply a custom ID).
+                // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's
+                // a valid optional input (a client may supply a custom ID).
                 id: {
                     type: 'string'
                 },

package/dist/utils/schemaConversion/sanitizeEntitySchema.spec.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n  it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {\n    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field\n    // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant\n    // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to\n    // reduce here (the variant did that upstream), so sanitize leaves the value untouched.\n    const standalone: JsonSchemaType = {\n      type: 'object',\n      $defs: {\n        LexicalNodes_ABCDEF12: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n              },\n            },\n          },\n        },\n      },\n    }\n\n    expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n      type: 'object',\n      $defs: {\n        // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n        // `oneOf` - not loosened to `anyOf`.\n        node: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                // The value is already ID-only from the input variant - left as-is.\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        // Managed fields (createdAt/updatedAt/_status) are excluded upstream by the `input` variant;\n        // `id` stays because it's a valid optional input (a client may supply a custom ID).\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/node' } },\n              },\n            },\n          },\n        },\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","description","id","content","root","children","items","$ref","toStrictEqual","node"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,yFAAyF;QAC1F,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,uFAAuF;QACvF,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACVK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAnB,OAAOE,qBAAqBC,aAAaiB,aAAa,CAAC;YACrDhB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,qCAAqC;gBACrCgB,MAAM;oBACJd,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,oEAAoE;gCACpEE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACV,6FAA6F;gBAC7F,oFAAoF;gBACpFK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.spec.ts"],"sourcesContent":["import { describe, expect, it } from 'vitest'\n\nimport type { JsonSchemaType } from '../../types.js'\n\nimport { sanitizeEntitySchema } from './sanitizeEntitySchema.js'\n\ndescribe('sanitizeEntitySchema', () => {\n  it('renames the Lexical node-union definition to a short name and keeps it a strict oneOf', () => {\n    // Shaped like the schema the MCP server prepares for a collection with a Lexical richText field\n    // (Payload's `input` variant): a `$defs` node union (a `oneOf` of node shapes). The input variant\n    // already types the relationship node's `value` as a bare ID - there is no populated-doc `$ref` to\n    // reduce here (the variant did that upstream), so sanitize leaves the value untouched.\n    const standalone: JsonSchemaType = {\n      type: 'object',\n      $defs: {\n        LexicalNodes_ABCDEF12: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/LexicalNodes_ABCDEF12' } },\n              },\n            },\n          },\n        },\n      },\n    }\n\n    expect(sanitizeEntitySchema(standalone)).toStrictEqual({\n      type: 'object',\n      $defs: {\n        // The node union is renamed to a short, readable `node`, and stays a strict discriminated\n        // `oneOf` - not loosened to `anyOf`.\n        node: {\n          oneOf: [\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: { type: { const: 'paragraph' } },\n              required: ['type'],\n            },\n            {\n              type: 'object',\n              additionalProperties: false,\n              properties: {\n                type: { const: 'relationship' },\n                // The value is already ID-only from the input variant - left as-is.\n                value: { type: 'string', description: 'The related document ID.' },\n              },\n              required: ['type'],\n            },\n          ],\n        },\n      },\n      properties: {\n        // Managed timestamps are excluded upstream by the `input` variant. `id` stays because it's\n        // a valid optional input (a client may supply a custom ID).\n        id: { type: 'string' },\n        content: {\n          type: 'object',\n          properties: {\n            root: {\n              type: 'object',\n              properties: {\n                children: { type: 'array', items: { $ref: '#/$defs/node' } },\n              },\n            },\n          },\n        },\n      },\n    })\n  })\n})\n"],"names":["describe","expect","it","sanitizeEntitySchema","standalone","type","$defs","LexicalNodes_ABCDEF12","oneOf","additionalProperties","properties","const","required","value","description","id","content","root","children","items","$ref","toStrictEqual","node"],"mappings":"AAAA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAI7C,SAASC,oBAAoB,QAAQ,4BAA2B;AAEhEH,SAAS,wBAAwB;IAC/BE,GAAG,yFAAyF;QAC1F,gGAAgG;QAChG,kGAAkG;QAClG,mGAAmG;QACnG,uFAAuF;QACvF,MAAME,aAA6B;YACjCC,MAAM;YACNC,OAAO;gBACLC,uBAAuB;oBACrBC,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9BE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACVK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAgC;gCAAE;4BAC9E;wBACF;oBACF;gBACF;YACF;QACF;QAEAnB,OAAOE,qBAAqBC,aAAaiB,aAAa,CAAC;YACrDhB,MAAM;YACNC,OAAO;gBACL,0FAA0F;gBAC1F,qCAAqC;gBACrCgB,MAAM;oBACJd,OAAO;wBACL;4BACEH,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCAAEL,MAAM;oCAAEM,OAAO;gCAAY;4BAAE;4BAC3CC,UAAU;gCAAC;6BAAO;wBACpB;wBACA;4BACEP,MAAM;4BACNI,sBAAsB;4BACtBC,YAAY;gCACVL,MAAM;oCAAEM,OAAO;gCAAe;gCAC9B,oEAAoE;gCACpEE,OAAO;oCAAER,MAAM;oCAAUS,aAAa;gCAA2B;4BACnE;4BACAF,UAAU;gCAAC;6BAAO;wBACpB;qBACD;gBACH;YACF;YACAF,YAAY;gBACV,2FAA2F;gBAC3F,4DAA4D;gBAC5DK,IAAI;oBAAEV,MAAM;gBAAS;gBACrBW,SAAS;oBACPX,MAAM;oBACNK,YAAY;wBACVO,MAAM;4BACJZ,MAAM;4BACNK,YAAY;gCACVQ,UAAU;oCAAEb,MAAM;oCAASc,OAAO;wCAAEC,MAAM;oCAAe;gCAAE;4BAC7D;wBACF;oBACF;gBACF;YACF;QACF;IACF;AACF"}

package/dist/utils/toStandardSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,GAAI,QAAQ,eAAe,KAAG,sBAG/B,CAAA"}
+{"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,WAAY,eAAe,KAAG,sBAG/B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.811e0a4",
+  "version": "4.0.0-internal.8867dba",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -55,16 +55,16 @@
     "bin.js"
   ],
   "dependencies": {
-    "@modelcontextprotocol/server": "2.0.0-beta.2",
+    "@modelcontextprotocol/server": "2.0.0-beta.3",
     "tsx": "4.22.4",
     "zod": "^4.2.0"
   },
   "devDependencies": {
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-internal.811e0a4"
+    "payload": "4.0.0-internal.8867dba"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.811e0a4"
+    "payload": "4.0.0-internal.8867dba"
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",

package/src/endpoint/access.ts

@@ -12,13 +12,8 @@ export type GetAuthorizedMCPArgs = {
 }
 
 /**
- * Resolves the MCP caller and returns the MCP surface authorized for that request.
- *
- * Authorization has two layers:
- * 1. Payload collection/global permissions determine whether built-in operation tools are shown.
- * 2. MCP `access` callbacks can further hide any configured tool, prompt, or resource.
- *
- * Like Payload core operations, `overrideAccess` skips both layers.
+ * Authenticates an MCP request and removes items the user cannot access.
+ * `overrideAccess` skips Payload and MCP item access checks.
  */
 export const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP> = async ({
   overrideAccess,
@@ -53,7 +48,6 @@ export const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<Authorize
       req,
     }),
     overrideAccess,
-    user: req.user,
   }
 }
 
@@ -66,8 +60,7 @@ export const filterMCPItems = async ({
   overrideAccess: boolean
   req: PayloadRequest
 }): Promise<MCPItem[]> => {
-  // Match Payload core: overrideAccess bypasses access evaluation instead of
-  // forcing each access function to return true.
+  // Match Payload core: overrideAccess bypasses access evaluation
   if (overrideAccess) {
     return items
   }

package/src/mcp/builtin/collections/countTool.ts

@@ -3,7 +3,6 @@ import { z } from 'zod'
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineCollectionTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import { localAPIDefaults } from '../../../utils/localAPIDefaults.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 
 const DEFAULT_DESCRIPTION =
@@ -42,8 +41,8 @@ export const countDocumentsTool = defineCollectionTool({
   try {
     const result = await payload.count({
       collection: collectionSlug,
+      overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...localAPIDefaults(authorizedMCP),
       ...(locale ? { locale } : {}),
       ...(trash !== undefined ? { trash } : {}),
       ...(where ? { where } : {}),