@payloadcms/plugin-mcp 4.0.0-internal.8867dba → 4.0.0-internal.934870d

package/bin.js

@@ -27,13 +27,6 @@ const start = async () => {
     return
   }
 
-  // tsx 4.22.4's synchronous loader leaks its namespace query onto Node built-ins on Node 23.5+.
-  // Force the stable asynchronous loader path, matching payload/bin.js.
-  const nodeModule = await import('node:module')
-  if (typeof nodeModule.default.registerHooks === 'function') {
-    nodeModule.default.registerHooks = undefined
-  }
-
   const { tsImport } = await import('tsx/esm/api')
   const { runMcpStdio } = await tsImport('./dist/stdio.js', baseURL)
   await runMcpStdio()

package/dist/endpoint/access.js

@@ -62,13 +62,13 @@ export const filterMCPItems = async ({ items, overrideAccess, req })=>{
     switch(item.type){
         case 'collectionTool':
             return !item.tool.access || await item.tool.access({
-                collectionSlug: item.collectionSlug,
+                slug: item.collectionSlug,
                 permissions,
                 req
             });
         case 'globalTool':
             return !item.tool.access || await item.tool.access({
-                globalSlug: item.globalSlug,
+                slug: item.globalSlug,
                 permissions,
                 req
             });

package/dist/endpoint/access.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { PayloadRequest, SanitizedPermissions } from 'payload'\n\nimport { getAccessResults, UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPItem } from '../types.js'\n\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\nexport type GetAuthorizedMCPArgs = {\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\n/**\n * Authenticates an MCP request and removes items the user cannot access.\n * `overrideAccess` skips Payload and MCP item access checks.\n */\nexport const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP> = async ({\n  overrideAccess,\n  req,\n}) => {\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  if (pluginConfig.overrideGetAuthorizedMCP) {\n    return await pluginConfig.overrideGetAuthorizedMCP({\n      overrideAccess,\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (req.headers) {\n    const headers = new Headers(req.headers)\n    const hasAuthorization = headers.has('Authorization')\n\n    headers.set('DisableAutologin', 'true')\n    req.user = (await req.payload.auth({ headers, req })).user\n\n    if (hasAuthorization && !req.user) {\n      throw new UnauthorizedError(req.t)\n    }\n  }\n\n  return {\n    items: await filterMCPItems({\n      items: pluginConfig.items,\n      overrideAccess,\n      req,\n    }),\n    overrideAccess,\n  }\n}\n\nexport const filterMCPItems = async ({\n  items,\n  overrideAccess,\n  req,\n}: {\n  items: MCPItem[]\n  overrideAccess: boolean\n  req: PayloadRequest\n}): Promise<MCPItem[]> => {\n  // Match Payload core: overrideAccess bypasses access evaluation\n  if (overrideAccess) {\n    return items\n  }\n\n  const authorizedItems: MCPItem[] = []\n\n  const permissions = await getAccessResults({ req })\n\n  for (const item of items) {\n    if (!(await checkItemAccess({ item, permissions, req }))) {\n      continue\n    }\n    authorizedItems.push(item)\n  }\n\n  return authorizedItems\n}\n\n/**\n * Runs MCP item access callbacks\n */\nconst checkItemAccess = async ({\n  item,\n  permissions,\n  req,\n}: {\n  item: MCPItem\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}): Promise<boolean> => {\n  switch (item.type) {\n    case 'collectionTool':\n      return (\n        !item.tool.access ||\n        (await item.tool.access({ collectionSlug: item.collectionSlug, permissions, req }))\n      )\n    case 'globalTool':\n      return (\n        !item.tool.access ||\n        (await item.tool.access({ globalSlug: item.globalSlug, permissions, req }))\n      )\n    case 'prompt':\n      return !item.prompt.access || (await item.prompt.access({ permissions, req }))\n    case 'resource':\n      return !item.resource.access || (await item.resource.access({ permissions, req }))\n    case 'tool':\n      return !item.tool.access || (await item.tool.access({ permissions, req }))\n  }\n}\n"],"names":["getAccessResults","UnauthorizedError","getPluginConfig","getAuthorizedMCP","overrideAccess","req","pluginConfig","config","payload","overrideGetAuthorizedMCP","headers","Headers","hasAuthorization","has","set","user","auth","t","items","filterMCPItems","authorizedItems","permissions","item","checkItemAccess","push","type","tool","access","collectionSlug","globalSlug","prompt","resource"],"mappings":"AAEA,SAASA,gBAAgB,EAAEC,iBAAiB,QAAQ,UAAS;AAI7D,SAASC,eAAe,QAAQ,8BAA6B;AAO7D;;;CAGC,GACD,OAAO,MAAMC,mBAA2E,OAAO,EAC7FC,cAAc,EACdC,GAAG,EACJ;IACC,MAAMC,eAAeJ,gBAAgB;QAAEK,QAAQF,IAAIG,OAAO,CAACD,MAAM;IAAC;IAElE,IAAID,aAAaG,wBAAwB,EAAE;QACzC,OAAO,MAAMH,aAAaG,wBAAwB,CAAC;YACjDL;YACAE;YACAD;QACF;IACF;IAEA,IAAIA,IAAIK,OAAO,EAAE;QACf,MAAMA,UAAU,IAAIC,QAAQN,IAAIK,OAAO;QACvC,MAAME,mBAAmBF,QAAQG,GAAG,CAAC;QAErCH,QAAQI,GAAG,CAAC,oBAAoB;QAChCT,IAAIU,IAAI,GAAG,AAAC,CAAA,MAAMV,IAAIG,OAAO,CAACQ,IAAI,CAAC;YAAEN;YAASL;QAAI,EAAC,EAAGU,IAAI;QAE1D,IAAIH,oBAAoB,CAACP,IAAIU,IAAI,EAAE;YACjC,MAAM,IAAId,kBAAkBI,IAAIY,CAAC;QACnC;IACF;IAEA,OAAO;QACLC,OAAO,MAAMC,eAAe;YAC1BD,OAAOZ,aAAaY,KAAK;YACzBd;YACAC;QACF;QACAD;IACF;AACF,EAAC;AAED,OAAO,MAAMe,iBAAiB,OAAO,EACnCD,KAAK,EACLd,cAAc,EACdC,GAAG,EAKJ;IACC,gEAAgE;IAChE,IAAID,gBAAgB;QAClB,OAAOc;IACT;IAEA,MAAME,kBAA6B,EAAE;IAErC,MAAMC,cAAc,MAAMrB,iBAAiB;QAAEK;IAAI;IAEjD,KAAK,MAAMiB,QAAQJ,MAAO;QACxB,IAAI,CAAE,MAAMK,gBAAgB;YAAED;YAAMD;YAAahB;QAAI,IAAK;YACxD;QACF;QACAe,gBAAgBI,IAAI,CAACF;IACvB;IAEA,OAAOF;AACT,EAAC;AAED;;CAEC,GACD,MAAMG,kBAAkB,OAAO,EAC7BD,IAAI,EACJD,WAAW,EACXhB,GAAG,EAKJ;IACC,OAAQiB,KAAKG,IAAI;QACf,KAAK;YACH,OACE,CAACH,KAAKI,IAAI,CAACC,MAAM,IAChB,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEC,gBAAgBN,KAAKM,cAAc;gBAAEP;gBAAahB;YAAI;QAEpF,KAAK;YACH,OACE,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAChB,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEE,YAAYP,KAAKO,UAAU;gBAAER;gBAAahB;YAAI;QAE5E,KAAK;YACH,OAAO,CAACiB,KAAKQ,MAAM,CAACH,MAAM,IAAK,MAAML,KAAKQ,MAAM,CAACH,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QAC7E,KAAK;YACH,OAAO,CAACiB,KAAKS,QAAQ,CAACJ,MAAM,IAAK,MAAML,KAAKS,QAAQ,CAACJ,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QACjF,KAAK;YACH,OAAO,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAAK,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;IAC3E;AACF"}
+{"version":3,"sources":["../../src/endpoint/access.ts"],"sourcesContent":["import type { PayloadRequest, SanitizedPermissions } from 'payload'\n\nimport { getAccessResults, UnauthorizedError } from 'payload'\n\nimport type { AuthorizedMCP, MCPItem } from '../types.js'\n\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\n\nexport type GetAuthorizedMCPArgs = {\n  overrideAccess: boolean\n  req: PayloadRequest\n}\n\n/**\n * Authenticates an MCP request and removes items the user cannot access.\n * `overrideAccess` skips Payload and MCP item access checks.\n */\nexport const getAuthorizedMCP: (args: GetAuthorizedMCPArgs) => Promise<AuthorizedMCP> = async ({\n  overrideAccess,\n  req,\n}) => {\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n\n  if (pluginConfig.overrideGetAuthorizedMCP) {\n    return await pluginConfig.overrideGetAuthorizedMCP({\n      overrideAccess,\n      pluginConfig,\n      req,\n    })\n  }\n\n  if (req.headers) {\n    const headers = new Headers(req.headers)\n    const hasAuthorization = headers.has('Authorization')\n\n    headers.set('DisableAutologin', 'true')\n    req.user = (await req.payload.auth({ headers, req })).user\n\n    if (hasAuthorization && !req.user) {\n      throw new UnauthorizedError(req.t)\n    }\n  }\n\n  return {\n    items: await filterMCPItems({\n      items: pluginConfig.items,\n      overrideAccess,\n      req,\n    }),\n    overrideAccess,\n  }\n}\n\nexport const filterMCPItems = async ({\n  items,\n  overrideAccess,\n  req,\n}: {\n  items: MCPItem[]\n  overrideAccess: boolean\n  req: PayloadRequest\n}): Promise<MCPItem[]> => {\n  // Match Payload core: overrideAccess bypasses access evaluation\n  if (overrideAccess) {\n    return items\n  }\n\n  const authorizedItems: MCPItem[] = []\n\n  const permissions = await getAccessResults({ req })\n\n  for (const item of items) {\n    if (!(await checkItemAccess({ item, permissions, req }))) {\n      continue\n    }\n    authorizedItems.push(item)\n  }\n\n  return authorizedItems\n}\n\n/**\n * Runs MCP item access callbacks\n */\nconst checkItemAccess = async ({\n  item,\n  permissions,\n  req,\n}: {\n  item: MCPItem\n  permissions?: SanitizedPermissions\n  req: PayloadRequest\n}): Promise<boolean> => {\n  switch (item.type) {\n    case 'collectionTool':\n      return (\n        !item.tool.access ||\n        (await item.tool.access({ slug: item.collectionSlug, permissions, req }))\n      )\n    case 'globalTool':\n      return (\n        !item.tool.access || (await item.tool.access({ slug: item.globalSlug, permissions, req }))\n      )\n    case 'prompt':\n      return !item.prompt.access || (await item.prompt.access({ permissions, req }))\n    case 'resource':\n      return !item.resource.access || (await item.resource.access({ permissions, req }))\n    case 'tool':\n      return !item.tool.access || (await item.tool.access({ permissions, req }))\n  }\n}\n"],"names":["getAccessResults","UnauthorizedError","getPluginConfig","getAuthorizedMCP","overrideAccess","req","pluginConfig","config","payload","overrideGetAuthorizedMCP","headers","Headers","hasAuthorization","has","set","user","auth","t","items","filterMCPItems","authorizedItems","permissions","item","checkItemAccess","push","type","tool","access","slug","collectionSlug","globalSlug","prompt","resource"],"mappings":"AAEA,SAASA,gBAAgB,EAAEC,iBAAiB,QAAQ,UAAS;AAI7D,SAASC,eAAe,QAAQ,8BAA6B;AAO7D;;;CAGC,GACD,OAAO,MAAMC,mBAA2E,OAAO,EAC7FC,cAAc,EACdC,GAAG,EACJ;IACC,MAAMC,eAAeJ,gBAAgB;QAAEK,QAAQF,IAAIG,OAAO,CAACD,MAAM;IAAC;IAElE,IAAID,aAAaG,wBAAwB,EAAE;QACzC,OAAO,MAAMH,aAAaG,wBAAwB,CAAC;YACjDL;YACAE;YACAD;QACF;IACF;IAEA,IAAIA,IAAIK,OAAO,EAAE;QACf,MAAMA,UAAU,IAAIC,QAAQN,IAAIK,OAAO;QACvC,MAAME,mBAAmBF,QAAQG,GAAG,CAAC;QAErCH,QAAQI,GAAG,CAAC,oBAAoB;QAChCT,IAAIU,IAAI,GAAG,AAAC,CAAA,MAAMV,IAAIG,OAAO,CAACQ,IAAI,CAAC;YAAEN;YAASL;QAAI,EAAC,EAAGU,IAAI;QAE1D,IAAIH,oBAAoB,CAACP,IAAIU,IAAI,EAAE;YACjC,MAAM,IAAId,kBAAkBI,IAAIY,CAAC;QACnC;IACF;IAEA,OAAO;QACLC,OAAO,MAAMC,eAAe;YAC1BD,OAAOZ,aAAaY,KAAK;YACzBd;YACAC;QACF;QACAD;IACF;AACF,EAAC;AAED,OAAO,MAAMe,iBAAiB,OAAO,EACnCD,KAAK,EACLd,cAAc,EACdC,GAAG,EAKJ;IACC,gEAAgE;IAChE,IAAID,gBAAgB;QAClB,OAAOc;IACT;IAEA,MAAME,kBAA6B,EAAE;IAErC,MAAMC,cAAc,MAAMrB,iBAAiB;QAAEK;IAAI;IAEjD,KAAK,MAAMiB,QAAQJ,MAAO;QACxB,IAAI,CAAE,MAAMK,gBAAgB;YAAED;YAAMD;YAAahB;QAAI,IAAK;YACxD;QACF;QACAe,gBAAgBI,IAAI,CAACF;IACvB;IAEA,OAAOF;AACT,EAAC;AAED;;CAEC,GACD,MAAMG,kBAAkB,OAAO,EAC7BD,IAAI,EACJD,WAAW,EACXhB,GAAG,EAKJ;IACC,OAAQiB,KAAKG,IAAI;QACf,KAAK;YACH,OACE,CAACH,KAAKI,IAAI,CAACC,MAAM,IAChB,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEC,MAAMN,KAAKO,cAAc;gBAAER;gBAAahB;YAAI;QAE1E,KAAK;YACH,OACE,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAAK,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEC,MAAMN,KAAKQ,UAAU;gBAAET;gBAAahB;YAAI;QAE3F,KAAK;YACH,OAAO,CAACiB,KAAKS,MAAM,CAACJ,MAAM,IAAK,MAAML,KAAKS,MAAM,CAACJ,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QAC7E,KAAK;YACH,OAAO,CAACiB,KAAKU,QAAQ,CAACL,MAAM,IAAK,MAAML,KAAKU,QAAQ,CAACL,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;QACjF,KAAK;YACH,OAAO,CAACiB,KAAKI,IAAI,CAACC,MAAM,IAAK,MAAML,KAAKI,IAAI,CAACC,MAAM,CAAC;gBAAEN;gBAAahB;YAAI;IAC3E;AACF"}

package/dist/endpoint/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoint/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,SAAS,CAAA;AAa7D,eAAO,MAAM,WAAW,EAAE,cA+DzB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoint/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAkB,MAAM,SAAS,CAAA;AAc7D,eAAO,MAAM,WAAW,EAAE,cAmEzB,CAAA"}

package/dist/endpoint/index.js

@@ -1,4 +1,4 @@
-import { createMcpHandler, isLegacyRequest, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
+import { createMcpHandler, isLegacyRequest, readRequestBody, WebStandardStreamableHTTPServerTransport } from '@modelcontextprotocol/server';
 import { APIError } from 'payload';
 import { buildMcpServer } from '../mcp/buildMcpServer.js';
 import { getPluginConfig } from '../utils/getPluginConfig.js';
@@ -25,10 +25,17 @@ export const mcpEndpoint = async (req)=>{
         overrideAccess,
         req
     });
+    const maxRequestBodySize = pluginConfig.mcp?.maxRequestBodySize;
     // Payload augments the original web-standard Request in place.
     const mcpRequest = req;
+    const parsedBody = await parseRequestBody({
+        maxRequestBodySize,
+        request: mcpRequest
+    });
     // Keep the old JSON-only, stateless behavior because the SDK's 2025 fallback uses SSE.
-    if (await isLegacyRequest(mcpRequest)) {
+    if (await isLegacyRequest(mcpRequest, parsedBody, {
+        maxRequestBodySize
+    })) {
         const server = buildMcpServer({
             authorizedMCP,
             pluginConfig,
@@ -36,6 +43,7 @@ export const mcpEndpoint = async (req)=>{
         });
         const transport = new WebStandardStreamableHTTPServerTransport({
             enableJsonResponse: true,
+            maxRequestBodySize,
             sessionIdGenerator: undefined
         });
         transport.onerror = (err)=>{
@@ -46,7 +54,9 @@ export const mcpEndpoint = async (req)=>{
         };
         try {
             await server.connect(transport);
-            return await transport.handleRequest(mcpRequest);
+            return await transport.handleRequest(mcpRequest, {
+                parsedBody
+            });
         } finally{
             await server.close().catch((err)=>{
                 req.payload.logger.error({
@@ -62,6 +72,7 @@ export const mcpEndpoint = async (req)=>{
             req
         }), {
         legacy: 'reject',
+        maxRequestBodySize,
         // SDK subscriptions always use SSE, so disable them to keep every response JSON-only.
         maxSubscriptions: 0,
         onerror: (err)=>{
@@ -73,7 +84,9 @@ export const mcpEndpoint = async (req)=>{
         responseMode: 'json'
     });
     try {
-        return await handler.fetch(mcpRequest);
+        return await handler.fetch(mcpRequest, {
+            parsedBody
+        });
     } finally{
         await handler.close().catch((err)=>{
             req.payload.logger.error({
@@ -83,5 +96,21 @@ export const mcpEndpoint = async (req)=>{
         });
     }
 };
+/**
+ * Parses a POST body once so the era check and the SDK handler can share it. The SDK
+ * skips its size limit for a pre-parsed body, so this reads with the same limit. It reads
+ * a clone and returns `undefined` for any body the SDK should reject (too large, unreadable,
+ * or not JSON), leaving the original request for the SDK to read and answer.
+ */ const parseRequestBody = async ({ maxRequestBodySize, request })=>{
+    if (request.method.toUpperCase() !== 'POST') {
+        return undefined;
+    }
+    try {
+        const body = await readRequestBody(request.clone(), maxRequestBodySize);
+        return body.tooLarge ? undefined : JSON.parse(body.text);
+    } catch  {
+        return undefined;
+    }
+};
 
 //# sourceMappingURL=index.js.map

package/dist/endpoint/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/endpoint/index.ts"],"sourcesContent":["import type { PayloadHandler, PayloadRequest } from 'payload'\n\nimport {\n  createMcpHandler,\n  isLegacyRequest,\n  WebStandardStreamableHTTPServerTransport,\n} from '@modelcontextprotocol/server'\nimport { APIError } from 'payload'\n\nimport { buildMcpServer } from '../mcp/buildMcpServer.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\nimport { getAuthorizedMCP } from './access.js'\n\nexport const mcpEndpoint: PayloadHandler = async (req) => {\n  if (!req.url) {\n    throw new APIError('Missing request URL', 400)\n  }\n\n  req.payloadAPI = 'MCP' as const\n\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n  const overrideAccessParam = new URL(req.url).searchParams.get('overrideAccess')\n\n  if (overrideAccessParam !== null && process.env.NODE_ENV !== 'development') {\n    throw new APIError('MCP overrideAccess is only available in development.', 400)\n  }\n\n  let overrideAccess = false\n  if (overrideAccessParam === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessParam !== null && overrideAccessParam !== 'false') {\n    throw new APIError('MCP overrideAccess must be \"true\" or \"false\".', 400)\n  }\n\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n  // Payload augments the original web-standard Request in place.\n  const mcpRequest = req as PayloadRequest & Request\n\n  // Keep the old JSON-only, stateless behavior because the SDK's 2025 fallback uses SSE.\n  if (await isLegacyRequest(mcpRequest)) {\n    const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n    const transport = new WebStandardStreamableHTTPServerTransport({\n      enableJsonResponse: true,\n      sessionIdGenerator: undefined, // stateless mode\n    })\n    transport.onerror = (err) => {\n      req.payload.logger.error({ err, msg: 'Error serving legacy MCP request' })\n    }\n\n    try {\n      await server.connect(transport)\n      return await transport.handleRequest(mcpRequest)\n    } finally {\n      await server.close().catch((err) => {\n        req.payload.logger.error({ err, msg: 'Error closing MCP server' })\n      })\n    }\n  }\n\n  const handler = createMcpHandler(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n    legacy: 'reject',\n    // SDK subscriptions always use SSE, so disable them to keep every response JSON-only.\n    maxSubscriptions: 0,\n    onerror: (err) => {\n      req.payload.logger.error({ err, msg: 'Error serving modern MCP request' })\n    },\n    responseMode: 'json',\n  })\n\n  try {\n    return await handler.fetch(mcpRequest)\n  } finally {\n    await handler.close().catch((err) => {\n      req.payload.logger.error({ err, msg: 'Error closing modern MCP handler' })\n    })\n  }\n}\n"],"names":["createMcpHandler","isLegacyRequest","WebStandardStreamableHTTPServerTransport","APIError","buildMcpServer","getPluginConfig","getAuthorizedMCP","mcpEndpoint","req","url","payloadAPI","pluginConfig","config","payload","overrideAccessParam","URL","searchParams","get","process","env","NODE_ENV","overrideAccess","authorizedMCP","mcpRequest","server","transport","enableJsonResponse","sessionIdGenerator","undefined","onerror","err","logger","error","msg","connect","handleRequest","close","catch","handler","legacy","maxSubscriptions","responseMode","fetch"],"mappings":"AAEA,SACEA,gBAAgB,EAChBC,eAAe,EACfC,wCAAwC,QACnC,+BAA8B;AACrC,SAASC,QAAQ,QAAQ,UAAS;AAElC,SAASC,cAAc,QAAQ,2BAA0B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,gBAAgB,QAAQ,cAAa;AAE9C,OAAO,MAAMC,cAA8B,OAAOC;IAChD,IAAI,CAACA,IAAIC,GAAG,EAAE;QACZ,MAAM,IAAIN,SAAS,uBAAuB;IAC5C;IAEAK,IAAIE,UAAU,GAAG;IAEjB,MAAMC,eAAeN,gBAAgB;QAAEO,QAAQJ,IAAIK,OAAO,CAACD,MAAM;IAAC;IAClE,MAAME,sBAAsB,IAAIC,IAAIP,IAAIC,GAAG,EAAEO,YAAY,CAACC,GAAG,CAAC;IAE9D,IAAIH,wBAAwB,QAAQI,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe;QAC1E,MAAM,IAAIjB,SAAS,wDAAwD;IAC7E;IAEA,IAAIkB,iBAAiB;IACrB,IAAIP,wBAAwB,QAAQ;QAClCO,iBAAiB;IACnB,OAAO,IAAIP,wBAAwB,QAAQA,wBAAwB,SAAS;QAC1E,MAAM,IAAIX,SAAS,iDAAiD;IACtE;IAEA,MAAMmB,gBAAgB,MAAMhB,iBAAiB;QAAEe;QAAgBb;IAAI;IACnE,+DAA+D;IAC/D,MAAMe,aAAaf;IAEnB,uFAAuF;IACvF,IAAI,MAAMP,gBAAgBsB,aAAa;QACrC,MAAMC,SAASpB,eAAe;YAAEkB;YAAeX;YAAcH;QAAI;QACjE,MAAMiB,YAAY,IAAIvB,yCAAyC;YAC7DwB,oBAAoB;YACpBC,oBAAoBC;QACtB;QACAH,UAAUI,OAAO,GAAG,CAACC;YACnBtB,IAAIK,OAAO,CAACkB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;QAEA,IAAI;YACF,MAAMT,OAAOU,OAAO,CAACT;YACrB,OAAO,MAAMA,UAAUU,aAAa,CAACZ;QACvC,SAAU;YACR,MAAMC,OAAOY,KAAK,GAAGC,KAAK,CAAC,CAACP;gBAC1BtB,IAAIK,OAAO,CAACkB,MAAM,CAACC,KAAK,CAAC;oBAAEF;oBAAKG,KAAK;gBAA2B;YAClE;QACF;IACF;IAEA,MAAMK,UAAUtC,iBAAiB,IAAMI,eAAe;YAAEkB;YAAeX;YAAcH;QAAI,IAAI;QAC3F+B,QAAQ;QACR,sFAAsF;QACtFC,kBAAkB;QAClBX,SAAS,CAACC;YACRtB,IAAIK,OAAO,CAACkB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;QACAQ,cAAc;IAChB;IAEA,IAAI;QACF,OAAO,MAAMH,QAAQI,KAAK,CAACnB;IAC7B,SAAU;QACR,MAAMe,QAAQF,KAAK,GAAGC,KAAK,CAAC,CAACP;YAC3BtB,IAAIK,OAAO,CAACkB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;IACF;AACF,EAAC"}
+{"version":3,"sources":["../../src/endpoint/index.ts"],"sourcesContent":["import type { PayloadHandler, PayloadRequest } from 'payload'\n\nimport {\n  createMcpHandler,\n  isLegacyRequest,\n  readRequestBody,\n  WebStandardStreamableHTTPServerTransport,\n} from '@modelcontextprotocol/server'\nimport { APIError } from 'payload'\n\nimport { buildMcpServer } from '../mcp/buildMcpServer.js'\nimport { getPluginConfig } from '../utils/getPluginConfig.js'\nimport { getAuthorizedMCP } from './access.js'\n\nexport const mcpEndpoint: PayloadHandler = async (req) => {\n  if (!req.url) {\n    throw new APIError('Missing request URL', 400)\n  }\n\n  req.payloadAPI = 'MCP' as const\n\n  const pluginConfig = getPluginConfig({ config: req.payload.config })\n  const overrideAccessParam = new URL(req.url).searchParams.get('overrideAccess')\n\n  if (overrideAccessParam !== null && process.env.NODE_ENV !== 'development') {\n    throw new APIError('MCP overrideAccess is only available in development.', 400)\n  }\n\n  let overrideAccess = false\n  if (overrideAccessParam === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessParam !== null && overrideAccessParam !== 'false') {\n    throw new APIError('MCP overrideAccess must be \"true\" or \"false\".', 400)\n  }\n\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n  const maxRequestBodySize = pluginConfig.mcp?.maxRequestBodySize\n  // Payload augments the original web-standard Request in place.\n  const mcpRequest = req as PayloadRequest & Request\n  const parsedBody = await parseRequestBody({ maxRequestBodySize, request: mcpRequest })\n\n  // Keep the old JSON-only, stateless behavior because the SDK's 2025 fallback uses SSE.\n  if (await isLegacyRequest(mcpRequest, parsedBody, { maxRequestBodySize })) {\n    const server = buildMcpServer({ authorizedMCP, pluginConfig, req })\n    const transport = new WebStandardStreamableHTTPServerTransport({\n      enableJsonResponse: true,\n      maxRequestBodySize,\n      sessionIdGenerator: undefined, // stateless mode\n    })\n    transport.onerror = (err) => {\n      req.payload.logger.error({ err, msg: 'Error serving legacy MCP request' })\n    }\n\n    try {\n      await server.connect(transport)\n      return await transport.handleRequest(mcpRequest, { parsedBody })\n    } finally {\n      await server.close().catch((err) => {\n        req.payload.logger.error({ err, msg: 'Error closing MCP server' })\n      })\n    }\n  }\n\n  const handler = createMcpHandler(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n    legacy: 'reject',\n    maxRequestBodySize,\n    // SDK subscriptions always use SSE, so disable them to keep every response JSON-only.\n    maxSubscriptions: 0,\n    onerror: (err) => {\n      req.payload.logger.error({ err, msg: 'Error serving modern MCP request' })\n    },\n    responseMode: 'json',\n  })\n\n  try {\n    return await handler.fetch(mcpRequest, { parsedBody })\n  } finally {\n    await handler.close().catch((err) => {\n      req.payload.logger.error({ err, msg: 'Error closing modern MCP handler' })\n    })\n  }\n}\n\n/**\n * Parses a POST body once so the era check and the SDK handler can share it. The SDK\n * skips its size limit for a pre-parsed body, so this reads with the same limit. It reads\n * a clone and returns `undefined` for any body the SDK should reject (too large, unreadable,\n * or not JSON), leaving the original request for the SDK to read and answer.\n */\nconst parseRequestBody = async ({\n  maxRequestBodySize,\n  request,\n}: {\n  maxRequestBodySize?: number\n  request: Request\n}): Promise<unknown> => {\n  if (request.method.toUpperCase() !== 'POST') {\n    return undefined\n  }\n\n  try {\n    const body = await readRequestBody(request.clone(), maxRequestBodySize)\n    return body.tooLarge ? undefined : JSON.parse(body.text)\n  } catch {\n    return undefined\n  }\n}\n"],"names":["createMcpHandler","isLegacyRequest","readRequestBody","WebStandardStreamableHTTPServerTransport","APIError","buildMcpServer","getPluginConfig","getAuthorizedMCP","mcpEndpoint","req","url","payloadAPI","pluginConfig","config","payload","overrideAccessParam","URL","searchParams","get","process","env","NODE_ENV","overrideAccess","authorizedMCP","maxRequestBodySize","mcp","mcpRequest","parsedBody","parseRequestBody","request","server","transport","enableJsonResponse","sessionIdGenerator","undefined","onerror","err","logger","error","msg","connect","handleRequest","close","catch","handler","legacy","maxSubscriptions","responseMode","fetch","method","toUpperCase","body","clone","tooLarge","JSON","parse","text"],"mappings":"AAEA,SACEA,gBAAgB,EAChBC,eAAe,EACfC,eAAe,EACfC,wCAAwC,QACnC,+BAA8B;AACrC,SAASC,QAAQ,QAAQ,UAAS;AAElC,SAASC,cAAc,QAAQ,2BAA0B;AACzD,SAASC,eAAe,QAAQ,8BAA6B;AAC7D,SAASC,gBAAgB,QAAQ,cAAa;AAE9C,OAAO,MAAMC,cAA8B,OAAOC;IAChD,IAAI,CAACA,IAAIC,GAAG,EAAE;QACZ,MAAM,IAAIN,SAAS,uBAAuB;IAC5C;IAEAK,IAAIE,UAAU,GAAG;IAEjB,MAAMC,eAAeN,gBAAgB;QAAEO,QAAQJ,IAAIK,OAAO,CAACD,MAAM;IAAC;IAClE,MAAME,sBAAsB,IAAIC,IAAIP,IAAIC,GAAG,EAAEO,YAAY,CAACC,GAAG,CAAC;IAE9D,IAAIH,wBAAwB,QAAQI,QAAQC,GAAG,CAACC,QAAQ,KAAK,eAAe;QAC1E,MAAM,IAAIjB,SAAS,wDAAwD;IAC7E;IAEA,IAAIkB,iBAAiB;IACrB,IAAIP,wBAAwB,QAAQ;QAClCO,iBAAiB;IACnB,OAAO,IAAIP,wBAAwB,QAAQA,wBAAwB,SAAS;QAC1E,MAAM,IAAIX,SAAS,iDAAiD;IACtE;IAEA,MAAMmB,gBAAgB,MAAMhB,iBAAiB;QAAEe;QAAgBb;IAAI;IACnE,MAAMe,qBAAqBZ,aAAaa,GAAG,EAAED;IAC7C,+DAA+D;IAC/D,MAAME,aAAajB;IACnB,MAAMkB,aAAa,MAAMC,iBAAiB;QAAEJ;QAAoBK,SAASH;IAAW;IAEpF,uFAAuF;IACvF,IAAI,MAAMzB,gBAAgByB,YAAYC,YAAY;QAAEH;IAAmB,IAAI;QACzE,MAAMM,SAASzB,eAAe;YAAEkB;YAAeX;YAAcH;QAAI;QACjE,MAAMsB,YAAY,IAAI5B,yCAAyC;YAC7D6B,oBAAoB;YACpBR;YACAS,oBAAoBC;QACtB;QACAH,UAAUI,OAAO,GAAG,CAACC;YACnB3B,IAAIK,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;QAEA,IAAI;YACF,MAAMT,OAAOU,OAAO,CAACT;YACrB,OAAO,MAAMA,UAAUU,aAAa,CAACf,YAAY;gBAAEC;YAAW;QAChE,SAAU;YACR,MAAMG,OAAOY,KAAK,GAAGC,KAAK,CAAC,CAACP;gBAC1B3B,IAAIK,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;oBAAEF;oBAAKG,KAAK;gBAA2B;YAClE;QACF;IACF;IAEA,MAAMK,UAAU5C,iBAAiB,IAAMK,eAAe;YAAEkB;YAAeX;YAAcH;QAAI,IAAI;QAC3FoC,QAAQ;QACRrB;QACA,sFAAsF;QACtFsB,kBAAkB;QAClBX,SAAS,CAACC;YACR3B,IAAIK,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;QACAQ,cAAc;IAChB;IAEA,IAAI;QACF,OAAO,MAAMH,QAAQI,KAAK,CAACtB,YAAY;YAAEC;QAAW;IACtD,SAAU;QACR,MAAMiB,QAAQF,KAAK,GAAGC,KAAK,CAAC,CAACP;YAC3B3B,IAAIK,OAAO,CAACuB,MAAM,CAACC,KAAK,CAAC;gBAAEF;gBAAKG,KAAK;YAAmC;QAC1E;IACF;AACF,EAAC;AAED;;;;;CAKC,GACD,MAAMX,mBAAmB,OAAO,EAC9BJ,kBAAkB,EAClBK,OAAO,EAIR;IACC,IAAIA,QAAQoB,MAAM,CAACC,WAAW,OAAO,QAAQ;QAC3C,OAAOhB;IACT;IAEA,IAAI;QACF,MAAMiB,OAAO,MAAMjD,gBAAgB2B,QAAQuB,KAAK,IAAI5B;QACpD,OAAO2B,KAAKE,QAAQ,GAAGnB,YAAYoB,KAAKC,KAAK,CAACJ,KAAKK,IAAI;IACzD,EAAE,OAAM;QACN,OAAOtB;IACT;AACF"}

package/dist/mcp/buildMcpServer.d.ts

@@ -1,5 +1,5 @@
+import type { PayloadRequest } from 'payload';
 import { McpServer } from '@modelcontextprotocol/server';
-import { type PayloadRequest } from 'payload';
 import type { AuthorizedMCP, SanitizedMCPPluginConfig } from '../types.js';
 /**
  * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
@@ -9,7 +9,7 @@ import type { AuthorizedMCP, SanitizedMCPPluginConfig } from '../types.js';
  *
  * `req` is the request context handlers see. For HTTP it's the live
  * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
- * synthesized one built via `createLocalReq`.
+ * synthesized one built via `createPayloadRequest`.
  */
 export declare const buildMcpServer: ({ authorizedMCP, pluginConfig, req, }: {
     authorizedMCP: AuthorizedMCP;

package/dist/mcp/buildMcpServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAC5E,OAAO,EAAY,KAAK,cAAc,EAAE,MAAM,SAAS,CAAA;AAGvD,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,0CAIxB;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAkNH,CAAA"}
+{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAG5E,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,0CAIxB;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAgNH,CAAA"}

package/dist/mcp/buildMcpServer.js

@@ -1,6 +1,5 @@
 import { McpServer } from '@modelcontextprotocol/server';
-import { APIError } from 'payload';
-import { z } from 'zod';
+import { APIError, strictObject, z } from 'payload';
 import { getLogger } from '../utils/getLogger.js';
 import { toStandardSchema } from '../utils/toStandardSchema.js';
 /**
@@ -11,8 +10,9 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
  *
  * `req` is the request context handlers see. For HTTP it's the live
  * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
- * synthesized one built via `createLocalReq`.
+ * synthesized one built via `createPayloadRequest`.
  */ export const buildMcpServer = ({ authorizedMCP, pluginConfig, req })=>{
+    z.config(z.locales.en());
     const serverOptions = pluginConfig.mcp?.serverOptions || {};
     const server = new McpServer({
         name: 'Payload MCP Server',
@@ -40,20 +40,19 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
     };
     /**
    * Runs a collection/global tool call:
-   * - reads `collectionSlug` / `globalSlug` from the input
+   * - reads `slug` from the input
    * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug
    * - runs the tool handler and finalizes its response
    */ const callEntityTool = async ({ input, item, serverContext })=>{
         const entity = item.type === 'collectionTool' ? 'collection' : 'global';
-        const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug';
         const toolInput = input ?? {};
-        const slug = toolInput[slugKey];
+        const slug = toolInput.slug;
         if (!slug) {
             return {
                 content: [
                     {
                         type: 'text',
-                        text: `Error: "${item.mcpName}" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`
+                        text: `Error: "${item.mcpName}" requires slug. Use getConfigInfo to inspect ${entity} slugs.`
                     }
                 ],
                 isError: true
@@ -79,10 +78,10 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
         };
         const response = await (match.type === 'collectionTool' ? match.tool.handler({
             ...handlerArgs,
-            collectionSlug: slug
+            slug
         }) : match.tool.handler({
             ...handlerArgs,
-            globalSlug: slug
+            slug
         }));
         return finalizeToolResponse({
             input: toolInput,
@@ -103,7 +102,6 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
                         }
                         registeredEntityTools.add(item.mcpName);
                         const inputSchema = withSlugInput({
-                            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',
                             input: item.tool.input
                         });
                         server.registerTool(item.mcpName, {
@@ -189,33 +187,47 @@ import { toStandardSchema } from '../utils/toStandardSchema.js';
     }
     return server;
 };
-const withSlugInput = ({ name, input })=>{
-    const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug';
-    const slugSchema = z.string().describe(description);
+const withSlugInput = ({ input })=>{
+    const description = 'The target slug.';
+    const slugSchema = z.string().check(z.describe(description));
     if (!input) {
-        return z.object({
-            [name]: slugSchema
+        return strictObject({
+            slug: slugSchema
         });
     }
-    if (input instanceof z.ZodObject) {
-        return input.extend({
-            [name]: slugSchema
+    if (typeof input === 'object' && input !== null && '~standard' in input) {
+        const schema = input['~standard'].jsonSchema.input({
+            target: 'draft-2020-12'
+        });
+        const properties = schema.properties;
+        if (properties?.slug) {
+            return input;
+        }
+        return addSlugToJSONSchema({
+            description,
+            schema: schema
         });
     }
-    const schema = input;
+    return addSlugToJSONSchema({
+        description,
+        schema: input
+    });
+};
+const addSlugToJSONSchema = ({ description, schema })=>{
+    const objectSchema = schema;
     return {
-        ...schema,
+        ...objectSchema,
         type: 'object',
         properties: {
-            ...schema.properties,
-            [name]: {
+            ...objectSchema.properties,
+            slug: {
                 type: 'string',
                 description
             }
         },
         required: Array.from(new Set([
-            name,
-            ...schema.required ?? []
+            'slug',
+            ...objectSchema.required ?? []
         ]))
     };
 };

package/dist/mcp/buildMcpServer.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/mcp/buildMcpServer.ts"],"sourcesContent":["import { McpServer, type ServerContext } from '@modelcontextprotocol/server'\nimport { APIError, type PayloadRequest } from 'payload'\nimport { z } from 'zod'\n\nimport type {\n  AuthorizedMCP,\n  CollectionMCPItem,\n  GlobalMCPItem,\n  JsonSchemaType,\n  MCPResponseOverride,\n  MCPToolResponse,\n  SanitizedMCPPluginConfig,\n  ToolInputSchema,\n} from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { toStandardSchema } from '../utils/toStandardSchema.js'\n\n/**\n * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh\n * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh\n * instances from this builder while they own the transport and protocol-era\n * decision.\n *\n * `req` is the request context handlers see. For HTTP it's the live\n * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a\n * synthesized one built via `createLocalReq`.\n */\nexport const buildMcpServer = ({\n  authorizedMCP,\n  pluginConfig,\n  req,\n}: {\n  authorizedMCP: AuthorizedMCP\n  pluginConfig: SanitizedMCPPluginConfig\n  req: PayloadRequest\n}): McpServer => {\n  const serverOptions = pluginConfig.mcp?.serverOptions || {}\n  const server = new McpServer(\n    { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },\n    serverOptions.options,\n  )\n\n  const logger = getLogger({ payload: req.payload })\n\n  /**\n   * Wrap a tool handler's response with the tool's `overrideResponse`, then\n   * strip the internal `doc` field so it doesn't leak onto the wire.\n   */\n  const finalizeToolResponse = async ({\n    input,\n    overrideResponse,\n    response,\n    toolName,\n  }: {\n    input: unknown\n    overrideResponse?: MCPResponseOverride\n    response: MCPToolResponse\n    toolName: string\n  }): Promise<MCPToolResponse> => {\n    let overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response\n    for (const hook of pluginConfig.hooks?.afterToolCall ?? []) {\n      overridden = await hook({ input, req, response: overridden, toolName })\n    }\n    const { doc: _doc, ...rest } = overridden\n    return rest\n  }\n\n  /**\n   * Runs a collection/global tool call:\n   * - reads `collectionSlug` / `globalSlug` from the input\n   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug\n   * - runs the tool handler and finalizes its response\n   */\n  const callEntityTool = async ({\n    input,\n    item,\n    serverContext,\n  }: {\n    input: unknown\n    item: CollectionMCPItem | GlobalMCPItem\n    serverContext: ServerContext\n  }): Promise<MCPToolResponse> => {\n    const entity = item.type === 'collectionTool' ? 'collection' : 'global'\n    const slugKey = item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug'\n    const toolInput = (input ?? {}) as Record<string, unknown>\n    const slug = toolInput[slugKey] as string | undefined\n\n    if (!slug) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: \"${item.mcpName}\" requires ${slugKey}. Use getConfigInfo to inspect ${entity} slugs.`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const match = authorizedMCP.items.find(\n      (candidate): candidate is CollectionMCPItem | GlobalMCPItem =>\n        candidate.type === item.type &&\n        candidate.mcpName === item.mcpName &&\n        (candidate.type === 'collectionTool'\n          ? candidate.collectionSlug === slug\n          : candidate.type === 'globalTool' && candidate.globalSlug === slug),\n    )\n\n    if (!match) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: MCP access to \"${item.mcpName}\" is not enabled for ${entity} \"${slug}\"`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const handlerArgs = {\n      authorizedMCP,\n      input: toolInput,\n      req,\n      serverContext,\n    }\n    const response = await (match.type === 'collectionTool'\n      ? match.tool.handler({ ...handlerArgs, collectionSlug: slug })\n      : match.tool.handler({ ...handlerArgs, globalSlug: slug }))\n\n    return finalizeToolResponse({\n      input: toolInput,\n      overrideResponse: match.tool.overrideResponse,\n      response,\n      toolName: match.mcpName,\n    })\n  }\n\n  try {\n    const registeredEntityTools = new Set<string>()\n\n    for (const item of authorizedMCP.items) {\n      switch (item.type) {\n        case 'collectionTool':\n        case 'globalTool': {\n          if (registeredEntityTools.has(item.mcpName)) {\n            break\n          }\n          registeredEntityTools.add(item.mcpName)\n\n          const inputSchema = withSlugInput({\n            name: item.type === 'collectionTool' ? 'collectionSlug' : 'globalSlug',\n            input: item.tool.input,\n          })\n\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: item.tool.annotations,\n              description: item.tool.description,\n              inputSchema: toStandardSchema(inputSchema),\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              callEntityTool({ input, item, serverContext: ctx }),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n        case 'prompt': {\n          const prompt = item.prompt\n          server.registerPrompt(\n            item.mcpName,\n            {\n              argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,\n              description: prompt.description,\n              title: prompt.title,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              prompt.handler({\n                input: (input ?? {}) as Record<string, unknown>,\n                req,\n                serverContext: ctx,\n              }),\n          )\n          logger.info(`✅ Prompt: ${prompt.title} Registered.`)\n          break\n        }\n        case 'resource': {\n          const resource = item.resource\n          server.registerResource(\n            item.mcpName,\n            // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)\n            resource.uri,\n            {\n              description: resource.description,\n              mimeType: resource.mimeType,\n              title: resource.title,\n            },\n            // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).\n            // The rest-params shape lets us collect either signature uniformly.\n            async (...sdkArgs: unknown[]) => {\n              const ctx = sdkArgs[sdkArgs.length - 1] as ServerContext\n              const uri = sdkArgs[0] as URL\n              const params = (sdkArgs.length > 2 ? sdkArgs[1] : {}) as Record<string, string>\n              return resource.handler({ params, req, serverContext: ctx, uri })\n            },\n          )\n          logger.info(`✅ Resource: ${resource.title} Registered.`)\n          break\n        }\n        case 'tool': {\n          const tool = item.tool\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: tool.annotations,\n              description: tool.description,\n              inputSchema: tool.input ? toStandardSchema(tool.input) : undefined,\n            },\n            async (input: unknown, ctx: ServerContext) => {\n              const toolInput = (input ?? {}) as Record<string, unknown>\n              const response = await tool.handler({\n                authorizedMCP,\n                input: toolInput,\n                req,\n                serverContext: ctx,\n              })\n              return finalizeToolResponse({\n                input: toolInput,\n                overrideResponse: tool.overrideResponse,\n                response,\n                toolName: item.mcpName,\n              })\n            },\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n      }\n    }\n  } catch (error) {\n    throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500)\n  }\n\n  return server\n}\n\nconst withSlugInput = ({\n  name,\n  input,\n}: {\n  input?: ToolInputSchema\n  name: 'collectionSlug' | 'globalSlug'\n}): ToolInputSchema => {\n  const description = name === 'collectionSlug' ? 'The collection slug' : 'The global slug'\n  const slugSchema = z.string().describe(description)\n\n  if (!input) {\n    return z.object({ [name]: slugSchema })\n  }\n\n  if (input instanceof z.ZodObject) {\n    return input.extend({ [name]: slugSchema })\n  }\n\n  const schema = input as {\n    properties?: Record<string, JsonSchemaType>\n    required?: string[]\n  } & JsonSchemaType\n\n  return {\n    ...schema,\n    type: 'object',\n    properties: {\n      ...schema.properties,\n      [name]: {\n        type: 'string',\n        description,\n      },\n    },\n    required: Array.from(new Set([name, ...(schema.required ?? [])])),\n  }\n}\n"],"names":["McpServer","APIError","z","getLogger","toStandardSchema","buildMcpServer","authorizedMCP","pluginConfig","req","serverOptions","mcp","server","name","version","serverInfo","options","logger","payload","finalizeToolResponse","input","overrideResponse","response","toolName","overridden","doc","hook","hooks","afterToolCall","_doc","rest","callEntityTool","item","serverContext","entity","type","slugKey","toolInput","slug","content","text","mcpName","isError","match","items","find","candidate","collectionSlug","globalSlug","handlerArgs","tool","handler","registeredEntityTools","Set","has","add","inputSchema","withSlugInput","registerTool","annotations","description","ctx","info","prompt","registerPrompt","argsSchema","undefined","title","resource","registerResource","uri","mimeType","sdkArgs","length","params","error","String","slugSchema","string","describe","object","ZodObject","extend","schema","properties","required","Array","from"],"mappings":"AAAA,SAASA,SAAS,QAA4B,+BAA8B;AAC5E,SAASC,QAAQ,QAA6B,UAAS;AACvD,SAASC,CAAC,QAAQ,MAAK;AAavB,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,aAAa,EACbC,YAAY,EACZC,GAAG,EAKJ;IACC,MAAMC,gBAAgBF,aAAaG,GAAG,EAAED,iBAAiB,CAAC;IAC1D,MAAME,SAAS,IAAIX,UACjB;QAAEY,MAAM;QAAsBC,SAAS;QAAS,GAAGJ,cAAcK,UAAU;IAAC,GAC5EL,cAAcM,OAAO;IAGvB,MAAMC,SAASb,UAAU;QAAEc,SAAST,IAAIS,OAAO;IAAC;IAEhD;;;GAGC,GACD,MAAMC,uBAAuB,OAAO,EAClCC,KAAK,EACLC,gBAAgB,EAChBC,QAAQ,EACRC,QAAQ,EAMT;QACC,IAAIC,aAAaH,mBAAmBC,UAAUA,SAASG,GAAG,IAAI,CAAC,GAAGhB,QAAQa;QAC1E,KAAK,MAAMI,QAAQlB,aAAamB,KAAK,EAAEC,iBAAiB,EAAE,CAAE;YAC1DJ,aAAa,MAAME,KAAK;gBAAEN;gBAAOX;gBAAKa,UAAUE;gBAAYD;YAAS;QACvE;QACA,MAAM,EAAEE,KAAKI,IAAI,EAAE,GAAGC,MAAM,GAAGN;QAC/B,OAAOM;IACT;IAEA;;;;;GAKC,GACD,MAAMC,iBAAiB,OAAO,EAC5BX,KAAK,EACLY,IAAI,EACJC,aAAa,EAKd;QACC,MAAMC,SAASF,KAAKG,IAAI,KAAK,mBAAmB,eAAe;QAC/D,MAAMC,UAAUJ,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;QACpE,MAAME,YAAajB,SAAS,CAAC;QAC7B,MAAMkB,OAAOD,SAAS,CAACD,QAAQ;QAE/B,IAAI,CAACE,MAAM;YACT,OAAO;gBACLC,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,QAAQ,EAAER,KAAKS,OAAO,CAAC,WAAW,EAAEL,QAAQ,+BAA+B,EAAEF,OAAO,OAAO,CAAC;oBACrG;iBACD;gBACDQ,SAAS;YACX;QACF;QAEA,MAAMC,QAAQpC,cAAcqC,KAAK,CAACC,IAAI,CACpC,CAACC,YACCA,UAAUX,IAAI,KAAKH,KAAKG,IAAI,IAC5BW,UAAUL,OAAO,KAAKT,KAAKS,OAAO,IACjCK,CAAAA,UAAUX,IAAI,KAAK,mBAChBW,UAAUC,cAAc,KAAKT,OAC7BQ,UAAUX,IAAI,KAAK,gBAAgBW,UAAUE,UAAU,KAAKV,IAAG;QAGvE,IAAI,CAACK,OAAO;YACV,OAAO;gBACLJ,SAAS;oBACP;wBACEJ,MAAM;wBACNK,MAAM,CAAC,sBAAsB,EAAER,KAAKS,OAAO,CAAC,qBAAqB,EAAEP,OAAO,EAAE,EAAEI,KAAK,CAAC,CAAC;oBACvF;iBACD;gBACDI,SAAS;YACX;QACF;QAEA,MAAMO,cAAc;YAClB1C;YACAa,OAAOiB;YACP5B;YACAwB;QACF;QACA,MAAMX,WAAW,MAAOqB,CAAAA,MAAMR,IAAI,KAAK,mBACnCQ,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEF,gBAAgBT;QAAK,KAC1DK,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAED,YAAYV;QAAK,EAAC;QAE3D,OAAOnB,qBAAqB;YAC1BC,OAAOiB;YACPhB,kBAAkBsB,MAAMO,IAAI,CAAC7B,gBAAgB;YAC7CC;YACAC,UAAUoB,MAAMF,OAAO;QACzB;IACF;IAEA,IAAI;QACF,MAAMW,wBAAwB,IAAIC;QAElC,KAAK,MAAMrB,QAAQzB,cAAcqC,KAAK,CAAE;YACtC,OAAQZ,KAAKG,IAAI;gBACf,KAAK;gBACL,KAAK;oBAAc;wBACjB,IAAIiB,sBAAsBE,GAAG,CAACtB,KAAKS,OAAO,GAAG;4BAC3C;wBACF;wBACAW,sBAAsBG,GAAG,CAACvB,KAAKS,OAAO;wBAEtC,MAAMe,cAAcC,cAAc;4BAChC5C,MAAMmB,KAAKG,IAAI,KAAK,mBAAmB,mBAAmB;4BAC1Df,OAAOY,KAAKkB,IAAI,CAAC9B,KAAK;wBACxB;wBAEAR,OAAO8C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAa3B,KAAKkB,IAAI,CAACS,WAAW;4BAClCC,aAAa5B,KAAKkB,IAAI,CAACU,WAAW;4BAClCJ,aAAanD,iBAAiBmD;wBAChC,GACA,OAAOpC,OAAgByC,MACrB9B,eAAe;gCAAEX;gCAAOY;gCAAMC,eAAe4B;4BAAI;wBAErD5C,OAAO6C,IAAI,CAAC,CAAC,QAAQ,EAAE9B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;gBACA,KAAK;oBAAU;wBACb,MAAMsB,SAAS/B,KAAK+B,MAAM;wBAC1BnD,OAAOoD,cAAc,CACnBhC,KAAKS,OAAO,EACZ;4BACEwB,YAAYF,OAAOE,UAAU,GAAG5D,iBAAiB0D,OAAOE,UAAU,IAAIC;4BACtEN,aAAaG,OAAOH,WAAW;4BAC/BO,OAAOJ,OAAOI,KAAK;wBACrB,GACA,OAAO/C,OAAgByC,MACrBE,OAAOZ,OAAO,CAAC;gCACb/B,OAAQA,SAAS,CAAC;gCAClBX;gCACAwB,eAAe4B;4BACjB;wBAEJ5C,OAAO6C,IAAI,CAAC,CAAC,UAAU,EAAEC,OAAOI,KAAK,CAAC,YAAY,CAAC;wBACnD;oBACF;gBACA,KAAK;oBAAY;wBACf,MAAMC,WAAWpC,KAAKoC,QAAQ;wBAC9BxD,OAAOyD,gBAAgB,CACrBrC,KAAKS,OAAO,EACZ,mFAAmF;wBACnF2B,SAASE,GAAG,EACZ;4BACEV,aAAaQ,SAASR,WAAW;4BACjCW,UAAUH,SAASG,QAAQ;4BAC3BJ,OAAOC,SAASD,KAAK;wBACvB,GACA,0EAA0E;wBAC1E,oEAAoE;wBACpE,OAAO,GAAGK;4BACR,MAAMX,MAAMW,OAAO,CAACA,QAAQC,MAAM,GAAG,EAAE;4BACvC,MAAMH,MAAME,OAAO,CAAC,EAAE;4BACtB,MAAME,SAAUF,QAAQC,MAAM,GAAG,IAAID,OAAO,CAAC,EAAE,GAAG,CAAC;4BACnD,OAAOJ,SAASjB,OAAO,CAAC;gCAAEuB;gCAAQjE;gCAAKwB,eAAe4B;gCAAKS;4BAAI;wBACjE;wBAEFrD,OAAO6C,IAAI,CAAC,CAAC,YAAY,EAAEM,SAASD,KAAK,CAAC,YAAY,CAAC;wBACvD;oBACF;gBACA,KAAK;oBAAQ;wBACX,MAAMjB,OAAOlB,KAAKkB,IAAI;wBACtBtC,OAAO8C,YAAY,CACjB1B,KAAKS,OAAO,EACZ;4BACEkB,aAAaT,KAAKS,WAAW;4BAC7BC,aAAaV,KAAKU,WAAW;4BAC7BJ,aAAaN,KAAK9B,KAAK,GAAGf,iBAAiB6C,KAAK9B,KAAK,IAAI8C;wBAC3D,GACA,OAAO9C,OAAgByC;4BACrB,MAAMxB,YAAajB,SAAS,CAAC;4BAC7B,MAAME,WAAW,MAAM4B,KAAKC,OAAO,CAAC;gCAClC5C;gCACAa,OAAOiB;gCACP5B;gCACAwB,eAAe4B;4BACjB;4BACA,OAAO1C,qBAAqB;gCAC1BC,OAAOiB;gCACPhB,kBAAkB6B,KAAK7B,gBAAgB;gCACvCC;gCACAC,UAAUS,KAAKS,OAAO;4BACxB;wBACF;wBAEFxB,OAAO6C,IAAI,CAAC,CAAC,QAAQ,EAAE9B,KAAKS,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;YACF;QACF;IACF,EAAE,OAAOkC,OAAO;QACd,MAAM,IAAIzE,SAAS,CAAC,gCAAgC,EAAE0E,OAAOD,QAAQ,EAAE;IACzE;IAEA,OAAO/D;AACT,EAAC;AAED,MAAM6C,gBAAgB,CAAC,EACrB5C,IAAI,EACJO,KAAK,EAIN;IACC,MAAMwC,cAAc/C,SAAS,mBAAmB,wBAAwB;IACxE,MAAMgE,aAAa1E,EAAE2E,MAAM,GAAGC,QAAQ,CAACnB;IAEvC,IAAI,CAACxC,OAAO;QACV,OAAOjB,EAAE6E,MAAM,CAAC;YAAE,CAACnE,KAAK,EAAEgE;QAAW;IACvC;IAEA,IAAIzD,iBAAiBjB,EAAE8E,SAAS,EAAE;QAChC,OAAO7D,MAAM8D,MAAM,CAAC;YAAE,CAACrE,KAAK,EAAEgE;QAAW;IAC3C;IAEA,MAAMM,SAAS/D;IAKf,OAAO;QACL,GAAG+D,MAAM;QACThD,MAAM;QACNiD,YAAY;YACV,GAAGD,OAAOC,UAAU;YACpB,CAACvE,KAAK,EAAE;gBACNsB,MAAM;gBACNyB;YACF;QACF;QACAyB,UAAUC,MAAMC,IAAI,CAAC,IAAIlC,IAAI;YAACxC;eAAUsE,OAAOE,QAAQ,IAAI,EAAE;SAAE;IACjE;AACF"}
+{"version":3,"sources":["../../src/mcp/buildMcpServer.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { McpServer, type ServerContext } from '@modelcontextprotocol/server'\nimport { APIError, strictObject, z } from 'payload'\n\nimport type {\n  AuthorizedMCP,\n  CollectionMCPItem,\n  GlobalMCPItem,\n  JsonSchemaType,\n  MCPResponseOverride,\n  MCPToolResponse,\n  SanitizedMCPPluginConfig,\n  ToolInputSchema,\n} from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { toStandardSchema } from '../utils/toStandardSchema.js'\n\n/**\n * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh\n * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh\n * instances from this builder while they own the transport and protocol-era\n * decision.\n *\n * `req` is the request context handlers see. For HTTP it's the live\n * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a\n * synthesized one built via `createPayloadRequest`.\n */\nexport const buildMcpServer = ({\n  authorizedMCP,\n  pluginConfig,\n  req,\n}: {\n  authorizedMCP: AuthorizedMCP\n  pluginConfig: SanitizedMCPPluginConfig\n  req: PayloadRequest\n}): McpServer => {\n  z.config(z.locales.en())\n\n  const serverOptions = pluginConfig.mcp?.serverOptions || {}\n  const server = new McpServer(\n    { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },\n    serverOptions.options,\n  )\n\n  const logger = getLogger({ payload: req.payload })\n\n  /**\n   * Wrap a tool handler's response with the tool's `overrideResponse`, then\n   * strip the internal `doc` field so it doesn't leak onto the wire.\n   */\n  const finalizeToolResponse = async ({\n    input,\n    overrideResponse,\n    response,\n    toolName,\n  }: {\n    input: unknown\n    overrideResponse?: MCPResponseOverride\n    response: MCPToolResponse\n    toolName: string\n  }): Promise<MCPToolResponse> => {\n    let overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response\n    for (const hook of pluginConfig.hooks?.afterToolCall ?? []) {\n      overridden = await hook({ input, req, response: overridden, toolName })\n    }\n    const { doc: _doc, ...rest } = overridden\n    return rest\n  }\n\n  /**\n   * Runs a collection/global tool call:\n   * - reads `slug` from the input\n   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug\n   * - runs the tool handler and finalizes its response\n   */\n  const callEntityTool = async ({\n    input,\n    item,\n    serverContext,\n  }: {\n    input: unknown\n    item: CollectionMCPItem | GlobalMCPItem\n    serverContext: ServerContext\n  }): Promise<MCPToolResponse> => {\n    const entity = item.type === 'collectionTool' ? 'collection' : 'global'\n    const toolInput = (input ?? {}) as Record<string, unknown>\n    const slug = toolInput.slug as string | undefined\n\n    if (!slug) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: \"${item.mcpName}\" requires slug. Use getConfigInfo to inspect ${entity} slugs.`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const match = authorizedMCP.items.find(\n      (candidate): candidate is CollectionMCPItem | GlobalMCPItem =>\n        candidate.type === item.type &&\n        candidate.mcpName === item.mcpName &&\n        (candidate.type === 'collectionTool'\n          ? candidate.collectionSlug === slug\n          : candidate.type === 'globalTool' && candidate.globalSlug === slug),\n    )\n\n    if (!match) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: MCP access to \"${item.mcpName}\" is not enabled for ${entity} \"${slug}\"`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const handlerArgs = {\n      authorizedMCP,\n      input: toolInput,\n      req,\n      serverContext,\n    }\n    const response = await (match.type === 'collectionTool'\n      ? match.tool.handler({ ...handlerArgs, slug })\n      : match.tool.handler({ ...handlerArgs, slug }))\n\n    return finalizeToolResponse({\n      input: toolInput,\n      overrideResponse: match.tool.overrideResponse,\n      response,\n      toolName: match.mcpName,\n    })\n  }\n\n  try {\n    const registeredEntityTools = new Set<string>()\n\n    for (const item of authorizedMCP.items) {\n      switch (item.type) {\n        case 'collectionTool':\n        case 'globalTool': {\n          if (registeredEntityTools.has(item.mcpName)) {\n            break\n          }\n          registeredEntityTools.add(item.mcpName)\n\n          const inputSchema = withSlugInput({ input: item.tool.input })\n\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: item.tool.annotations,\n              description: item.tool.description,\n              inputSchema: toStandardSchema(inputSchema),\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              callEntityTool({ input, item, serverContext: ctx }),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n        case 'prompt': {\n          const prompt = item.prompt\n          server.registerPrompt(\n            item.mcpName,\n            {\n              argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,\n              description: prompt.description,\n              title: prompt.title,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              prompt.handler({\n                input: (input ?? {}) as Record<string, unknown>,\n                req,\n                serverContext: ctx,\n              }),\n          )\n          logger.info(`✅ Prompt: ${prompt.title} Registered.`)\n          break\n        }\n        case 'resource': {\n          const resource = item.resource\n          server.registerResource(\n            item.mcpName,\n            // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)\n            resource.uri,\n            {\n              description: resource.description,\n              mimeType: resource.mimeType,\n              title: resource.title,\n            },\n            // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).\n            // The rest-params shape lets us collect either signature uniformly.\n            async (...sdkArgs: unknown[]) => {\n              const ctx = sdkArgs[sdkArgs.length - 1] as ServerContext\n              const uri = sdkArgs[0] as URL\n              const params = (sdkArgs.length > 2 ? sdkArgs[1] : {}) as Record<string, string>\n              return resource.handler({ params, req, serverContext: ctx, uri })\n            },\n          )\n          logger.info(`✅ Resource: ${resource.title} Registered.`)\n          break\n        }\n        case 'tool': {\n          const tool = item.tool\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: tool.annotations,\n              description: tool.description,\n              inputSchema: tool.input ? toStandardSchema(tool.input) : undefined,\n            },\n            async (input: unknown, ctx: ServerContext) => {\n              const toolInput = (input ?? {}) as Record<string, unknown>\n              const response = await tool.handler({\n                authorizedMCP,\n                input: toolInput,\n                req,\n                serverContext: ctx,\n              })\n              return finalizeToolResponse({\n                input: toolInput,\n                overrideResponse: tool.overrideResponse,\n                response,\n                toolName: item.mcpName,\n              })\n            },\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n      }\n    }\n  } catch (error) {\n    throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500)\n  }\n\n  return server\n}\n\nconst withSlugInput = ({ input }: { input?: ToolInputSchema }): ToolInputSchema => {\n  const description = 'The target slug.'\n  const slugSchema = z.string().check(z.describe(description))\n\n  if (!input) {\n    return strictObject({ slug: slugSchema }) as unknown as ToolInputSchema\n  }\n\n  if (typeof input === 'object' && input !== null && '~standard' in input) {\n    const schema = input['~standard'].jsonSchema.input({ target: 'draft-2020-12' })\n    const properties = schema.properties as Record<string, unknown> | undefined\n\n    if (properties?.slug) {\n      return input\n    }\n\n    return addSlugToJSONSchema({ description, schema: schema as JsonSchemaType })\n  }\n\n  return addSlugToJSONSchema({ description, schema: input })\n}\n\nconst addSlugToJSONSchema = ({\n  description,\n  schema,\n}: {\n  description: string\n  schema: JsonSchemaType\n}): JsonSchemaType => {\n  const objectSchema = schema as {\n    properties?: Record<string, JsonSchemaType>\n    required?: string[]\n  } & JsonSchemaType\n\n  return {\n    ...objectSchema,\n    type: 'object',\n    properties: {\n      ...objectSchema.properties,\n      slug: {\n        type: 'string',\n        description,\n      },\n    },\n    required: Array.from(new Set(['slug', ...(objectSchema.required ?? [])])),\n  }\n}\n"],"names":["McpServer","APIError","strictObject","z","getLogger","toStandardSchema","buildMcpServer","authorizedMCP","pluginConfig","req","config","locales","en","serverOptions","mcp","server","name","version","serverInfo","options","logger","payload","finalizeToolResponse","input","overrideResponse","response","toolName","overridden","doc","hook","hooks","afterToolCall","_doc","rest","callEntityTool","item","serverContext","entity","type","toolInput","slug","content","text","mcpName","isError","match","items","find","candidate","collectionSlug","globalSlug","handlerArgs","tool","handler","registeredEntityTools","Set","has","add","inputSchema","withSlugInput","registerTool","annotations","description","ctx","info","prompt","registerPrompt","argsSchema","undefined","title","resource","registerResource","uri","mimeType","sdkArgs","length","params","error","String","slugSchema","string","check","describe","schema","jsonSchema","target","properties","addSlugToJSONSchema","objectSchema","required","Array","from"],"mappings":"AAEA,SAASA,SAAS,QAA4B,+BAA8B;AAC5E,SAASC,QAAQ,EAAEC,YAAY,EAAEC,CAAC,QAAQ,UAAS;AAanD,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,aAAa,EACbC,YAAY,EACZC,GAAG,EAKJ;IACCN,EAAEO,MAAM,CAACP,EAAEQ,OAAO,CAACC,EAAE;IAErB,MAAMC,gBAAgBL,aAAaM,GAAG,EAAED,iBAAiB,CAAC;IAC1D,MAAME,SAAS,IAAIf,UACjB;QAAEgB,MAAM;QAAsBC,SAAS;QAAS,GAAGJ,cAAcK,UAAU;IAAC,GAC5EL,cAAcM,OAAO;IAGvB,MAAMC,SAAShB,UAAU;QAAEiB,SAASZ,IAAIY,OAAO;IAAC;IAEhD;;;GAGC,GACD,MAAMC,uBAAuB,OAAO,EAClCC,KAAK,EACLC,gBAAgB,EAChBC,QAAQ,EACRC,QAAQ,EAMT;QACC,IAAIC,aAAaH,mBAAmBC,UAAUA,SAASG,GAAG,IAAI,CAAC,GAAGnB,QAAQgB;QAC1E,KAAK,MAAMI,QAAQrB,aAAasB,KAAK,EAAEC,iBAAiB,EAAE,CAAE;YAC1DJ,aAAa,MAAME,KAAK;gBAAEN;gBAAOd;gBAAKgB,UAAUE;gBAAYD;YAAS;QACvE;QACA,MAAM,EAAEE,KAAKI,IAAI,EAAE,GAAGC,MAAM,GAAGN;QAC/B,OAAOM;IACT;IAEA;;;;;GAKC,GACD,MAAMC,iBAAiB,OAAO,EAC5BX,KAAK,EACLY,IAAI,EACJC,aAAa,EAKd;QACC,MAAMC,SAASF,KAAKG,IAAI,KAAK,mBAAmB,eAAe;QAC/D,MAAMC,YAAahB,SAAS,CAAC;QAC7B,MAAMiB,OAAOD,UAAUC,IAAI;QAE3B,IAAI,CAACA,MAAM;YACT,OAAO;gBACLC,SAAS;oBACP;wBACEH,MAAM;wBACNI,MAAM,CAAC,QAAQ,EAAEP,KAAKQ,OAAO,CAAC,8CAA8C,EAAEN,OAAO,OAAO,CAAC;oBAC/F;iBACD;gBACDO,SAAS;YACX;QACF;QAEA,MAAMC,QAAQtC,cAAcuC,KAAK,CAACC,IAAI,CACpC,CAACC,YACCA,UAAUV,IAAI,KAAKH,KAAKG,IAAI,IAC5BU,UAAUL,OAAO,KAAKR,KAAKQ,OAAO,IACjCK,CAAAA,UAAUV,IAAI,KAAK,mBAChBU,UAAUC,cAAc,KAAKT,OAC7BQ,UAAUV,IAAI,KAAK,gBAAgBU,UAAUE,UAAU,KAAKV,IAAG;QAGvE,IAAI,CAACK,OAAO;YACV,OAAO;gBACLJ,SAAS;oBACP;wBACEH,MAAM;wBACNI,MAAM,CAAC,sBAAsB,EAAEP,KAAKQ,OAAO,CAAC,qBAAqB,EAAEN,OAAO,EAAE,EAAEG,KAAK,CAAC,CAAC;oBACvF;iBACD;gBACDI,SAAS;YACX;QACF;QAEA,MAAMO,cAAc;YAClB5C;YACAgB,OAAOgB;YACP9B;YACA2B;QACF;QACA,MAAMX,WAAW,MAAOoB,CAAAA,MAAMP,IAAI,KAAK,mBACnCO,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEX;QAAK,KAC1CK,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEX;QAAK,EAAC;QAE/C,OAAOlB,qBAAqB;YAC1BC,OAAOgB;YACPf,kBAAkBqB,MAAMO,IAAI,CAAC5B,gBAAgB;YAC7CC;YACAC,UAAUmB,MAAMF,OAAO;QACzB;IACF;IAEA,IAAI;QACF,MAAMW,wBAAwB,IAAIC;QAElC,KAAK,MAAMpB,QAAQ5B,cAAcuC,KAAK,CAAE;YACtC,OAAQX,KAAKG,IAAI;gBACf,KAAK;gBACL,KAAK;oBAAc;wBACjB,IAAIgB,sBAAsBE,GAAG,CAACrB,KAAKQ,OAAO,GAAG;4BAC3C;wBACF;wBACAW,sBAAsBG,GAAG,CAACtB,KAAKQ,OAAO;wBAEtC,MAAMe,cAAcC,cAAc;4BAAEpC,OAAOY,KAAKiB,IAAI,CAAC7B,KAAK;wBAAC;wBAE3DR,OAAO6C,YAAY,CACjBzB,KAAKQ,OAAO,EACZ;4BACEkB,aAAa1B,KAAKiB,IAAI,CAACS,WAAW;4BAClCC,aAAa3B,KAAKiB,IAAI,CAACU,WAAW;4BAClCJ,aAAarD,iBAAiBqD;wBAChC,GACA,OAAOnC,OAAgBwC,MACrB7B,eAAe;gCAAEX;gCAAOY;gCAAMC,eAAe2B;4BAAI;wBAErD3C,OAAO4C,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKQ,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;gBACA,KAAK;oBAAU;wBACb,MAAMsB,SAAS9B,KAAK8B,MAAM;wBAC1BlD,OAAOmD,cAAc,CACnB/B,KAAKQ,OAAO,EACZ;4BACEwB,YAAYF,OAAOE,UAAU,GAAG9D,iBAAiB4D,OAAOE,UAAU,IAAIC;4BACtEN,aAAaG,OAAOH,WAAW;4BAC/BO,OAAOJ,OAAOI,KAAK;wBACrB,GACA,OAAO9C,OAAgBwC,MACrBE,OAAOZ,OAAO,CAAC;gCACb9B,OAAQA,SAAS,CAAC;gCAClBd;gCACA2B,eAAe2B;4BACjB;wBAEJ3C,OAAO4C,IAAI,CAAC,CAAC,UAAU,EAAEC,OAAOI,KAAK,CAAC,YAAY,CAAC;wBACnD;oBACF;gBACA,KAAK;oBAAY;wBACf,MAAMC,WAAWnC,KAAKmC,QAAQ;wBAC9BvD,OAAOwD,gBAAgB,CACrBpC,KAAKQ,OAAO,EACZ,mFAAmF;wBACnF2B,SAASE,GAAG,EACZ;4BACEV,aAAaQ,SAASR,WAAW;4BACjCW,UAAUH,SAASG,QAAQ;4BAC3BJ,OAAOC,SAASD,KAAK;wBACvB,GACA,0EAA0E;wBAC1E,oEAAoE;wBACpE,OAAO,GAAGK;4BACR,MAAMX,MAAMW,OAAO,CAACA,QAAQC,MAAM,GAAG,EAAE;4BACvC,MAAMH,MAAME,OAAO,CAAC,EAAE;4BACtB,MAAME,SAAUF,QAAQC,MAAM,GAAG,IAAID,OAAO,CAAC,EAAE,GAAG,CAAC;4BACnD,OAAOJ,SAASjB,OAAO,CAAC;gCAAEuB;gCAAQnE;gCAAK2B,eAAe2B;gCAAKS;4BAAI;wBACjE;wBAEFpD,OAAO4C,IAAI,CAAC,CAAC,YAAY,EAAEM,SAASD,KAAK,CAAC,YAAY,CAAC;wBACvD;oBACF;gBACA,KAAK;oBAAQ;wBACX,MAAMjB,OAAOjB,KAAKiB,IAAI;wBACtBrC,OAAO6C,YAAY,CACjBzB,KAAKQ,OAAO,EACZ;4BACEkB,aAAaT,KAAKS,WAAW;4BAC7BC,aAAaV,KAAKU,WAAW;4BAC7BJ,aAAaN,KAAK7B,KAAK,GAAGlB,iBAAiB+C,KAAK7B,KAAK,IAAI6C;wBAC3D,GACA,OAAO7C,OAAgBwC;4BACrB,MAAMxB,YAAahB,SAAS,CAAC;4BAC7B,MAAME,WAAW,MAAM2B,KAAKC,OAAO,CAAC;gCAClC9C;gCACAgB,OAAOgB;gCACP9B;gCACA2B,eAAe2B;4BACjB;4BACA,OAAOzC,qBAAqB;gCAC1BC,OAAOgB;gCACPf,kBAAkB4B,KAAK5B,gBAAgB;gCACvCC;gCACAC,UAAUS,KAAKQ,OAAO;4BACxB;wBACF;wBAEFvB,OAAO4C,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKQ,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;YACF;QACF;IACF,EAAE,OAAOkC,OAAO;QACd,MAAM,IAAI5E,SAAS,CAAC,gCAAgC,EAAE6E,OAAOD,QAAQ,EAAE;IACzE;IAEA,OAAO9D;AACT,EAAC;AAED,MAAM4C,gBAAgB,CAAC,EAAEpC,KAAK,EAA+B;IAC3D,MAAMuC,cAAc;IACpB,MAAMiB,aAAa5E,EAAE6E,MAAM,GAAGC,KAAK,CAAC9E,EAAE+E,QAAQ,CAACpB;IAE/C,IAAI,CAACvC,OAAO;QACV,OAAOrB,aAAa;YAAEsC,MAAMuC;QAAW;IACzC;IAEA,IAAI,OAAOxD,UAAU,YAAYA,UAAU,QAAQ,eAAeA,OAAO;QACvE,MAAM4D,SAAS5D,KAAK,CAAC,YAAY,CAAC6D,UAAU,CAAC7D,KAAK,CAAC;YAAE8D,QAAQ;QAAgB;QAC7E,MAAMC,aAAaH,OAAOG,UAAU;QAEpC,IAAIA,YAAY9C,MAAM;YACpB,OAAOjB;QACT;QAEA,OAAOgE,oBAAoB;YAAEzB;YAAaqB,QAAQA;QAAyB;IAC7E;IAEA,OAAOI,oBAAoB;QAAEzB;QAAaqB,QAAQ5D;IAAM;AAC1D;AAEA,MAAMgE,sBAAsB,CAAC,EAC3BzB,WAAW,EACXqB,MAAM,EAIP;IACC,MAAMK,eAAeL;IAKrB,OAAO;QACL,GAAGK,YAAY;QACflD,MAAM;QACNgD,YAAY;YACV,GAAGE,aAAaF,UAAU;YAC1B9C,MAAM;gBACJF,MAAM;gBACNwB;YACF;QACF;QACA2B,UAAUC,MAAMC,IAAI,CAAC,IAAIpC,IAAI;YAAC;eAAYiC,aAAaC,QAAQ,IAAI,EAAE;SAAE;IACzE;AACF"}

package/dist/mcp/builtin/collections/authTools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authTools.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/authTools.ts"],"names":[],"mappings":"AAiCA,eAAO,MAAM,kBAAkB,4CAqC7B,CAAA;AAEF,eAAO,MAAM,4BAA4B,4CAuCvC,CAAA;AAEF,eAAO,MAAM,mBAAmB,4CAiD9B,CAAA;AAEF,eAAO,MAAM,2BAA2B,4CAmCtC,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAgC/B,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAiC/B,CAAA"}
+{"version":3,"file":"authTools.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/authTools.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,kBAAkB,4CA0D7B,CAAA;AAEF,eAAO,MAAM,4BAA4B,4CAmCvC,CAAA;AAEF,eAAO,MAAM,mBAAmB,4CAuC9B,CAAA;AAEF,eAAO,MAAM,2BAA2B,4CAmCtC,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAmC/B,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAiC/B,CAAA"}