@payloadcms/plugin-mcp 4.0.0-internal.a0ef1b8 → 4.0.0-internal.a2d053c

package/src/types.ts

@@ -1,23 +1,24 @@
 import type {
   CallToolResult,
   ContentBlock,
+  Implementation,
   JsonSchemaType,
-  McpServer,
+  McpServerOptions,
   ResourceTemplate,
   ServerContext,
   StandardSchemaWithJSON,
+  ToolAnnotations,
 } from '@modelcontextprotocol/server'
 import type {
   AuthCollectionSlug,
-  CollectionConfig,
   CollectionSlug,
-  DefaultDocumentIDType,
   GlobalSlug,
   MaybePromise,
   PayloadRequest,
-  TypedUser,
+  SanitizedPermissions,
 } from 'payload'
 
+import type { GetAuthorizedMCPArgs } from './endpoint/access.js'
 import type {
   MCPCollectionAuthToolName,
   MCPCollectionBuiltinName,
@@ -26,34 +27,16 @@ import type {
 
 export type { MCPCollectionAuthToolName, MCPCollectionBuiltinName, MCPGlobalBuiltinName }
 
-/** Re-exported from `@modelcontextprotocol/server` — the JSON Schema shape the MCP runtime validates against. */
-export type { JsonSchemaType, StandardSchemaWithJSON }
+/** Re-exported from `@modelcontextprotocol/server` — common MCP types used in plugin config. */
+export type { JsonSchemaType, StandardSchemaWithJSON, ToolAnnotations }
 
 /**
  * What a tool's `input` (or a prompt's `argsSchema`) can be — either a raw
- * JSON Schema literal, or a Standard Schema instance (Zod, Valibot, …).
+ * JSON Schema 2020-12 literal, or a Standard Schema instance (Zod, Valibot, …).
+ * Raw schemas may omit `$schema`; when present it must declare the 2020-12 dialect.
  */
 export type ToolInputSchema = JsonSchemaType | StandardSchemaWithJSON
 
-/**
- * Serializable mirror of `SanitizedMCPPluginConfig` for client components —
- * the full sanitized config carries functions (tool handlers, etc.) that can't
- * cross the server→client boundary. Built by `sanitizeClientPluginConfig` and
- * passed to the `AccessField` component via `clientProps`.
- *
- * @internal
- */
-export type ClientMCPPluginConfig = {
-  items: Array<{
-    collectionSlug?: string
-    description: string
-    globalSlug?: string
-    key: string
-    label: string
-    type: 'collectionTool' | 'globalTool' | 'prompt' | 'resource' | 'tool'
-  }>
-}
-
 export type MCPToolResponse = {
   content: ContentBlock[]
   /**
@@ -70,6 +53,13 @@ export type MCPResponseOverride = (
   req: PayloadRequest,
 ) => MCPToolResponse
 
+export type MCPAfterToolCallHook = (args: {
+  input: unknown
+  req: PayloadRequest
+  response: MCPToolResponse
+  toolName: string
+}) => MaybePromise<MCPToolResponse>
+
 /**
  * The handler's `input` type. A specific Standard Schema (Zod, Valibot, …) gets
  * its inferred output; anything else falls back to `Record<string, unknown>`.
@@ -80,6 +70,19 @@ export type TypedInput<TSchema> = TSchema extends StandardSchemaWithJSON
     : StandardSchemaWithJSON.InferOutput<TSchema>
   : Record<string, unknown>
 
+export type MCPAccessArgs = {
+  permissions?: SanitizedPermissions
+  req: PayloadRequest
+}
+
+export type CollectionMCPAccessArgs = {
+  slug: CollectionSlug
+} & MCPAccessArgs
+
+export type GlobalMCPAccessArgs = {
+  slug: GlobalSlug
+} & MCPAccessArgs
+
 export type ToolHandlerArgs<TSchema = undefined> = {
   authorizedMCP: AuthorizedMCP
   input: TypedInput<TSchema>
@@ -88,14 +91,21 @@ export type ToolHandlerArgs<TSchema = undefined> = {
 }
 
 export type CollectionToolHandlerArgs<TSchema = undefined> = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & ToolHandlerArgs<TSchema>
 
 export type GlobalToolHandlerArgs<TSchema = undefined> = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
+  /**
+   * Runs while authorizing each MCP request, before the tool is advertised or called. Return
+   * `false` to make the tool unavailable for that request. This is skipped when `overrideAccess`
+   * is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
   description: string
   handler: (args: ToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
   input?: TSchema
@@ -105,30 +115,57 @@ export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema |
   overrideResponse?: MCPResponseOverride
 }
 
-/**
- * `TSchema` is the schema itself (Standard Schema, raw JSON Schema, or undefined).
- * The function-form variant of `input` carries a concrete `{ collectionSchema: JsonSchemaType }`
- * parameter type so callers can write `({ collectionSchema }) => …` without annotating it.
- */
 export type CollectionTool<
   TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined,
 > = {
+  /**
+   * Runs while authorizing each MCP request for this collection. Return `false` to reject calls
+   * to this tool for the collection. The shared tool is not advertised when no collections allow
+   * it, but can remain advertised when it is available for another collection. This is skipped
+   * when `overrideAccess` is enabled.
+   */
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
   handler: (args: CollectionToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
-  input?: ((args: { collectionSchema: JsonSchemaType }) => TSchema) | TSchema
-} & Pick<Tool, 'description' | 'overrideResponse'>
+  input?: TSchema
+} & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
 
 export type GlobalTool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> =
   {
+    /**
+     * Runs while authorizing each MCP request for this global. Return `false` to reject calls to
+     * this tool for the global. The shared tool is not advertised when no globals allow it, but
+     * can remain advertised when it is available for another global. This is skipped when
+     * `overrideAccess` is enabled.
+     */
+    access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
     handler: (args: GlobalToolHandlerArgs<TSchema>) => MaybePromise<MCPToolResponse>
-    input?: ((args: { globalSchema: JsonSchemaType }) => TSchema) | TSchema
-  } & Pick<Tool, 'description' | 'overrideResponse'>
+    input?: TSchema
+  } & Pick<Tool, 'annotations' | 'description' | 'overrideResponse'>
 
 /**
  * Configures (or disables) a built-in tool without replacing it.
  * `handler?: never` prevents a full `CollectionTool`/`GlobalTool` (which has a
  * required handler) from being silently accepted at a built-in key slot.
  */
-export type MCPBuiltInToolOverride = {
+export type MCPBuiltInCollectionToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this collection. This is skipped when `overrideAccess` is enabled.
+   */
+  access?: (args: CollectionMCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
+  description?: string
+  handler?: never
+  overrideResponse?: MCPResponseOverride
+}
+
+export type MCPBuiltInGlobalToolOverride = {
+  /**
+   * Replaces the built-in tool's access check. Return `false` to make the tool unavailable for
+   * this global. This is skipped when `overrideAccess` is enabled.
+   */
+  access?: (args: GlobalMCPAccessArgs) => MaybePromise<boolean>
+  annotations?: ToolAnnotations
   description?: string
   handler?: never
   overrideResponse?: MCPResponseOverride
@@ -142,13 +179,13 @@ export type MCPBuiltInToolOverride = {
 export type MCPTopLevelToolEntry = Tool
 
 export type MCPCollectionToolsMap = {
-  [customToolName: string]: boolean | CollectionTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | CollectionTool | MCPBuiltInCollectionToolOverride | undefined
 } & {
-  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPCollectionBuiltinName]?: false | MCPBuiltInCollectionToolOverride
 }
 
 export type MCPAuthCollectionToolsMap = {
-  [K in MCPCollectionAuthToolName]?: MCPBuiltInToolOverride | true
+  [K in MCPCollectionAuthToolName]?: MCPBuiltInCollectionToolOverride | true
 } & MCPCollectionToolsMap
 
 /** Auth-enabled collections get auth-tool name autocomplete; others get CRUD-only. */
@@ -157,9 +194,9 @@ export type MCPToolsMapForCollection<Slug extends CollectionSlug> = Slug extends
   : MCPCollectionToolsMap
 
 export type MCPGlobalToolsMap = {
-  [customToolName: string]: boolean | GlobalTool | MCPBuiltInToolOverride | undefined
+  [customToolName: string]: boolean | GlobalTool | MCPBuiltInGlobalToolOverride | undefined
 } & {
-  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInToolOverride
+  [K in MCPGlobalBuiltinName]?: false | MCPBuiltInGlobalToolOverride
 }
 
 export type MCPTopLevelToolsMap = Record<string, Tool>
@@ -171,6 +208,12 @@ export type PromptHandlerArgs<TSchema = undefined> = {
 }
 
 export type Prompt<TSchema extends ToolInputSchema = ToolInputSchema> = {
+  /**
+   * Runs while authorizing each MCP request, before the prompt is advertised or used. Return
+   * `false` to make the prompt unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   argsSchema: TSchema
   description: string
   handler: (args: PromptHandlerArgs<TSchema>) => MaybePromise<{
@@ -188,6 +231,12 @@ export type ResourceHandlerArgs = {
 }
 
 export type Resource = {
+  /**
+   * Runs while authorizing each MCP request, before the resource is advertised or read. Return
+   * `false` to make the resource unavailable for that request. This is skipped when
+   * `overrideAccess` is enabled.
+   */
+  access?: (args: MCPAccessArgs) => MaybePromise<boolean>
   description: string
   handler: (args: ResourceHandlerArgs) => MaybePromise<{
     contents: Array<{ text: string; uri: string }>
@@ -221,106 +270,162 @@ export type MCPPluginConfig = {
   collections?: {
     [Slug in CollectionSlug]?: MCPPluginCollectionConfig<Slug>
   }
-  /** Skip MCP registration. The API key collection is still added (so DB / types stay stable). */
+  /** Skip MCP endpoint registration. */
   disabled?: boolean
   globals?: {
     [Slug in GlobalSlug]?: MCPPluginGlobalConfig
   }
+  hooks?: {
+    /** Transform a tool response after its handler returns */
+    afterToolCall?: MCPAfterToolCallHook[]
+  }
   mcp?: {
+    /**
+     * Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
+     * are answered with `413`. Base64 file uploads count toward this limit.
+     *
+     * @default 4194304 (4 MiB, the MCP SDK default)
+     */
+    maxRequestBodySize?: number
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
-  overrideApiKeyCollection?: (collection: CollectionConfig) => CollectionConfig
-  /** Replace the default API-key auth with a custom resolver. */
-  overrideAuth?: (args: {
-    getAPIKeyDoc: (overrideApiKey?: string) => Promise<MCPAPIKeysDoc>
-    getAuthorizedMCP: (args: { apiKeyDoc: MCPAPIKeysDoc }) => AuthorizedMCP
-    pluginConfig: SanitizedMCPPluginConfig
-    req: PayloadRequest
-  }) => MaybePromise<AuthorizedMCP>
+  /**
+   * How MCP clients sign in. MCP requests without an authenticated user get a `401` that points
+   * to the protected resource metadata (RFC 9728). Set to `false` to only accept API keys and
+   * anonymous requests.
+   *
+   * @default { type: 'builtin' }
+   */
+  oauth?: false | MCPOAuthConfig
+  /**
+   * Replace the default MCP authorization resolver.
+   *
+   * This hook replaces the default authentication flow. It must set `req.user` to the
+   * authenticated Payload user, or to `null` for an anonymous caller, before returning.
+   */
+  overrideGetAuthorizedMCP?: (
+    args: {
+      pluginConfig: SanitizedMCPPluginConfig
+    } & GetAuthorizedMCPArgs,
+  ) => MaybePromise<AuthorizedMCP>
   prompts?: Record<string, Prompt>
   resources?: Record<string, Resource>
   /** Cross-cutting tools (not scoped to any collection or global). */
   tools?: MCPTopLevelToolsMap
-  userCollection?: CollectionSlug
 }
 
-export type SanitizedMCPPluginConfig = {
-  items: MCPItem[]
-  userCollection: CollectionSlug
-} & Pick<MCPPluginConfig, 'disabled' | 'mcp' | 'overrideApiKeyCollection' | 'overrideAuth'>
-
-export type MCPServerOptions = {
-  options?: ConstructorParameters<typeof McpServer>[1]
-  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>
-}
+export type MCPOAuthConfig = MCPBuiltinOAuthConfig | MCPExternalOAuthConfig
 
 /**
- * Nested access tree as stored in the collection.
- * A `false` leaf disables that tool; missing keys defer to
- * defaults (built-in CRUD is on, opt-in tools are off).
+ * This Payload app is the authorization server. Users sign in to the admin panel and allow the
+ * MCP client, which then gets an access token for them.
  */
-export type MCPAPIKeysDocAccessTree = {
-  collections?: {
-    [CollectionSlug: CollectionSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  globals?: {
-    [GlobalSlug: GlobalSlug]: {
-      [ToolKey: string]: boolean
-    }
-  }
-  prompts?: {
-    [PromptKey: string]: boolean
-  }
-  resources?: {
-    [ResourceKey: string]: boolean
-  }
-  tools?: {
-    [ToolKey: string]: boolean
-  }
+export type MCPBuiltinOAuthConfig = {
+  /**
+   * Creates the tokens the MCP client gets when the user clicks Allow. `req` is the user's own
+   * browser request, so `req.user` is the user who allowed it. Pass `authenticate` too if
+   * Payload's auth strategies don't accept the access token.
+   *
+   * @default a Payload login token for that user that only works for MCP, with a refresh token when
+   * the collection uses sessions
+   */
+  issueToken?: (args: { req: PayloadRequest }) => MaybePromise<MCPOAuthTokens>
+  /**
+   * Trades a refresh token from `issueToken`, or from an earlier refresh, for new tokens. Return
+   * `null` when it's no longer valid, and the client sends the user through sign-in again. `req`
+   * is the MCP client's request, without a user. Only used together with `issueToken`.
+   *
+   * OAuth requires noticing copied refresh tokens: return a new refresh token every time, and
+   * revoke the tokens when an already used refresh token comes back.
+   */
+  refreshToken?: (args: {
+    refreshToken: string
+    req: PayloadRequest
+  }) => MaybePromise<MCPOAuthTokens | null>
+  type: 'builtin'
+} & MCPOAuthSharedConfig
+
+export type MCPOAuthTokens = {
+  accessToken: string
+  /** Seconds until the access token expires. */
+  expiresIn?: number
+  /** Lets the client get new tokens without the user, through `refreshToken`. */
+  refreshToken?: string
 }
 
-/**
- * Stored on `payload-mcp-api-keys` docs
- */
-export type MCPAPIKeysDoc = {
-  access: MCPAPIKeysDocAccessTree
-  id: DefaultDocumentIDType
-  overrideAccess?: boolean
-  user: null | TypedUser
+/** Another service, e.g. your identity provider, is the authorization server. */
+export type MCPExternalOAuthConfig = {
+  /**
+   * The authorization servers that issue access tokens for MCP clients. Clients require each one
+   * to exactly match the `issuer` in that server's metadata, so pass a function when the exact
+   * value is only known at runtime, e.g. from the server's OpenID configuration or per host.
+   */
+  authorizationServers: ((args: { req: PayloadRequest }) => MaybePromise<string[]>) | string[]
+  /**
+   * Scopes MCP clients should request, e.g. `['openid', 'email', 'profile']`. Without them,
+   * clients request none, which some authorization servers reject or answer with a token that
+   * doesn't identify the user.
+   */
+  scopes?: string[]
+  type: 'external'
+} & MCPOAuthSharedConfig
+
+type MCPOAuthSharedConfig = {
+  /**
+   * Called on MCP requests with a bearer token that Payload's auth strategies didn't accept.
+   * Return the Payload user, including its `collection`, or `null` to answer with the OAuth challenge.
+   */
+  authenticate?: (args: {
+    req: PayloadRequest
+    token: string
+  }) => MaybePromise<PayloadRequest['user']>
+  /**
+   * The URL clients call to reach the MCP endpoint.
+   *
+   * @default the absolute URL of `/api/mcp`, based on `serverURL` or the request URL
+   */
+  resource?: string
+}
+
+export type SanitizedMCPPluginConfig = {
+  items: MCPItem[]
+  /** `undefined` when OAuth is turned off. */
+  oauth?: MCPOAuthConfig
+} & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
+
+export type MCPServerOptions = {
+  options?: McpServerOptions
+  serverInfo?: Partial<Implementation>
 }
 
 /**
- * One MCP primitive — tool, prompt, or resource — paired with the metadata both
- * the endpoint and the API key collection need. Built by `sanitizeMCPConfig`,
- * filtered by `getAuthorizedMCP`, registered by the MCP endpoint.
+ * One MCP primitive plus the metadata needed for config-driven filtering and
+ * registration.
  *
- *  - `key`: the config identifier (`find`, `echo`). Used for the API-key deny
- *    lookup and as the admin checkbox field name. For collection/global tools,
- *    the MCP wire name (`findPosts`) is derived from `key + slug` at
- *    registration time.
- *  - `label`: human-readable admin-UI display text for the checkbox.
- *  - `tool` / `prompt` / `resource`: the live primitive (its own
- *    `description` is what both MCP clients and the admin UI surface).
+ * - `configKey`: the config identifier, e.g. `find` or `echo`.
+ * - `mcpName`: the MCP wire name, e.g. `findDocuments` or `echo`.
+ * - `label`: human-readable display text.
  */
 export type MCPItemBase = {
-  key: string
+  configKey: string
   label: string
+  mcpName: string
 }
 
+export type CollectionMCPItem = {
+  collectionSlug: CollectionSlug
+  tool: CollectionTool
+  type: 'collectionTool'
+} & MCPItemBase
+
+export type GlobalMCPItem = {
+  globalSlug: GlobalSlug
+  tool: GlobalTool
+  type: 'globalTool'
+} & MCPItemBase
+
 export type MCPItem =
-  | ({
-      collectionSlug: CollectionSlug
-      tool: CollectionTool
-      type: 'collectionTool'
-    } & MCPItemBase)
-  | ({
-      globalSlug: GlobalSlug
-      tool: GlobalTool
-      type: 'globalTool'
-    } & MCPItemBase)
   | ({
       prompt: Prompt
       type: 'prompt'
@@ -333,15 +438,14 @@ export type MCPItem =
       tool: Tool
       type: 'tool'
     } & MCPItemBase)
+  | CollectionMCPItem
+  | GlobalMCPItem
 
 /**
- * The caller's identity + the MCP items they can use for this request. Returned
- * by `getAuthorizedMCP`; denied items are simply absent from `items`. Handlers
- * receive this via `args.authorizedMCP` so they can spread
- * `localAPIDefaults(authorizedMCP)` into every local API call.
+ * The MCP items and access mode authorized for this request. The authenticated user is available
+ * as `req.user`.
  */
 export type AuthorizedMCP = {
   items: MCPItem[]
   overrideAccess: boolean
-  user: null | TypedUser
 }

package/src/utils/getPluginConfig.ts

@@ -5,7 +5,7 @@ import type { SanitizedMCPPluginConfig } from '../types.js'
 /**
  * Returns the sanitized plugin config — the form produced by
  * `sanitizeMCPConfig` and stashed back on the plugin's `options` during init.
- * Callers downstream of plugin init can rely on `items`, `userCollection`, etc.
+ * Callers downstream of plugin init can rely on `items` and other defaults
  * being fully resolved.
  */
 export const getPluginConfig: (args: { config: SanitizedConfig }) => SanitizedMCPPluginConfig = ({

package/src/utils/seal.ts

@@ -0,0 +1,46 @@
+import type { PayloadRequest } from 'payload'
+
+/**
+ * Encrypts data for the client to hold, so it doesn't need to be stored. `type` keeps one kind
+ * from being used as another, e.g. a client ID as an authorization code.
+ */
+export const seal = ({
+  type,
+  data,
+  expiresIn,
+  req,
+}: {
+  data: object
+  /** Seconds */
+  expiresIn?: number
+  req: PayloadRequest
+  type: string
+}): string =>
+  req.payload.encrypt(
+    JSON.stringify({ ...data, type, exp: expiresIn && Date.now() + expiresIn * 1000 }),
+  )
+
+export const unseal = <T>({
+  type,
+  req,
+  value,
+}: {
+  req: PayloadRequest
+  type: string
+  value: null | string
+}): T | undefined => {
+  // Only the v1 format is authenticated. Older formats decrypt anything without an error.
+  if (!value?.startsWith('v1:')) {
+    return undefined
+  }
+
+  try {
+    // Previous secrets can be public, like a default secret from source code, so only client IDs
+    // accept them. Client IDs grant nothing, and this keeps clients registered when the secret changes.
+    const secret = type === 'client' ? undefined : req.payload.config.secret
+    const data = JSON.parse(req.payload.decrypt(value, { secret }))
+    return data.type === type && (!data.exp || data.exp > Date.now()) ? data : undefined
+  } catch {
+    return undefined
+  }
+}

package/src/utils/toStandardSchema.ts

@@ -5,5 +5,5 @@ import type { ToolInputSchema } from '../types.js'
 /** Normalize a tool/prompt input to a Standard Schema. Raw JSON Schema gets wrapped; Standard Schema instances pass through. */
 export const toStandardSchema = (schema: ToolInputSchema): StandardSchemaWithJSON =>
   typeof schema === 'object' && schema !== null && '~standard' in schema
-    ? (schema as StandardSchemaWithJSON)
+    ? schema
     : fromJsonSchema(schema)

package/dist/@types/assets.d.js

@@ -1,2 +0,0 @@
-
-//# sourceMappingURL=assets.d.js.map

package/dist/@types/assets.d.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/@types/assets.d.ts"],"names":[],"mappings":""}

package/dist/collection/getAccessField.d.ts

@@ -1,12 +0,0 @@
-import type { JSONField } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */
-export declare const getAccessField: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => JSONField;
-//# sourceMappingURL=getAccessField.d.ts.map

package/dist/collection/getAccessField.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"getAccessField.d.ts","sourceRoot":"","sources":["../../src/collection/getAccessField.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAExC,OAAO,KAAK,EAAkC,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,cAAc,GAAI,mBAE5B;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,SAqBH,CAAA"}

package/dist/collection/getAccessField.js

@@ -1,57 +0,0 @@
-/**
- * Returns the API key collection's `access` field — a JSON field whose value
- * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is
- * a custom client component (`AccessField`) which renders a permissions
- * matrix; the field's stored shape is just the runtime access tree.
- */ export const getAccessField = ({ pluginConfig })=>{
-    const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig);
-    return {
-        name: 'access',
-        type: 'json',
-        admin: {
-            components: {
-                Field: {
-                    clientProps: {
-                        pluginConfig: clientPluginConfig
-                    },
-                    path: '@payloadcms/plugin-mcp/client#AccessField'
-                }
-            },
-            // TODO: needs i18n once design is finalized
-            description: 'Access for this API key — uncheck to revoke individual tools.',
-            position: 'sidebar'
-        },
-        defaultValue: {},
-        // TODO: needs i18n once design is finalized
-        label: 'Access'
-    };
-};
-/**
- * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,
- * input/argsSchema functions, etc.) so the result is safe to thread to a
- * client component via `clientProps`.
- */ const sanitizeClientPluginConfig = (pluginConfig)=>({
-        items: pluginConfig.items.map((item)=>({
-                ...item.type === 'collectionTool' ? {
-                    collectionSlug: item.collectionSlug
-                } : {},
-                ...item.type === 'globalTool' ? {
-                    globalSlug: item.globalSlug
-                } : {},
-                type: item.type,
-                description: itemDescription(item),
-                key: item.key,
-                label: item.label
-            }))
-    });
-const itemDescription = (item)=>{
-    if (item.type === 'prompt') {
-        return item.prompt.description;
-    }
-    if (item.type === 'resource') {
-        return item.resource.description;
-    }
-    return item.tool.description;
-};
-
-//# sourceMappingURL=getAccessField.js.map

package/dist/collection/getAccessField.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/collection/getAccessField.ts"],"sourcesContent":["import type { JSONField } from 'payload'\n\nimport type { ClientMCPPluginConfig, MCPItem, SanitizedMCPPluginConfig } from '../types.js'\n\n/**\n * Returns the API key collection's `access` field — a JSON field whose value\n * is the `MCPAPIKeysDocAccessTree` the endpoint consults. The actual UI is\n * a custom client component (`AccessField`) which renders a permissions\n * matrix; the field's stored shape is just the runtime access tree.\n */\nexport const getAccessField = ({\n  pluginConfig,\n}: {\n  pluginConfig: SanitizedMCPPluginConfig\n}): JSONField => {\n  const clientPluginConfig = sanitizeClientPluginConfig(pluginConfig)\n\n  return {\n    name: 'access',\n    type: 'json',\n    admin: {\n      components: {\n        Field: {\n          clientProps: { pluginConfig: clientPluginConfig },\n          path: '@payloadcms/plugin-mcp/client#AccessField',\n        },\n      },\n      // TODO: needs i18n once design is finalized\n      description: 'Access for this API key — uncheck to revoke individual tools.',\n      position: 'sidebar',\n    },\n    defaultValue: {},\n    // TODO: needs i18n once design is finalized\n    label: 'Access',\n  }\n}\n\n/**\n * Strips the non-serializable parts of `SanitizedMCPPluginConfig` (handlers,\n * input/argsSchema functions, etc.) so the result is safe to thread to a\n * client component via `clientProps`.\n */\nconst sanitizeClientPluginConfig = (\n  pluginConfig: SanitizedMCPPluginConfig,\n): ClientMCPPluginConfig => ({\n  items: pluginConfig.items.map((item) => ({\n    ...(item.type === 'collectionTool' ? { collectionSlug: item.collectionSlug } : {}),\n    ...(item.type === 'globalTool' ? { globalSlug: item.globalSlug } : {}),\n    type: item.type,\n    description: itemDescription(item),\n    key: item.key,\n    label: item.label,\n  })),\n})\n\nconst itemDescription = (item: MCPItem): string => {\n  if (item.type === 'prompt') {\n    return item.prompt.description\n  }\n  if (item.type === 'resource') {\n    return item.resource.description\n  }\n  return item.tool.description\n}\n"],"names":["getAccessField","pluginConfig","clientPluginConfig","sanitizeClientPluginConfig","name","type","admin","components","Field","clientProps","path","description","position","defaultValue","label","items","map","item","collectionSlug","globalSlug","itemDescription","key","prompt","resource","tool"],"mappings":"AAIA;;;;;CAKC,GACD,OAAO,MAAMA,iBAAiB,CAAC,EAC7BC,YAAY,EAGb;IACC,MAAMC,qBAAqBC,2BAA2BF;IAEtD,OAAO;QACLG,MAAM;QACNC,MAAM;QACNC,OAAO;YACLC,YAAY;gBACVC,OAAO;oBACLC,aAAa;wBAAER,cAAcC;oBAAmB;oBAChDQ,MAAM;gBACR;YACF;YACA,4CAA4C;YAC5CC,aAAa;YACbC,UAAU;QACZ;QACAC,cAAc,CAAC;QACf,4CAA4C;QAC5CC,OAAO;IACT;AACF,EAAC;AAED;;;;CAIC,GACD,MAAMX,6BAA6B,CACjCF,eAC2B,CAAA;QAC3Bc,OAAOd,aAAac,KAAK,CAACC,GAAG,CAAC,CAACC,OAAU,CAAA;gBACvC,GAAIA,KAAKZ,IAAI,KAAK,mBAAmB;oBAAEa,gBAAgBD,KAAKC,cAAc;gBAAC,IAAI,CAAC,CAAC;gBACjF,GAAID,KAAKZ,IAAI,KAAK,eAAe;oBAAEc,YAAYF,KAAKE,UAAU;gBAAC,IAAI,CAAC,CAAC;gBACrEd,MAAMY,KAAKZ,IAAI;gBACfM,aAAaS,gBAAgBH;gBAC7BI,KAAKJ,KAAKI,GAAG;gBACbP,OAAOG,KAAKH,KAAK;YACnB,CAAA;IACF,CAAA;AAEA,MAAMM,kBAAkB,CAACH;IACvB,IAAIA,KAAKZ,IAAI,KAAK,UAAU;QAC1B,OAAOY,KAAKK,MAAM,CAACX,WAAW;IAChC;IACA,IAAIM,KAAKZ,IAAI,KAAK,YAAY;QAC5B,OAAOY,KAAKM,QAAQ,CAACZ,WAAW;IAClC;IACA,OAAOM,KAAKO,IAAI,CAACb,WAAW;AAC9B"}

package/dist/collection/index.d.ts

@@ -1,6 +0,0 @@
-import type { CollectionConfig } from 'payload';
-import type { SanitizedMCPPluginConfig } from '../types.js';
-export declare const getAPIKeysCollection: ({ pluginConfig, }: {
-    pluginConfig: SanitizedMCPPluginConfig;
-}) => CollectionConfig;
-//# sourceMappingURL=index.d.ts.map

package/dist/collection/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/collection/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAE/C,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAA;AAI3D,eAAO,MAAM,oBAAoB,GAAI,mBAElC;IACD,YAAY,EAAE,wBAAwB,CAAA;CACvC,KAAG,gBAqDH,CAAA"}