@payloadcms/plugin-mcp 4.0.0-internal.cea8867 → 4.0.0-internal.d927017

package/dist/stdio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAgBA;;;;;GAKG;AACH,eAAO,MAAM,WAAW,QAAa,OAAO,CAAC,IAAI,CA2GhD,CAAA"}
+{"version":3,"file":"stdio.d.ts","sourceRoot":"","sources":["../src/stdio.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,SAAS,CAAA;AAgB9D;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAU,iBAAiB,eAAe,KAAG,OAAO,CAAC,IAAI,CA4GhF,CAAA"}

package/dist/stdio.js

@@ -12,7 +12,7 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
  *
  * Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,
  * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.
- */ export const runMcpStdio = async ()=>{
+ */ export const runMcpStdio = async (configOverride)=>{
     // MCP clients may start this command from another folder. Move to the Payload
     // project so findConfig() can find the config.
     const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url));
@@ -20,8 +20,9 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js';
         process.chdir(projectRoot);
     }
     const configPath = findConfig();
-    const configModule = await import(pathToFileURL(configPath).toString());
-    const config = await (configModule.default ?? configModule);
+    const configURL = pathToFileURL(configPath).href;
+    const configModule = configOverride ? undefined : await import(configURL);
+    const config = configOverride ?? await (configModule?.default ?? configModule);
     /**
    * stdout is only for MCP messages. The spec says the server must not write
    * logs there and may write them to stderr instead.

package/dist/stdio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { Config, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { serveStdio } from '@modelcontextprotocol/server/stdio'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Starts Payload's MCP server over stdin and stdout.\n *\n * Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,\n * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.\n */\nexport const runMcpStdio = async (): Promise<void> => {\n  // MCP clients may start this command from another folder. Move to the Payload\n  // project so findConfig() can find the config.\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configModule = await import(pathToFileURL(configPath).toString())\n  const config = (await (configModule.default ?? configModule)) as SanitizedConfig\n\n  /**\n   * stdout is only for MCP messages. The spec says the server must not write\n   * logs there and may write them to stderr instead.\n   *\n   * The 2.0 client library recovers from stray stdout logs, but that behavior is not\n   * guaranteed. Move Payload logs to stderr so Payload does not add invalid data\n   * to stdout. Keep options from configurable loggers. Replace pre-built loggers\n   * because their output cannot be redirected.\n   *\n   * @see https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#stdio\n   */\n  const loggerConfig: { logger?: Config['logger'] } = config\n  if (\n    loggerConfig.logger &&\n    typeof loggerConfig.logger === 'object' &&\n    'options' in loggerConfig.logger\n  ) {\n    loggerConfig.logger.destination = process.stderr\n  } else {\n    loggerConfig.logger = { destination: process.stderr, options: {} }\n  }\n\n  const payload = await getPayload({ config, cron: false, disableOnInit: true })\n\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    // The command also works when mcpPlugin() is not in the Payload config.\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fallbackPlugin: Plugin = (config) => config\n    Object.assign(fallbackPlugin, {\n      slug: '@payloadcms/plugin-mcp',\n      sanitizedOptions: pluginConfig,\n    })\n    payload.config.plugins ??= []\n    payload.config.plugins.push(fallbackPlugin)\n  }\n\n  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n  let overrideAccess = false\n\n  if (overrideAccessEnv === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n  }\n\n  if (overrideAccess && process.env.NODE_ENV !== 'development') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n  }\n\n  const headers = new Headers()\n  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n  }\n\n  const req = await createLocalReq({ req: { headers } }, payload)\n  req.payloadAPI = 'MCP' as const\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n  const stdioServer = serveStdio(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n    onerror: (err) => {\n      // MCP messages use stdout, so write SDK errors to stderr.\n      console.error('[payload-mcp] error serving MCP over stdio:', err)\n    },\n  })\n\n  // Close the MCP server and Payload when the client disconnects or the process stops.\n  let isShuttingDown = false\n  const shutdown = async () => {\n    if (isShuttingDown) {\n      return\n    }\n    isShuttingDown = true\n\n    try {\n      await stdioServer.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n\n    process.exit(0)\n  }\n\n  process.once('SIGINT', () => void shutdown())\n  process.once('SIGTERM', () => void shutdown())\n  process.stdin.once('close', () => void shutdown())\n}\n"],"names":["serveStdio","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","projectRoot","url","process","chdir","configPath","configModule","toString","config","default","loggerConfig","logger","destination","stderr","options","payload","cron","disableOnInit","pluginConfig","fallbackPlugin","Object","assign","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","stdioServer","onerror","err","console","error","isShuttingDown","shutdown","close","destroy","exit","once","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,UAAU,QAAQ,qCAAoC;AAC/D,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc;IACzB,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAMC,cAAcF,mBAAmBT,cAAc,YAAYY,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaX;IACnB,MAAMY,eAAe,MAAM,MAAM,CAACf,cAAcc,YAAYE,QAAQ;IACpE,MAAMC,SAAU,MAAOF,CAAAA,aAAaG,OAAO,IAAIH,YAAW;IAE1D;;;;;;;;;;GAUC,GACD,MAAMI,eAA8CF;IACpD,IACEE,aAAaC,MAAM,IACnB,OAAOD,aAAaC,MAAM,KAAK,YAC/B,aAAaD,aAAaC,MAAM,EAChC;QACAD,aAAaC,MAAM,CAACC,WAAW,GAAGT,QAAQU,MAAM;IAClD,OAAO;QACLH,aAAaC,MAAM,GAAG;YAAEC,aAAaT,QAAQU,MAAM;YAAEC,SAAS,CAAC;QAAE;IACnE;IAEA,MAAMC,UAAU,MAAMtB,WAAW;QAAEe;QAAQQ,MAAM;QAAOC,eAAe;IAAK;IAE5E,IAAIC;IACJ,IAAI;QACFA,eAAepB,gBAAgB;YAAEU,QAAQO,QAAQP,MAAM;QAAC;IAC1D,EAAE,OAAM;QACN,wEAAwE;QACxEU,eAAerB,kBAAkB;YAAEW,QAAQO,QAAQP,MAAM;YAAEU,cAAc,CAAC;QAAE;QAE5E,MAAMC,iBAAyB,CAACX,SAAWA;QAC3CY,OAAOC,MAAM,CAACF,gBAAgB;YAC5BG,MAAM;YACNC,kBAAkBL;QACpB;QACAH,QAAQP,MAAM,CAACgB,OAAO,KAAK,EAAE;QAC7BT,QAAQP,MAAM,CAACgB,OAAO,CAACC,IAAI,CAACN;IAC9B;IAEA,MAAMO,oBAAoBvB,QAAQwB,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkB1B,QAAQwB,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAI9B,QAAQwB,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBhC,QAAQwB,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,MAAM5C,eAAe;QAAE4C,KAAK;YAAEJ;QAAQ;IAAE,GAAGjB;IACvDqB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAM3C,iBAAiB;QAAEkC;QAAgBO;IAAI;IAEnE,MAAMG,cAAclD,WAAW,IAAMO,eAAe;YAAE0C;YAAepB;YAAckB;QAAI,IAAI;QACzFI,SAAS,CAACC;YACR,0DAA0D;YAC1DC,QAAQC,KAAK,CAAC,+CAA+CF;QAC/D;IACF;IAEA,qFAAqF;IACrF,IAAIG,iBAAiB;IACrB,MAAMC,WAAW;QACf,IAAID,gBAAgB;YAClB;QACF;QACAA,iBAAiB;QAEjB,IAAI;YACF,MAAML,YAAYO,KAAK;QACzB,EAAE,OAAOL,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QAEA,IAAI;YACF,MAAM1B,QAAQgC,OAAO;QACvB,EAAE,OAAON,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QAEAtC,QAAQ6C,IAAI,CAAC;IACf;IAEA7C,QAAQ8C,IAAI,CAAC,UAAU,IAAM,KAAKJ;IAClC1C,QAAQ8C,IAAI,CAAC,WAAW,IAAM,KAAKJ;IACnC1C,QAAQ+C,KAAK,CAACD,IAAI,CAAC,SAAS,IAAM,KAAKJ;AACzC,EAAC"}
+{"version":3,"sources":["../src/stdio.ts"],"sourcesContent":["import type { Config, Plugin, SanitizedConfig } from 'payload'\n\n/* eslint-disable no-console */\nimport { serveStdio } from '@modelcontextprotocol/server/stdio'\nimport { fileURLToPath, pathToFileURL } from 'node:url'\nimport { createLocalReq, getPayload } from 'payload'\nimport { findConfig } from 'payload/node'\n\nimport type { SanitizedMCPPluginConfig } from './types.js'\n\nimport { getAuthorizedMCP } from './endpoint/access.js'\nimport { buildMcpServer } from './mcp/buildMcpServer.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\nimport { getPluginConfig } from './utils/getPluginConfig.js'\nimport { resolveProjectRoot } from './utils/resolveProjectRoot.js'\n\n/**\n * Starts Payload's MCP server over stdin and stdout.\n *\n * Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,\n * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.\n */\nexport const runMcpStdio = async (configOverride?: SanitizedConfig): Promise<void> => {\n  // MCP clients may start this command from another folder. Move to the Payload\n  // project so findConfig() can find the config.\n  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))\n  if (projectRoot) {\n    process.chdir(projectRoot)\n  }\n\n  const configPath = findConfig()\n  const configURL = pathToFileURL(configPath).href\n  const configModule = configOverride ? undefined : await import(configURL)\n  const config: SanitizedConfig = configOverride ?? (await (configModule?.default ?? configModule))\n\n  /**\n   * stdout is only for MCP messages. The spec says the server must not write\n   * logs there and may write them to stderr instead.\n   *\n   * The 2.0 client library recovers from stray stdout logs, but that behavior is not\n   * guaranteed. Move Payload logs to stderr so Payload does not add invalid data\n   * to stdout. Keep options from configurable loggers. Replace pre-built loggers\n   * because their output cannot be redirected.\n   *\n   * @see https://modelcontextprotocol.io/specification/2025-11-25/basic/transports#stdio\n   */\n  const loggerConfig: { logger?: Config['logger'] } = config\n  if (\n    loggerConfig.logger &&\n    typeof loggerConfig.logger === 'object' &&\n    'options' in loggerConfig.logger\n  ) {\n    loggerConfig.logger.destination = process.stderr\n  } else {\n    loggerConfig.logger = { destination: process.stderr, options: {} }\n  }\n\n  const payload = await getPayload({ config, cron: false, disableOnInit: true })\n\n  let pluginConfig: SanitizedMCPPluginConfig\n  try {\n    pluginConfig = getPluginConfig({ config: payload.config })\n  } catch {\n    // The command also works when mcpPlugin() is not in the Payload config.\n    pluginConfig = sanitizeMCPConfig({ config: payload.config, pluginConfig: {} })\n\n    const fallbackPlugin: Plugin = (config) => config\n    Object.assign(fallbackPlugin, {\n      slug: '@payloadcms/plugin-mcp',\n      sanitizedOptions: pluginConfig,\n    })\n    payload.config.plugins ??= []\n    payload.config.plugins.push(fallbackPlugin)\n  }\n\n  const overrideAccessEnv = process.env.PAYLOAD_MCP_OVERRIDE_ACCESS\n  let overrideAccess = false\n\n  if (overrideAccessEnv === 'true') {\n    overrideAccess = true\n  } else if (overrideAccessEnv && overrideAccessEnv !== 'false') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS must be \"true\" or \"false\".')\n  }\n\n  if (overrideAccess && process.env.NODE_ENV !== 'development') {\n    throw new Error('PAYLOAD_MCP_OVERRIDE_ACCESS is only available in development.')\n  }\n\n  const headers = new Headers()\n  if (process.env.PAYLOAD_MCP_AUTHORIZATION) {\n    headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)\n  }\n\n  const req = await createLocalReq({ req: { headers } }, payload)\n  req.payloadAPI = 'MCP' as const\n  const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })\n\n  const stdioServer = serveStdio(() => buildMcpServer({ authorizedMCP, pluginConfig, req }), {\n    onerror: (err) => {\n      // MCP messages use stdout, so write SDK errors to stderr.\n      console.error('[payload-mcp] error serving MCP over stdio:', err)\n    },\n  })\n\n  // Close the MCP server and Payload when the client disconnects or the process stops.\n  let isShuttingDown = false\n  const shutdown = async () => {\n    if (isShuttingDown) {\n      return\n    }\n    isShuttingDown = true\n\n    try {\n      await stdioServer.close()\n    } catch (err) {\n      console.error('[payload-mcp] error closing server:', err)\n    }\n\n    try {\n      await payload.destroy()\n    } catch (err) {\n      console.error('[payload-mcp] error destroying payload:', err)\n    }\n\n    process.exit(0)\n  }\n\n  process.once('SIGINT', () => void shutdown())\n  process.once('SIGTERM', () => void shutdown())\n  process.stdin.once('close', () => void shutdown())\n}\n"],"names":["serveStdio","fileURLToPath","pathToFileURL","createLocalReq","getPayload","findConfig","getAuthorizedMCP","buildMcpServer","sanitizeMCPConfig","getPluginConfig","resolveProjectRoot","runMcpStdio","configOverride","projectRoot","url","process","chdir","configPath","configURL","href","configModule","undefined","config","default","loggerConfig","logger","destination","stderr","options","payload","cron","disableOnInit","pluginConfig","fallbackPlugin","Object","assign","slug","sanitizedOptions","plugins","push","overrideAccessEnv","env","PAYLOAD_MCP_OVERRIDE_ACCESS","overrideAccess","Error","NODE_ENV","headers","Headers","PAYLOAD_MCP_AUTHORIZATION","set","req","payloadAPI","authorizedMCP","stdioServer","onerror","err","console","error","isShuttingDown","shutdown","close","destroy","exit","once","stdin"],"mappings":"AAEA,6BAA6B,GAC7B,SAASA,UAAU,QAAQ,qCAAoC;AAC/D,SAASC,aAAa,EAAEC,aAAa,QAAQ,WAAU;AACvD,SAASC,cAAc,EAAEC,UAAU,QAAQ,UAAS;AACpD,SAASC,UAAU,QAAQ,eAAc;AAIzC,SAASC,gBAAgB,QAAQ,uBAAsB;AACvD,SAASC,cAAc,QAAQ,0BAAyB;AACxD,SAASC,iBAAiB,QAAQ,6BAA4B;AAC9D,SAASC,eAAe,QAAQ,6BAA4B;AAC5D,SAASC,kBAAkB,QAAQ,gCAA+B;AAElE;;;;;CAKC,GACD,OAAO,MAAMC,cAAc,OAAOC;IAChC,8EAA8E;IAC9E,+CAA+C;IAC/C,MAAMC,cAAcH,mBAAmBT,cAAc,YAAYa,GAAG;IACpE,IAAID,aAAa;QACfE,QAAQC,KAAK,CAACH;IAChB;IAEA,MAAMI,aAAaZ;IACnB,MAAMa,YAAYhB,cAAce,YAAYE,IAAI;IAChD,MAAMC,eAAeR,iBAAiBS,YAAY,MAAM,MAAM,CAACH;IAC/D,MAAMI,SAA0BV,kBAAmB,MAAOQ,CAAAA,cAAcG,WAAWH,YAAW;IAE9F;;;;;;;;;;GAUC,GACD,MAAMI,eAA8CF;IACpD,IACEE,aAAaC,MAAM,IACnB,OAAOD,aAAaC,MAAM,KAAK,YAC/B,aAAaD,aAAaC,MAAM,EAChC;QACAD,aAAaC,MAAM,CAACC,WAAW,GAAGX,QAAQY,MAAM;IAClD,OAAO;QACLH,aAAaC,MAAM,GAAG;YAAEC,aAAaX,QAAQY,MAAM;YAAEC,SAAS,CAAC;QAAE;IACnE;IAEA,MAAMC,UAAU,MAAMzB,WAAW;QAAEkB;QAAQQ,MAAM;QAAOC,eAAe;IAAK;IAE5E,IAAIC;IACJ,IAAI;QACFA,eAAevB,gBAAgB;YAAEa,QAAQO,QAAQP,MAAM;QAAC;IAC1D,EAAE,OAAM;QACN,wEAAwE;QACxEU,eAAexB,kBAAkB;YAAEc,QAAQO,QAAQP,MAAM;YAAEU,cAAc,CAAC;QAAE;QAE5E,MAAMC,iBAAyB,CAACX,SAAWA;QAC3CY,OAAOC,MAAM,CAACF,gBAAgB;YAC5BG,MAAM;YACNC,kBAAkBL;QACpB;QACAH,QAAQP,MAAM,CAACgB,OAAO,KAAK,EAAE;QAC7BT,QAAQP,MAAM,CAACgB,OAAO,CAACC,IAAI,CAACN;IAC9B;IAEA,MAAMO,oBAAoBzB,QAAQ0B,GAAG,CAACC,2BAA2B;IACjE,IAAIC,iBAAiB;IAErB,IAAIH,sBAAsB,QAAQ;QAChCG,iBAAiB;IACnB,OAAO,IAAIH,qBAAqBA,sBAAsB,SAAS;QAC7D,MAAM,IAAII,MAAM;IAClB;IAEA,IAAID,kBAAkB5B,QAAQ0B,GAAG,CAACI,QAAQ,KAAK,eAAe;QAC5D,MAAM,IAAID,MAAM;IAClB;IAEA,MAAME,UAAU,IAAIC;IACpB,IAAIhC,QAAQ0B,GAAG,CAACO,yBAAyB,EAAE;QACzCF,QAAQG,GAAG,CAAC,iBAAiBlC,QAAQ0B,GAAG,CAACO,yBAAyB;IACpE;IAEA,MAAME,MAAM,MAAM/C,eAAe;QAAE+C,KAAK;YAAEJ;QAAQ;IAAE,GAAGjB;IACvDqB,IAAIC,UAAU,GAAG;IACjB,MAAMC,gBAAgB,MAAM9C,iBAAiB;QAAEqC;QAAgBO;IAAI;IAEnE,MAAMG,cAAcrD,WAAW,IAAMO,eAAe;YAAE6C;YAAepB;YAAckB;QAAI,IAAI;QACzFI,SAAS,CAACC;YACR,0DAA0D;YAC1DC,QAAQC,KAAK,CAAC,+CAA+CF;QAC/D;IACF;IAEA,qFAAqF;IACrF,IAAIG,iBAAiB;IACrB,MAAMC,WAAW;QACf,IAAID,gBAAgB;YAClB;QACF;QACAA,iBAAiB;QAEjB,IAAI;YACF,MAAML,YAAYO,KAAK;QACzB,EAAE,OAAOL,KAAK;YACZC,QAAQC,KAAK,CAAC,uCAAuCF;QACvD;QAEA,IAAI;YACF,MAAM1B,QAAQgC,OAAO;QACvB,EAAE,OAAON,KAAK;YACZC,QAAQC,KAAK,CAAC,2CAA2CF;QAC3D;QAEAxC,QAAQ+C,IAAI,CAAC;IACf;IAEA/C,QAAQgD,IAAI,CAAC,UAAU,IAAM,KAAKJ;IAClC5C,QAAQgD,IAAI,CAAC,WAAW,IAAM,KAAKJ;IACnC5C,QAAQiD,KAAK,CAACD,IAAI,CAAC,SAAS,IAAM,KAAKJ;AACzC,EAAC"}

package/dist/utils/camelCase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,QAAS,MAAM,KAAG,MAIzC,CAAA"}
+{"version":3,"file":"camelCase.d.ts","sourceRoot":"","sources":["../../src/utils/camelCase.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,MAIzC,CAAA"}

package/dist/utils/resolveProjectRoot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAc,MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}
+{"version":3,"file":"resolveProjectRoot.d.ts","sourceRoot":"","sources":["../../src/utils/resolveProjectRoot.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,UAAU,MAAM,KAAG,IAAI,GAAG,MAS5D,CAAA"}

package/dist/utils/schemaConversion/filterFieldsByAccess.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filterFieldsByAccess.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,4BAA4B,EAE7B,MAAM,SAAS,CAAA;AAEhB,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAClD,KAAK,sBAAsB,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,yDAK9B;IACD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,WAAW,EAAE,4BAA4B,CAAA;IACzC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,OAAO,CAAA;CAC3E,KAAG,cAAc,EAoFjB,CAAA"}
+{"version":3,"file":"filterFieldsByAccess.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/filterFieldsByAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,cAAc,EACd,SAAS,EACT,4BAA4B,EAE7B,MAAM,SAAS,CAAA;AAEhB,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AAClD,KAAK,sBAAsB,GAAG,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;AAE7D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,oBAAoB,GAAI,sDAKlC;IACD,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,WAAW,EAAE,4BAA4B,CAAA;IACzC,kBAAkB,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,KAAK,OAAO,CAAA;CAC3E,KAAG,cAAc,EAoFjB,CAAA"}

package/dist/utils/schemaConversion/getEntityInputSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,0CAIlC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,sCAI9B;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}
+{"version":3,"file":"getEntityInputSchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/getEntityInputSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,cAAc,EAGnB,KAAK,UAAU,EACf,KAAK,cAAc,EAEnB,KAAK,6BAA6B,EAElC,KAAK,yBAAyB,EAC/B,MAAM,SAAS,CAAA;AAEhB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAKpD,eAAO,MAAM,wBAAwB,GAAI,uCAItC;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,WAAW,CAAC,EAAE,6BAA6B,CAAA;IAC3C,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA;AAED,eAAO,MAAM,oBAAoB,GAAI,mCAIlC;IACD,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,CAAC,EAAE,yBAAyB,CAAA;IACvC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,cAAc,GAAG,IAmBpB,CAAA"}

package/dist/utils/schemaConversion/sanitizeEntitySchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,WAAY,cAAc,KAAG,cA0B7D,CAAA"}
+{"version":3,"file":"sanitizeEntitySchema.d.ts","sourceRoot":"","sources":["../../../src/utils/schemaConversion/sanitizeEntitySchema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAEpD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ,cAAc,KAAG,cA0B7D,CAAA"}

package/dist/utils/toStandardSchema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,WAAY,eAAe,KAAG,sBAG/B,CAAA"}
+{"version":3,"file":"toStandardSchema.d.ts","sourceRoot":"","sources":["../../src/utils/toStandardSchema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAE1F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,gIAAgI;AAChI,eAAO,MAAM,gBAAgB,GAAI,QAAQ,eAAe,KAAG,sBAG/B,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payloadcms/plugin-mcp",
-  "version": "4.0.0-internal.cea8867",
+  "version": "4.0.0-internal.d927017",
   "description": "MCP (Model Context Protocol) capabilities with Payload",
   "keywords": [
     "plugin",
@@ -28,6 +28,11 @@
       "types": "./dist/index.d.ts",
       "default": "./dist/index.js"
     },
+    "./bin": {
+      "import": "./dist/bin/index.js",
+      "types": "./dist/bin/index.d.ts",
+      "default": "./dist/bin/index.js"
+    },
     "./client": {
       "import": "./dist/exports/client.js",
       "types": "./dist/exports/client.d.ts",
@@ -60,15 +65,23 @@
     "zod": "^4.2.0"
   },
   "devDependencies": {
+    "vite": "~8.1.4",
     "@payloadcms/eslint-config": "3.28.0",
-    "payload": "4.0.0-internal.cea8867"
+    "payload": "4.0.0-internal.d927017"
   },
   "peerDependencies": {
-    "payload": "4.0.0-internal.cea8867"
+    "vite": "~8.1.4",
+    "payload": "4.0.0-internal.d927017"
+  },
+  "peerDependenciesMeta": {
+    "vite": {
+      "optional": true
+    }
   },
   "//deps_notes": {
     "zod": "zod is a hard dependency of @modelcontextprotocol/server, thus we can safely use it without it impacting bundle size. Make extra sure the zod version here matches exactly what's defined in the dependencies of @modelcontextprotocol/server to avoid duplicate versions being installed.",
-    "tsx": "Required by the `bin.js` stdio mcp. Keep the version pinned to whatever `payload` ships to avoid duplicate installs."
+    "tsx": "Required by the `bin.js` stdio mcp. Keep the version pinned to whatever `payload` ships to avoid duplicate installs.",
+    "vite": "Vite is an optional peer used by stdio development HMR and duplicated in devDependencies for this package's build and tests. Keep the Vite minor pinned while its server module runner API is experimental."
   },
   "homepage:": "https://payloadcms.com",
   "scripts": {

package/src/bin/index.ts

@@ -0,0 +1,16 @@
+import { runMcpStdio } from '../stdio.js'
+
+export const bin = async (): Promise<void> => {
+  let viteHMR
+  if (
+    process.env.NODE_ENV !== 'production' &&
+    process.env.NODE_ENV !== 'test' &&
+    process.env.DISABLE_PAYLOAD_HMR !== 'true'
+  ) {
+    const { initializeViteHMR } = await import('./initializeViteHMR.js')
+    viteHMR = await initializeViteHMR()
+  }
+
+  await runMcpStdio(viteHMR?.config)
+  await viteHMR?.connect()
+}

package/src/bin/initializeViteHMR.ts

@@ -0,0 +1,60 @@
+import type { SanitizedConfig } from 'payload'
+
+/* eslint-disable no-console */
+import { fileURLToPath } from 'node:url'
+import { getPayload, reload } from 'payload'
+import { findConfig } from 'payload/node'
+import { createServer, createServerModuleRunner, normalizePath } from 'vite'
+
+import type * as ConfigBoundary from './viteConfigBoundary.js'
+
+import { resolveProjectRoot } from '../utils/resolveProjectRoot.js'
+
+type ViteHMR = {
+  config: SanitizedConfig
+  connect: () => Promise<void>
+}
+
+export const initializeViteHMR = async (): Promise<ViteHMR> => {
+  const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))
+  if (projectRoot) {
+    process.chdir(projectRoot)
+  }
+
+  const vite = await createServer({
+    clearScreen: false,
+    configFile: false,
+    envDir: false,
+    logLevel: 'error',
+    optimizeDeps: { noDiscovery: true },
+    publicDir: false,
+    resolve: { alias: { 'payload-mcp:config': normalizePath(findConfig()) }, tsconfigPaths: true },
+    server: { middlewareMode: true, ws: false },
+    ssr: { noExternal: [/^@payloadcms\//, /^payload$/] },
+  })
+  const runner = createServerModuleRunner(vite.environments.ssr)
+  const boundaryPath = fileURLToPath(new URL('./viteConfigBoundary.js', import.meta.url))
+  const boundary = await runner.import<typeof ConfigBoundary>(boundaryPath)
+  const config = boundary.getConfig()
+
+  return {
+    config,
+    connect: async () => {
+      const payload = await getPayload({ config, cron: false, disableOnInit: true })
+      let payloadReloadQueue = Promise.resolve()
+      const reloadPayload = (nextConfig: SanitizedConfig): Promise<void> => {
+        payloadReloadQueue = payloadReloadQueue
+          .then(() => reload(nextConfig, payload, false))
+          .catch((error) => console.error('[payload-mcp] config reload failed:', error))
+        return payloadReloadQueue
+      }
+
+      boundary.subscribe(reloadPayload)
+
+      const latestConfig = boundary.getConfig()
+      if (config !== latestConfig) {
+        await reloadPayload(latestConfig)
+      }
+    },
+  }
+}

package/src/bin/viteConfigBoundary.ts

@@ -0,0 +1,39 @@
+/// <reference types="vite/client" />
+
+import type { SanitizedConfig } from 'payload'
+
+/* eslint-disable no-console */
+// @ts-expect-error - The Vite initializer resolves this ID to the Payload config.
+import * as configModule from 'payload-mcp:config'
+
+type ConfigListener = (config: SanitizedConfig) => Promise<void> | void
+
+let listener: ConfigListener | undefined
+let configQueue = Promise.resolve()
+
+const resolveConfig = async (module: unknown): Promise<SanitizedConfig> => {
+  const config = module as { default?: unknown }
+
+  return (await (config.default ?? module)) as SanitizedConfig
+}
+
+let config = await resolveConfig(configModule)
+
+export const getConfig = (): SanitizedConfig => config
+
+export const subscribe = (nextListener: ConfigListener): void => {
+  listener = nextListener
+}
+
+import.meta.hot?.accept('payload-mcp:config', (nextModule) => {
+  if (!nextModule) {
+    return
+  }
+
+  configQueue = configQueue
+    .then(async () => {
+      config = await resolveConfig(nextModule)
+      await listener?.(config)
+    })
+    .catch((error) => console.error('[payload-mcp] config reload failed:', error))
+})

package/src/mcp/builtin/collections/createTool.ts

@@ -11,7 +11,6 @@ import {
 } from '../../../utils/getVirtualFieldNames.js'
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { validateCollectionData } from '../validateEntityData.js'
-import { fileInputSchema, resolveFileInput } from './fileInput.js'
 import { formatCollectionError } from './formatCollectionError.js'
 
 const DEFAULT_DESCRIPTION =
@@ -53,7 +52,6 @@ export const createDocumentTool = defineCollectionTool({
       .string()
       .describe('Optional: fallback locale code to use when requested locale is not available')
       .optional(),
-    file: fileInputSchema.optional(),
     locale: z
       .string()
       .describe(
@@ -71,7 +69,7 @@ export const createDocumentTool = defineCollectionTool({
   const payload = req.payload
   const logger = getLogger({ payload })
 
-  const { data, depth, draft, fallbackLocale, file: fileInput, locale, select } = input
+  const { data, depth, draft, fallbackLocale, locale, select } = input
 
   logger.info(
     `Creating document in collection: ${collectionSlug}${locale ? ` with locale: ${locale}` : ''}`,
@@ -87,7 +85,6 @@ export const createDocumentTool = defineCollectionTool({
     }
 
     const parsedData = transformPointDataToPayload(inputData)
-    const file = await resolveFileInput({ collectionSlug, input: fileInput, req })
 
     const result = await payload.create({
       collection: collectionSlug,
@@ -96,7 +93,6 @@ export const createDocumentTool = defineCollectionTool({
       draft,
       overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...(file ? { file } : {}),
       ...(locale ? { locale } : {}),
       ...(fallbackLocale ? { fallbackLocale } : {}),
       ...(select ? { select: select as SelectType } : {}),

package/src/mcp/builtin/collections/getCollectionSchemaTool.ts

@@ -48,29 +48,16 @@ export const getCollectionSchemaTool = defineCollectionTool({
     }
   }
 
-  const uploadConfig = req.payload.collections[collectionSlug]?.config.upload
-  const maxFileSize = req.payload.config.upload.limits?.fileSize
-  const upload = uploadConfig
-    ? {
-        enabled: true,
-        filesRequiredOnCreate: uploadConfig.filesRequiredOnCreate !== false,
-        mimeTypes: uploadConfig.mimeTypes ?? ['*/*'],
-        sources: [...(uploadConfig.pasteURL !== false ? ['url'] : []), 'base64'],
-        ...(typeof maxFileSize === 'number' && Number.isFinite(maxFileSize) ? { maxFileSize } : {}),
-      }
-    : { enabled: false }
-
   return {
     content: [
       {
         type: 'text',
-        text: `Schema for collection "${collectionSlug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\`\nUpload configuration:\n\`\`\`json\n${JSON.stringify(upload)}\n\`\`\``,
+        text: `Schema for collection "${collectionSlug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
       },
     ],
     structuredContent: {
       collectionSlug,
       schema: inputSchema,
-      upload,
     },
   }
 })

package/src/mcp/builtin/collections/updateTool.ts

@@ -13,7 +13,6 @@ import { getCollectionInputSchema } from '../../../utils/schemaConversion/getEnt
 import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
 import { whereSchema } from '../../../utils/whereSchema.js'
 import { validateCollectionData } from '../validateEntityData.js'
-import { fileInputSchema, resolveFileInput } from './fileInput.js'
 import { formatCollectionError } from './formatCollectionError.js'
 
 const DEFAULT_DESCRIPTION =
@@ -53,7 +52,7 @@ export const updateDocumentTool = defineCollectionTool({
       .string()
       .describe('Optional: fallback locale code to use when requested locale is not available')
       .optional(),
-    file: fileInputSchema.optional(),
+    filePath: z.string().describe('File path for file uploads').optional(),
     locale: z
       .string()
       .describe(
@@ -98,7 +97,7 @@ export const updateDocumentTool = defineCollectionTool({
     depth,
     draft,
     fallbackLocale,
-    file: fileInput,
+    filePath,
     locale,
     overrideLock,
     overwriteExistingFiles,
@@ -132,7 +131,6 @@ export const updateDocumentTool = defineCollectionTool({
     }
 
     const parsedData = transformPointDataToPayload(inputData)
-    const file = await resolveFileInput({ collectionSlug, input: fileInput, req })
 
     const whereClause: Where = where ?? {}
 
@@ -146,7 +144,7 @@ export const updateDocumentTool = defineCollectionTool({
         overrideAccess: authorizedMCP.overrideAccess,
         overrideLock,
         req,
-        ...(file ? { file } : {}),
+        ...(filePath ? { filePath } : {}),
         ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
         ...(publishAllLocales !== undefined ? { publishAllLocales } : {}),
         ...(locale ? { locale } : {}),
@@ -174,7 +172,7 @@ export const updateDocumentTool = defineCollectionTool({
       overrideLock,
       req,
       where: whereClause,
-      ...(file ? { file } : {}),
+      ...(filePath ? { filePath } : {}),
       ...(overwriteExistingFiles ? { overwriteExistingFiles } : {}),
       ...(publishAllLocales !== undefined ? { publishAllLocales } : {}),
       ...(locale ? { locale } : {}),

package/src/stdio.ts

@@ -20,7 +20,7 @@ import { resolveProjectRoot } from './utils/resolveProjectRoot.js'
  * Set `PAYLOAD_MCP_AUTHORIZATION` to authenticate. In development,
  * `PAYLOAD_MCP_OVERRIDE_ACCESS=true` skips access checks.
  */
-export const runMcpStdio = async (): Promise<void> => {
+export const runMcpStdio = async (configOverride?: SanitizedConfig): Promise<void> => {
   // MCP clients may start this command from another folder. Move to the Payload
   // project so findConfig() can find the config.
   const projectRoot = resolveProjectRoot(fileURLToPath(import.meta.url))
@@ -29,8 +29,9 @@ export const runMcpStdio = async (): Promise<void> => {
   }
 
   const configPath = findConfig()
-  const configModule = await import(pathToFileURL(configPath).toString())
-  const config = (await (configModule.default ?? configModule)) as SanitizedConfig
+  const configURL = pathToFileURL(configPath).href
+  const configModule = configOverride ? undefined : await import(configURL)
+  const config: SanitizedConfig = configOverride ?? (await (configModule?.default ?? configModule))
 
   /**
    * stdout is only for MCP messages. The spec says the server must not write

package/dist/mcp/builtin/collections/fileInput.d.ts

@@ -1,20 +0,0 @@
-import type { CollectionSlug, File, PayloadRequest } from 'payload';
-import { z } from 'zod';
-export declare const fileInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    name: z.ZodString;
-    data: z.ZodString;
-    mimeType: z.ZodString;
-    source: z.ZodLiteral<"base64">;
-}, z.core.$strip>, z.ZodObject<{
-    name: z.ZodOptional<z.ZodString>;
-    source: z.ZodLiteral<"url">;
-    url: z.ZodURL;
-}, z.core.$strip>], "source">;
-type FileInput = z.infer<typeof fileInputSchema>;
-export declare function resolveFileInput({ collectionSlug, input, req, }: {
-    collectionSlug: CollectionSlug;
-    input?: FileInput;
-    req: PayloadRequest;
-}): Promise<File | undefined>;
-export {};
-//# sourceMappingURL=fileInput.d.ts.map

package/dist/mcp/builtin/collections/fileInput.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fileInput.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/fileInput.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,IAAI,EAAY,cAAc,EAAE,MAAM,SAAS,CAAA;AAK7E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,eAAO,MAAM,eAAe;;;;;;;;;6BAgBzB,CAAA;AAEH,KAAK,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEhD,wBAAsB,gBAAgB,CAAC,EACrC,cAAc,EACd,KAAK,EACL,GAAG,GACJ,EAAE;IACD,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,GAAG,EAAE,cAAc,CAAA;CACpB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAgE5B"}

package/dist/mcp/builtin/collections/fileInput.js

@@ -1,100 +0,0 @@
-import { APIError } from 'payload';
-import { getExternalFile, isURLAllowed } from 'payload/internal';
-import { sanitizeFilename } from 'payload/shared';
-import { z } from 'zod';
-const mimeTypeSchema = z.string().regex(/^[!#$%&'*+.^`|~\w-]+\/[!#$%&'*+.^`|~\w-]+$/, 'MIME type must use the type/subtype format');
-export const fileInputSchema = z.discriminatedUnion('source', [
-    z.object({
-        name: z.string().min(1).describe('The file name, including its extension'),
-        data: z.string().describe('The base64-encoded file bytes, without a data URL prefix'),
-        mimeType: mimeTypeSchema.describe('The file MIME type, for example image/png'),
-        source: z.literal('base64')
-    }),
-    z.object({
-        name: z.string().min(1).describe('Optional file name override').optional(),
-        source: z.literal('url'),
-        url: z.url().describe('The http or https URL to download')
-    })
-]).describe('A file for an upload collection. Use only a source listed by getCollectionSchema: url for an online file or base64 for a local file.');
-export async function resolveFileInput({ collectionSlug, input, req }) {
-    if (!input) {
-        return undefined;
-    }
-    const uploadConfig = req.payload.collections[collectionSlug]?.config.upload;
-    if (!uploadConfig) {
-        throw new APIError(`Collection "${collectionSlug}" does not support file uploads.`, 400);
-    }
-    const maxFileSize = req.payload.config.upload.limits?.fileSize;
-    let file;
-    if (input.source === 'base64') {
-        const data = decodeBase64({
-            maxFileSize,
-            value: input.data
-        });
-        file = {
-            name: sanitizeFilename(input.name),
-            data,
-            mimetype: input.mimeType,
-            size: data.length
-        };
-    } else {
-        if (uploadConfig.pasteURL === false) {
-            throw new APIError(`Uploading files from URLs is disabled for collection "${collectionSlug}".`, 400);
-        }
-        const url = new URL(input.url);
-        if (![
-            'http:',
-            'https:'
-        ].includes(url.protocol)) {
-            throw new APIError('File URLs must use http or https.', 400);
-        }
-        if (typeof uploadConfig.pasteURL === 'object' && !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)) {
-            throw new APIError('The provided file URL is not allowed.', 400);
-        }
-        file = await getExternalFile({
-            data: {
-                filename: sanitizeFilename(input.name || getURLFilename(url)),
-                url: input.url
-            },
-            req,
-            uploadConfig: {
-                ...uploadConfig,
-                externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (()=>({}))
-            }
-        });
-        file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream';
-        file.size = file.data.length;
-    }
-    if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {
-        throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400);
-    }
-    return file;
-}
-function decodeBase64({ maxFileSize, value }) {
-    const normalized = value.replace(/\s/g, '');
-    if (!/^[a-z0-9+/]*={0,2}$/i.test(normalized) || normalized.length % 4 === 1) {
-        throw new APIError('File data must be valid base64.', 400);
-    }
-    if (maxFileSize !== undefined && Number.isFinite(maxFileSize)) {
-        const paddingLength = normalized.endsWith('==') ? 2 : normalized.endsWith('=') ? 1 : 0;
-        const decodedSize = Math.floor(normalized.length * 3 / 4) - paddingLength;
-        if (decodedSize > maxFileSize) {
-            throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400);
-        }
-    }
-    const data = Buffer.from(normalized, 'base64');
-    if (data.toString('base64').replace(/=+$/, '') !== normalized.replace(/=+$/, '')) {
-        throw new APIError('File data must be valid base64.', 400);
-    }
-    return data;
-}
-function getURLFilename(url) {
-    const pathSegment = url.pathname.split('/').pop() || 'upload';
-    try {
-        return decodeURIComponent(pathSegment);
-    } catch  {
-        return pathSegment;
-    }
-}
-
-//# sourceMappingURL=fileInput.js.map

package/dist/mcp/builtin/collections/fileInput.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.ts"],"sourcesContent":["import type { CollectionSlug, File, FileData, PayloadRequest } from 'payload'\n\nimport { APIError } from 'payload'\nimport { getExternalFile, isURLAllowed } from 'payload/internal'\nimport { sanitizeFilename } from 'payload/shared'\nimport { z } from 'zod'\n\nconst mimeTypeSchema = z\n  .string()\n  .regex(/^[!#$%&'*+.^`|~\\w-]+\\/[!#$%&'*+.^`|~\\w-]+$/, 'MIME type must use the type/subtype format')\n\nexport const fileInputSchema = z\n  .discriminatedUnion('source', [\n    z.object({\n      name: z.string().min(1).describe('The file name, including its extension'),\n      data: z.string().describe('The base64-encoded file bytes, without a data URL prefix'),\n      mimeType: mimeTypeSchema.describe('The file MIME type, for example image/png'),\n      source: z.literal('base64'),\n    }),\n    z.object({\n      name: z.string().min(1).describe('Optional file name override').optional(),\n      source: z.literal('url'),\n      url: z.url().describe('The http or https URL to download'),\n    }),\n  ])\n  .describe(\n    'A file for an upload collection. Use only a source listed by getCollectionSchema: url for an online file or base64 for a local file.',\n  )\n\ntype FileInput = z.infer<typeof fileInputSchema>\n\nexport async function resolveFileInput({\n  collectionSlug,\n  input,\n  req,\n}: {\n  collectionSlug: CollectionSlug\n  input?: FileInput\n  req: PayloadRequest\n}): Promise<File | undefined> {\n  if (!input) {\n    return undefined\n  }\n\n  const uploadConfig = req.payload.collections[collectionSlug]?.config.upload\n\n  if (!uploadConfig) {\n    throw new APIError(`Collection \"${collectionSlug}\" does not support file uploads.`, 400)\n  }\n\n  const maxFileSize = req.payload.config.upload.limits?.fileSize\n  let file: File\n\n  if (input.source === 'base64') {\n    const data = decodeBase64({ maxFileSize, value: input.data })\n\n    file = {\n      name: sanitizeFilename(input.name),\n      data,\n      mimetype: input.mimeType,\n      size: data.length,\n    }\n  } else {\n    if (uploadConfig.pasteURL === false) {\n      throw new APIError(\n        `Uploading files from URLs is disabled for collection \"${collectionSlug}\".`,\n        400,\n      )\n    }\n\n    const url = new URL(input.url)\n\n    if (!['http:', 'https:'].includes(url.protocol)) {\n      throw new APIError('File URLs must use http or https.', 400)\n    }\n\n    if (\n      typeof uploadConfig.pasteURL === 'object' &&\n      !isURLAllowed(input.url, uploadConfig.pasteURL.allowList)\n    ) {\n      throw new APIError('The provided file URL is not allowed.', 400)\n    }\n\n    file = await getExternalFile({\n      data: {\n        filename: sanitizeFilename(input.name || getURLFilename(url)),\n        url: input.url,\n      } as FileData,\n      req,\n      uploadConfig: {\n        ...uploadConfig,\n        externalFileHeaderFilter: uploadConfig.externalFileHeaderFilter ?? (() => ({})),\n      },\n    })\n    file.mimetype = file.mimetype?.split(';')[0] || 'application/octet-stream'\n    file.size = file.data.length\n  }\n\n  if (maxFileSize !== undefined && Number.isFinite(maxFileSize) && file.size > maxFileSize) {\n    throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400)\n  }\n\n  return file\n}\n\nfunction decodeBase64({ maxFileSize, value }: { maxFileSize?: number; value: string }): Buffer {\n  const normalized = value.replace(/\\s/g, '')\n\n  if (!/^[a-z0-9+/]*={0,2}$/i.test(normalized) || normalized.length % 4 === 1) {\n    throw new APIError('File data must be valid base64.', 400)\n  }\n\n  if (maxFileSize !== undefined && Number.isFinite(maxFileSize)) {\n    const paddingLength = normalized.endsWith('==') ? 2 : normalized.endsWith('=') ? 1 : 0\n    const decodedSize = Math.floor((normalized.length * 3) / 4) - paddingLength\n\n    if (decodedSize > maxFileSize) {\n      throw new APIError(`File exceeds the ${maxFileSize} byte upload limit.`, 400)\n    }\n  }\n\n  const data = Buffer.from(normalized, 'base64')\n\n  if (data.toString('base64').replace(/=+$/, '') !== normalized.replace(/=+$/, '')) {\n    throw new APIError('File data must be valid base64.', 400)\n  }\n\n  return data\n}\n\nfunction getURLFilename(url: URL): string {\n  const pathSegment = url.pathname.split('/').pop() || 'upload'\n\n  try {\n    return decodeURIComponent(pathSegment)\n  } catch {\n    return pathSegment\n  }\n}\n"],"names":["APIError","getExternalFile","isURLAllowed","sanitizeFilename","z","mimeTypeSchema","string","regex","fileInputSchema","discriminatedUnion","object","name","min","describe","data","mimeType","source","literal","optional","url","resolveFileInput","collectionSlug","input","req","undefined","uploadConfig","payload","collections","config","upload","maxFileSize","limits","fileSize","file","decodeBase64","value","mimetype","size","length","pasteURL","URL","includes","protocol","allowList","filename","getURLFilename","externalFileHeaderFilter","split","Number","isFinite","normalized","replace","test","paddingLength","endsWith","decodedSize","Math","floor","Buffer","from","toString","pathSegment","pathname","pop","decodeURIComponent"],"mappings":"AAEA,SAASA,QAAQ,QAAQ,UAAS;AAClC,SAASC,eAAe,EAAEC,YAAY,QAAQ,mBAAkB;AAChE,SAASC,gBAAgB,QAAQ,iBAAgB;AACjD,SAASC,CAAC,QAAQ,MAAK;AAEvB,MAAMC,iBAAiBD,EACpBE,MAAM,GACNC,KAAK,CAAC,8CAA8C;AAEvD,OAAO,MAAMC,kBAAkBJ,EAC5BK,kBAAkB,CAAC,UAAU;IAC5BL,EAAEM,MAAM,CAAC;QACPC,MAAMP,EAAEE,MAAM,GAAGM,GAAG,CAAC,GAAGC,QAAQ,CAAC;QACjCC,MAAMV,EAAEE,MAAM,GAAGO,QAAQ,CAAC;QAC1BE,UAAUV,eAAeQ,QAAQ,CAAC;QAClCG,QAAQZ,EAAEa,OAAO,CAAC;IACpB;IACAb,EAAEM,MAAM,CAAC;QACPC,MAAMP,EAAEE,MAAM,GAAGM,GAAG,CAAC,GAAGC,QAAQ,CAAC,+BAA+BK,QAAQ;QACxEF,QAAQZ,EAAEa,OAAO,CAAC;QAClBE,KAAKf,EAAEe,GAAG,GAAGN,QAAQ,CAAC;IACxB;CACD,EACAA,QAAQ,CACP,wIACD;AAIH,OAAO,eAAeO,iBAAiB,EACrCC,cAAc,EACdC,KAAK,EACLC,GAAG,EAKJ;IACC,IAAI,CAACD,OAAO;QACV,OAAOE;IACT;IAEA,MAAMC,eAAeF,IAAIG,OAAO,CAACC,WAAW,CAACN,eAAe,EAAEO,OAAOC;IAErE,IAAI,CAACJ,cAAc;QACjB,MAAM,IAAIzB,SAAS,CAAC,YAAY,EAAEqB,eAAe,gCAAgC,CAAC,EAAE;IACtF;IAEA,MAAMS,cAAcP,IAAIG,OAAO,CAACE,MAAM,CAACC,MAAM,CAACE,MAAM,EAAEC;IACtD,IAAIC;IAEJ,IAAIX,MAAMN,MAAM,KAAK,UAAU;QAC7B,MAAMF,OAAOoB,aAAa;YAAEJ;YAAaK,OAAOb,MAAMR,IAAI;QAAC;QAE3DmB,OAAO;YACLtB,MAAMR,iBAAiBmB,MAAMX,IAAI;YACjCG;YACAsB,UAAUd,MAAMP,QAAQ;YACxBsB,MAAMvB,KAAKwB,MAAM;QACnB;IACF,OAAO;QACL,IAAIb,aAAac,QAAQ,KAAK,OAAO;YACnC,MAAM,IAAIvC,SACR,CAAC,sDAAsD,EAAEqB,eAAe,EAAE,CAAC,EAC3E;QAEJ;QAEA,MAAMF,MAAM,IAAIqB,IAAIlB,MAAMH,GAAG;QAE7B,IAAI,CAAC;YAAC;YAAS;SAAS,CAACsB,QAAQ,CAACtB,IAAIuB,QAAQ,GAAG;YAC/C,MAAM,IAAI1C,SAAS,qCAAqC;QAC1D;QAEA,IACE,OAAOyB,aAAac,QAAQ,KAAK,YACjC,CAACrC,aAAaoB,MAAMH,GAAG,EAAEM,aAAac,QAAQ,CAACI,SAAS,GACxD;YACA,MAAM,IAAI3C,SAAS,yCAAyC;QAC9D;QAEAiC,OAAO,MAAMhC,gBAAgB;YAC3Ba,MAAM;gBACJ8B,UAAUzC,iBAAiBmB,MAAMX,IAAI,IAAIkC,eAAe1B;gBACxDA,KAAKG,MAAMH,GAAG;YAChB;YACAI;YACAE,cAAc;gBACZ,GAAGA,YAAY;gBACfqB,0BAA0BrB,aAAaqB,wBAAwB,IAAK,CAAA,IAAO,CAAA,CAAC,CAAA,CAAC;YAC/E;QACF;QACAb,KAAKG,QAAQ,GAAGH,KAAKG,QAAQ,EAAEW,MAAM,IAAI,CAAC,EAAE,IAAI;QAChDd,KAAKI,IAAI,GAAGJ,KAAKnB,IAAI,CAACwB,MAAM;IAC9B;IAEA,IAAIR,gBAAgBN,aAAawB,OAAOC,QAAQ,CAACnB,gBAAgBG,KAAKI,IAAI,GAAGP,aAAa;QACxF,MAAM,IAAI9B,SAAS,CAAC,iBAAiB,EAAE8B,YAAY,mBAAmB,CAAC,EAAE;IAC3E;IAEA,OAAOG;AACT;AAEA,SAASC,aAAa,EAAEJ,WAAW,EAAEK,KAAK,EAA2C;IACnF,MAAMe,aAAaf,MAAMgB,OAAO,CAAC,OAAO;IAExC,IAAI,CAAC,uBAAuBC,IAAI,CAACF,eAAeA,WAAWZ,MAAM,GAAG,MAAM,GAAG;QAC3E,MAAM,IAAItC,SAAS,mCAAmC;IACxD;IAEA,IAAI8B,gBAAgBN,aAAawB,OAAOC,QAAQ,CAACnB,cAAc;QAC7D,MAAMuB,gBAAgBH,WAAWI,QAAQ,CAAC,QAAQ,IAAIJ,WAAWI,QAAQ,CAAC,OAAO,IAAI;QACrF,MAAMC,cAAcC,KAAKC,KAAK,CAAC,AAACP,WAAWZ,MAAM,GAAG,IAAK,KAAKe;QAE9D,IAAIE,cAAczB,aAAa;YAC7B,MAAM,IAAI9B,SAAS,CAAC,iBAAiB,EAAE8B,YAAY,mBAAmB,CAAC,EAAE;QAC3E;IACF;IAEA,MAAMhB,OAAO4C,OAAOC,IAAI,CAACT,YAAY;IAErC,IAAIpC,KAAK8C,QAAQ,CAAC,UAAUT,OAAO,CAAC,OAAO,QAAQD,WAAWC,OAAO,CAAC,OAAO,KAAK;QAChF,MAAM,IAAInD,SAAS,mCAAmC;IACxD;IAEA,OAAOc;AACT;AAEA,SAAS+B,eAAe1B,GAAQ;IAC9B,MAAM0C,cAAc1C,IAAI2C,QAAQ,CAACf,KAAK,CAAC,KAAKgB,GAAG,MAAM;IAErD,IAAI;QACF,OAAOC,mBAAmBH;IAC5B,EAAE,OAAM;QACN,OAAOA;IACT;AACF"}

package/dist/mcp/builtin/collections/fileInput.spec.js

@@ -1,72 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { fileInputSchema, resolveFileInput } from './fileInput.js';
-describe('MCP file input', ()=>{
-    it('should reject malformed MIME types', ()=>{
-        const result = fileInputSchema.safeParse({
-            data: 'aGVsbG8=',
-            mimeType: 'text/plain\r\nx-test: value',
-            name: 'hello.txt',
-            source: 'base64'
-        });
-        expect(result.success).toBe(false);
-    });
-    it('should reject oversized base64 files', async ()=>{
-        const req = createRequest({
-            maxFileSize: 4
-        });
-        await expect(resolveFileInput({
-            collectionSlug: 'media',
-            input: {
-                data: Buffer.from('hello').toString('base64'),
-                mimeType: 'text/plain',
-                name: 'hello.txt',
-                source: 'base64'
-            },
-            req
-        })).rejects.toThrow('File exceeds the 4 byte upload limit.');
-    });
-    it('should reject URLs outside the collection allowlist', async ()=>{
-        const req = createRequest({
-            allowList: [
-                {
-                    hostname: 'assets.example.com',
-                    protocol: 'https'
-                }
-            ]
-        });
-        await expect(resolveFileInput({
-            collectionSlug: 'media',
-            input: {
-                source: 'url',
-                url: 'https://example.com/image.png'
-            },
-            req
-        })).rejects.toThrow('The provided file URL is not allowed.');
-    });
-});
-function createRequest({ allowList, maxFileSize }) {
-    return {
-        payload: {
-            collections: {
-                media: {
-                    config: {
-                        upload: allowList ? {
-                            pasteURL: {
-                                allowList
-                            }
-                        } : {}
-                    }
-                }
-            },
-            config: {
-                upload: {
-                    limits: {
-                        fileSize: maxFileSize
-                    }
-                }
-            }
-        }
-    };
-}
-
-//# sourceMappingURL=fileInput.spec.js.map