@payloadcms/plugin-mcp 4.0.0-internal.d28e9fb → 4.0.0-internal.d3909a9

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { definePlugin } from 'payload'\n\nimport type { MCPAccessSettings, MCPPluginConfig } from './types.js'\n\nimport { createAPIKeysCollection } from './collections/createApiKeysCollection.js'\nimport { initializeMCPHandler } from './endpoints/mcp.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequest {\n    payloadAPI: 'GraphQL' | 'local' | 'MCP' | 'REST'\n  }\n  interface RegisteredPlugins {\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nimport { defaults } from './defaults.js'\n\nexport type { MCPAccessSettings, MCPPluginConfig }\n\n/**\n * The MCP Plugin for Payload. This plugin allows you to add MCP capabilities to your Payload project.\n *\n * @param pluginOptions - The options for the MCP plugin.\n */\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, plugins: _plugins, ...pluginOptions }) => {\n    if (!config.collections) {\n      config.collections = []\n    }\n\n    // Collections\n    const collections = pluginOptions.collections || {}\n    // Globals\n    const globals = pluginOptions.globals || {}\n    // Extract custom tools for the global config\n    const customTools =\n      pluginOptions.mcp?.tools?.map((tool) => ({\n        name: tool.name,\n        description: tool.description,\n      })) || []\n\n    // User Collection\n    pluginOptions.userCollection =\n      pluginOptions.userCollection ?? config?.admin?.user ?? defaults.userCollection\n\n    const experimentalTools = pluginOptions?.experimental?.tools || {}\n\n    /**\n     * API Keys\n     * --------\n     * High resolution control over MCP capabilities is crucial when using Payload with LLMs.\n     *\n     * This API Keys collection has ways for admins to create API keys and allow or disallow the MCP capabilities.\n     * This is useful when Admins want to allow or disallow the use of the MCP capabilities in real time.\n     * For example:\n     *  - If a collection has all of its capabilities enabled, admins can allow or disallow the create, update, delete, and find capabilities on that collection.\n     *  - If a collection only has the find capability enabled, admins can only allow or disallow the find capability on that collection.\n     *  - If a global has all of its capabilities enabled, admins can allow or disallow the find and update capabilities on that global.\n     *  - If a custom tool has gone haywire, admins can disallow that tool.\n     *\n     */\n    const apiKeyCollection = createAPIKeysCollection(\n      collections,\n      globals,\n      customTools,\n      experimentalTools,\n      pluginOptions,\n    )\n    if (pluginOptions.overrideApiKeyCollection) {\n      config.collections.push(pluginOptions.overrideApiKeyCollection(apiKeyCollection))\n    } else {\n      config.collections.push(apiKeyCollection)\n    }\n\n    /**\n     * If the plugin is disabled, we still want to keep added collections/fields so the database schema is consistent which is important for migrations.\n     * If your plugin heavily modifies the database schema, you may want to remove this property.\n     */\n    if (pluginOptions.disabled) {\n      return config\n    }\n\n    if (!config.endpoints) {\n      config.endpoints = []\n    }\n\n    /**\n     * This is the primary MCP Server Endpoint.\n     * Payload will automatically add the /api prefix to the path, so the full path is `/api/mcp`\n     * NOTE: This is only transport method until we add full support for SSE which will be another endpoint at `/api/sse`\n     */\n    config.endpoints.push({\n      handler: initializeMCPHandler(pluginOptions),\n      method: 'post',\n      path: '/mcp',\n    })\n\n    /**\n     * The GET response is always: {\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32000,\"message\":\"Method not allowed.\"},\"id\":null} -- even with an API key\n     * This is expected behavior and MCP clients should always use the POST endpoint.\n     */\n    config.endpoints.push({\n      handler: initializeMCPHandler(pluginOptions),\n      method: 'get',\n      path: '/mcp',\n    })\n\n    return config\n  },\n})\n"],"names":["definePlugin","createAPIKeysCollection","initializeMCPHandler","defaults","mcpPlugin","slug","order","plugin","config","plugins","_plugins","pluginOptions","collections","globals","customTools","mcp","tools","map","tool","name","description","userCollection","admin","user","experimentalTools","experimental","apiKeyCollection","overrideApiKeyCollection","push","disabled","endpoints","handler","method","path"],"mappings":"AAAA,SAASA,YAAY,QAAQ,UAAS;AAItC,SAASC,uBAAuB,QAAQ,2CAA0C;AAClF,SAASC,oBAAoB,QAAQ,qBAAoB;AAWzD,SAASC,QAAQ,QAAQ,gBAAe;AAIxC;;;;CAIC,GACD,OAAO,MAAMC,YAAYJ,aAA8B;IACrDK,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,SAASC,QAAQ,EAAE,GAAGC,eAAe;QACtD,IAAI,CAACH,OAAOI,WAAW,EAAE;YACvBJ,OAAOI,WAAW,GAAG,EAAE;QACzB;QAEA,cAAc;QACd,MAAMA,cAAcD,cAAcC,WAAW,IAAI,CAAC;QAClD,UAAU;QACV,MAAMC,UAAUF,cAAcE,OAAO,IAAI,CAAC;QAC1C,6CAA6C;QAC7C,MAAMC,cACJH,cAAcI,GAAG,EAAEC,OAAOC,IAAI,CAACC,OAAU,CAAA;gBACvCC,MAAMD,KAAKC,IAAI;gBACfC,aAAaF,KAAKE,WAAW;YAC/B,CAAA,MAAO,EAAE;QAEX,kBAAkB;QAClBT,cAAcU,cAAc,GAC1BV,cAAcU,cAAc,IAAIb,QAAQc,OAAOC,QAAQpB,SAASkB,cAAc;QAEhF,MAAMG,oBAAoBb,eAAec,cAAcT,SAAS,CAAC;QAEjE;;;;;;;;;;;;;KAaC,GACD,MAAMU,mBAAmBzB,wBACvBW,aACAC,SACAC,aACAU,mBACAb;QAEF,IAAIA,cAAcgB,wBAAwB,EAAE;YAC1CnB,OAAOI,WAAW,CAACgB,IAAI,CAACjB,cAAcgB,wBAAwB,CAACD;QACjE,OAAO;YACLlB,OAAOI,WAAW,CAACgB,IAAI,CAACF;QAC1B;QAEA;;;KAGC,GACD,IAAIf,cAAckB,QAAQ,EAAE;YAC1B,OAAOrB;QACT;QAEA,IAAI,CAACA,OAAOsB,SAAS,EAAE;YACrBtB,OAAOsB,SAAS,GAAG,EAAE;QACvB;QAEA;;;;KAIC,GACDtB,OAAOsB,SAAS,CAACF,IAAI,CAAC;YACpBG,SAAS7B,qBAAqBS;YAC9BqB,QAAQ;YACRC,MAAM;QACR;QAEA;;;KAGC,GACDzB,OAAOsB,SAAS,CAACF,IAAI,CAAC;YACpBG,SAAS7B,qBAAqBS;YAC9BqB,QAAQ;YACRC,MAAM;QACR;QAEA,OAAOzB;IACT;AACF,GAAE"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import { definePlugin } from 'payload'\n\nimport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig } from './types.js'\n\nimport { mcpEndpoint } from './endpoint/index.js'\nimport { sanitizeMCPConfig } from './mcp/sanitizeMCPConfig.js'\n\ndeclare module 'payload' {\n  export interface PayloadRequestAPI {\n    MCP: true\n  }\n  interface RegisteredPlugins {\n    /** After the plugin's `plugin` callback runs, `options` holds the sanitized config. */\n    '@payloadcms/plugin-mcp': MCPPluginConfig\n  }\n}\n\nexport type { AuthorizedMCP, MCPPluginConfig, SanitizedMCPPluginConfig }\n\nexport { defineCollectionTool, defineGlobalTool, definePrompt, defineTool } from './defineTool.js'\n\nexport const mcpPlugin = definePlugin<MCPPluginConfig>({\n  slug: '@payloadcms/plugin-mcp',\n  order: 10,\n  plugin: ({ config, options, plugins }) => {\n    const pluginConfig = sanitizeMCPConfig({ config, pluginConfig: options })\n\n    // Stash the sanitized config on plugin options so `getPluginConfig()` reads it.\n    const registered = plugins['@payloadcms/plugin-mcp']\n    if (registered) {\n      // @ts-expect-error\n      registered.sanitizedOptions = pluginConfig\n    }\n\n    if (pluginConfig.disabled) {\n      return config\n    }\n\n    return {\n      ...config,\n      endpoints: [\n        ...(config.endpoints ?? []),\n        // Payload prefixes /api, so the full path is /api/mcp.\n        { handler: mcpEndpoint, method: 'post', path: '/mcp' },\n        // Streamable HTTP's optional server=>client GET stream. We don't offer\n        // one, so answer 405 per spec-— clients then skip it cleanly\n        {\n          handler: () => new Response(null, { headers: { Allow: 'POST' }, status: 405 }),\n          method: 'get',\n          path: '/mcp',\n        },\n      ],\n    }\n  },\n})\n"],"names":["definePlugin","mcpEndpoint","sanitizeMCPConfig","defineCollectionTool","defineGlobalTool","definePrompt","defineTool","mcpPlugin","slug","order","plugin","config","options","plugins","pluginConfig","registered","sanitizedOptions","disabled","endpoints","handler","method","path","Response","headers","Allow","status"],"mappings":"AAAA,SAASA,YAAY,QAAQ,UAAS;AAItC,SAASC,WAAW,QAAQ,sBAAqB;AACjD,SAASC,iBAAiB,QAAQ,6BAA4B;AAc9D,SAASC,oBAAoB,EAAEC,gBAAgB,EAAEC,YAAY,EAAEC,UAAU,QAAQ,kBAAiB;AAElG,OAAO,MAAMC,YAAYP,aAA8B;IACrDQ,MAAM;IACNC,OAAO;IACPC,QAAQ,CAAC,EAAEC,MAAM,EAAEC,OAAO,EAAEC,OAAO,EAAE;QACnC,MAAMC,eAAeZ,kBAAkB;YAAES;YAAQG,cAAcF;QAAQ;QAEvE,gFAAgF;QAChF,MAAMG,aAAaF,OAAO,CAAC,yBAAyB;QACpD,IAAIE,YAAY;YACd,mBAAmB;YACnBA,WAAWC,gBAAgB,GAAGF;QAChC;QAEA,IAAIA,aAAaG,QAAQ,EAAE;YACzB,OAAON;QACT;QAEA,OAAO;YACL,GAAGA,MAAM;YACTO,WAAW;mBACLP,OAAOO,SAAS,IAAI,EAAE;gBAC1B,uDAAuD;gBACvD;oBAAEC,SAASlB;oBAAamB,QAAQ;oBAAQC,MAAM;gBAAO;gBACrD,uEAAuE;gBACvE,6DAA6D;gBAC7D;oBACEF,SAAS,IAAM,IAAIG,SAAS,MAAM;4BAAEC,SAAS;gCAAEC,OAAO;4BAAO;4BAAGC,QAAQ;wBAAI;oBAC5EL,QAAQ;oBACRC,MAAM;gBACR;aACD;QACH;IACF;AACF,GAAE"}

package/dist/mcp/buildMcpServer.d.ts

@@ -0,0 +1,19 @@
+import type { PayloadRequest } from 'payload';
+import { McpServer } from '@modelcontextprotocol/server';
+import type { AuthorizedMCP, SanitizedMCPPluginConfig } from '../types.js';
+/**
+ * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
+ * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh
+ * instances from this builder while they own the transport and protocol-era
+ * decision.
+ *
+ * `req` is the request context handlers see. For HTTP it's the live
+ * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
+ * synthesized one built via `createPayloadRequest`.
+ */
+export declare const buildMcpServer: ({ authorizedMCP, pluginConfig, req, }: {
+    authorizedMCP: AuthorizedMCP;
+    pluginConfig: SanitizedMCPPluginConfig;
+    req: PayloadRequest;
+}) => McpServer;
+//# sourceMappingURL=buildMcpServer.d.ts.map

package/dist/mcp/buildMcpServer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"buildMcpServer.d.ts","sourceRoot":"","sources":["../../src/mcp/buildMcpServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7C,OAAO,EAAE,SAAS,EAAsB,MAAM,8BAA8B,CAAA;AAG5E,OAAO,KAAK,EACV,aAAa,EAMb,wBAAwB,EAEzB,MAAM,aAAa,CAAA;AAKpB;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,0CAIxB;IACD,aAAa,EAAE,aAAa,CAAA;IAC5B,YAAY,EAAE,wBAAwB,CAAA;IACtC,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,SAgNH,CAAA"}

package/dist/mcp/buildMcpServer.js

@@ -0,0 +1,235 @@
+import { McpServer } from '@modelcontextprotocol/server';
+import { APIError, strictObject, z } from 'payload';
+import { getLogger } from '../utils/getLogger.js';
+import { toStandardSchema } from '../utils/toStandardSchema.js';
+/**
+ * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh
+ * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh
+ * instances from this builder while they own the transport and protocol-era
+ * decision.
+ *
+ * `req` is the request context handlers see. For HTTP it's the live
+ * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a
+ * synthesized one built via `createPayloadRequest`.
+ */ export const buildMcpServer = ({ authorizedMCP, pluginConfig, req })=>{
+    z.config(z.locales.en());
+    const serverOptions = pluginConfig.mcp?.serverOptions || {};
+    const server = new McpServer({
+        name: 'Payload MCP Server',
+        version: '1.0.0',
+        ...serverOptions.serverInfo
+    }, serverOptions.options);
+    const logger = getLogger({
+        payload: req.payload
+    });
+    /**
+   * Wrap a tool handler's response with the tool's `overrideResponse`, then
+   * strip the internal `doc` field so it doesn't leak onto the wire.
+   */ const finalizeToolResponse = async ({ input, overrideResponse, response, toolName })=>{
+        let overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response;
+        for (const hook of pluginConfig.hooks?.afterToolCall ?? []){
+            overridden = await hook({
+                input,
+                req,
+                response: overridden,
+                toolName
+            });
+        }
+        const { doc: _doc, ...rest } = overridden;
+        return rest;
+    };
+    /**
+   * Runs a collection/global tool call:
+   * - reads `slug` from the input
+   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug
+   * - runs the tool handler and finalizes its response
+   */ const callEntityTool = async ({ input, item, serverContext })=>{
+        const entity = item.type === 'collectionTool' ? 'collection' : 'global';
+        const toolInput = input ?? {};
+        const slug = toolInput.slug;
+        if (!slug) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Error: "${item.mcpName}" requires slug. Use getConfigInfo to inspect ${entity} slugs.`
+                    }
+                ],
+                isError: true
+            };
+        }
+        const match = authorizedMCP.items.find((candidate)=>candidate.type === item.type && candidate.mcpName === item.mcpName && (candidate.type === 'collectionTool' ? candidate.collectionSlug === slug : candidate.type === 'globalTool' && candidate.globalSlug === slug));
+        if (!match) {
+            return {
+                content: [
+                    {
+                        type: 'text',
+                        text: `Error: MCP access to "${item.mcpName}" is not enabled for ${entity} "${slug}"`
+                    }
+                ],
+                isError: true
+            };
+        }
+        const handlerArgs = {
+            authorizedMCP,
+            input: toolInput,
+            req,
+            serverContext
+        };
+        const response = await (match.type === 'collectionTool' ? match.tool.handler({
+            ...handlerArgs,
+            slug
+        }) : match.tool.handler({
+            ...handlerArgs,
+            slug
+        }));
+        return finalizeToolResponse({
+            input: toolInput,
+            overrideResponse: match.tool.overrideResponse,
+            response,
+            toolName: match.mcpName
+        });
+    };
+    try {
+        const registeredEntityTools = new Set();
+        for (const item of authorizedMCP.items){
+            switch(item.type){
+                case 'collectionTool':
+                case 'globalTool':
+                    {
+                        if (registeredEntityTools.has(item.mcpName)) {
+                            break;
+                        }
+                        registeredEntityTools.add(item.mcpName);
+                        const inputSchema = withSlugInput({
+                            input: item.tool.input
+                        });
+                        server.registerTool(item.mcpName, {
+                            annotations: item.tool.annotations,
+                            description: item.tool.description,
+                            inputSchema: toStandardSchema(inputSchema)
+                        }, async (input, ctx)=>callEntityTool({
+                                input,
+                                item,
+                                serverContext: ctx
+                            }));
+                        logger.info(`✅ Tool: ${item.mcpName} Registered.`);
+                        break;
+                    }
+                case 'prompt':
+                    {
+                        const prompt = item.prompt;
+                        server.registerPrompt(item.mcpName, {
+                            argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,
+                            description: prompt.description,
+                            title: prompt.title
+                        }, async (input, ctx)=>prompt.handler({
+                                input: input ?? {},
+                                req,
+                                serverContext: ctx
+                            }));
+                        logger.info(`✅ Prompt: ${prompt.title} Registered.`);
+                        break;
+                    }
+                case 'resource':
+                    {
+                        const resource = item.resource;
+                        server.registerResource(item.mcpName, // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)
+                        resource.uri, {
+                            description: resource.description,
+                            mimeType: resource.mimeType,
+                            title: resource.title
+                        }, // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).
+                        // The rest-params shape lets us collect either signature uniformly.
+                        async (...sdkArgs)=>{
+                            const ctx = sdkArgs[sdkArgs.length - 1];
+                            const uri = sdkArgs[0];
+                            const params = sdkArgs.length > 2 ? sdkArgs[1] : {};
+                            return resource.handler({
+                                params,
+                                req,
+                                serverContext: ctx,
+                                uri
+                            });
+                        });
+                        logger.info(`✅ Resource: ${resource.title} Registered.`);
+                        break;
+                    }
+                case 'tool':
+                    {
+                        const tool = item.tool;
+                        server.registerTool(item.mcpName, {
+                            annotations: tool.annotations,
+                            description: tool.description,
+                            inputSchema: tool.input ? toStandardSchema(tool.input) : undefined
+                        }, async (input, ctx)=>{
+                            const toolInput = input ?? {};
+                            const response = await tool.handler({
+                                authorizedMCP,
+                                input: toolInput,
+                                req,
+                                serverContext: ctx
+                            });
+                            return finalizeToolResponse({
+                                input: toolInput,
+                                overrideResponse: tool.overrideResponse,
+                                response,
+                                toolName: item.mcpName
+                            });
+                        });
+                        logger.info(`✅ Tool: ${item.mcpName} Registered.`);
+                        break;
+                    }
+            }
+        }
+    } catch (error) {
+        throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500);
+    }
+    return server;
+};
+const withSlugInput = ({ input })=>{
+    const description = 'The target slug.';
+    const slugSchema = z.string().check(z.describe(description));
+    if (!input) {
+        return strictObject({
+            slug: slugSchema
+        });
+    }
+    if (typeof input === 'object' && input !== null && '~standard' in input) {
+        const schema = input['~standard'].jsonSchema.input({
+            target: 'draft-2020-12'
+        });
+        const properties = schema.properties;
+        if (properties?.slug) {
+            return input;
+        }
+        return addSlugToJSONSchema({
+            description,
+            schema
+        });
+    }
+    return addSlugToJSONSchema({
+        description,
+        schema: input
+    });
+};
+const addSlugToJSONSchema = ({ description, schema })=>{
+    const objectSchema = schema;
+    return {
+        ...objectSchema,
+        type: 'object',
+        properties: {
+            ...objectSchema.properties,
+            slug: {
+                type: 'string',
+                description
+            }
+        },
+        required: Array.from(new Set([
+            'slug',
+            ...objectSchema.required ?? []
+        ]))
+    };
+};
+
+//# sourceMappingURL=buildMcpServer.js.map

package/dist/mcp/buildMcpServer.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/mcp/buildMcpServer.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { McpServer, type ServerContext } from '@modelcontextprotocol/server'\nimport { APIError, strictObject, z } from 'payload'\n\nimport type {\n  AuthorizedMCP,\n  CollectionMCPItem,\n  GlobalMCPItem,\n  JsonSchemaType,\n  MCPResponseOverride,\n  MCPToolResponse,\n  SanitizedMCPPluginConfig,\n  ToolInputSchema,\n} from '../types.js'\n\nimport { getLogger } from '../utils/getLogger.js'\nimport { toStandardSchema } from '../utils/toStandardSchema.js'\n\n/**\n * Serving-entry-agnostic core: registers every authorized MCP item onto a fresh\n * `McpServer` and returns it. The HTTP and stdio entry point callers provide fresh\n * instances from this builder while they own the transport and protocol-era\n * decision.\n *\n * `req` is the request context handlers see. For HTTP it's the live\n * `PayloadRequest` derived from the incoming HTTP request; for stdio it's a\n * synthesized one built via `createPayloadRequest`.\n */\nexport const buildMcpServer = ({\n  authorizedMCP,\n  pluginConfig,\n  req,\n}: {\n  authorizedMCP: AuthorizedMCP\n  pluginConfig: SanitizedMCPPluginConfig\n  req: PayloadRequest\n}): McpServer => {\n  z.config(z.locales.en())\n\n  const serverOptions = pluginConfig.mcp?.serverOptions || {}\n  const server = new McpServer(\n    { name: 'Payload MCP Server', version: '1.0.0', ...serverOptions.serverInfo },\n    serverOptions.options,\n  )\n\n  const logger = getLogger({ payload: req.payload })\n\n  /**\n   * Wrap a tool handler's response with the tool's `overrideResponse`, then\n   * strip the internal `doc` field so it doesn't leak onto the wire.\n   */\n  const finalizeToolResponse = async ({\n    input,\n    overrideResponse,\n    response,\n    toolName,\n  }: {\n    input: unknown\n    overrideResponse?: MCPResponseOverride\n    response: MCPToolResponse\n    toolName: string\n  }): Promise<MCPToolResponse> => {\n    let overridden = overrideResponse?.(response, response.doc ?? {}, req) ?? response\n    for (const hook of pluginConfig.hooks?.afterToolCall ?? []) {\n      overridden = await hook({ input, req, response: overridden, toolName })\n    }\n    const { doc: _doc, ...rest } = overridden\n    return rest\n  }\n\n  /**\n   * Runs a collection/global tool call:\n   * - reads `slug` from the input\n   * - runs access control: errors if `authorizedMCP.items` has no entry for this tool + slug\n   * - runs the tool handler and finalizes its response\n   */\n  const callEntityTool = async ({\n    input,\n    item,\n    serverContext,\n  }: {\n    input: unknown\n    item: CollectionMCPItem | GlobalMCPItem\n    serverContext: ServerContext\n  }): Promise<MCPToolResponse> => {\n    const entity = item.type === 'collectionTool' ? 'collection' : 'global'\n    const toolInput = (input ?? {}) as Record<string, unknown>\n    const slug = toolInput.slug as string | undefined\n\n    if (!slug) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: \"${item.mcpName}\" requires slug. Use getConfigInfo to inspect ${entity} slugs.`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const match = authorizedMCP.items.find(\n      (candidate): candidate is CollectionMCPItem | GlobalMCPItem =>\n        candidate.type === item.type &&\n        candidate.mcpName === item.mcpName &&\n        (candidate.type === 'collectionTool'\n          ? candidate.collectionSlug === slug\n          : candidate.type === 'globalTool' && candidate.globalSlug === slug),\n    )\n\n    if (!match) {\n      return {\n        content: [\n          {\n            type: 'text',\n            text: `Error: MCP access to \"${item.mcpName}\" is not enabled for ${entity} \"${slug}\"`,\n          },\n        ],\n        isError: true,\n      }\n    }\n\n    const handlerArgs = {\n      authorizedMCP,\n      input: toolInput,\n      req,\n      serverContext,\n    }\n    const response = await (match.type === 'collectionTool'\n      ? match.tool.handler({ ...handlerArgs, slug })\n      : match.tool.handler({ ...handlerArgs, slug }))\n\n    return finalizeToolResponse({\n      input: toolInput,\n      overrideResponse: match.tool.overrideResponse,\n      response,\n      toolName: match.mcpName,\n    })\n  }\n\n  try {\n    const registeredEntityTools = new Set<string>()\n\n    for (const item of authorizedMCP.items) {\n      switch (item.type) {\n        case 'collectionTool':\n        case 'globalTool': {\n          if (registeredEntityTools.has(item.mcpName)) {\n            break\n          }\n          registeredEntityTools.add(item.mcpName)\n\n          const inputSchema = withSlugInput({ input: item.tool.input })\n\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: item.tool.annotations,\n              description: item.tool.description,\n              inputSchema: toStandardSchema(inputSchema),\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              callEntityTool({ input, item, serverContext: ctx }),\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n        case 'prompt': {\n          const prompt = item.prompt\n          server.registerPrompt(\n            item.mcpName,\n            {\n              argsSchema: prompt.argsSchema ? toStandardSchema(prompt.argsSchema) : undefined,\n              description: prompt.description,\n              title: prompt.title,\n            },\n            async (input: unknown, ctx: ServerContext) =>\n              prompt.handler({\n                input: (input ?? {}) as Record<string, unknown>,\n                req,\n                serverContext: ctx,\n              }),\n          )\n          logger.info(`✅ Prompt: ${prompt.title} Registered.`)\n          break\n        }\n        case 'resource': {\n          const resource = item.resource\n          server.registerResource(\n            item.mcpName,\n            // @ts-expect-error - Overload type ambiguity (string OR ResourceTemplate is valid)\n            resource.uri,\n            {\n              description: resource.description,\n              mimeType: resource.mimeType,\n              title: resource.title,\n            },\n            // Static URIs call (uri, ctx); ResourceTemplates call (uri, params, ctx).\n            // The rest-params shape lets us collect either signature uniformly.\n            async (...sdkArgs: unknown[]) => {\n              const ctx = sdkArgs[sdkArgs.length - 1] as ServerContext\n              const uri = sdkArgs[0] as URL\n              const params = (sdkArgs.length > 2 ? sdkArgs[1] : {}) as Record<string, string>\n              return resource.handler({ params, req, serverContext: ctx, uri })\n            },\n          )\n          logger.info(`✅ Resource: ${resource.title} Registered.`)\n          break\n        }\n        case 'tool': {\n          const tool = item.tool\n          server.registerTool(\n            item.mcpName,\n            {\n              annotations: tool.annotations,\n              description: tool.description,\n              inputSchema: tool.input ? toStandardSchema(tool.input) : undefined,\n            },\n            async (input: unknown, ctx: ServerContext) => {\n              const toolInput = (input ?? {}) as Record<string, unknown>\n              const response = await tool.handler({\n                authorizedMCP,\n                input: toolInput,\n                req,\n                serverContext: ctx,\n              })\n              return finalizeToolResponse({\n                input: toolInput,\n                overrideResponse: tool.overrideResponse,\n                response,\n                toolName: item.mcpName,\n              })\n            },\n          )\n          logger.info(`✅ Tool: ${item.mcpName} Registered.`)\n          break\n        }\n      }\n    }\n  } catch (error) {\n    throw new APIError(`Error initializing MCP handler: ${String(error)}`, 500)\n  }\n\n  return server\n}\n\nconst withSlugInput = ({ input }: { input?: ToolInputSchema }): ToolInputSchema => {\n  const description = 'The target slug.'\n  const slugSchema = z.string().check(z.describe(description))\n\n  if (!input) {\n    return strictObject({ slug: slugSchema })\n  }\n\n  if (typeof input === 'object' && input !== null && '~standard' in input) {\n    const schema = input['~standard'].jsonSchema.input({ target: 'draft-2020-12' })\n    const properties = schema.properties as Record<string, unknown> | undefined\n\n    if (properties?.slug) {\n      return input\n    }\n\n    return addSlugToJSONSchema({ description, schema })\n  }\n\n  return addSlugToJSONSchema({ description, schema: input })\n}\n\nconst addSlugToJSONSchema = ({\n  description,\n  schema,\n}: {\n  description: string\n  schema: JsonSchemaType\n}): JsonSchemaType => {\n  const objectSchema = schema as {\n    properties?: Record<string, JsonSchemaType>\n    required?: string[]\n  } & JsonSchemaType\n\n  return {\n    ...objectSchema,\n    type: 'object',\n    properties: {\n      ...objectSchema.properties,\n      slug: {\n        type: 'string',\n        description,\n      },\n    },\n    required: Array.from(new Set(['slug', ...(objectSchema.required ?? [])])),\n  }\n}\n"],"names":["McpServer","APIError","strictObject","z","getLogger","toStandardSchema","buildMcpServer","authorizedMCP","pluginConfig","req","config","locales","en","serverOptions","mcp","server","name","version","serverInfo","options","logger","payload","finalizeToolResponse","input","overrideResponse","response","toolName","overridden","doc","hook","hooks","afterToolCall","_doc","rest","callEntityTool","item","serverContext","entity","type","toolInput","slug","content","text","mcpName","isError","match","items","find","candidate","collectionSlug","globalSlug","handlerArgs","tool","handler","registeredEntityTools","Set","has","add","inputSchema","withSlugInput","registerTool","annotations","description","ctx","info","prompt","registerPrompt","argsSchema","undefined","title","resource","registerResource","uri","mimeType","sdkArgs","length","params","error","String","slugSchema","string","check","describe","schema","jsonSchema","target","properties","addSlugToJSONSchema","objectSchema","required","Array","from"],"mappings":"AAEA,SAASA,SAAS,QAA4B,+BAA8B;AAC5E,SAASC,QAAQ,EAAEC,YAAY,EAAEC,CAAC,QAAQ,UAAS;AAanD,SAASC,SAAS,QAAQ,wBAAuB;AACjD,SAASC,gBAAgB,QAAQ,+BAA8B;AAE/D;;;;;;;;;CASC,GACD,OAAO,MAAMC,iBAAiB,CAAC,EAC7BC,aAAa,EACbC,YAAY,EACZC,GAAG,EAKJ;IACCN,EAAEO,MAAM,CAACP,EAAEQ,OAAO,CAACC,EAAE;IAErB,MAAMC,gBAAgBL,aAAaM,GAAG,EAAED,iBAAiB,CAAC;IAC1D,MAAME,SAAS,IAAIf,UACjB;QAAEgB,MAAM;QAAsBC,SAAS;QAAS,GAAGJ,cAAcK,UAAU;IAAC,GAC5EL,cAAcM,OAAO;IAGvB,MAAMC,SAAShB,UAAU;QAAEiB,SAASZ,IAAIY,OAAO;IAAC;IAEhD;;;GAGC,GACD,MAAMC,uBAAuB,OAAO,EAClCC,KAAK,EACLC,gBAAgB,EAChBC,QAAQ,EACRC,QAAQ,EAMT;QACC,IAAIC,aAAaH,mBAAmBC,UAAUA,SAASG,GAAG,IAAI,CAAC,GAAGnB,QAAQgB;QAC1E,KAAK,MAAMI,QAAQrB,aAAasB,KAAK,EAAEC,iBAAiB,EAAE,CAAE;YAC1DJ,aAAa,MAAME,KAAK;gBAAEN;gBAAOd;gBAAKgB,UAAUE;gBAAYD;YAAS;QACvE;QACA,MAAM,EAAEE,KAAKI,IAAI,EAAE,GAAGC,MAAM,GAAGN;QAC/B,OAAOM;IACT;IAEA;;;;;GAKC,GACD,MAAMC,iBAAiB,OAAO,EAC5BX,KAAK,EACLY,IAAI,EACJC,aAAa,EAKd;QACC,MAAMC,SAASF,KAAKG,IAAI,KAAK,mBAAmB,eAAe;QAC/D,MAAMC,YAAahB,SAAS,CAAC;QAC7B,MAAMiB,OAAOD,UAAUC,IAAI;QAE3B,IAAI,CAACA,MAAM;YACT,OAAO;gBACLC,SAAS;oBACP;wBACEH,MAAM;wBACNI,MAAM,CAAC,QAAQ,EAAEP,KAAKQ,OAAO,CAAC,8CAA8C,EAAEN,OAAO,OAAO,CAAC;oBAC/F;iBACD;gBACDO,SAAS;YACX;QACF;QAEA,MAAMC,QAAQtC,cAAcuC,KAAK,CAACC,IAAI,CACpC,CAACC,YACCA,UAAUV,IAAI,KAAKH,KAAKG,IAAI,IAC5BU,UAAUL,OAAO,KAAKR,KAAKQ,OAAO,IACjCK,CAAAA,UAAUV,IAAI,KAAK,mBAChBU,UAAUC,cAAc,KAAKT,OAC7BQ,UAAUV,IAAI,KAAK,gBAAgBU,UAAUE,UAAU,KAAKV,IAAG;QAGvE,IAAI,CAACK,OAAO;YACV,OAAO;gBACLJ,SAAS;oBACP;wBACEH,MAAM;wBACNI,MAAM,CAAC,sBAAsB,EAAEP,KAAKQ,OAAO,CAAC,qBAAqB,EAAEN,OAAO,EAAE,EAAEG,KAAK,CAAC,CAAC;oBACvF;iBACD;gBACDI,SAAS;YACX;QACF;QAEA,MAAMO,cAAc;YAClB5C;YACAgB,OAAOgB;YACP9B;YACA2B;QACF;QACA,MAAMX,WAAW,MAAOoB,CAAAA,MAAMP,IAAI,KAAK,mBACnCO,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEX;QAAK,KAC1CK,MAAMO,IAAI,CAACC,OAAO,CAAC;YAAE,GAAGF,WAAW;YAAEX;QAAK,EAAC;QAE/C,OAAOlB,qBAAqB;YAC1BC,OAAOgB;YACPf,kBAAkBqB,MAAMO,IAAI,CAAC5B,gBAAgB;YAC7CC;YACAC,UAAUmB,MAAMF,OAAO;QACzB;IACF;IAEA,IAAI;QACF,MAAMW,wBAAwB,IAAIC;QAElC,KAAK,MAAMpB,QAAQ5B,cAAcuC,KAAK,CAAE;YACtC,OAAQX,KAAKG,IAAI;gBACf,KAAK;gBACL,KAAK;oBAAc;wBACjB,IAAIgB,sBAAsBE,GAAG,CAACrB,KAAKQ,OAAO,GAAG;4BAC3C;wBACF;wBACAW,sBAAsBG,GAAG,CAACtB,KAAKQ,OAAO;wBAEtC,MAAMe,cAAcC,cAAc;4BAAEpC,OAAOY,KAAKiB,IAAI,CAAC7B,KAAK;wBAAC;wBAE3DR,OAAO6C,YAAY,CACjBzB,KAAKQ,OAAO,EACZ;4BACEkB,aAAa1B,KAAKiB,IAAI,CAACS,WAAW;4BAClCC,aAAa3B,KAAKiB,IAAI,CAACU,WAAW;4BAClCJ,aAAarD,iBAAiBqD;wBAChC,GACA,OAAOnC,OAAgBwC,MACrB7B,eAAe;gCAAEX;gCAAOY;gCAAMC,eAAe2B;4BAAI;wBAErD3C,OAAO4C,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKQ,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;gBACA,KAAK;oBAAU;wBACb,MAAMsB,SAAS9B,KAAK8B,MAAM;wBAC1BlD,OAAOmD,cAAc,CACnB/B,KAAKQ,OAAO,EACZ;4BACEwB,YAAYF,OAAOE,UAAU,GAAG9D,iBAAiB4D,OAAOE,UAAU,IAAIC;4BACtEN,aAAaG,OAAOH,WAAW;4BAC/BO,OAAOJ,OAAOI,KAAK;wBACrB,GACA,OAAO9C,OAAgBwC,MACrBE,OAAOZ,OAAO,CAAC;gCACb9B,OAAQA,SAAS,CAAC;gCAClBd;gCACA2B,eAAe2B;4BACjB;wBAEJ3C,OAAO4C,IAAI,CAAC,CAAC,UAAU,EAAEC,OAAOI,KAAK,CAAC,YAAY,CAAC;wBACnD;oBACF;gBACA,KAAK;oBAAY;wBACf,MAAMC,WAAWnC,KAAKmC,QAAQ;wBAC9BvD,OAAOwD,gBAAgB,CACrBpC,KAAKQ,OAAO,EACZ,mFAAmF;wBACnF2B,SAASE,GAAG,EACZ;4BACEV,aAAaQ,SAASR,WAAW;4BACjCW,UAAUH,SAASG,QAAQ;4BAC3BJ,OAAOC,SAASD,KAAK;wBACvB,GACA,0EAA0E;wBAC1E,oEAAoE;wBACpE,OAAO,GAAGK;4BACR,MAAMX,MAAMW,OAAO,CAACA,QAAQC,MAAM,GAAG,EAAE;4BACvC,MAAMH,MAAME,OAAO,CAAC,EAAE;4BACtB,MAAME,SAAUF,QAAQC,MAAM,GAAG,IAAID,OAAO,CAAC,EAAE,GAAG,CAAC;4BACnD,OAAOJ,SAASjB,OAAO,CAAC;gCAAEuB;gCAAQnE;gCAAK2B,eAAe2B;gCAAKS;4BAAI;wBACjE;wBAEFpD,OAAO4C,IAAI,CAAC,CAAC,YAAY,EAAEM,SAASD,KAAK,CAAC,YAAY,CAAC;wBACvD;oBACF;gBACA,KAAK;oBAAQ;wBACX,MAAMjB,OAAOjB,KAAKiB,IAAI;wBACtBrC,OAAO6C,YAAY,CACjBzB,KAAKQ,OAAO,EACZ;4BACEkB,aAAaT,KAAKS,WAAW;4BAC7BC,aAAaV,KAAKU,WAAW;4BAC7BJ,aAAaN,KAAK7B,KAAK,GAAGlB,iBAAiB+C,KAAK7B,KAAK,IAAI6C;wBAC3D,GACA,OAAO7C,OAAgBwC;4BACrB,MAAMxB,YAAahB,SAAS,CAAC;4BAC7B,MAAME,WAAW,MAAM2B,KAAKC,OAAO,CAAC;gCAClC9C;gCACAgB,OAAOgB;gCACP9B;gCACA2B,eAAe2B;4BACjB;4BACA,OAAOzC,qBAAqB;gCAC1BC,OAAOgB;gCACPf,kBAAkB4B,KAAK5B,gBAAgB;gCACvCC;gCACAC,UAAUS,KAAKQ,OAAO;4BACxB;wBACF;wBAEFvB,OAAO4C,IAAI,CAAC,CAAC,QAAQ,EAAE7B,KAAKQ,OAAO,CAAC,YAAY,CAAC;wBACjD;oBACF;YACF;QACF;IACF,EAAE,OAAOkC,OAAO;QACd,MAAM,IAAI5E,SAAS,CAAC,gCAAgC,EAAE6E,OAAOD,QAAQ,EAAE;IACzE;IAEA,OAAO9D;AACT,EAAC;AAED,MAAM4C,gBAAgB,CAAC,EAAEpC,KAAK,EAA+B;IAC3D,MAAMuC,cAAc;IACpB,MAAMiB,aAAa5E,EAAE6E,MAAM,GAAGC,KAAK,CAAC9E,EAAE+E,QAAQ,CAACpB;IAE/C,IAAI,CAACvC,OAAO;QACV,OAAOrB,aAAa;YAAEsC,MAAMuC;QAAW;IACzC;IAEA,IAAI,OAAOxD,UAAU,YAAYA,UAAU,QAAQ,eAAeA,OAAO;QACvE,MAAM4D,SAAS5D,KAAK,CAAC,YAAY,CAAC6D,UAAU,CAAC7D,KAAK,CAAC;YAAE8D,QAAQ;QAAgB;QAC7E,MAAMC,aAAaH,OAAOG,UAAU;QAEpC,IAAIA,YAAY9C,MAAM;YACpB,OAAOjB;QACT;QAEA,OAAOgE,oBAAoB;YAAEzB;YAAaqB;QAAO;IACnD;IAEA,OAAOI,oBAAoB;QAAEzB;QAAaqB,QAAQ5D;IAAM;AAC1D;AAEA,MAAMgE,sBAAsB,CAAC,EAC3BzB,WAAW,EACXqB,MAAM,EAIP;IACC,MAAMK,eAAeL;IAKrB,OAAO;QACL,GAAGK,YAAY;QACflD,MAAM;QACNgD,YAAY;YACV,GAAGE,aAAaF,UAAU;YAC1B9C,MAAM;gBACJF,MAAM;gBACNwB;YACF;QACF;QACA2B,UAAUC,MAAMC,IAAI,CAAC,IAAIpC,IAAI;YAAC;eAAYiC,aAAaC,QAAQ,IAAI,EAAE;SAAE;IACzE;AACF"}

package/dist/mcp/builtin/collections/authTools.d.ts

@@ -0,0 +1,7 @@
+export declare const authCollectionTool: import("../../../types.js").CollectionTool;
+export declare const forgotPasswordCollectionTool: import("../../../types.js").CollectionTool;
+export declare const loginCollectionTool: import("../../../types.js").CollectionTool;
+export declare const resetPasswordCollectionTool: import("../../../types.js").CollectionTool;
+export declare const unlockCollectionTool: import("../../../types.js").CollectionTool;
+export declare const verifyCollectionTool: import("../../../types.js").CollectionTool;
+//# sourceMappingURL=authTools.d.ts.map

package/dist/mcp/builtin/collections/authTools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authTools.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/authTools.ts"],"names":[],"mappings":"AAkCA,eAAO,MAAM,kBAAkB,4CA0D7B,CAAA;AAEF,eAAO,MAAM,4BAA4B,4CAmCvC,CAAA;AAEF,eAAO,MAAM,mBAAmB,4CAuC9B,CAAA;AAEF,eAAO,MAAM,2BAA2B,4CAmCtC,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAmC/B,CAAA;AAEF,eAAO,MAAM,oBAAoB,4CAiC/B,CAAA"}

package/dist/mcp/builtin/collections/authTools.js

@@ -0,0 +1,312 @@
+import { createPayloadRequest, strictObject, z } from 'payload';
+import { defaultAccess } from '../../../defaultAccess.js';
+import { defineCollectionTool } from '../../../defineTool.js';
+import { getLogger } from '../../../utils/getLogger.js';
+/**
+ * Auth tools surfaced under `collections.<auth-collection>.tools`. Opt-in: they
+ * default off (an LLM with `login` access can probe passwords; not something
+ * to expose by default). Enable in plugin config via `tools: { login: true }`
+ * (or `{ description: '...' }`).
+ *
+ * `auth` (check current token) doesn't actually depend on the collection at
+ * runtime — `payload.auth({ headers })` is global — but it's grouped under the
+ * users collection so all auth-shaped tools live in one place.
+ */ const emailSchema = z.email().check(z.describe('The user email address.'));
+const wrapError = (name)=>({ slug, message })=>{
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `❌ **Error in ${name}** on ${slug}: ${message}`
+                }
+            ]
+        };
+    };
+export const authCollectionTool = defineCollectionTool({
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+        readOnlyHint: true,
+        title: 'Check Auth Status'
+    },
+    description: 'Checks authentication status for the current user.',
+    input: strictObject({
+        headers: z.optional(z.record(z.string(), z.string())).check(z.describe('Custom headers to send with the authentication request.'))
+    })
+}).handler(async ({ slug, authorizedMCP, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        let authHeaders = new Headers();
+        if (input.headers) {
+            authHeaders = new Headers(input.headers);
+        }
+        const authReq = await createPayloadRequest({
+            payload: req.payload,
+            req: {
+                headers: authHeaders
+            }
+        });
+        const result = await req.payload.auth({
+            headers: authHeaders,
+            req: authReq
+        });
+        if (result.user) {
+            const authenticatedUser = result.user;
+            // Auth strategies read users with trusted Local API access. Re-read the user with the MCP
+            // caller's access level before returning it to the client.
+            const user = await req.payload.findByID({
+                id: authenticatedUser.id,
+                collection: authenticatedUser.collection,
+                overrideAccess: authorizedMCP.overrideAccess,
+                req: authReq
+            });
+            result.user = {
+                ...user,
+                _sid: authenticatedUser._sid,
+                _strategy: authenticatedUser._strategy,
+                collection: authenticatedUser.collection
+            };
+        }
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `# Authentication Status\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in auth tool on ${slug}: ${errorMessage}`);
+        return wrapError('auth')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+export const forgotPasswordCollectionTool = defineCollectionTool({
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: true,
+        readOnlyHint: false,
+        title: 'Forgot Password'
+    },
+    description: 'Sends a password reset email to a user.',
+    input: strictObject({
+        email: emailSchema
+    })
+}).handler(async ({ slug, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        await req.payload.forgotPassword({
+            collection: slug,
+            data: {
+                email: input.email
+            },
+            disableEmail: false,
+            overrideAccess: false,
+            req
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: 'If an account matches that email, password reset instructions have been sent.'
+                }
+            ]
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in forgotPassword tool on ${slug}: ${errorMessage}`);
+        return wrapError('forgotPassword')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+export const loginCollectionTool = defineCollectionTool({
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        readOnlyHint: false,
+        title: 'User Login'
+    },
+    description: 'Authenticates a user with email and password.',
+    input: strictObject({
+        depth: z._default(z.int().check(z.minimum(0), z.maximum(10)), 0).check(z.describe('Depth of population for relationships.')),
+        email: emailSchema,
+        password: z.string().check(z.describe('The user password.'))
+    })
+}).handler(async ({ slug, authorizedMCP, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        const result = await req.payload.login({
+            collection: slug,
+            data: {
+                email: input.email,
+                password: input.password
+            },
+            depth: input.depth,
+            overrideAccess: authorizedMCP.overrideAccess
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `# Login Successful\n\n**User:** ${input.email}\n**Collection:** ${slug}\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in login tool on ${slug}: ${errorMessage}`);
+        return wrapError('login')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+export const resetPasswordCollectionTool = defineCollectionTool({
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        readOnlyHint: false,
+        title: 'Reset Password'
+    },
+    description: 'Resets a user password with a reset token.',
+    input: strictObject({
+        password: z.string().check(z.describe('The new password for the user.')),
+        token: z.string().check(z.describe('The password reset token sent to the user email.'))
+    })
+}).handler(async ({ slug, authorizedMCP, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        const result = await req.payload.resetPassword({
+            collection: slug,
+            data: {
+                password: input.password,
+                token: input.token
+            },
+            overrideAccess: authorizedMCP.overrideAccess
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `# Password Reset Successful\n\n**Collection:** ${slug}\n\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``
+                }
+            ],
+            doc: result
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in resetPassword tool on ${slug}: ${errorMessage}`);
+        return wrapError('resetPassword')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+export const unlockCollectionTool = defineCollectionTool({
+    access: (args)=>defaultAccess(args) && Boolean(args.permissions?.collections?.[args.slug]?.unlock),
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: true,
+        openWorldHint: false,
+        readOnlyHint: false,
+        title: 'Unlock Account'
+    },
+    description: 'Unlocks a user account that has been locked due to failed login attempts.',
+    input: strictObject({
+        email: emailSchema
+    })
+}).handler(async ({ slug, authorizedMCP, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        const result = await req.payload.unlock({
+            collection: slug,
+            data: {
+                email: input.email
+            },
+            overrideAccess: authorizedMCP.overrideAccess,
+            req
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `# Account Unlocked\n\n**Collection:** ${slug}\n**Email:** ${input.email}\n**Result:** ${result ? 'Success' : 'Failed'}`
+                }
+            ],
+            doc: {
+                result
+            }
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in unlock tool on ${slug}: ${errorMessage}`);
+        return wrapError('unlock')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+export const verifyCollectionTool = defineCollectionTool({
+    annotations: {
+        destructiveHint: false,
+        idempotentHint: false,
+        openWorldHint: false,
+        readOnlyHint: false,
+        title: 'Email Verification'
+    },
+    description: 'Verifies a user email with a verification token.',
+    input: strictObject({
+        token: z.string().check(z.describe('The verification token sent to the user email.'))
+    })
+}).handler(async ({ slug, input, req })=>{
+    const logger = getLogger({
+        payload: req.payload
+    });
+    try {
+        const result = await req.payload.verifyEmail({
+            collection: slug,
+            token: input.token
+        });
+        return {
+            content: [
+                {
+                    type: 'text',
+                    text: `# Email Verification Successful\n\n**Collection:** ${slug}\n**Result:** ${result ? 'Success' : 'Failed'}`
+                }
+            ],
+            doc: {
+                result
+            }
+        };
+    } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        logger.error(`Error in verify tool on ${slug}: ${errorMessage}`);
+        return wrapError('verify')({
+            slug,
+            message: errorMessage
+        });
+    }
+});
+
+//# sourceMappingURL=authTools.js.map