@payloadcms/plugin-mcp 4.0.0-internal.e7d4ebc → 4.0.0-internal.ee5d8bd

package/src/mcp/builtin/globals/getGlobalSchemaTool.ts

@@ -1,12 +1,12 @@
-import { getAccessResults } from 'payload'
+import { getAccessResults, getGlobalInputSchema, getGlobalSchemaInputSchema } from 'payload'
+import { getLLMInstructions } from 'payload/internal'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
-import { getGlobalInputSchema } from '../../../utils/schemaConversion/getEntityInputSchema.js'
 
 export const getGlobalSchemaTool = defineGlobalTool({
   access: (args) => {
-    const permissions = args.permissions?.globals?.[args.globalSlug]
+    const permissions = args.permissions?.globals?.[args.slug]
 
     return defaultAccess(args) && Boolean(permissions?.update)
   },
@@ -17,18 +17,19 @@ export const getGlobalSchemaTool = defineGlobalTool({
     readOnlyHint: true,
     title: 'Get Global Schema',
   },
-  description: 'Get the input schema for updating a global.',
-}).handler(async ({ authorizedMCP, globalSlug, req }) => {
+  description: 'Get the input schema and LLM instructions before updating a global.',
+  input: getGlobalSchemaInputSchema,
+}).handler(async ({ slug, authorizedMCP, req }) => {
   const permissions = authorizedMCP.overrideAccess
     ? null
-    : (await getAccessResults({ req })).globals?.[globalSlug]
+    : (await getAccessResults({ req })).globals?.[slug]
 
   if (!authorizedMCP.overrideAccess && !permissions?.update) {
     return {
       content: [
         {
           type: 'text',
-          text: `Error: MCP access to "getGlobalSchema" is not enabled for global "${globalSlug}"`,
+          text: `Error: MCP access to "getGlobalSchema" is not enabled for global "${slug}"`,
         },
       ],
       isError: true,
@@ -36,28 +37,37 @@ export const getGlobalSchemaTool = defineGlobalTool({
   }
 
   const inputSchema = getGlobalInputSchema({
-    globalSlug,
+    globalSlug: slug,
     req,
     ...(permissions ? { permissions } : {}),
   })
 
   if (!inputSchema) {
     return {
-      content: [{ type: 'text', text: `Error: Global "${globalSlug}" not found` }],
+      content: [{ type: 'text', text: `Error: Global "${slug}" not found` }],
       isError: true,
     }
   }
 
+  const instructions = await getLLMInstructions({
+    slug,
+    type: 'global',
+    overrideAccess: authorizedMCP.overrideAccess,
+    req,
+  })
+
   return {
     content: [
       {
         type: 'text',
-        text: `Schema for global "${globalSlug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
+        text: `Schema for global "${slug}":\n\`\`\`json\n${JSON.stringify(inputSchema)}\n\`\`\``,
       },
+      ...(instructions ? [{ type: 'text' as const, text: instructions }] : []),
     ],
     structuredContent: {
-      globalSlug,
+      slug,
       schema: inputSchema,
+      ...(instructions ? { instructions } : {}),
     },
   }
 })

package/src/mcp/builtin/globals/restoreVersionTool.ts

@@ -1,6 +1,4 @@
-import type { PopulateType } from 'payload'
-
-import { z } from 'zod'
+import { restoreGlobalVersionInputSchema } from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
@@ -10,8 +8,7 @@ const DEFAULT_DESCRIPTION =
   'Restore a global from a previous version in any version-enabled global.'
 
 export const restoreGlobalVersionTool = defineGlobalTool({
-  access: (args) =>
-    defaultAccess(args) && Boolean(args.permissions?.globals?.[args.globalSlug]?.update),
+  access: (args) => defaultAccess(args) && Boolean(args.permissions?.globals?.[args.slug]?.update),
   annotations: {
     destructiveHint: true,
     idempotentHint: false,
@@ -20,53 +17,25 @@ export const restoreGlobalVersionTool = defineGlobalTool({
     title: 'Restore Global Version',
   },
   description: DEFAULT_DESCRIPTION,
-  input: z.object({
-    id: z.string().describe('The ID of the global version to restore'),
-    depth: z
-      .number()
-      .int()
-      .min(0)
-      .max(10)
-      .describe('How many levels deep to populate relationships in response')
-      .optional()
-      .default(0),
-    fallbackLocale: z
-      .string()
-      .describe('Optional: fallback locale code to use when requested locale is not available')
-      .optional(),
-    locale: z
-      .string()
-      .describe('Optional: locale code to restore in (e.g., "en", "es")')
-      .optional(),
-    populate: z
-      .record(z.string(), z.unknown())
-      .describe(
-        'Optional: control which fields to include from populated relationship or upload documents.',
-      )
-      .optional(),
-    showHiddenFields: z
-      .boolean()
-      .describe('Optional: include hidden fields in the restored global response')
-      .optional(),
-  }),
-}).handler(async ({ authorizedMCP, globalSlug, input, req }) => {
+  input: restoreGlobalVersionInputSchema,
+}).handler(async ({ slug, authorizedMCP, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
-  const { id, depth, fallbackLocale, locale, populate, showHiddenFields } = input
+  const { id, depth, fallbackLocale, locale, populate, select } = input
 
-  logger.info(`Restoring version for global: ${globalSlug} with ID: ${id}`)
+  logger.info(`Restoring version for global: ${slug} with ID: ${id}`)
 
   try {
     const result = await payload.restoreGlobalVersion({
-      id,
-      slug: globalSlug,
+      id: String(id),
+      slug,
       depth,
       overrideAccess: authorizedMCP.overrideAccess,
       req,
-      ...(fallbackLocale ? { fallbackLocale } : {}),
+      ...(fallbackLocale !== undefined ? { fallbackLocale } : {}),
       ...(locale ? { locale } : {}),
-      ...(populate ? { populate: populate as PopulateType } : {}),
-      ...(showHiddenFields !== undefined ? { showHiddenFields } : {}),
+      ...(populate ? { populate } : {}),
+      ...(select ? { select } : {}),
     })
     const resultObject = result as Record<string, unknown>
     const restoredGlobal =
@@ -78,19 +47,19 @@ export const restoreGlobalVersionTool = defineGlobalTool({
       content: [
         {
           type: 'text',
-          text: `Version "${id}" restored successfully for global "${globalSlug}"!\nRestored global:\n\`\`\`json\n${JSON.stringify(restoredGlobal)}\n\`\`\``,
+          text: `Version "${id}" restored successfully for global "${slug}"!\nRestored global:\n\`\`\`json\n${JSON.stringify(restoredGlobal)}\n\`\`\``,
         },
       ],
       doc: restoredGlobal,
     }
   } catch (error) {
     const errorMessage = error instanceof Error ? error.message : 'Unknown error'
-    logger.error(`Error restoring version ${id} for global ${globalSlug}: ${errorMessage}`)
+    logger.error(`Error restoring version ${id} for global ${slug}: ${errorMessage}`)
     return {
       content: [
         {
           type: 'text',
-          text: `❌ **Error restoring version "${id}" for global "${globalSlug}":** ${errorMessage}`,
+          text: `❌ **Error restoring version "${id}" for global "${slug}":** ${errorMessage}`,
         },
       ],
       isError: true,

package/src/mcp/builtin/globals/updateTool.ts

@@ -1,22 +1,20 @@
-import type { SelectType } from 'payload'
-
-import { z } from 'zod'
+import {
+  getGlobalVirtualFieldNames,
+  stripVirtualFields,
+  transformPointDataToPayload,
+  updateGlobalInputSchema,
+  validateGlobalData,
+} from 'payload'
 
 import { defaultAccess } from '../../../defaultAccess.js'
 import { defineGlobalTool } from '../../../defineTool.js'
 import { getLogger } from '../../../utils/getLogger.js'
-import {
-  getGlobalVirtualFieldNames,
-  stripVirtualFields,
-} from '../../../utils/getVirtualFieldNames.js'
-import { transformPointDataToPayload } from '../../../utils/transformPointDataToPayload.js'
-import { validateGlobalData } from '../validateEntityData.js'
+import { formatEntityError } from '../formatEntityError.js'
 
 const DEFAULT_DESCRIPTION = 'Update any Payload global by passing the global slug and data.'
 
 export const updateGlobalTool = defineGlobalTool({
-  access: (args) =>
-    defaultAccess(args) && Boolean(args.permissions?.globals?.[args.globalSlug]?.update),
+  access: (args) => defaultAccess(args) && Boolean(args.permissions?.globals?.[args.slug]?.update),
   annotations: {
     destructiveHint: true,
     idempotentHint: false,
@@ -25,73 +23,54 @@ export const updateGlobalTool = defineGlobalTool({
     title: 'Update Global',
   },
   description: DEFAULT_DESCRIPTION,
-  input: z.object({
-    data: z.record(z.string(), z.unknown()).describe('The global fields to update'),
-    depth: z
-      .number()
-      .describe('Optional: Depth of relationships to populate')
-      .optional()
-      .default(0),
-    draft: z
-      .boolean()
-      .describe('Optional: Whether to save as draft (default: false)')
-      .optional()
-      .default(false),
-    fallbackLocale: z
-      .string()
-      .describe('Optional: fallback locale code to use when requested locale is not available')
-      .optional(),
-    locale: z
-      .string()
-      .describe(
-        'Optional: locale code to update data in (e.g., "en", "es"). Use "all" to update all locales for localized fields',
-      )
-      .optional(),
-    select: z
-      .record(z.string(), z.unknown())
-      .describe(
-        'Optional: define exactly which fields you\'d like to return in the response, e.g., {"siteName": true}',
-      )
-      .optional(),
-  }),
-}).handler(async ({ authorizedMCP, globalSlug, input, req }) => {
+  input: updateGlobalInputSchema,
+}).handler(async ({ slug, authorizedMCP, input, req }) => {
   const payload = req.payload
   const logger = getLogger({ payload })
 
-  const { data, depth, draft, fallbackLocale, locale, select } = input
+  const {
+    data,
+    depth,
+    draft,
+    fallbackLocale,
+    locale,
+    overrideLock,
+    populate,
+    publishAllLocales,
+    select,
+    unpublishAllLocales,
+  } = input
 
-  logger.info(
-    `Updating global: ${globalSlug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`,
-  )
+  logger.info(`Updating global: ${slug}, draft: ${draft}${locale ? `, locale: ${locale}` : ''}`)
 
   try {
-    const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, globalSlug)
+    const virtualFieldNames = getGlobalVirtualFieldNames(payload.config, slug)
     const inputData = stripVirtualFields(data, virtualFieldNames)
-    const validationError = validateGlobalData({ data: inputData, globalSlug, req })
-
-    if (validationError) {
-      return validationError
-    }
+    validateGlobalData({ slug, data: inputData, req })
 
     const parsedData = transformPointDataToPayload(inputData)
 
     const updateOptions: Parameters<typeof payload.updateGlobal>[0] = {
-      slug: globalSlug,
+      slug,
       data: parsedData,
       depth,
       draft,
       overrideAccess: authorizedMCP.overrideAccess,
+      overrideLock,
+      populate,
+      publishAllLocales,
       req,
+      unpublishAllLocales,
     }
 
     if (locale) {
       updateOptions.locale = locale
     }
-    if (fallbackLocale) {
+    if (fallbackLocale !== undefined) {
       updateOptions.fallbackLocale = fallbackLocale
     }
     if (select) {
-      updateOptions.select = select as SelectType
+      updateOptions.select = select
     }
 
     const result = await payload.updateGlobal(updateOptions)
@@ -100,16 +79,14 @@ export const updateGlobalTool = defineGlobalTool({
       content: [
         {
           type: 'text',
-          text: `Global "${globalSlug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
+          text: `Global "${slug}" updated successfully!\n\`\`\`json\n${JSON.stringify(result)}\n\`\`\``,
         },
       ],
-      doc: result as Record<string, unknown>,
+      doc: result,
     }
   } catch (error) {
-    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
-    logger.error(`Error updating global ${globalSlug}: ${errorMessage}`)
-    return {
-      content: [{ type: 'text', text: `Error updating global "${globalSlug}": ${errorMessage}` }],
-    }
+    const message = error instanceof Error ? error.message : 'Unknown error'
+    logger.error(`Error updating global ${slug}: ${message}`)
+    return formatEntityError({ slug, action: 'updating', entity: 'global', error, req })
   }
 })

package/src/mcp/builtinTools.ts

@@ -10,7 +10,7 @@ import {
 } from './builtin/collections/authTools.js'
 import { countDocumentsTool } from './builtin/collections/countTool.js'
 import { countVersionsTool } from './builtin/collections/countVersionsTool.js'
-import { createDocumentTool } from './builtin/collections/createTool.js'
+import { createDocumentsTool } from './builtin/collections/createTool.js'
 import { deleteDocumentsTool } from './builtin/collections/deleteTool.js'
 import { duplicateDocumentTool } from './builtin/collections/duplicateTool.js'
 import { findDistinctTool } from './builtin/collections/findDistinctTool.js'
@@ -56,7 +56,7 @@ export const TOOL_BUILTINS = {
 export const COLLECTION_BUILTINS = {
   count: { mcpName: 'countDocuments', tool: countDocumentsTool },
   countVersions: { mcpName: 'countVersions', requiresVersions: true, tool: countVersionsTool },
-  create: { mcpName: 'createDocument', tool: createDocumentTool },
+  create: { mcpName: 'createDocuments', tool: createDocumentsTool },
   delete: { mcpName: 'deleteDocuments', tool: deleteDocumentsTool },
   duplicate: {
     mcpName: 'duplicateDocument',

package/src/mcp/sanitizeMCPConfig.ts

@@ -103,6 +103,7 @@ export const sanitizeMCPConfig = ({
     hooks: pluginConfig.hooks,
     items,
     mcp: pluginConfig.mcp,
+    oauth: pluginConfig.oauth === false ? undefined : (pluginConfig.oauth ?? { type: 'builtin' }),
     overrideGetAuthorizedMCP: pluginConfig.overrideGetAuthorizedMCP,
   }
 }

package/src/stdio.ts

@@ -3,7 +3,7 @@ import type { Config, Plugin, SanitizedConfig } from 'payload'
 /* eslint-disable no-console */
 import { serveStdio } from '@modelcontextprotocol/server/stdio'
 import { fileURLToPath, pathToFileURL } from 'node:url'
-import { createLocalReq, getPayload } from 'payload'
+import { createPayloadRequest, getPayload } from 'payload'
 import { findConfig, loadEnv } from 'payload/node'
 
 import type { SanitizedMCPPluginConfig } from './types.js'
@@ -91,7 +91,7 @@ export const runMcpStdio = async (): Promise<void> => {
     headers.set('Authorization', process.env.PAYLOAD_MCP_AUTHORIZATION)
   }
 
-  const req = await createLocalReq({ req: { headers } }, payload)
+  const req = await createPayloadRequest({ payload, req: { headers } })
   req.payloadAPI = 'MCP' as const
   const authorizedMCP = await getAuthorizedMCP({ overrideAccess, req })
 

package/src/types.ts

@@ -1,8 +1,9 @@
 import type {
   CallToolResult,
   ContentBlock,
+  Implementation,
   JsonSchemaType,
-  McpServer,
+  McpServerOptions,
   ResourceTemplate,
   ServerContext,
   StandardSchemaWithJSON,
@@ -75,11 +76,11 @@ export type MCPAccessArgs = {
 }
 
 export type CollectionMCPAccessArgs = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & MCPAccessArgs
 
 export type GlobalMCPAccessArgs = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & MCPAccessArgs
 
 export type ToolHandlerArgs<TSchema = undefined> = {
@@ -90,11 +91,11 @@ export type ToolHandlerArgs<TSchema = undefined> = {
 }
 
 export type CollectionToolHandlerArgs<TSchema = undefined> = {
-  collectionSlug: CollectionSlug
+  slug: CollectionSlug
 } & ToolHandlerArgs<TSchema>
 
 export type GlobalToolHandlerArgs<TSchema = undefined> = {
-  globalSlug: GlobalSlug
+  slug: GlobalSlug
 } & ToolHandlerArgs<TSchema>
 
 export type Tool<TSchema extends ToolInputSchema | undefined = ToolInputSchema | undefined> = {
@@ -279,9 +280,24 @@ export type MCPPluginConfig = {
     afterToolCall?: MCPAfterToolCallHook[]
   }
   mcp?: {
+    /**
+     * Largest HTTP request body, in bytes, that the MCP endpoint accepts. Larger requests
+     * are answered with `413`. Base64 file uploads count toward this limit.
+     *
+     * @default 4194304 (4 MiB, the MCP SDK default)
+     */
+    maxRequestBodySize?: number
     serverOptions?: MCPServerOptions
     verboseLogs?: boolean
   }
+  /**
+   * How MCP clients sign in. MCP requests without an authenticated user get a `401` that points
+   * to the protected resource metadata (RFC 9728). Set to `false` to only accept API keys and
+   * anonymous requests.
+   *
+   * @default { type: 'builtin' }
+   */
+  oauth?: false | MCPOAuthConfig
   /**
    * Replace the default MCP authorization resolver.
    *
@@ -299,13 +315,87 @@ export type MCPPluginConfig = {
   tools?: MCPTopLevelToolsMap
 }
 
+export type MCPOAuthConfig = MCPBuiltinOAuthConfig | MCPExternalOAuthConfig
+
+/**
+ * This Payload app is the authorization server. Users sign in to the admin panel and allow the
+ * MCP client, which then gets an access token for them.
+ */
+export type MCPBuiltinOAuthConfig = {
+  /**
+   * Creates the tokens the MCP client gets when the user clicks Allow. `req` is the user's own
+   * browser request, so `req.user` is the user who allowed it. Pass `authenticate` too if
+   * Payload's auth strategies don't accept the access token.
+   *
+   * @default a Payload login token for that user, with a refresh token when the collection uses sessions
+   */
+  issueToken?: (args: { req: PayloadRequest }) => MaybePromise<MCPOAuthTokens>
+  /**
+   * Trades a refresh token from `issueToken`, or from an earlier refresh, for new tokens. Return
+   * `null` when it's no longer valid, and the client sends the user through sign-in again. `req`
+   * is the MCP client's request, without a user. Only used together with `issueToken`.
+   *
+   * OAuth requires noticing copied refresh tokens: return a new refresh token every time, and
+   * revoke the tokens when an already used refresh token comes back.
+   */
+  refreshToken?: (args: {
+    refreshToken: string
+    req: PayloadRequest
+  }) => MaybePromise<MCPOAuthTokens | null>
+  type: 'builtin'
+} & MCPOAuthSharedConfig
+
+export type MCPOAuthTokens = {
+  accessToken: string
+  /** Seconds until the access token expires. */
+  expiresIn?: number
+  /** Lets the client get new tokens without the user, through `refreshToken`. */
+  refreshToken?: string
+}
+
+/** Another service, e.g. your identity provider, is the authorization server. */
+export type MCPExternalOAuthConfig = {
+  /**
+   * The authorization servers that issue access tokens for MCP clients. Clients require each one
+   * to exactly match the `issuer` in that server's metadata, so pass a function when the exact
+   * value is only known at runtime, e.g. from the server's OpenID configuration or per host.
+   */
+  authorizationServers: ((args: { req: PayloadRequest }) => MaybePromise<string[]>) | string[]
+  /**
+   * Scopes MCP clients should request, e.g. `['openid', 'email', 'profile']`. Without them,
+   * clients request none, which some authorization servers reject or answer with a token that
+   * doesn't identify the user.
+   */
+  scopes?: string[]
+  type: 'external'
+} & MCPOAuthSharedConfig
+
+type MCPOAuthSharedConfig = {
+  /**
+   * Called on MCP requests with a bearer token that Payload's auth strategies didn't accept.
+   * Return the Payload user, including its `collection`, or `null` to answer with the OAuth challenge.
+   */
+  authenticate?: (args: {
+    req: PayloadRequest
+    token: string
+  }) => MaybePromise<PayloadRequest['user']>
+  /**
+   * The URL clients call to reach the MCP endpoint.
+   *
+   * @default the absolute URL of `/api/mcp`, based on `serverURL` or the request URL
+   */
+  resource?: string
+}
+
 export type SanitizedMCPPluginConfig = {
   items: MCPItem[]
+  /** `undefined` when OAuth is turned off. */
+  oauth?: MCPOAuthConfig
 } & Pick<MCPPluginConfig, 'disabled' | 'hooks' | 'mcp' | 'overrideGetAuthorizedMCP'>
 
 export type MCPServerOptions = {
-  options?: ConstructorParameters<typeof McpServer>[1]
-  serverInfo?: Partial<ConstructorParameters<typeof McpServer>[0]>
+  options?: McpServerOptions
+  serverInfo?: Partial<Implementation>
 }
 
 /**

package/src/utils/toStandardSchema.ts

@@ -5,5 +5,5 @@ import type { ToolInputSchema } from '../types.js'
 /** Normalize a tool/prompt input to a Standard Schema. Raw JSON Schema gets wrapped; Standard Schema instances pass through. */
 export const toStandardSchema = (schema: ToolInputSchema): StandardSchemaWithJSON =>
   typeof schema === 'object' && schema !== null && '~standard' in schema
-    ? (schema as StandardSchemaWithJSON)
+    ? schema
     : fromJsonSchema(schema)

package/dist/mcp/builtin/collections/fileInput.spec.js

@@ -1,86 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { fileInputSchema, resolveFile } from './fileInput.js';
-describe('MCP file input', ()=>{
-    it('should reject malformed MIME types', ()=>{
-        const result = fileInputSchema.safeParse({
-            data: 'aGVsbG8=',
-            mimeType: 'text/plain\r\nx-test: value',
-            name: 'hello.txt',
-            source: 'base64'
-        });
-        expect(result.success).toBe(false);
-    });
-    it('should accept a prepared upload', ()=>{
-        const result = fileInputSchema.safeParse({
-            file: {
-                filename: 'image.png',
-                mimeType: 'image/png',
-                size: 123,
-                uploadReference: {
-                    uploadId: 'upload-id'
-                }
-            },
-            source: 'uploadReference'
-        });
-        expect(result.success).toBe(true);
-    });
-    it('should reject oversized base64 files', async ()=>{
-        const req = createRequest({
-            maxFileSize: 4
-        });
-        await expect(resolveFile({
-            collectionSlug: 'media',
-            input: {
-                data: Buffer.from('hello').toString('base64'),
-                mimeType: 'text/plain',
-                name: 'hello.txt',
-                source: 'base64'
-            },
-            req
-        })).rejects.toThrow('File exceeds the 4 byte upload limit.');
-    });
-    it('should reject URLs outside the collection allowlist', async ()=>{
-        const req = createRequest({
-            allowList: [
-                {
-                    hostname: 'assets.example.com',
-                    protocol: 'https'
-                }
-            ]
-        });
-        await expect(resolveFile({
-            collectionSlug: 'media',
-            input: {
-                source: 'externalURL',
-                url: 'https://example.com/image.png'
-            },
-            req
-        })).rejects.toThrow('The provided file URL is not allowed.');
-    });
-});
-function createRequest({ allowList, maxFileSize }) {
-    return {
-        payload: {
-            collections: {
-                media: {
-                    config: {
-                        upload: allowList ? {
-                            pasteURL: {
-                                allowList
-                            }
-                        } : {}
-                    }
-                }
-            },
-            config: {
-                upload: {
-                    limits: {
-                        fileSize: maxFileSize
-                    }
-                }
-            }
-        }
-    };
-}
-
-//# sourceMappingURL=fileInput.spec.js.map

package/dist/mcp/builtin/collections/fileInput.spec.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../../src/mcp/builtin/collections/fileInput.spec.ts"],"sourcesContent":["import type { PayloadRequest } from 'payload'\n\nimport { describe, expect, it } from 'vitest'\n\nimport { fileInputSchema, resolveFile } from './fileInput.js'\n\ndescribe('MCP file input', () => {\n  it('should reject malformed MIME types', () => {\n    const result = fileInputSchema.safeParse({\n      data: 'aGVsbG8=',\n      mimeType: 'text/plain\\r\\nx-test: value',\n      name: 'hello.txt',\n      source: 'base64',\n    })\n\n    expect(result.success).toBe(false)\n  })\n\n  it('should accept a prepared upload', () => {\n    const result = fileInputSchema.safeParse({\n      file: {\n        filename: 'image.png',\n        mimeType: 'image/png',\n        size: 123,\n        uploadReference: { uploadId: 'upload-id' },\n      },\n      source: 'uploadReference',\n    })\n\n    expect(result.success).toBe(true)\n  })\n\n  it('should reject oversized base64 files', async () => {\n    const req = createRequest({ maxFileSize: 4 })\n\n    await expect(\n      resolveFile({\n        collectionSlug: 'media',\n        input: {\n          data: Buffer.from('hello').toString('base64'),\n          mimeType: 'text/plain',\n          name: 'hello.txt',\n          source: 'base64',\n        },\n        req,\n      }),\n    ).rejects.toThrow('File exceeds the 4 byte upload limit.')\n  })\n\n  it('should reject URLs outside the collection allowlist', async () => {\n    const req = createRequest({\n      allowList: [{ hostname: 'assets.example.com', protocol: 'https' }],\n    })\n\n    await expect(\n      resolveFile({\n        collectionSlug: 'media',\n        input: {\n          source: 'externalURL',\n          url: 'https://example.com/image.png',\n        },\n        req,\n      }),\n    ).rejects.toThrow('The provided file URL is not allowed.')\n  })\n})\n\nfunction createRequest({\n  allowList,\n  maxFileSize,\n}: {\n  allowList?: Array<{ hostname: string; protocol: 'http' | 'https' }>\n  maxFileSize?: number\n}): PayloadRequest {\n  return {\n    payload: {\n      collections: {\n        media: {\n          config: {\n            upload: allowList ? { pasteURL: { allowList } } : {},\n          },\n        },\n      },\n      config: {\n        upload: {\n          limits: {\n            fileSize: maxFileSize,\n          },\n        },\n      },\n    },\n  } as unknown as PayloadRequest\n}\n"],"names":["describe","expect","it","fileInputSchema","resolveFile","result","safeParse","data","mimeType","name","source","success","toBe","file","filename","size","uploadReference","uploadId","req","createRequest","maxFileSize","collectionSlug","input","Buffer","from","toString","rejects","toThrow","allowList","hostname","protocol","url","payload","collections","media","config","upload","pasteURL","limits","fileSize"],"mappings":"AAEA,SAASA,QAAQ,EAAEC,MAAM,EAAEC,EAAE,QAAQ,SAAQ;AAE7C,SAASC,eAAe,EAAEC,WAAW,QAAQ,iBAAgB;AAE7DJ,SAAS,kBAAkB;IACzBE,GAAG,sCAAsC;QACvC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCC,MAAM;YACNC,UAAU;YACVC,MAAM;YACNC,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,mCAAmC;QACpC,MAAMG,SAASF,gBAAgBG,SAAS,CAAC;YACvCO,MAAM;gBACJC,UAAU;gBACVN,UAAU;gBACVO,MAAM;gBACNC,iBAAiB;oBAAEC,UAAU;gBAAY;YAC3C;YACAP,QAAQ;QACV;QAEAT,OAAOI,OAAOM,OAAO,EAAEC,IAAI,CAAC;IAC9B;IAEAV,GAAG,wCAAwC;QACzC,MAAMgB,MAAMC,cAAc;YAAEC,aAAa;QAAE;QAE3C,MAAMnB,OACJG,YAAY;YACViB,gBAAgB;YAChBC,OAAO;gBACLf,MAAMgB,OAAOC,IAAI,CAAC,SAASC,QAAQ,CAAC;gBACpCjB,UAAU;gBACVC,MAAM;gBACNC,QAAQ;YACV;YACAQ;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;IAEAzB,GAAG,uDAAuD;QACxD,MAAMgB,MAAMC,cAAc;YACxBS,WAAW;gBAAC;oBAAEC,UAAU;oBAAsBC,UAAU;gBAAQ;aAAE;QACpE;QAEA,MAAM7B,OACJG,YAAY;YACViB,gBAAgB;YAChBC,OAAO;gBACLZ,QAAQ;gBACRqB,KAAK;YACP;YACAb;QACF,IACAQ,OAAO,CAACC,OAAO,CAAC;IACpB;AACF;AAEA,SAASR,cAAc,EACrBS,SAAS,EACTR,WAAW,EAIZ;IACC,OAAO;QACLY,SAAS;YACPC,aAAa;gBACXC,OAAO;oBACLC,QAAQ;wBACNC,QAAQR,YAAY;4BAAES,UAAU;gCAAET;4BAAU;wBAAE,IAAI,CAAC;oBACrD;gBACF;YACF;YACAO,QAAQ;gBACNC,QAAQ;oBACNE,QAAQ;wBACNC,UAAUnB;oBACZ;gBACF;YACF;QACF;IACF;AACF"}

package/dist/mcp/builtin/collections/formatCollectionError.d.ts

@@ -1,9 +0,0 @@
-import type { CollectionSlug, PayloadRequest } from 'payload';
-import type { MCPToolResponse } from '../../../types.js';
-export declare const formatCollectionError: ({ action, collectionSlug, error, req, }: {
-    action: 'creating' | 'duplicating' | 'updating';
-    collectionSlug: CollectionSlug;
-    error: unknown;
-    req: PayloadRequest;
-}) => MCPToolResponse;
-//# sourceMappingURL=formatCollectionError.d.ts.map

package/dist/mcp/builtin/collections/formatCollectionError.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formatCollectionError.d.ts","sourceRoot":"","sources":["../../../../src/mcp/builtin/collections/formatCollectionError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAE7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAgCxD,eAAO,MAAM,qBAAqB,4CAK/B;IACD,MAAM,EAAE,UAAU,GAAG,aAAa,GAAG,UAAU,CAAA;IAC/C,cAAc,EAAE,cAAc,CAAA;IAC9B,KAAK,EAAE,OAAO,CAAA;IACd,GAAG,EAAE,cAAc,CAAA;CACpB,KAAG,eAuCH,CAAA"}