@strapi/content-manager 5.46.0 → 5.47.0

package/dist/server/mcp/handlers/single-type-handlers.mjs

@@ -0,0 +1,336 @@
+import { errors, async, setCreatorFields } from '@strapi/utils';
+import { getService } from '../../utils/index.mjs';
+import { getDocumentLocaleAndStatus } from '../../controllers/validation/dimensions.mjs';
+import { formatDocumentWithMetadata } from '../../controllers/utils/metadata.mjs';
+import { getPopulateForLocalizations } from '../../services/utils/populate.mjs';
+import { MCP_NOT_FOUND_DOCUMENT } from './constants.mjs';
+import { isContentTypeLocalized } from '../permissions.mjs';
+import { ok } from '../utils.mjs';
+
+// ---------------------------------------------------------------------------
+// Shared create-or-update logic mirroring single-types controller
+// ---------------------------------------------------------------------------
+/**
+ * Core write logic shared by the single-type write handler.
+ * Creates the document when none exists; updates the existing draft otherwise.
+ * Enforces RBAC create/update permission and sanitizes input + output.
+ */ const singleCreateOrUpdate = async (strapi, uid, context, args)=>{
+    const { userAbility, user } = context;
+    const { data, locale } = args;
+    // TODO: fix UID.SingleType assignability in @strapi/types
+    const typedUid = uid;
+    const documentManager = getService('document-manager');
+    const permissionChecker = getService('permission-checker').create({
+        userAbility,
+        model: uid
+    });
+    if (permissionChecker.cannot.create() && permissionChecker.cannot.update()) {
+        throw new errors.ForbiddenError();
+    }
+    const sanitizedQuery = await permissionChecker.sanitizedQuery.update({
+        locale
+    });
+    const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({
+        locale
+    }, uid);
+    const populate = await getService('populate-builder')(typedUid).populateFromQuery(sanitizedQuery).populateDeep(Infinity).countRelations().withPopulateOverride(getPopulateForLocalizations(typedUid)).build();
+    const draftFindQuery = {
+        ...sanitizedQuery,
+        populate,
+        locale: resolvedLocale,
+        status: 'draft'
+    };
+    const [documentVersion, otherDocumentVersion] = await Promise.all([
+        documentManager.findMany(draftFindQuery, typedUid).then((docs)=>docs[0]),
+        strapi.db.query(typedUid).findOne({
+            select: [
+                'documentId'
+            ]
+        })
+    ]);
+    const documentId = otherDocumentVersion?.documentId;
+    if (documentVersion) {
+        if (permissionChecker.cannot.update(documentVersion)) {
+            throw new errors.ForbiddenError();
+        }
+    } else if (permissionChecker.cannot.create()) {
+        throw new errors.ForbiddenError();
+    }
+    const sanitizeInput = documentVersion ? permissionChecker.sanitizeUpdateInput(documentVersion) : permissionChecker.sanitizeCreateInput;
+    const isEdition = documentVersion !== null && documentVersion !== undefined;
+    const sanitizedData = setCreatorFields({
+        user,
+        isEdition
+    })(await sanitizeInput(data));
+    const formatted = await strapi.db.transaction(async ()=>{
+        let doc;
+        if (documentId === undefined) {
+            doc = await documentManager.create(typedUid, {
+                data: sanitizedData,
+                ...sanitizedQuery,
+                locale: resolvedLocale
+            });
+        } else {
+            doc = await documentManager.update(documentId, typedUid, {
+                data: sanitizedData,
+                populate,
+                locale: resolvedLocale
+            });
+        }
+        const sanitizedDocument = await permissionChecker.sanitizeOutput(doc);
+        return formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);
+    });
+    return ok(formatted);
+};
+// ---------------------------------------------------------------------------
+// Handler factories
+// ---------------------------------------------------------------------------
+/**
+ * Creates a handler for reading the single-type document.
+ * Returns available locale metadata when the requested locale version does not exist.
+ * Enforces RBAC read permission.
+ */ const createSingleGetHandler = (uid)=>(strapi, context)=>async ({ args })=>{
+            const { userAbility } = context;
+            const { locale, status } = args;
+            // TODO: fix UID.SingleType assignability in @strapi/types
+            const typedUid = uid;
+            const permissionChecker = getService('permission-checker').create({
+                userAbility,
+                model: uid
+            });
+            if (permissionChecker.cannot.read()) {
+                throw new errors.ForbiddenError();
+            }
+            const permissionQuery = await permissionChecker.sanitizedQuery.read({
+                locale,
+                status
+            });
+            const { locale: resolvedLocale, status: resolvedStatus } = await getDocumentLocaleAndStatus({
+                locale,
+                status
+            }, uid);
+            const populate = await getService('populate-builder')(typedUid).populateFromQuery(permissionQuery).populateDeep(Infinity).countRelations().withPopulateOverride(getPopulateForLocalizations(typedUid)).build();
+            const versionFindQuery = {
+                ...permissionQuery,
+                populate,
+                locale: resolvedLocale,
+                status: resolvedStatus
+            };
+            const version = await getService('document-manager').findMany(versionFindQuery, typedUid).then((docs)=>docs[0]);
+            if (!version) {
+                if (permissionChecker.cannot.create()) {
+                    throw new errors.ForbiddenError();
+                }
+                const document = await strapi.db.query(typedUid).findOne({});
+                if (!document) {
+                    throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);
+                }
+                const { meta } = await formatDocumentWithMetadata(permissionChecker, typedUid, {
+                    documentId: document.documentId,
+                    locale: resolvedLocale,
+                    publishedAt: null
+                }, {
+                    availableLocales: true,
+                    availableStatus: false
+                });
+                return ok({
+                    data: {},
+                    meta
+                });
+            }
+            if (permissionChecker.cannot.read(version)) {
+                throw new errors.ForbiddenError();
+            }
+            const sanitizedDocument = await permissionChecker.sanitizeOutput(version);
+            const result = await formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);
+            return ok(result);
+        };
+/**
+ * Creates a handler for creating or updating the single-type document.
+ * Delegates to `singleCreateOrUpdate`; enforces RBAC create/update permission.
+ */ const createSingleWriteHandler = (uid)=>(strapi, context)=>async ({ args })=>{
+            return singleCreateOrUpdate(strapi, uid, context, args);
+        };
+/**
+ * Creates a handler for deleting the single-type document (or a specific locale).
+ * Enforces RBAC delete permission on every locale version before deletion.
+ */ const createSingleDeleteHandler = (uid)=>(strapi, context)=>async ({ args })=>{
+            const { userAbility } = context;
+            const { locale } = args;
+            // TODO: fix UID.SingleType assignability in @strapi/types
+            const typedUid = uid;
+            const documentManager = getService('document-manager');
+            const permissionChecker = getService('permission-checker').create({
+                userAbility,
+                model: uid
+            });
+            if (permissionChecker.cannot.delete()) {
+                throw new errors.ForbiddenError();
+            }
+            const sanitizedQuery = await permissionChecker.sanitizedQuery.delete({
+                locale
+            });
+            const populate = await getService('populate-builder')(typedUid).populateFromQuery(sanitizedQuery).populateDeep(Infinity).countRelations().withPopulateOverride(getPopulateForLocalizations(typedUid)).build();
+            const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({
+                locale
+            }, uid);
+            const isLocalized = isContentTypeLocalized(strapi, uid);
+            const localeForQuery = isLocalized === true ? resolvedLocale : undefined;
+            const documentLocales = await documentManager.findLocales(undefined, typedUid, {
+                populate,
+                locale: localeForQuery
+            });
+            if (documentLocales.length === 0) {
+                throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);
+            }
+            for (const document of documentLocales){
+                if (permissionChecker.cannot.delete(document)) {
+                    throw new errors.ForbiddenError();
+                }
+            }
+            const deletedEntity = await documentManager.delete(documentLocales[0].documentId, typedUid, {
+                locale: localeForQuery
+            });
+            const sanitizedResult = await permissionChecker.sanitizeOutput(deletedEntity);
+            return ok({
+                data: sanitizedResult
+            });
+        };
+/**
+ * Creates a handler for publishing the single-type document draft.
+ * Enforces RBAC publish permission; throws NotFound when the draft is missing.
+ */ const createSinglePublishHandler = (uid)=>(strapi, context)=>async ({ args })=>{
+            const { userAbility } = context;
+            const { locale } = args;
+            // TODO: fix UID.SingleType assignability in @strapi/types
+            const typedUid = uid;
+            const documentManager = getService('document-manager');
+            const permissionChecker = getService('permission-checker').create({
+                userAbility,
+                model: uid
+            });
+            if (permissionChecker.cannot.publish()) {
+                throw new errors.ForbiddenError();
+            }
+            const publishedDocument = await strapi.db.transaction(async ()=>{
+                const sanitizedQuery = await permissionChecker.sanitizedQuery.publish({
+                    locale
+                });
+                const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({
+                    locale
+                }, uid);
+                const publishFindQuery = {
+                    ...sanitizedQuery,
+                    locale: resolvedLocale,
+                    status: 'draft'
+                };
+                const document = await getService('document-manager').findMany(publishFindQuery, typedUid).then((docs)=>docs[0]);
+                if (!document) {
+                    throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);
+                }
+                if (permissionChecker.cannot.publish(document)) {
+                    throw new errors.ForbiddenError();
+                }
+                const publishResult = await documentManager.publish(document.documentId, typedUid, {
+                    locale: resolvedLocale
+                });
+                return publishResult?.at(0);
+            });
+            const sanitizedDocument = await permissionChecker.sanitizeOutput(publishedDocument);
+            const result = await formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);
+            return ok(result);
+        };
+/**
+ * Creates a handler for unpublishing the single-type document.
+ * Optionally discards the draft in the same transaction when `discardDraft` is true.
+ * Enforces RBAC unpublish (and discard) permission.
+ */ const createSingleUnpublishHandler = (uid)=>(strapi, context)=>async ({ args })=>{
+            const { userAbility } = context;
+            const { locale, discardDraft } = args;
+            // TODO: fix UID.SingleType assignability in @strapi/types
+            const typedUid = uid;
+            const documentManager = getService('document-manager');
+            const permissionChecker = getService('permission-checker').create({
+                userAbility,
+                model: uid
+            });
+            if (permissionChecker.cannot.unpublish()) {
+                throw new errors.ForbiddenError();
+            }
+            if (discardDraft === true && permissionChecker.cannot.discard()) {
+                throw new errors.ForbiddenError();
+            }
+            const sanitizedQuery = await permissionChecker.sanitizedQuery.unpublish({
+                locale
+            });
+            const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({
+                locale
+            }, uid);
+            const unpublishFindQuery = {
+                ...sanitizedQuery,
+                locale: resolvedLocale
+            };
+            const document = await getService('document-manager').findMany(unpublishFindQuery, typedUid).then((docs)=>docs[0]);
+            if (!document) {
+                throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);
+            }
+            if (permissionChecker.cannot.unpublish(document)) {
+                throw new errors.ForbiddenError();
+            }
+            if (discardDraft === true && permissionChecker.cannot.discard(document)) {
+                throw new errors.ForbiddenError();
+            }
+            const result = await strapi.db.transaction(async ()=>{
+                if (discardDraft === true) {
+                    await documentManager.discardDraft(document.documentId, typedUid, {
+                        locale: resolvedLocale
+                    });
+                }
+                return async.pipe((doc)=>documentManager.unpublish(doc.documentId, typedUid, {
+                        locale: resolvedLocale
+                    }), permissionChecker.sanitizeOutput, (doc)=>formatDocumentWithMetadata(permissionChecker, typedUid, doc))(document);
+            });
+            return ok(result);
+        };
+/**
+ * Creates a handler for discarding the draft of the single-type document.
+ * Restores the published version as the draft. Enforces RBAC discard permission.
+ */ const createSingleDiscardDraftHandler = (uid)=>(_strapi, context)=>async ({ args })=>{
+            const { userAbility } = context;
+            const { locale } = args;
+            // TODO: fix UID.SingleType assignability in @strapi/types
+            const typedUid = uid;
+            const documentManager = getService('document-manager');
+            const permissionChecker = getService('permission-checker').create({
+                userAbility,
+                model: uid
+            });
+            if (permissionChecker.cannot.discard()) {
+                throw new errors.ForbiddenError();
+            }
+            const sanitizedQuery = await permissionChecker.sanitizedQuery.discard({
+                locale
+            });
+            const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({
+                locale
+            }, uid);
+            const discardFindQuery = {
+                ...sanitizedQuery,
+                locale: resolvedLocale,
+                status: 'published'
+            };
+            const document = await getService('document-manager').findMany(discardFindQuery, typedUid).then((docs)=>docs[0]);
+            if (!document) {
+                throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);
+            }
+            if (permissionChecker.cannot.discard(document)) {
+                throw new errors.ForbiddenError();
+            }
+            const discardedDocument = await async.pipe((doc)=>documentManager.discardDraft(doc.documentId, typedUid, {
+                    locale: resolvedLocale
+                }), permissionChecker.sanitizeOutput, (doc)=>formatDocumentWithMetadata(permissionChecker, typedUid, doc))(document);
+            return ok(discardedDocument);
+        };
+
+export { createSingleDeleteHandler, createSingleDiscardDraftHandler, createSingleGetHandler, createSinglePublishHandler, createSingleUnpublishHandler, createSingleWriteHandler, singleCreateOrUpdate };
+//# sourceMappingURL=single-type-handlers.mjs.map

package/dist/server/mcp/handlers/single-type-handlers.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-type-handlers.mjs","sources":["../../../../server/src/mcp/handlers/single-type-handlers.ts"],"sourcesContent":["import { errors, async as asyncPipe, setCreatorFields } from '@strapi/utils';\nimport type { Core, Modules, UID } from '@strapi/types';\n\nimport { getService } from '../../utils';\nimport { getDocumentLocaleAndStatus } from '../../controllers/validation/dimensions';\nimport { formatDocumentWithMetadata } from '../../controllers/utils/metadata';\nimport { getPopulateForLocalizations } from '../../services/utils/populate';\nimport { MCP_NOT_FOUND_DOCUMENT } from './constants';\nimport { isContentTypeLocalized } from '../permissions';\nimport { ok } from '../utils';\n\ntype McpDocumentQuery = {\n  populate?: unknown;\n  locale?: string;\n  status?: string;\n  filters?: unknown;\n  sort?: unknown;\n  pagination?: unknown;\n  [key: string]: unknown;\n};\n\ntype McpFindManyParams = Parameters<Modules.Documents.ServiceInstance['findMany']>[0];\n\n// ---------------------------------------------------------------------------\n// Input arg schemas — used for type-safe narrowing from Record<string, unknown>\n// ---------------------------------------------------------------------------\n\ntype SingleLocaleArgs = { locale?: string };\ntype SingleGetArgs = SingleLocaleArgs & { status?: 'draft' | 'published' };\ntype SingleUnpublishArgs = SingleLocaleArgs & { discardDraft?: boolean };\ntype SingleWriteArgs = { data: Record<string, unknown>; locale?: string };\n\n// ---------------------------------------------------------------------------\n// Shared create-or-update logic mirroring single-types controller\n// ---------------------------------------------------------------------------\n\n/**\n * Core write logic shared by the single-type write handler.\n * Creates the document when none exists; updates the existing draft otherwise.\n * Enforces RBAC create/update permission and sanitizes input + output.\n */\nexport const singleCreateOrUpdate = async (\n  strapi: Core.Strapi,\n  uid: UID.SingleType,\n  context: Modules.MCP.McpHandlerContext,\n  args: SingleWriteArgs\n): Promise<Modules.MCP.McpToolHandlerReturn> => {\n  const { userAbility, user } = context;\n  const { data, locale } = args;\n  // TODO: fix UID.SingleType assignability in @strapi/types\n  const typedUid = uid as UID.ContentType;\n\n  const documentManager = getService('document-manager');\n  const permissionChecker = getService('permission-checker').create({\n    userAbility,\n    model: uid as string,\n  });\n\n  if (permissionChecker.cannot.create() && permissionChecker.cannot.update()) {\n    throw new errors.ForbiddenError();\n  }\n\n  const sanitizedQuery = await permissionChecker.sanitizedQuery.update({ locale });\n  const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({ locale }, uid);\n\n  const populate = await getService('populate-builder')(typedUid)\n    .populateFromQuery(sanitizedQuery)\n    .populateDeep(Infinity)\n    .countRelations()\n    .withPopulateOverride(getPopulateForLocalizations(typedUid))\n    .build();\n\n  const draftFindQuery: McpDocumentQuery = {\n    ...sanitizedQuery,\n    populate,\n    locale: resolvedLocale,\n    status: 'draft',\n  };\n  const [documentVersion, otherDocumentVersion] = await Promise.all([\n    documentManager\n      .findMany(draftFindQuery as McpFindManyParams, typedUid)\n      .then((docs: any[]) => docs[0]),\n    strapi.db.query(typedUid).findOne({ select: ['documentId'] }),\n  ]);\n\n  const documentId = otherDocumentVersion?.documentId;\n\n  if (documentVersion) {\n    if (permissionChecker.cannot.update(documentVersion)) {\n      throw new errors.ForbiddenError();\n    }\n  } else if (permissionChecker.cannot.create()) {\n    throw new errors.ForbiddenError();\n  }\n\n  const sanitizeInput = documentVersion\n    ? permissionChecker.sanitizeUpdateInput(documentVersion)\n    : permissionChecker.sanitizeCreateInput;\n\n  const isEdition = documentVersion !== null && documentVersion !== undefined;\n  const sanitizedData = setCreatorFields({ user, isEdition })(await sanitizeInput(data)) as Record<\n    string,\n    unknown\n  >;\n\n  const formatted = await strapi.db.transaction(async () => {\n    let doc: any;\n\n    if (documentId === undefined) {\n      doc = await documentManager.create(typedUid, {\n        data: sanitizedData,\n        ...sanitizedQuery,\n        locale: resolvedLocale,\n      });\n    } else {\n      doc = await documentManager.update(documentId, typedUid, {\n        data: sanitizedData,\n        populate,\n        locale: resolvedLocale,\n      });\n    }\n\n    const sanitizedDocument = await permissionChecker.sanitizeOutput(doc);\n    return formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);\n  });\n\n  return ok(formatted as Record<string, unknown>);\n};\n\n// ---------------------------------------------------------------------------\n// Handler factories\n// ---------------------------------------------------------------------------\n\n/**\n * Creates a handler for reading the single-type document.\n * Returns available locale metadata when the requested locale version does not exist.\n * Enforces RBAC read permission.\n */\nexport const createSingleGetHandler =\n  (uid: UID.SingleType) =>\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({ args }: { args: SingleGetArgs }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { userAbility } = context;\n    const { locale, status } = args;\n    // TODO: fix UID.SingleType assignability in @strapi/types\n    const typedUid = uid as UID.ContentType;\n\n    const permissionChecker = getService('permission-checker').create({\n      userAbility,\n      model: uid as string,\n    });\n\n    if (permissionChecker.cannot.read()) {\n      throw new errors.ForbiddenError();\n    }\n\n    const permissionQuery = await permissionChecker.sanitizedQuery.read({ locale, status });\n    const { locale: resolvedLocale, status: resolvedStatus } = await getDocumentLocaleAndStatus(\n      { locale, status },\n      uid\n    );\n\n    const populate = await getService('populate-builder')(typedUid)\n      .populateFromQuery(permissionQuery)\n      .populateDeep(Infinity)\n      .countRelations()\n      .withPopulateOverride(getPopulateForLocalizations(typedUid))\n      .build();\n\n    const versionFindQuery: McpDocumentQuery = {\n      ...permissionQuery,\n      populate,\n      locale: resolvedLocale,\n      status: resolvedStatus,\n    };\n    const version = await getService('document-manager')\n      .findMany(versionFindQuery as McpFindManyParams, typedUid)\n      .then((docs: any[]) => docs[0]);\n\n    if (!version) {\n      if (permissionChecker.cannot.create()) {\n        throw new errors.ForbiddenError();\n      }\n\n      const document = await strapi.db.query(typedUid).findOne({});\n\n      if (!document) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);\n      }\n\n      const { meta } = await formatDocumentWithMetadata(\n        permissionChecker,\n        typedUid,\n        {\n          documentId: document.documentId,\n          locale: resolvedLocale,\n          publishedAt: null,\n        } as Parameters<typeof formatDocumentWithMetadata>[2],\n        { availableLocales: true, availableStatus: false }\n      );\n\n      return ok({ data: {}, meta } as Record<string, unknown>);\n    }\n\n    if (permissionChecker.cannot.read(version)) {\n      throw new errors.ForbiddenError();\n    }\n\n    const sanitizedDocument = await permissionChecker.sanitizeOutput(version);\n    const result = await formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);\n\n    return ok(result as Record<string, unknown>);\n  };\n\n/**\n * Creates a handler for creating or updating the single-type document.\n * Delegates to `singleCreateOrUpdate`; enforces RBAC create/update permission.\n */\nexport const createSingleWriteHandler =\n  (uid: UID.SingleType) =>\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({\n    args,\n  }: {\n    args: Record<string, unknown>;\n  }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    return singleCreateOrUpdate(strapi, uid, context, args as SingleWriteArgs);\n  };\n\n/**\n * Creates a handler for deleting the single-type document (or a specific locale).\n * Enforces RBAC delete permission on every locale version before deletion.\n */\nexport const createSingleDeleteHandler =\n  (uid: UID.SingleType) =>\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({ args }: { args: SingleLocaleArgs }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { userAbility } = context;\n    const { locale } = args;\n    // TODO: fix UID.SingleType assignability in @strapi/types\n    const typedUid = uid as UID.ContentType;\n\n    const documentManager = getService('document-manager');\n    const permissionChecker = getService('permission-checker').create({\n      userAbility,\n      model: uid as string,\n    });\n\n    if (permissionChecker.cannot.delete()) {\n      throw new errors.ForbiddenError();\n    }\n\n    const sanitizedQuery = await permissionChecker.sanitizedQuery.delete({ locale });\n\n    const populate = await getService('populate-builder')(typedUid)\n      .populateFromQuery(sanitizedQuery)\n      .populateDeep(Infinity)\n      .countRelations()\n      .withPopulateOverride(getPopulateForLocalizations(typedUid))\n      .build();\n\n    const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({ locale }, uid);\n\n    const isLocalized = isContentTypeLocalized(strapi, uid);\n\n    const localeForQuery = isLocalized === true ? resolvedLocale : undefined;\n\n    const documentLocales = await documentManager.findLocales(undefined, typedUid, {\n      populate,\n      locale: localeForQuery,\n    });\n\n    if (documentLocales.length === 0) {\n      throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);\n    }\n\n    for (const document of documentLocales) {\n      if (permissionChecker.cannot.delete(document)) {\n        throw new errors.ForbiddenError();\n      }\n    }\n\n    const deletedEntity = await documentManager.delete(documentLocales[0].documentId, typedUid, {\n      locale: localeForQuery,\n    });\n\n    const sanitizedResult = await permissionChecker.sanitizeOutput(deletedEntity);\n\n    return ok({ data: sanitizedResult } as Record<string, unknown>);\n  };\n\n/**\n * Creates a handler for publishing the single-type document draft.\n * Enforces RBAC publish permission; throws NotFound when the draft is missing.\n */\nexport const createSinglePublishHandler =\n  (uid: UID.SingleType) =>\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({ args }: { args: SingleLocaleArgs }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { userAbility } = context;\n    const { locale } = args;\n    // TODO: fix UID.SingleType assignability in @strapi/types\n    const typedUid = uid as UID.ContentType;\n\n    const documentManager = getService('document-manager');\n    const permissionChecker = getService('permission-checker').create({\n      userAbility,\n      model: uid as string,\n    });\n\n    if (permissionChecker.cannot.publish()) {\n      throw new errors.ForbiddenError();\n    }\n\n    const publishedDocument = await strapi.db.transaction(async () => {\n      const sanitizedQuery = await permissionChecker.sanitizedQuery.publish({ locale });\n      const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({ locale }, uid);\n\n      const publishFindQuery: McpDocumentQuery = {\n        ...sanitizedQuery,\n        locale: resolvedLocale,\n        status: 'draft',\n      };\n      const document = await getService('document-manager')\n        .findMany(publishFindQuery as McpFindManyParams, typedUid)\n        .then((docs: any[]) => docs[0]);\n\n      if (!document) {\n        throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);\n      }\n\n      if (permissionChecker.cannot.publish(document)) {\n        throw new errors.ForbiddenError();\n      }\n\n      const publishResult = await documentManager.publish(document.documentId, typedUid, {\n        locale: resolvedLocale,\n      });\n\n      return publishResult?.at(0);\n    });\n\n    const sanitizedDocument = await permissionChecker.sanitizeOutput(publishedDocument);\n    const result = await formatDocumentWithMetadata(permissionChecker, typedUid, sanitizedDocument);\n\n    return ok(result as Record<string, unknown>);\n  };\n\n/**\n * Creates a handler for unpublishing the single-type document.\n * Optionally discards the draft in the same transaction when `discardDraft` is true.\n * Enforces RBAC unpublish (and discard) permission.\n */\nexport const createSingleUnpublishHandler =\n  (uid: UID.SingleType) =>\n  (strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({ args }: { args: SingleUnpublishArgs }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { userAbility } = context;\n    const { locale, discardDraft } = args;\n    // TODO: fix UID.SingleType assignability in @strapi/types\n    const typedUid = uid as UID.ContentType;\n\n    const documentManager = getService('document-manager');\n    const permissionChecker = getService('permission-checker').create({\n      userAbility,\n      model: uid as string,\n    });\n\n    if (permissionChecker.cannot.unpublish()) {\n      throw new errors.ForbiddenError();\n    }\n\n    if (discardDraft === true && permissionChecker.cannot.discard()) {\n      throw new errors.ForbiddenError();\n    }\n\n    const sanitizedQuery = await permissionChecker.sanitizedQuery.unpublish({ locale });\n    const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({ locale }, uid);\n\n    const unpublishFindQuery: McpDocumentQuery = { ...sanitizedQuery, locale: resolvedLocale };\n    const document = await getService('document-manager')\n      .findMany(unpublishFindQuery as McpFindManyParams, typedUid)\n      .then((docs: any[]) => docs[0]);\n\n    if (!document) {\n      throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);\n    }\n\n    if (permissionChecker.cannot.unpublish(document)) {\n      throw new errors.ForbiddenError();\n    }\n\n    if (discardDraft === true && permissionChecker.cannot.discard(document)) {\n      throw new errors.ForbiddenError();\n    }\n\n    const result = await strapi.db.transaction(async () => {\n      if (discardDraft === true) {\n        await documentManager.discardDraft(document.documentId, typedUid, {\n          locale: resolvedLocale,\n        });\n      }\n\n      return asyncPipe.pipe(\n        (doc: any) =>\n          documentManager.unpublish(doc.documentId, typedUid, { locale: resolvedLocale }),\n        permissionChecker.sanitizeOutput,\n        (doc: any) => formatDocumentWithMetadata(permissionChecker, typedUid, doc)\n      )(document);\n    });\n\n    return ok(result as Record<string, unknown>);\n  };\n\n/**\n * Creates a handler for discarding the draft of the single-type document.\n * Restores the published version as the draft. Enforces RBAC discard permission.\n */\nexport const createSingleDiscardDraftHandler =\n  (uid: UID.SingleType) =>\n  (_strapi: Core.Strapi, context: Modules.MCP.McpHandlerContext) =>\n  async ({ args }: { args: SingleLocaleArgs }): Promise<Modules.MCP.McpToolHandlerReturn> => {\n    const { userAbility } = context;\n    const { locale } = args;\n    // TODO: fix UID.SingleType assignability in @strapi/types\n    const typedUid = uid as UID.ContentType;\n\n    const documentManager = getService('document-manager');\n    const permissionChecker = getService('permission-checker').create({\n      userAbility,\n      model: uid as string,\n    });\n\n    if (permissionChecker.cannot.discard()) {\n      throw new errors.ForbiddenError();\n    }\n\n    const sanitizedQuery = await permissionChecker.sanitizedQuery.discard({ locale });\n    const { locale: resolvedLocale } = await getDocumentLocaleAndStatus({ locale }, uid);\n\n    const discardFindQuery: McpDocumentQuery = {\n      ...sanitizedQuery,\n      locale: resolvedLocale,\n      status: 'published',\n    };\n    const document = await getService('document-manager')\n      .findMany(discardFindQuery as McpFindManyParams, typedUid)\n      .then((docs: any[]) => docs[0]);\n\n    if (!document) {\n      throw new errors.NotFoundError(MCP_NOT_FOUND_DOCUMENT);\n    }\n\n    if (permissionChecker.cannot.discard(document)) {\n      throw new errors.ForbiddenError();\n    }\n\n    const discardedDocument = await asyncPipe.pipe(\n      (doc: any) =>\n        documentManager.discardDraft(doc.documentId, typedUid, { locale: resolvedLocale }),\n      permissionChecker.sanitizeOutput,\n      (doc: any) => formatDocumentWithMetadata(permissionChecker, typedUid, doc)\n    )(document);\n\n    return ok(discardedDocument as Record<string, unknown>);\n  };\n"],"names":["singleCreateOrUpdate","strapi","uid","context","args","userAbility","user","data","locale","typedUid","documentManager","getService","permissionChecker","create","model","cannot","update","errors","ForbiddenError","sanitizedQuery","resolvedLocale","getDocumentLocaleAndStatus","populate","populateFromQuery","populateDeep","Infinity","countRelations","withPopulateOverride","getPopulateForLocalizations","build","draftFindQuery","status","documentVersion","otherDocumentVersion","Promise","all","findMany","then","docs","db","query","findOne","select","documentId","sanitizeInput","sanitizeUpdateInput","sanitizeCreateInput","isEdition","undefined","sanitizedData","setCreatorFields","formatted","transaction","doc","sanitizedDocument","sanitizeOutput","formatDocumentWithMetadata","ok","createSingleGetHandler","read","permissionQuery","resolvedStatus","versionFindQuery","version","document","NotFoundError","MCP_NOT_FOUND_DOCUMENT","meta","publishedAt","availableLocales","availableStatus","result","createSingleWriteHandler","createSingleDeleteHandler","delete","isLocalized","isContentTypeLocalized","localeForQuery","documentLocales","findLocales","length","deletedEntity","sanitizedResult","createSinglePublishHandler","publish","publishedDocument","publishFindQuery","publishResult","at","createSingleUnpublishHandler","discardDraft","unpublish","discard","unpublishFindQuery","asyncPipe","pipe","createSingleDiscardDraftHandler","_strapi","discardFindQuery","discardedDocument"],"mappings":";;;;;;;;;AAgCA;AACA;AACA;AAEA;;;;AAIC,IACM,MAAMA,oBAAAA,GAAuB,OAClCC,MAAAA,EACAC,KACAC,OAAAA,EACAC,IAAAA,GAAAA;AAEA,IAAA,MAAM,EAAEC,WAAW,EAAEC,IAAI,EAAE,GAAGH,OAAAA;AAC9B,IAAA,MAAM,EAAEI,IAAI,EAAEC,MAAM,EAAE,GAAGJ,IAAAA;;AAEzB,IAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,IAAA,MAAMQ,kBAAkBC,UAAAA,CAAW,kBAAA,CAAA;AACnC,IAAA,MAAMC,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,QAAAA,WAAAA;QACAS,KAAAA,EAAOZ;AACT,KAAA,CAAA;IAEA,IAAIU,iBAAAA,CAAkBG,MAAM,CAACF,MAAM,MAAMD,iBAAAA,CAAkBG,MAAM,CAACC,MAAM,EAAA,EAAI;QAC1E,MAAM,IAAIC,OAAOC,cAAc,EAAA;AACjC,IAAA;AAEA,IAAA,MAAMC,iBAAiB,MAAMP,iBAAAA,CAAkBO,cAAc,CAACH,MAAM,CAAC;AAAER,QAAAA;AAAO,KAAA,CAAA;AAC9E,IAAA,MAAM,EAAEA,MAAAA,EAAQY,cAAc,EAAE,GAAG,MAAMC,0BAAAA,CAA2B;AAAEb,QAAAA;KAAO,EAAGN,GAAAA,CAAAA;AAEhF,IAAA,MAAMoB,WAAW,MAAMX,UAAAA,CAAW,kBAAA,CAAA,CAAoBF,QAAAA,CAAAA,CACnDc,iBAAiB,CAACJ,cAAAA,CAAAA,CAClBK,YAAY,CAACC,UACbC,cAAc,EAAA,CACdC,oBAAoB,CAACC,2BAAAA,CAA4BnB,WACjDoB,KAAK,EAAA;AAER,IAAA,MAAMC,cAAAA,GAAmC;AACvC,QAAA,GAAGX,cAAc;AACjBG,QAAAA,QAAAA;QACAd,MAAAA,EAAQY,cAAAA;QACRW,MAAAA,EAAQ;AACV,KAAA;AACA,IAAA,MAAM,CAACC,eAAAA,EAAiBC,oBAAAA,CAAqB,GAAG,MAAMC,OAAAA,CAAQC,GAAG,CAAC;QAChEzB,eAAAA,CACG0B,QAAQ,CAACN,cAAAA,EAAqCrB,QAAAA,CAAAA,CAC9C4B,IAAI,CAAC,CAACC,IAAAA,GAAgBA,IAAI,CAAC,CAAA,CAAE,CAAA;AAChCrC,QAAAA,MAAAA,CAAOsC,EAAE,CAACC,KAAK,CAAC/B,QAAAA,CAAAA,CAAUgC,OAAO,CAAC;YAAEC,MAAAA,EAAQ;AAAC,gBAAA;AAAa;AAAC,SAAA;AAC5D,KAAA,CAAA;AAED,IAAA,MAAMC,aAAaV,oBAAAA,EAAsBU,UAAAA;AAEzC,IAAA,IAAIX,eAAAA,EAAiB;AACnB,QAAA,IAAIpB,iBAAAA,CAAkBG,MAAM,CAACC,MAAM,CAACgB,eAAAA,CAAAA,EAAkB;YACpD,MAAM,IAAIf,OAAOC,cAAc,EAAA;AACjC,QAAA;AACF,IAAA,CAAA,MAAO,IAAIN,iBAAAA,CAAkBG,MAAM,CAACF,MAAM,EAAA,EAAI;QAC5C,MAAM,IAAII,OAAOC,cAAc,EAAA;AACjC,IAAA;AAEA,IAAA,MAAM0B,gBAAgBZ,eAAAA,GAClBpB,iBAAAA,CAAkBiC,mBAAmB,CAACb,eAAAA,CAAAA,GACtCpB,kBAAkBkC,mBAAmB;IAEzC,MAAMC,SAAAA,GAAYf,eAAAA,KAAoB,IAAA,IAAQA,eAAAA,KAAoBgB,SAAAA;AAClE,IAAA,MAAMC,gBAAgBC,gBAAAA,CAAiB;AAAE5C,QAAAA,IAAAA;AAAMyC,QAAAA;AAAU,KAAA,CAAA,CAAG,MAAMH,aAAAA,CAAcrC,IAAAA,CAAAA,CAAAA;AAKhF,IAAA,MAAM4C,YAAY,MAAMlD,MAAAA,CAAOsC,EAAE,CAACa,WAAW,CAAC,UAAA;QAC5C,IAAIC,GAAAA;AAEJ,QAAA,IAAIV,eAAeK,SAAAA,EAAW;AAC5BK,YAAAA,GAAAA,GAAM,MAAM3C,eAAAA,CAAgBG,MAAM,CAACJ,QAAAA,EAAU;gBAC3CF,IAAAA,EAAM0C,aAAAA;AACN,gBAAA,GAAG9B,cAAc;gBACjBX,MAAAA,EAAQY;AACV,aAAA,CAAA;QACF,CAAA,MAAO;AACLiC,YAAAA,GAAAA,GAAM,MAAM3C,eAAAA,CAAgBM,MAAM,CAAC2B,YAAYlC,QAAAA,EAAU;gBACvDF,IAAAA,EAAM0C,aAAAA;AACN3B,gBAAAA,QAAAA;gBACAd,MAAAA,EAAQY;AACV,aAAA,CAAA;AACF,QAAA;AAEA,QAAA,MAAMkC,iBAAAA,GAAoB,MAAM1C,iBAAAA,CAAkB2C,cAAc,CAACF,GAAAA,CAAAA;QACjE,OAAOG,0BAAAA,CAA2B5C,mBAAmBH,QAAAA,EAAU6C,iBAAAA,CAAAA;AACjE,IAAA,CAAA,CAAA;AAEA,IAAA,OAAOG,EAAAA,CAAGN,SAAAA,CAAAA;AACZ;AAEA;AACA;AACA;AAEA;;;;IAKO,MAAMO,sBAAAA,GACX,CAACxD,GAAAA,GACD,CAACD,MAAAA,EAAqBE,OAAAA,GACtB,OAAO,EAAEC,IAAI,EAA2B,GAAA;YACtC,MAAM,EAAEC,WAAW,EAAE,GAAGF,OAAAA;AACxB,YAAA,MAAM,EAAEK,MAAM,EAAEuB,MAAM,EAAE,GAAG3B,IAAAA;;AAE3B,YAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,YAAA,MAAMU,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,gBAAAA,WAAAA;gBACAS,KAAAA,EAAOZ;AACT,aAAA,CAAA;AAEA,YAAA,IAAIU,iBAAAA,CAAkBG,MAAM,CAAC4C,IAAI,EAAA,EAAI;gBACnC,MAAM,IAAI1C,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAM0C,kBAAkB,MAAMhD,iBAAAA,CAAkBO,cAAc,CAACwC,IAAI,CAAC;AAAEnD,gBAAAA,MAAAA;AAAQuB,gBAAAA;AAAO,aAAA,CAAA;YACrF,MAAM,EAAEvB,QAAQY,cAAc,EAAEW,QAAQ8B,cAAc,EAAE,GAAG,MAAMxC,0BAAAA,CAC/D;AAAEb,gBAAAA,MAAAA;AAAQuB,gBAAAA;aAAO,EACjB7B,GAAAA,CAAAA;AAGF,YAAA,MAAMoB,WAAW,MAAMX,UAAAA,CAAW,kBAAA,CAAA,CAAoBF,QAAAA,CAAAA,CACnDc,iBAAiB,CAACqC,eAAAA,CAAAA,CAClBpC,YAAY,CAACC,UACbC,cAAc,EAAA,CACdC,oBAAoB,CAACC,2BAAAA,CAA4BnB,WACjDoB,KAAK,EAAA;AAER,YAAA,MAAMiC,gBAAAA,GAAqC;AACzC,gBAAA,GAAGF,eAAe;AAClBtC,gBAAAA,QAAAA;gBACAd,MAAAA,EAAQY,cAAAA;gBACRW,MAAAA,EAAQ8B;AACV,aAAA;AACA,YAAA,MAAME,OAAAA,GAAU,MAAMpD,UAAAA,CAAW,kBAAA,CAAA,CAC9ByB,QAAQ,CAAC0B,gBAAAA,EAAuCrD,QAAAA,CAAAA,CAChD4B,IAAI,CAAC,CAACC,IAAAA,GAAgBA,IAAI,CAAC,CAAA,CAAE,CAAA;AAEhC,YAAA,IAAI,CAACyB,OAAAA,EAAS;AACZ,gBAAA,IAAInD,iBAAAA,CAAkBG,MAAM,CAACF,MAAM,EAAA,EAAI;oBACrC,MAAM,IAAII,OAAOC,cAAc,EAAA;AACjC,gBAAA;gBAEA,MAAM8C,QAAAA,GAAW,MAAM/D,MAAAA,CAAOsC,EAAE,CAACC,KAAK,CAAC/B,QAAAA,CAAAA,CAAUgC,OAAO,CAAC,EAAC,CAAA;AAE1D,gBAAA,IAAI,CAACuB,QAAAA,EAAU;oBACb,MAAM,IAAI/C,MAAAA,CAAOgD,aAAa,CAACC,sBAAAA,CAAAA;AACjC,gBAAA;AAEA,gBAAA,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMX,0BAAAA,CACrB5C,mBACAH,QAAAA,EACA;AACEkC,oBAAAA,UAAAA,EAAYqB,SAASrB,UAAU;oBAC/BnC,MAAAA,EAAQY,cAAAA;oBACRgD,WAAAA,EAAa;iBACf,EACA;oBAAEC,gBAAAA,EAAkB,IAAA;oBAAMC,eAAAA,EAAiB;AAAM,iBAAA,CAAA;AAGnD,gBAAA,OAAOb,EAAAA,CAAG;AAAElD,oBAAAA,IAAAA,EAAM,EAAC;AAAG4D,oBAAAA;AAAK,iBAAA,CAAA;AAC7B,YAAA;AAEA,YAAA,IAAIvD,iBAAAA,CAAkBG,MAAM,CAAC4C,IAAI,CAACI,OAAAA,CAAAA,EAAU;gBAC1C,MAAM,IAAI9C,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMoC,iBAAAA,GAAoB,MAAM1C,iBAAAA,CAAkB2C,cAAc,CAACQ,OAAAA,CAAAA;AACjE,YAAA,MAAMQ,MAAAA,GAAS,MAAMf,0BAAAA,CAA2B5C,iBAAAA,EAAmBH,QAAAA,EAAU6C,iBAAAA,CAAAA;AAE7E,YAAA,OAAOG,EAAAA,CAAGc,MAAAA,CAAAA;QACZ;AAEF;;;IAIO,MAAMC,wBAAAA,GACX,CAACtE,GAAAA,GACD,CAACD,MAAAA,EAAqBE,OAAAA,GACtB,OAAO,EACLC,IAAI,EAGL,GAAA;YACC,OAAOJ,oBAAAA,CAAqBC,MAAAA,EAAQC,GAAAA,EAAKC,OAAAA,EAASC,IAAAA,CAAAA;QACpD;AAEF;;;IAIO,MAAMqE,yBAAAA,GACX,CAACvE,GAAAA,GACD,CAACD,MAAAA,EAAqBE,OAAAA,GACtB,OAAO,EAAEC,IAAI,EAA8B,GAAA;YACzC,MAAM,EAAEC,WAAW,EAAE,GAAGF,OAAAA;YACxB,MAAM,EAAEK,MAAM,EAAE,GAAGJ,IAAAA;;AAEnB,YAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,YAAA,MAAMQ,kBAAkBC,UAAAA,CAAW,kBAAA,CAAA;AACnC,YAAA,MAAMC,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,gBAAAA,WAAAA;gBACAS,KAAAA,EAAOZ;AACT,aAAA,CAAA;AAEA,YAAA,IAAIU,iBAAAA,CAAkBG,MAAM,CAAC2D,MAAM,EAAA,EAAI;gBACrC,MAAM,IAAIzD,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMC,iBAAiB,MAAMP,iBAAAA,CAAkBO,cAAc,CAACuD,MAAM,CAAC;AAAElE,gBAAAA;AAAO,aAAA,CAAA;AAE9E,YAAA,MAAMc,WAAW,MAAMX,UAAAA,CAAW,kBAAA,CAAA,CAAoBF,QAAAA,CAAAA,CACnDc,iBAAiB,CAACJ,cAAAA,CAAAA,CAClBK,YAAY,CAACC,UACbC,cAAc,EAAA,CACdC,oBAAoB,CAACC,2BAAAA,CAA4BnB,WACjDoB,KAAK,EAAA;AAER,YAAA,MAAM,EAAErB,MAAAA,EAAQY,cAAc,EAAE,GAAG,MAAMC,0BAAAA,CAA2B;AAAEb,gBAAAA;aAAO,EAAGN,GAAAA,CAAAA;YAEhF,MAAMyE,WAAAA,GAAcC,uBAAuB3E,MAAAA,EAAQC,GAAAA,CAAAA;YAEnD,MAAM2E,cAAAA,GAAiBF,WAAAA,KAAgB,IAAA,GAAOvD,cAAAA,GAAiB4B,SAAAA;AAE/D,YAAA,MAAM8B,kBAAkB,MAAMpE,eAAAA,CAAgBqE,WAAW,CAAC/B,WAAWvC,QAAAA,EAAU;AAC7Ea,gBAAAA,QAAAA;gBACAd,MAAAA,EAAQqE;AACV,aAAA,CAAA;YAEA,IAAIC,eAAAA,CAAgBE,MAAM,KAAK,CAAA,EAAG;gBAChC,MAAM,IAAI/D,MAAAA,CAAOgD,aAAa,CAACC,sBAAAA,CAAAA;AACjC,YAAA;YAEA,KAAK,MAAMF,YAAYc,eAAAA,CAAiB;AACtC,gBAAA,IAAIlE,iBAAAA,CAAkBG,MAAM,CAAC2D,MAAM,CAACV,QAAAA,CAAAA,EAAW;oBAC7C,MAAM,IAAI/C,OAAOC,cAAc,EAAA;AACjC,gBAAA;AACF,YAAA;YAEA,MAAM+D,aAAAA,GAAgB,MAAMvE,eAAAA,CAAgBgE,MAAM,CAACI,eAAe,CAAC,CAAA,CAAE,CAACnC,UAAU,EAAElC,QAAAA,EAAU;gBAC1FD,MAAAA,EAAQqE;AACV,aAAA,CAAA;AAEA,YAAA,MAAMK,eAAAA,GAAkB,MAAMtE,iBAAAA,CAAkB2C,cAAc,CAAC0B,aAAAA,CAAAA;AAE/D,YAAA,OAAOxB,EAAAA,CAAG;gBAAElD,IAAAA,EAAM2E;AAAgB,aAAA,CAAA;QACpC;AAEF;;;IAIO,MAAMC,0BAAAA,GACX,CAACjF,GAAAA,GACD,CAACD,MAAAA,EAAqBE,OAAAA,GACtB,OAAO,EAAEC,IAAI,EAA8B,GAAA;YACzC,MAAM,EAAEC,WAAW,EAAE,GAAGF,OAAAA;YACxB,MAAM,EAAEK,MAAM,EAAE,GAAGJ,IAAAA;;AAEnB,YAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,YAAA,MAAMQ,kBAAkBC,UAAAA,CAAW,kBAAA,CAAA;AACnC,YAAA,MAAMC,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,gBAAAA,WAAAA;gBACAS,KAAAA,EAAOZ;AACT,aAAA,CAAA;AAEA,YAAA,IAAIU,iBAAAA,CAAkBG,MAAM,CAACqE,OAAO,EAAA,EAAI;gBACtC,MAAM,IAAInE,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMmE,oBAAoB,MAAMpF,MAAAA,CAAOsC,EAAE,CAACa,WAAW,CAAC,UAAA;AACpD,gBAAA,MAAMjC,iBAAiB,MAAMP,iBAAAA,CAAkBO,cAAc,CAACiE,OAAO,CAAC;AAAE5E,oBAAAA;AAAO,iBAAA,CAAA;AAC/E,gBAAA,MAAM,EAAEA,MAAAA,EAAQY,cAAc,EAAE,GAAG,MAAMC,0BAAAA,CAA2B;AAAEb,oBAAAA;iBAAO,EAAGN,GAAAA,CAAAA;AAEhF,gBAAA,MAAMoF,gBAAAA,GAAqC;AACzC,oBAAA,GAAGnE,cAAc;oBACjBX,MAAAA,EAAQY,cAAAA;oBACRW,MAAAA,EAAQ;AACV,iBAAA;AACA,gBAAA,MAAMiC,QAAAA,GAAW,MAAMrD,UAAAA,CAAW,kBAAA,CAAA,CAC/ByB,QAAQ,CAACkD,gBAAAA,EAAuC7E,QAAAA,CAAAA,CAChD4B,IAAI,CAAC,CAACC,IAAAA,GAAgBA,IAAI,CAAC,CAAA,CAAE,CAAA;AAEhC,gBAAA,IAAI,CAAC0B,QAAAA,EAAU;oBACb,MAAM,IAAI/C,MAAAA,CAAOgD,aAAa,CAACC,sBAAAA,CAAAA;AACjC,gBAAA;AAEA,gBAAA,IAAItD,iBAAAA,CAAkBG,MAAM,CAACqE,OAAO,CAACpB,QAAAA,CAAAA,EAAW;oBAC9C,MAAM,IAAI/C,OAAOC,cAAc,EAAA;AACjC,gBAAA;gBAEA,MAAMqE,aAAAA,GAAgB,MAAM7E,eAAAA,CAAgB0E,OAAO,CAACpB,QAAAA,CAASrB,UAAU,EAAElC,QAAAA,EAAU;oBACjFD,MAAAA,EAAQY;AACV,iBAAA,CAAA;AAEA,gBAAA,OAAOmE,eAAeC,EAAAA,CAAG,CAAA,CAAA;AAC3B,YAAA,CAAA,CAAA;AAEA,YAAA,MAAMlC,iBAAAA,GAAoB,MAAM1C,iBAAAA,CAAkB2C,cAAc,CAAC8B,iBAAAA,CAAAA;AACjE,YAAA,MAAMd,MAAAA,GAAS,MAAMf,0BAAAA,CAA2B5C,iBAAAA,EAAmBH,QAAAA,EAAU6C,iBAAAA,CAAAA;AAE7E,YAAA,OAAOG,EAAAA,CAAGc,MAAAA,CAAAA;QACZ;AAEF;;;;IAKO,MAAMkB,4BAAAA,GACX,CAACvF,GAAAA,GACD,CAACD,MAAAA,EAAqBE,OAAAA,GACtB,OAAO,EAAEC,IAAI,EAAiC,GAAA;YAC5C,MAAM,EAAEC,WAAW,EAAE,GAAGF,OAAAA;AACxB,YAAA,MAAM,EAAEK,MAAM,EAAEkF,YAAY,EAAE,GAAGtF,IAAAA;;AAEjC,YAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,YAAA,MAAMQ,kBAAkBC,UAAAA,CAAW,kBAAA,CAAA;AACnC,YAAA,MAAMC,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,gBAAAA,WAAAA;gBACAS,KAAAA,EAAOZ;AACT,aAAA,CAAA;AAEA,YAAA,IAAIU,iBAAAA,CAAkBG,MAAM,CAAC4E,SAAS,EAAA,EAAI;gBACxC,MAAM,IAAI1E,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,IAAIwE,iBAAiB,IAAA,IAAQ9E,iBAAAA,CAAkBG,MAAM,CAAC6E,OAAO,EAAA,EAAI;gBAC/D,MAAM,IAAI3E,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMC,iBAAiB,MAAMP,iBAAAA,CAAkBO,cAAc,CAACwE,SAAS,CAAC;AAAEnF,gBAAAA;AAAO,aAAA,CAAA;AACjF,YAAA,MAAM,EAAEA,MAAAA,EAAQY,cAAc,EAAE,GAAG,MAAMC,0BAAAA,CAA2B;AAAEb,gBAAAA;aAAO,EAAGN,GAAAA,CAAAA;AAEhF,YAAA,MAAM2F,kBAAAA,GAAuC;AAAE,gBAAA,GAAG1E,cAAc;gBAAEX,MAAAA,EAAQY;AAAe,aAAA;AACzF,YAAA,MAAM4C,QAAAA,GAAW,MAAMrD,UAAAA,CAAW,kBAAA,CAAA,CAC/ByB,QAAQ,CAACyD,kBAAAA,EAAyCpF,QAAAA,CAAAA,CAClD4B,IAAI,CAAC,CAACC,IAAAA,GAAgBA,IAAI,CAAC,CAAA,CAAE,CAAA;AAEhC,YAAA,IAAI,CAAC0B,QAAAA,EAAU;gBACb,MAAM,IAAI/C,MAAAA,CAAOgD,aAAa,CAACC,sBAAAA,CAAAA;AACjC,YAAA;AAEA,YAAA,IAAItD,iBAAAA,CAAkBG,MAAM,CAAC4E,SAAS,CAAC3B,QAAAA,CAAAA,EAAW;gBAChD,MAAM,IAAI/C,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,IAAIwE,iBAAiB,IAAA,IAAQ9E,iBAAAA,CAAkBG,MAAM,CAAC6E,OAAO,CAAC5B,QAAAA,CAAAA,EAAW;gBACvE,MAAM,IAAI/C,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMqD,SAAS,MAAMtE,MAAAA,CAAOsC,EAAE,CAACa,WAAW,CAAC,UAAA;AACzC,gBAAA,IAAIsC,iBAAiB,IAAA,EAAM;AACzB,oBAAA,MAAMhF,gBAAgBgF,YAAY,CAAC1B,QAAAA,CAASrB,UAAU,EAAElC,QAAAA,EAAU;wBAChED,MAAAA,EAAQY;AACV,qBAAA,CAAA;AACF,gBAAA;gBAEA,OAAO0E,KAAAA,CAAUC,IAAI,CACnB,CAAC1C,GAAAA,GACC3C,eAAAA,CAAgBiF,SAAS,CAACtC,GAAAA,CAAIV,UAAU,EAAElC,QAAAA,EAAU;wBAAED,MAAAA,EAAQY;qBAAe,CAAA,EAC/ER,iBAAAA,CAAkB2C,cAAc,EAChC,CAACF,MAAaG,0BAAAA,CAA2B5C,iBAAAA,EAAmBH,UAAU4C,GAAAA,CAAAA,CAAAA,CACtEW,QAAAA,CAAAA;AACJ,YAAA,CAAA,CAAA;AAEA,YAAA,OAAOP,EAAAA,CAAGc,MAAAA,CAAAA;QACZ;AAEF;;;IAIO,MAAMyB,+BAAAA,GACX,CAAC9F,GAAAA,GACD,CAAC+F,OAAAA,EAAsB9F,OAAAA,GACvB,OAAO,EAAEC,IAAI,EAA8B,GAAA;YACzC,MAAM,EAAEC,WAAW,EAAE,GAAGF,OAAAA;YACxB,MAAM,EAAEK,MAAM,EAAE,GAAGJ,IAAAA;;AAEnB,YAAA,MAAMK,QAAAA,GAAWP,GAAAA;AAEjB,YAAA,MAAMQ,kBAAkBC,UAAAA,CAAW,kBAAA,CAAA;AACnC,YAAA,MAAMC,iBAAAA,GAAoBD,UAAAA,CAAW,oBAAA,CAAA,CAAsBE,MAAM,CAAC;AAChER,gBAAAA,WAAAA;gBACAS,KAAAA,EAAOZ;AACT,aAAA,CAAA;AAEA,YAAA,IAAIU,iBAAAA,CAAkBG,MAAM,CAAC6E,OAAO,EAAA,EAAI;gBACtC,MAAM,IAAI3E,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMC,iBAAiB,MAAMP,iBAAAA,CAAkBO,cAAc,CAACyE,OAAO,CAAC;AAAEpF,gBAAAA;AAAO,aAAA,CAAA;AAC/E,YAAA,MAAM,EAAEA,MAAAA,EAAQY,cAAc,EAAE,GAAG,MAAMC,0BAAAA,CAA2B;AAAEb,gBAAAA;aAAO,EAAGN,GAAAA,CAAAA;AAEhF,YAAA,MAAMgG,gBAAAA,GAAqC;AACzC,gBAAA,GAAG/E,cAAc;gBACjBX,MAAAA,EAAQY,cAAAA;gBACRW,MAAAA,EAAQ;AACV,aAAA;AACA,YAAA,MAAMiC,QAAAA,GAAW,MAAMrD,UAAAA,CAAW,kBAAA,CAAA,CAC/ByB,QAAQ,CAAC8D,gBAAAA,EAAuCzF,QAAAA,CAAAA,CAChD4B,IAAI,CAAC,CAACC,IAAAA,GAAgBA,IAAI,CAAC,CAAA,CAAE,CAAA;AAEhC,YAAA,IAAI,CAAC0B,QAAAA,EAAU;gBACb,MAAM,IAAI/C,MAAAA,CAAOgD,aAAa,CAACC,sBAAAA,CAAAA;AACjC,YAAA;AAEA,YAAA,IAAItD,iBAAAA,CAAkBG,MAAM,CAAC6E,OAAO,CAAC5B,QAAAA,CAAAA,EAAW;gBAC9C,MAAM,IAAI/C,OAAOC,cAAc,EAAA;AACjC,YAAA;AAEA,YAAA,MAAMiF,iBAAAA,GAAoB,MAAML,KAAAA,CAAUC,IAAI,CAC5C,CAAC1C,GAAAA,GACC3C,eAAAA,CAAgBgF,YAAY,CAACrC,GAAAA,CAAIV,UAAU,EAAElC,QAAAA,EAAU;oBAAED,MAAAA,EAAQY;iBAAe,CAAA,EAClFR,iBAAAA,CAAkB2C,cAAc,EAChC,CAACF,MAAaG,0BAAAA,CAA2B5C,iBAAAA,EAAmBH,UAAU4C,GAAAA,CAAAA,CAAAA,CACtEW,QAAAA,CAAAA;AAEF,YAAA,OAAOP,EAAAA,CAAG0C,iBAAAA,CAAAA;QACZ;;;;"}

package/dist/server/mcp/permissions.js

@@ -0,0 +1,138 @@
+'use strict';
+
+var strapiUtils = require('@strapi/utils');
+var index = require('../utils/index.js');
+
+/** Returns true if the content type identified by `uid` has the i18n `localized` plugin option enabled. */ const isContentTypeLocalized = (strapi, uid)=>{
+    const ct = strapi.contentTypes?.[uid];
+    if (ct === undefined) return false;
+    return ct.pluginOptions?.i18n?.localized === true;
+};
+const localeDefaultDescription = (defaultLocale, allowedLocales)=>{
+    if (defaultLocale !== null && allowedLocales.includes(defaultLocale)) {
+        return `Defaults to "${defaultLocale}".`;
+    }
+    return 'Defaults to the default locale.';
+};
+/**
+ * Builds the base locale Zod schema for a derived MCP tool input.
+ * When `localeCodes` is provided, constrains the field to a `z.enum` of available codes
+ * with an optional default; otherwise falls back to a plain optional string.
+ */ const buildLocaleSchema = (localeCodes, defaultLocale)=>{
+    if (localeCodes !== null && localeCodes.length > 0) {
+        let schema = strapiUtils.z.enum(localeCodes).optional();
+        if (defaultLocale !== null && localeCodes.includes(defaultLocale)) {
+            schema = schema.default(defaultLocale);
+        }
+        return schema.describe(`Locale code. Available: ${localeCodes.join(', ')}. ${localeDefaultDescription(defaultLocale, localeCodes)}`);
+    }
+    return strapiUtils.z.string().optional().describe('Locale code (e.g. "en", "fr"). Defaults to the default locale.');
+};
+/**
+ * Narrows the base locale schema to only locales the session is permitted to access
+ * for the given action + uid combination.
+ *
+ * Returns the base schema unchanged when:
+ *   - localeCodes is null (i18n not installed)
+ *   - the content type is not localized
+ *   - all installed locales are permitted for this action
+ *
+ * Returns z.never().optional() when no locales are permitted, keeping the tool
+ * registered but signalling no valid locale input.
+ */ const resolvePermittedLocaleSchema = (strapi, context, action, uid, localeCodes, defaultLocale, baseLocaleSchema)=>{
+    if (localeCodes === null) return baseLocaleSchema;
+    const isLocalized = isContentTypeLocalized(strapi, uid);
+    if (isLocalized === false) {
+        return strapiUtils.z.string().optional().describe('This content type is not localized. Locale is ignored.');
+    }
+    const permissionChecker = index.getService('permission-checker').create({
+        userAbility: context.userAbility,
+        model: uid
+    });
+    const permitted = getPermittedLocales(permissionChecker, action, localeCodes);
+    if (permitted === null) return baseLocaleSchema;
+    if (permitted.length === 0) {
+        return strapiUtils.z.never().optional().describe('No locale access for this action.');
+    }
+    let schema = strapiUtils.z.enum(permitted).optional();
+    if (defaultLocale !== null && permitted.includes(defaultLocale)) {
+        schema = schema.default(defaultLocale);
+    }
+    return schema.describe(`Locale code. Permitted: ${permitted.join(', ')}. ${localeDefaultDescription(defaultLocale, permitted)}`);
+};
+/**
+ * Recursively resolves leaf field paths for a component, matching the nested
+ * path format used by CASL rules (e.g. 'SEO.title', 'SEO.og.image').
+ *
+ * The admin RBAC system decomposes component attrs into nested paths and removes
+ * the parent key — so checking `ability.can(action, uid, 'SEO')` returns false
+ * even when the user has full access to the component's sub-fields.
+ */ const getComponentLeafPaths = (strapi, componentUid, prefix, visited = new Set())=>{
+    if (visited.has(componentUid) === true) return [
+        prefix
+    ];
+    const component = strapi.components[componentUid];
+    if (component === undefined) return [
+        prefix
+    ];
+    visited.add(componentUid);
+    const paths = [];
+    for (const [key, attr] of Object.entries(component.attributes)){
+        if (key === 'id') {
+            continue;
+        }
+        const fieldPath = `${prefix}.${key}`;
+        if (attr.type === 'component' && attr.component !== undefined) {
+            paths.push(...getComponentLeafPaths(strapi, attr.component, fieldPath, visited));
+        } else {
+            paths.push(fieldPath);
+        }
+    }
+    visited.delete(componentUid);
+    return paths.length > 0 ? paths : [
+        prefix
+    ];
+};
+/**
+ * Returns the subset of attribute keys the session may access for `action` on `uid`.
+ * Returns `null` when all fields are permitted (caller should skip field filtering).
+ * Component attributes are resolved to their nested leaf paths before checking CASL rules.
+ */ const getPermittedFields = (strapi, userAbility, action, uid, attributes)=>{
+    const allKeys = Object.keys(attributes);
+    const permitted = allKeys.filter((key)=>{
+        if (userAbility.can(action, uid, key) === true) return true;
+        // Component attrs: CASL rules use nested paths (e.g. 'SEO.title').
+        // Check if at least one sub-field path is permitted.
+        const attr = attributes[key];
+        if (attr.type === 'component' && attr.component !== undefined) {
+            const leafPaths = getComponentLeafPaths(strapi, attr.component, key);
+            return leafPaths.some((path)=>userAbility.can(action, uid, path) === true);
+        }
+        return false;
+    });
+    if (permitted.length === allKeys.length) {
+        return null;
+    }
+    return new Set(permitted);
+};
+/**
+ * Filters `localeCodes` to only those the session may access for `action`.
+ * Returns `null` when all locales are permitted (caller should use the unfiltered base schema).
+ * Returns an empty tuple-like array when no locale is permitted.
+ */ const getPermittedLocales = (permissionChecker, action, localeCodes)=>{
+    const permitted = localeCodes.filter((code)=>permissionChecker.cannot(action, {
+            locale: code
+        }) === false);
+    if (permitted.length === localeCodes.length) {
+        return null;
+    }
+    return permitted.length > 0 ? permitted : [];
+};
+
+exports.buildLocaleSchema = buildLocaleSchema;
+exports.getComponentLeafPaths = getComponentLeafPaths;
+exports.getPermittedFields = getPermittedFields;
+exports.getPermittedLocales = getPermittedLocales;
+exports.isContentTypeLocalized = isContentTypeLocalized;
+exports.resolvePermittedLocaleSchema = resolvePermittedLocaleSchema;
+//# sourceMappingURL=permissions.js.map

package/dist/server/mcp/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sources":["../../../server/src/mcp/permissions.ts"],"sourcesContent":["import { z } from '@strapi/utils';\nimport type { Core, Modules, Struct, UID } from '@strapi/types';\n\nimport { getService } from '../utils';\nimport type { ContentManagerModelForMcp } from './types';\n\n/** Returns true if the content type identified by `uid` has the i18n `localized` plugin option enabled. */\nexport const isContentTypeLocalized = (strapi: Core.Strapi, uid: string): boolean => {\n  const ct = strapi.contentTypes?.[uid as UID.ContentType];\n  if (ct === undefined) return false;\n  return (\n    (ct as { pluginOptions?: { i18n?: { localized?: boolean } } }).pluginOptions?.i18n\n      ?.localized === true\n  );\n};\n\nconst localeDefaultDescription = (\n  defaultLocale: string | null,\n  allowedLocales: readonly string[]\n): string => {\n  if (defaultLocale !== null && allowedLocales.includes(defaultLocale)) {\n    return `Defaults to \"${defaultLocale}\".`;\n  }\n\n  return 'Defaults to the default locale.';\n};\n\n/**\n * Builds the base locale Zod schema for a derived MCP tool input.\n * When `localeCodes` is provided, constrains the field to a `z.enum` of available codes\n * with an optional default; otherwise falls back to a plain optional string.\n */\nexport const buildLocaleSchema = (\n  localeCodes: [string, ...string[]] | null,\n  defaultLocale: string | null\n): z.ZodTypeAny => {\n  if (localeCodes !== null && localeCodes.length > 0) {\n    let schema: z.ZodTypeAny = z.enum(localeCodes).optional();\n\n    if (defaultLocale !== null && localeCodes.includes(defaultLocale)) {\n      schema = schema.default(defaultLocale);\n    }\n\n    return schema.describe(\n      `Locale code. Available: ${localeCodes.join(', ')}. ${localeDefaultDescription(defaultLocale, localeCodes)}`\n    );\n  }\n\n  return z\n    .string()\n    .optional()\n    .describe('Locale code (e.g. \"en\", \"fr\"). Defaults to the default locale.');\n};\n\n/**\n * Narrows the base locale schema to only locales the session is permitted to access\n * for the given action + uid combination.\n *\n * Returns the base schema unchanged when:\n *   - localeCodes is null (i18n not installed)\n *   - the content type is not localized\n *   - all installed locales are permitted for this action\n *\n * Returns z.never().optional() when no locales are permitted, keeping the tool\n * registered but signalling no valid locale input.\n */\nexport const resolvePermittedLocaleSchema = (\n  strapi: Core.Strapi,\n  context: Modules.MCP.McpHandlerContext,\n  action: string,\n  uid: string,\n  localeCodes: [string, ...string[]] | null,\n  defaultLocale: string | null,\n  baseLocaleSchema: z.ZodTypeAny\n): z.ZodTypeAny => {\n  if (localeCodes === null) return baseLocaleSchema;\n\n  const isLocalized = isContentTypeLocalized(strapi, uid);\n  if (isLocalized === false) {\n    return z.string().optional().describe('This content type is not localized. Locale is ignored.');\n  }\n\n  const permissionChecker = getService('permission-checker').create({\n    userAbility: context.userAbility,\n    model: uid,\n  });\n  const permitted = getPermittedLocales(permissionChecker, action, localeCodes);\n  if (permitted === null) return baseLocaleSchema;\n  if (permitted.length === 0) {\n    return z.never().optional().describe('No locale access for this action.');\n  }\n\n  let schema: z.ZodTypeAny = z.enum(permitted).optional();\n\n  if (defaultLocale !== null && permitted.includes(defaultLocale)) {\n    schema = schema.default(defaultLocale);\n  }\n\n  return schema.describe(\n    `Locale code. Permitted: ${permitted.join(', ')}. ${localeDefaultDescription(defaultLocale, permitted)}`\n  );\n};\n\n/**\n * Recursively resolves leaf field paths for a component, matching the nested\n * path format used by CASL rules (e.g. 'SEO.title', 'SEO.og.image').\n *\n * The admin RBAC system decomposes component attrs into nested paths and removes\n * the parent key — so checking `ability.can(action, uid, 'SEO')` returns false\n * even when the user has full access to the component's sub-fields.\n */\nexport const getComponentLeafPaths = (\n  strapi: Core.Strapi,\n  componentUid: string,\n  prefix: string,\n  visited: Set<string> = new Set()\n): string[] => {\n  if (visited.has(componentUid) === true) return [prefix];\n\n  type ComponentEntry = { attributes: Record<string, { type: string; component?: string }> };\n  const component = (strapi.components as unknown as Record<string, ComponentEntry | undefined>)[\n    componentUid\n  ];\n  if (component === undefined) return [prefix];\n\n  visited.add(componentUid);\n  const paths: string[] = [];\n\n  for (const [key, attr] of Object.entries(component.attributes)) {\n    if (key === 'id') {\n      // skip system id field — it is not a user-facing permission path\n      // eslint-disable-next-line no-continue\n      continue;\n    }\n    const fieldPath = `${prefix}.${key}`;\n\n    if (attr.type === 'component' && attr.component !== undefined) {\n      paths.push(...getComponentLeafPaths(strapi, attr.component, fieldPath, visited));\n    } else {\n      paths.push(fieldPath);\n    }\n  }\n\n  visited.delete(componentUid);\n\n  return paths.length > 0 ? paths : [prefix];\n};\n\n/**\n * Returns the subset of attribute keys the session may access for `action` on `uid`.\n * Returns `null` when all fields are permitted (caller should skip field filtering).\n * Component attributes are resolved to their nested leaf paths before checking CASL rules.\n */\nexport const getPermittedFields = (\n  strapi: Core.Strapi,\n  userAbility: Modules.MCP.McpHandlerContext['userAbility'],\n  action: string,\n  uid: string,\n  attributes: Struct.SchemaAttributes\n): Set<string> | null => {\n  const allKeys = Object.keys(attributes);\n  const permitted = allKeys.filter((key) => {\n    if (userAbility.can(action, uid, key) === true) return true;\n\n    // Component attrs: CASL rules use nested paths (e.g. 'SEO.title').\n    // Check if at least one sub-field path is permitted.\n    const attr = attributes[key] as { type: string; component?: string };\n    if (attr.type === 'component' && attr.component !== undefined) {\n      const leafPaths = getComponentLeafPaths(strapi, attr.component, key);\n      return leafPaths.some((path) => userAbility.can(action, uid, path) === true);\n    }\n\n    return false;\n  });\n\n  if (permitted.length === allKeys.length) {\n    return null;\n  }\n\n  return new Set(permitted);\n};\n\n/**\n * Filters `localeCodes` to only those the session may access for `action`.\n * Returns `null` when all locales are permitted (caller should use the unfiltered base schema).\n * Returns an empty tuple-like array when no locale is permitted.\n */\nexport const getPermittedLocales = (\n  permissionChecker: { cannot: (action: string, entity?: unknown) => boolean },\n  action: string,\n  localeCodes: [string, ...string[]]\n): [string, ...string[]] | null => {\n  const permitted = localeCodes.filter(\n    (code) => permissionChecker.cannot(action, { locale: code }) === false\n  );\n\n  if (permitted.length === localeCodes.length) {\n    return null;\n  }\n\n  return permitted.length > 0\n    ? (permitted as [string, ...string[]])\n    : ([] as unknown as [string, ...string[]]);\n};\n\n// Re-export for use in handler files (avoids needing to import from permissions in each handler)\nexport type { ContentManagerModelForMcp };\n"],"names":["isContentTypeLocalized","strapi","uid","ct","contentTypes","undefined","pluginOptions","i18n","localized","localeDefaultDescription","defaultLocale","allowedLocales","includes","buildLocaleSchema","localeCodes","length","schema","z","enum","optional","default","describe","join","string","resolvePermittedLocaleSchema","context","action","baseLocaleSchema","isLocalized","permissionChecker","getService","create","userAbility","model","permitted","getPermittedLocales","never","getComponentLeafPaths","componentUid","prefix","visited","Set","has","component","components","add","paths","key","attr","Object","entries","attributes","fieldPath","type","push","delete","getPermittedFields","allKeys","keys","filter","can","leafPaths","some","path","code","cannot","locale"],"mappings":";;;;;AAMA,4GACO,MAAMA,sBAAAA,GAAyB,CAACC,MAAAA,EAAqBC,GAAAA,GAAAA;AAC1D,IAAA,MAAMC,EAAAA,GAAKF,MAAAA,CAAOG,YAAY,GAAGF,GAAAA,CAAuB;IACxD,IAAIC,EAAAA,KAAOE,WAAW,OAAO,KAAA;AAC7B,IAAA,OACE,EAACF,CAA8DG,aAAa,EAAEC,MAC1EC,SAAAA,KAAc,IAAA;AAEtB;AAEA,MAAMC,wBAAAA,GAA2B,CAC/BC,aAAAA,EACAC,cAAAA,GAAAA;AAEA,IAAA,IAAID,aAAAA,KAAkB,IAAA,IAAQC,cAAAA,CAAeC,QAAQ,CAACF,aAAAA,CAAAA,EAAgB;AACpE,QAAA,OAAO,CAAC,aAAa,EAAEA,aAAAA,CAAc,EAAE,CAAC;AAC1C,IAAA;IAEA,OAAO,iCAAA;AACT,CAAA;AAEA;;;;AAIC,IACM,MAAMG,iBAAAA,GAAoB,CAC/BC,WAAAA,EACAJ,aAAAA,GAAAA;AAEA,IAAA,IAAII,WAAAA,KAAgB,IAAA,IAAQA,WAAAA,CAAYC,MAAM,GAAG,CAAA,EAAG;AAClD,QAAA,IAAIC,MAAAA,GAAuBC,aAAAA,CAAEC,IAAI,CAACJ,aAAaK,QAAQ,EAAA;AAEvD,QAAA,IAAIT,aAAAA,KAAkB,IAAA,IAAQI,WAAAA,CAAYF,QAAQ,CAACF,aAAAA,CAAAA,EAAgB;YACjEM,MAAAA,GAASA,MAAAA,CAAOI,OAAO,CAACV,aAAAA,CAAAA;AAC1B,QAAA;AAEA,QAAA,OAAOM,MAAAA,CAAOK,QAAQ,CACpB,CAAC,wBAAwB,EAAEP,WAAAA,CAAYQ,IAAI,CAAC,IAAA,CAAA,CAAM,EAAE,EAAEb,wBAAAA,CAAyBC,eAAeI,WAAAA,CAAAA,CAAAA,CAAc,CAAA;AAEhH,IAAA;AAEA,IAAA,OAAOG,cACJM,MAAM,EAAA,CACNJ,QAAQ,EAAA,CACRE,QAAQ,CAAC,gEAAA,CAAA;AACd;AAEA;;;;;;;;;;;UAYaG,4BAAAA,GAA+B,CAC1CvB,QACAwB,OAAAA,EACAC,MAAAA,EACAxB,GAAAA,EACAY,WAAAA,EACAJ,aAAAA,EACAiB,gBAAAA,GAAAA;IAEA,IAAIb,WAAAA,KAAgB,MAAM,OAAOa,gBAAAA;IAEjC,MAAMC,WAAAA,GAAc5B,uBAAuBC,MAAAA,EAAQC,GAAAA,CAAAA;AACnD,IAAA,IAAI0B,gBAAgB,KAAA,EAAO;AACzB,QAAA,OAAOX,cAAEM,MAAM,EAAA,CAAGJ,QAAQ,EAAA,CAAGE,QAAQ,CAAC,wDAAA,CAAA;AACxC,IAAA;AAEA,IAAA,MAAMQ,iBAAAA,GAAoBC,gBAAAA,CAAW,oBAAA,CAAA,CAAsBC,MAAM,CAAC;AAChEC,QAAAA,WAAAA,EAAaP,QAAQO,WAAW;QAChCC,KAAAA,EAAO/B;AACT,KAAA,CAAA;IACA,MAAMgC,SAAAA,GAAYC,mBAAAA,CAAoBN,iBAAAA,EAAmBH,MAAAA,EAAQZ,WAAAA,CAAAA;IACjE,IAAIoB,SAAAA,KAAc,MAAM,OAAOP,gBAAAA;IAC/B,IAAIO,SAAAA,CAAUnB,MAAM,KAAK,CAAA,EAAG;AAC1B,QAAA,OAAOE,cAAEmB,KAAK,EAAA,CAAGjB,QAAQ,EAAA,CAAGE,QAAQ,CAAC,mCAAA,CAAA;AACvC,IAAA;AAEA,IAAA,IAAIL,MAAAA,GAAuBC,aAAAA,CAAEC,IAAI,CAACgB,WAAWf,QAAQ,EAAA;AAErD,IAAA,IAAIT,aAAAA,KAAkB,IAAA,IAAQwB,SAAAA,CAAUtB,QAAQ,CAACF,aAAAA,CAAAA,EAAgB;QAC/DM,MAAAA,GAASA,MAAAA,CAAOI,OAAO,CAACV,aAAAA,CAAAA;AAC1B,IAAA;AAEA,IAAA,OAAOM,MAAAA,CAAOK,QAAQ,CACpB,CAAC,wBAAwB,EAAEa,SAAAA,CAAUZ,IAAI,CAAC,IAAA,CAAA,CAAM,EAAE,EAAEb,wBAAAA,CAAyBC,eAAewB,SAAAA,CAAAA,CAAAA,CAAY,CAAA;AAE5G;AAEA;;;;;;;UAQaG,qBAAAA,GAAwB,CACnCpC,QACAqC,YAAAA,EACAC,MAAAA,EACAC,OAAAA,GAAuB,IAAIC,GAAAA,EAAK,GAAA;AAEhC,IAAA,IAAID,OAAAA,CAAQE,GAAG,CAACJ,YAAAA,CAAAA,KAAkB,MAAM,OAAO;AAACC,QAAAA;AAAO,KAAA;AAGvD,IAAA,MAAMI,YAAY,MAAC1C,CAAO2C,UAAoE,CAC5FN,YAAAA,CACD;IACD,IAAIK,SAAAA,KAActC,WAAW,OAAO;AAACkC,QAAAA;AAAO,KAAA;AAE5CC,IAAAA,OAAAA,CAAQK,GAAG,CAACP,YAAAA,CAAAA;AACZ,IAAA,MAAMQ,QAAkB,EAAE;IAE1B,KAAK,MAAM,CAACC,GAAAA,EAAKC,IAAAA,CAAK,IAAIC,OAAOC,OAAO,CAACP,SAAAA,CAAUQ,UAAU,CAAA,CAAG;AAC9D,QAAA,IAAIJ,QAAQ,IAAA,EAAM;AAGhB,YAAA;AACF,QAAA;AACA,QAAA,MAAMK,SAAAA,GAAY,CAAA,EAAGb,MAAAA,CAAO,CAAC,EAAEQ,GAAAA,CAAAA,CAAK;AAEpC,QAAA,IAAIC,KAAKK,IAAI,KAAK,eAAeL,IAAAA,CAAKL,SAAS,KAAKtC,SAAAA,EAAW;AAC7DyC,YAAAA,KAAAA,CAAMQ,IAAI,CAAA,GAAIjB,qBAAAA,CAAsBpC,QAAQ+C,IAAAA,CAAKL,SAAS,EAAES,SAAAA,EAAWZ,OAAAA,CAAAA,CAAAA;QACzE,CAAA,MAAO;AACLM,YAAAA,KAAAA,CAAMQ,IAAI,CAACF,SAAAA,CAAAA;AACb,QAAA;AACF,IAAA;AAEAZ,IAAAA,OAAAA,CAAQe,MAAM,CAACjB,YAAAA,CAAAA;AAEf,IAAA,OAAOQ,KAAAA,CAAM/B,MAAM,GAAG,CAAA,GAAI+B,KAAAA,GAAQ;AAACP,QAAAA;AAAO,KAAA;AAC5C;AAEA;;;;AAIC,IACM,MAAMiB,kBAAAA,GAAqB,CAChCvD,MAAAA,EACA+B,WAAAA,EACAN,QACAxB,GAAAA,EACAiD,UAAAA,GAAAA;IAEA,MAAMM,OAAAA,GAAUR,MAAAA,CAAOS,IAAI,CAACP,UAAAA,CAAAA;AAC5B,IAAA,MAAMjB,SAAAA,GAAYuB,OAAAA,CAAQE,MAAM,CAAC,CAACZ,GAAAA,GAAAA;AAChC,QAAA,IAAIf,YAAY4B,GAAG,CAAClC,QAAQxB,GAAAA,EAAK6C,GAAAA,CAAAA,KAAS,MAAM,OAAO,IAAA;;;QAIvD,MAAMC,IAAAA,GAAOG,UAAU,CAACJ,GAAAA,CAAI;AAC5B,QAAA,IAAIC,KAAKK,IAAI,KAAK,eAAeL,IAAAA,CAAKL,SAAS,KAAKtC,SAAAA,EAAW;AAC7D,YAAA,MAAMwD,SAAAA,GAAYxB,qBAAAA,CAAsBpC,MAAAA,EAAQ+C,IAAAA,CAAKL,SAAS,EAAEI,GAAAA,CAAAA;YAChE,OAAOc,SAAAA,CAAUC,IAAI,CAAC,CAACC,IAAAA,GAAS/B,YAAY4B,GAAG,CAAClC,MAAAA,EAAQxB,GAAAA,EAAK6D,IAAAA,CAAAA,KAAU,IAAA,CAAA;AACzE,QAAA;QAEA,OAAO,KAAA;AACT,IAAA,CAAA,CAAA;AAEA,IAAA,IAAI7B,SAAAA,CAAUnB,MAAM,KAAK0C,OAAAA,CAAQ1C,MAAM,EAAE;QACvC,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAO,IAAI0B,GAAAA,CAAIP,SAAAA,CAAAA;AACjB;AAEA;;;;AAIC,IACM,MAAMC,mBAAAA,GAAsB,CACjCN,mBACAH,MAAAA,EACAZ,WAAAA,GAAAA;IAEA,MAAMoB,SAAAA,GAAYpB,YAAY6C,MAAM,CAClC,CAACK,IAAAA,GAASnC,iBAAAA,CAAkBoC,MAAM,CAACvC,MAAAA,EAAQ;YAAEwC,MAAAA,EAAQF;SAAK,CAAA,KAAO,KAAA,CAAA;AAGnE,IAAA,IAAI9B,SAAAA,CAAUnB,MAAM,KAAKD,WAAAA,CAAYC,MAAM,EAAE;QAC3C,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OAAOmB,SAAAA,CAAUnB,MAAM,GAAG,CAAA,GACrBmB,YACA,EAAE;AACT;;;;;;;;;"}