@abinnovision/payloadcms-mcpx 2.0.0-beta.13 → 2.0.0-beta.15

package/README.md

@@ -61,7 +61,7 @@ The plugin adds:
 - An `mcpx-api-keys` collection in the admin group "MCP", holding the keys.
 - A draft guard on every collection and global that turns MCP writes into draft saves.
 
-The key form uses two admin components, so regenerate the import map:
+The key form uses two admin components, three with `delete`, so regenerate the import map:
 
 ```sh
 payload generate:importmap
@@ -86,24 +86,25 @@ Claude Desktop and the MCP Inspector are covered in
 
 ## Options
 
-| Option                       | Default                                   | Description                                                         |
-| ---------------------------- | ----------------------------------------- | ------------------------------------------------------------------- |
-| `collections`                | required                                  | Collections to expose. `true` means `{}`, everything it supports.   |
-| `collections.<slug>.read`    | `true`                                    | Expose the read tools for this collection.                          |
-| `collections.<slug>.write`   | `true`                                    | Expose the write tools. Without drafts, a write goes live.          |
-| `collections.<slug>.publish` | `true` with drafts                        | Expose `publishDocument`. Needs `versions.drafts` and `write`.      |
-| `globals`                    | `{}`                                      | Globals to expose, with the same three options.                     |
-| `userCollection`             | `config.admin.user`, then `users`         | Auth collection whose users the keys act as.                        |
-| `apiKeys.slug`               | `mcpx-api-keys`                           | Slug of the key collection.                                         |
-| `apiKeys.setupGuide`         | `true`                                    | Add the "Connect a client" tab to saved keys.                       |
-| `apiKeys.overrideCollection` | none                                      | Function that receives the key collection and returns it.           |
-| `endpoint.path`              | `/mcpx`                                   | Endpoint path below the API route.                                  |
-| `limits.maxLimit`            | `25`                                      | Highest `limit` a client may pass to a list tool.                   |
-| `limits.maxDepth`            | `1`                                       | Highest `depth` a client may pass to a read tool.                   |
-| `tools`                      | `[]`                                      | Custom tools, see [`docs/custom-tools.md`](./docs/custom-tools.md). |
-| `auth.resolve`               | none                                      | Replace or wrap the key lookup.                                     |
-| `serverInfo`                 | `payloadcms-mcpx` and the package version | `{ name, version }` reported to clients.                            |
-| `diagnostics`                | `true`                                    | Expose the server version plus repository and issue links.          |
+| Option                       | Default                                   | Description                                                                                                                                       |
+| ---------------------------- | ----------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `collections`                | required                                  | Collections to expose. `true` means `{}`, everything it supports.                                                                                 |
+| `collections.<slug>.read`    | `true`                                    | Expose the read tools for this collection.                                                                                                        |
+| `collections.<slug>.write`   | `true`                                    | Expose the write tools. Needs `read`. Without drafts, a write goes live.                                                                          |
+| `collections.<slug>.publish` | `true` with drafts                        | Expose `publishDocument`. Needs `versions.drafts` and `write`.                                                                                    |
+| `collections.<slug>.delete`  | `false`                                   | Expose `deleteDocument`. Needs `read`. Each delete is approved in the admin. `"unattended"` also offers trashing without approval; needs `trash`. |
+| `globals`                    | `{}`                                      | Globals to expose, with `read`, `write` and `publish`.                                                                                            |
+| `userCollection`             | `config.admin.user`, then `users`         | Auth collection whose users the keys act as.                                                                                                      |
+| `apiKeys.slug`               | `mcpx-api-keys`                           | Slug of the key collection.                                                                                                                       |
+| `apiKeys.setupGuide`         | `true`                                    | Add the "Connect a client" tab to saved keys.                                                                                                     |
+| `apiKeys.overrideCollection` | none                                      | Function that receives the key collection and returns it.                                                                                         |
+| `endpoint.path`              | `/mcpx`                                   | Endpoint path below the API route.                                                                                                                |
+| `limits.maxLimit`            | `25`                                      | Highest `limit` a client may pass to a list tool.                                                                                                 |
+| `limits.maxDepth`            | `1`                                       | Highest `depth` a client may pass to a read tool.                                                                                                 |
+| `tools`                      | `[]`                                      | Custom tools, see [`docs/custom-tools.md`](./docs/custom-tools.md).                                                                               |
+| `auth.resolve`               | none                                      | Replace or wrap the key lookup.                                                                                                                   |
+| `serverInfo`                 | `payloadcms-mcpx` and the package version | `{ name, version }` reported to clients.                                                                                                          |
+| `diagnostics`                | `true`                                    | Expose the server version plus repository and issue links.                                                                                        |
 
 The config only takes capabilities away: `true` exposes everything the entity supports, and a key's
 checkboxes decide what each key may do. `publish: false` keeps MCP writes as drafts. On an entity
@@ -115,17 +116,19 @@ every check.
 
 ## Tools
 
-| Tool               | What it does                                                       | Needs              |
-| ------------------ | ------------------------------------------------------------------ | ------------------ |
-| `listCapabilities` | Lists what this key may do. Clients call it first.                 | any key            |
-| `describeSchema`   | Describes the fields at one schema path, with the paths below it.  | `read`             |
-| `findDocuments`    | Queries a collection with a Payload `where`, `sort` and `select`.  | `read`             |
-| `getDocument`      | Reads a document, a subtree of it, an old version or a diff.       | `read`             |
-| `findVersions`     | Lists the version history of a document or global, without bodies. | `read`             |
-| `patchDocument`    | Applies JSON Patch operations to the current draft, or a new file. | `write`            |
-| `createDocument`   | Creates a draft from a seed, with a file in an upload collection.  | `write`            |
-| `validateDocument` | Lists what blocks publishing, without saving.                      | `write`            |
-| `publishDocument`  | Publishes the current draft.                                       | `write`, `publish` |
+| Tool               | What it does                                                       | Needs     |
+| ------------------ | ------------------------------------------------------------------ | --------- |
+| `listCapabilities` | Lists what this key may do. Clients call it first.                 | any key   |
+| `describeSchema`   | Describes the fields at one schema path, with the paths below it.  | `read`    |
+| `findDocuments`    | Queries a collection with a Payload `where`, `sort` and `select`.  | `read`    |
+| `getDocument`      | Reads a document, a subtree of it, an old version or a diff.       | `read`    |
+| `findVersions`     | Lists the version history of a document or global, without bodies. | `read`    |
+| `patchDocument`    | Applies JSON Patch operations to the current draft, or a new file. | `write`   |
+| `createDocument`   | Creates a draft from a seed, with a file in an upload collection.  | `write`   |
+| `validateDocument` | Lists what blocks publishing, without saving.                      | `write`   |
+| `publishDocument`  | Publishes the current draft.                                       | `publish` |
+| `deleteDocument`   | Asks to delete a document, which the key's user approves.          | `delete`  |
+| `runConfirmed`     | Runs the approved calls.                                           | `delete`  |
 
 Collections and globals use the same tools. A tool that addresses one document takes either
 `collection` and `id`, or `global` alone. [`docs/concepts.md`](./docs/concepts.md#tools) lists
@@ -138,11 +141,20 @@ A key can do something only when both the config and the key allow it.
 The plugin config sets the upper bound: which collections and globals are exposed, and whether
 each one is readable, writable and publishable. A key cannot go past it.
 
-Each key carries one checkbox per exposed entity and operation (`read`, `write`, `publish`), and
-one per custom tool. The admin panel shows them as a matrix with a row per entity and a column per
-operation. A cell the config does not expose shows a dash. `publish` exists only where the config
-exposes `write` and `publish` on an entity with drafts, and counts only when `write` is ticked as
-well. A write checkbox on an entity without drafts is marked "Writes go live immediately."
+Each key carries one checkbox per exposed entity and operation (`read`, `write`, `publish`,
+`delete`, `deleteUnattended`), and
+one per custom tool. The admin panel shows them as a matrix with a row per entity, an Access
+control (None, Read, Write, Publish) and a Delete control (Off, Approval, Trash). Each access level
+includes the ones before it, and a level the config does not expose has no segment. `publish`
+exists only where the config exposes `write` and `publish` on an entity with drafts, and counts
+only when `write` is ticked as well. `write` counts only when `read` is ticked, so a key never
+writes what it cannot read. An entity without drafts carries a "Live" badge, as its writes go live
+immediately.
+`delete` exists only where the config sets `delete: true` on a collection, and counts only when
+`read` is ticked as well. Setting access to None clears it. A delete runs only after the key's user
+approved it on the key's edit view, except where the config sets `delete: "unattended"` and the
+key's Delete control is set to Trash: there the document moves to trash at once. See
+[deleting](./docs/concepts.md#deleting).
 
 `tools/list` follows the key. A tool the key cannot use is not listed, and each `collection` and
 `global` argument lists only the slugs the key may use with that tool. A checkbox added by a later
@@ -167,6 +179,9 @@ To restrict that, use `apiKeys.overrideCollection` as shown in
 - A file is sent in a second step, a `PUT`, and downloaded with a `GET`, each with a short-lived,
   single-use grant. Only collections with `upload.mimeTypes` take files. Downloads go through the
   collection's own file access. See [uploads](./docs/security.md#uploads).
+- A delete waits for the key's user to approve it in the admin panel and is then run by the same
+  key. Collections with `trash` move the document to trash. See
+  [confirmations](./docs/security.md#confirmations).
 - Custom tools are trusted code and must apply access control themselves.
 
 Open limitations: a filter through a relation into a readable collection ignores that collection's

package/dist/admin/capability-matrix.d.mts

@@ -25,9 +25,10 @@ interface McpxCapabilityMatrixProps {
   withinTab?: boolean;
 }
 /**
- * What an API key may do, as one table per namespace: a row per entity, a
- * column per operation and a bulk toggle in each column header. The nested
- * checkbox fields back every cell, so the stored document is unaffected.
+ * What an API key may do, as one table per namespace: a row per entity with
+ * segmented Access and Delete controls, and an "All" row that sets every row.
+ * The nested checkbox fields back every control, so the stored document is
+ * unaffected.
  */
 export declare const McpxCapabilityMatrix: React.FC<McpxCapabilityMatrixProps>;
 //#endregion

package/dist/admin/capability-matrix.mjs

@@ -1,17 +1,28 @@
 "use client";
 import { CAPABILITIES_FIELD } from "../capabilities.mjs";
-import { CAPABILITY_OPERATIONS, capabilityPaths, cellPath, toolPath } from "../api-keys/capability-matrix.mjs";
-import { buildToggleActions, columnState, rowState, toolsState } from "./capability-toggles.mjs";
+import { CAPABILITY_OPERATIONS, STORED_OPERATIONS, capabilityPaths, toolPath } from "../api-keys/capability-matrix.mjs";
+import { accessLevelOf, accessLevelsOf, allAccessLevel, allDeleteMode, buildToggleActions, deleteModeOf, toolsState } from "./capability-toggles.mjs";
 import { jsx, jsxs } from "react/jsx-runtime";
-import { CheckboxInput, FieldDescription, FieldLabel, useForm, useFormFields } from "@payloadcms/ui";
+import { Button, CheckboxInput, FieldDescription, FieldLabel, Pill, useForm, useFormFields } from "@payloadcms/ui";
 import { useCallback, useMemo } from "react";
 //#region src/admin/capability-matrix.tsx
-const NOT_EXPOSED = "The plugin config does not expose this.";
 const BASE_CLASS = "mcpx-capabilities";
+const LIVE_WRITE = "Writes go live immediately.";
 const SHEET = `
 .${BASE_CLASS} tbody tr:hover { background: var(--theme-elevation-50); }
-.${BASE_CLASS}__toggle:hover { text-decoration: underline; }
 .${BASE_CLASS} section:last-of-type { margin-bottom: 0; }
+.${BASE_CLASS}__segments {
+	display: inline-flex;
+	border: 1px solid var(--theme-elevation-150);
+	border-radius: var(--style-radius-s);
+	background: var(--theme-input-bg);
+}
+.${BASE_CLASS}__segments .btn { border: 0; border-radius: 0; white-space: nowrap; }
+.${BASE_CLASS}__segments .btn + .btn { border-inline-start: 1px solid var(--theme-elevation-150); }
+.${BASE_CLASS}__segments .btn:first-child { border-start-start-radius: inherit; border-end-start-radius: inherit; }
+.${BASE_CLASS}__segments .btn:last-child { border-start-end-radius: inherit; border-end-end-radius: inherit; }
+.${BASE_CLASS}__segments .btn--style-transparent { --hover-bg: var(--theme-elevation-100); }
+.${BASE_CLASS}__segments .${BASE_CLASS}__danger { --bg-color: var(--theme-error-500); --hover-bg: var(--theme-error-600); }
 `;
 const CELL_PADDING = "calc(var(--base) * 0.6)";
 const EDGE_PADDING = "calc(var(--base) * 0.8)";
@@ -57,30 +68,35 @@ const styles = {
 		fontWeight: "normal",
 		wordBreak: "break-word"
 	},
-	rowButton: {
-		padding: 0,
-		border: 0,
-		background: "none",
-		color: "inherit",
-		font: "inherit",
-		cursor: "pointer",
-		textAlign: "start",
-		textDecoration: "none"
-	},
 	hint: {
 		display: "block",
 		color: "var(--theme-elevation-400)"
 	},
+	badge: {
+		display: "inline-flex",
+		marginInlineStart: "calc(var(--base) * 0.4)",
+		verticalAlign: "middle",
+		cursor: "help"
+	},
+	visuallyHidden: {
+		position: "absolute",
+		width: "1px",
+		height: "1px",
+		overflow: "hidden",
+		clip: "rect(0 0 0 0)",
+		whiteSpace: "nowrap"
+	},
 	cell: {
 		padding: CELL_PADDING,
 		verticalAlign: "middle",
 		textAlign: "center"
 	},
-	lastCell: { paddingInlineEnd: EDGE_PADDING },
-	dash: {
-		color: "var(--theme-elevation-400)",
-		cursor: "help"
-	}
+	controlCell: {
+		padding: CELL_PADDING,
+		verticalAlign: "middle",
+		textAlign: "start"
+	},
+	lastCell: { paddingInlineEnd: EDGE_PADDING }
 };
 const Box = ({ label, onChange, readOnly, state }) => /*#__PURE__*/ jsx(CheckboxInput, {
 	checked: state === "on",
@@ -89,116 +105,250 @@ const Box = ({ label, onChange, readOnly, state }) => /*#__PURE__*/ jsx(Checkbox
 	partialChecked: state === "mixed",
 	readOnly
 });
+const descriptionOf = (operation) => STORED_OPERATIONS.find((candidate) => candidate.id === operation)?.description;
+const ACCESS_OPTIONS = [{
+	id: "none",
+	label: "None",
+	title: "No access"
+}, ...CAPABILITY_OPERATIONS.filter((operation) => operation.id !== "delete").map((operation) => ({
+	id: operation.id,
+	label: operation.label,
+	title: operation.description
+}))];
+const DELETE_OPTIONS = [
+	{
+		id: "off",
+		label: "Off",
+		title: "No delete"
+	},
+	{
+		id: "approve",
+		label: "Approval",
+		title: descriptionOf("delete")
+	},
+	{
+		id: "trash",
+		label: "Trash",
+		title: descriptionOf("deleteUnattended")
+	}
+];
+const ARROW_STEPS = {
+	ArrowDown: 1,
+	ArrowLeft: -1,
+	ArrowRight: 1,
+	ArrowUp: -1
+};
+const Segments = ({ included = [], label, onSelect, options, readOnly, selected }) => {
+	const focusable = options.some((option) => option.id === selected) ? selected : options[0]?.id;
+	const onKeyDown = (event) => {
+		const step = ARROW_STEPS[event.key];
+		if (readOnly || step === void 0) return;
+		event.preventDefault();
+		const radios = [...event.currentTarget.querySelectorAll("[role=\"radio\"]")];
+		const current = radios.findIndex((radio) => radio === document.activeElement);
+		const next = Math.min(Math.max(current + step, 0), radios.length - 1);
+		const option = options[next];
+		if (option) {
+			radios[next]?.focus();
+			onSelect(option.id);
+		}
+	};
+	return /*#__PURE__*/ jsx("div", {
+		"aria-label": label,
+		className: `${BASE_CLASS}__segments`,
+		onKeyDown,
+		role: "radiogroup",
+		children: options.map((option) => {
+			const checked = option.id === selected;
+			return /*#__PURE__*/ jsx(Button, {
+				buttonStyle: checked ? "primary" : included.includes(option.id) ? "pill" : "transparent",
+				className: checked && option.id === "trash" ? `${BASE_CLASS}__danger` : "",
+				disabled: readOnly,
+				extraButtonProps: {
+					"aria-checked": checked,
+					role: "radio",
+					tabIndex: option.id === focusable ? 0 : -1,
+					title: option.title
+				},
+				margin: false,
+				onClick: () => {
+					onSelect(option.id);
+				},
+				size: "small",
+				children: option.label
+			}, option.id);
+		})
+	});
+};
+const includedBelow = (options, level) => {
+	const selected = options.findIndex((option) => option.id === level);
+	return selected < 1 ? [] : options.slice(1, selected).map((option) => option.id);
+};
+const accessOptions = (rows) => ACCESS_OPTIONS.filter((option) => rows.some((row) => accessLevelsOf(row).includes(option.id)));
 const LABEL_WIDTH = "calc(var(--base) * 9)";
 const OPERATION_WIDTH = "calc(var(--base) * 3.5)";
-const Columns = ({ count }) => /*#__PURE__*/ jsxs("colgroup", { children: [/*#__PURE__*/ jsx("col", { style: { width: LABEL_WIDTH } }), Array.from({ length: count }, (_, index) => /*#__PURE__*/ jsx("col", { style: { width: OPERATION_WIDTH } }, index))] });
-const cellStyle = (isLast) => isLast ? {
+const ACCESS_WIDTH = "calc(var(--base) * 13)";
+const DELETE_WIDTH = "calc(var(--base) * 10)";
+const Columns = ({ widths }) => /*#__PURE__*/ jsxs("colgroup", { children: [/*#__PURE__*/ jsx("col", { style: { width: LABEL_WIDTH } }), widths.map((width, index) => /*#__PURE__*/ jsx("col", { style: { width } }, index))] });
+const lastCellStyle = {
 	...styles.cell,
 	...styles.lastCell
-} : styles.cell;
-const Dash = () => /*#__PURE__*/ jsx("span", {
-	"aria-label": NOT_EXPOSED,
-	style: styles.dash,
-	title: NOT_EXPOSED,
-	children: "—"
+};
+const controlStyle = (isLast) => isLast ? {
+	...styles.controlCell,
+	...styles.lastCell
+} : styles.controlCell;
+const LiveBadge = () => /*#__PURE__*/ jsx("span", {
+	style: styles.badge,
+	title: LIVE_WRITE,
+	children: /*#__PURE__*/ jsxs(Pill, {
+		pillStyle: "warning",
+		size: "small",
+		children: [/*#__PURE__*/ jsx("span", {
+			"aria-hidden": "true",
+			children: "Live"
+		}), /*#__PURE__*/ jsx("span", {
+			style: styles.visuallyHidden,
+			children: LIVE_WRITE
+		})]
+	})
 });
 const NamespaceTable = ({ matrix, namespace, path, readOnly, toggle, values }) => {
 	const rows = matrix[namespace.id];
-	const columns = CAPABILITY_OPERATIONS.filter((operation) => rows.some((row) => row[operation.id]));
+	const withDelete = rows.some((row) => row.delete);
+	const allOptions = accessOptions(rows);
+	const allLevel = allAccessLevel(matrix, path, namespace.id, values);
+	const entries = namespace.title.toLowerCase();
 	return /*#__PURE__*/ jsx("section", {
 		style: styles.section,
 		children: /*#__PURE__*/ jsxs("table", {
 			style: styles.table,
 			children: [
-				/*#__PURE__*/ jsx(Columns, { count: columns.length }),
+				/*#__PURE__*/ jsx(Columns, { widths: withDelete ? [ACCESS_WIDTH, DELETE_WIDTH] : [ACCESS_WIDTH] }),
 				/*#__PURE__*/ jsxs("thead", {
 					style: styles.head,
-					children: [/*#__PURE__*/ jsxs("tr", { children: [/*#__PURE__*/ jsx("th", {
-						scope: "col",
-						style: {
-							...styles.headTitle,
-							...styles.topStart
-						},
-						children: namespace.title
-					}), columns.map((operation, column) => /*#__PURE__*/ jsx("th", {
-						scope: "col",
-						style: column === columns.length - 1 ? {
-							...styles.headOperation,
-							...styles.topEnd
-						} : styles.headOperation,
-						title: operation.description,
-						children: operation.label
-					}, operation.id))] }), /*#__PURE__*/ jsxs("tr", { children: [/*#__PURE__*/ jsx("th", {
-						scope: "row",
-						style: {
-							...styles.headLabel,
-							...styles.rule
-						},
-						children: "All"
-					}), columns.map((operation, column) => {
-						const state = columnState(matrix, path, namespace.id, operation.id, values);
-						return /*#__PURE__*/ jsx("td", {
+					children: [/*#__PURE__*/ jsxs("tr", { children: [
+						/*#__PURE__*/ jsx("th", {
+							scope: "col",
 							style: {
-								...cellStyle(column === columns.length - 1),
+								...styles.headTitle,
+								...styles.topStart
+							},
+							children: namespace.title
+						}),
+						/*#__PURE__*/ jsx("th", {
+							scope: "col",
+							style: {
+								...styles.headOperation,
+								textAlign: "start",
+								...withDelete ? {} : styles.topEnd
+							},
+							children: "Access"
+						}),
+						withDelete ? /*#__PURE__*/ jsx("th", {
+							scope: "col",
+							style: {
+								...styles.headOperation,
+								textAlign: "start",
+								...styles.topEnd
+							},
+							children: "Delete"
+						}) : null
+					] }), /*#__PURE__*/ jsxs("tr", { children: [
+						/*#__PURE__*/ jsx("th", {
+							scope: "row",
+							style: {
+								...styles.headLabel,
 								...styles.rule
 							},
-							children: /*#__PURE__*/ jsx(Box, {
-								label: `${operation.label} every ${namespace.title.toLowerCase()} entry`,
-								onChange: () => {
+							children: "All"
+						}),
+						/*#__PURE__*/ jsx("td", {
+							style: {
+								...controlStyle(!withDelete),
+								...styles.rule
+							},
+							children: /*#__PURE__*/ jsx(Segments, {
+								included: includedBelow(allOptions, allLevel),
+								label: `Access for every ${entries} entry`,
+								onSelect: (level) => {
 									toggle({
-										kind: "column",
+										kind: "access",
 										namespace: namespace.id,
-										operation: operation.id,
-										value: state !== "on"
+										level
 									});
 								},
+								options: allOptions,
 								readOnly,
-								state
+								selected: allLevel
 							})
-						}, operation.id);
-					})] })]
+						}),
+						withDelete ? /*#__PURE__*/ jsx("td", {
+							style: {
+								...controlStyle(true),
+								...styles.rule
+							},
+							children: /*#__PURE__*/ jsx(Segments, {
+								label: `Delete for every ${entries} entry`,
+								onSelect: (mode) => {
+									toggle({
+										kind: "deleteMode",
+										namespace: namespace.id,
+										mode
+									});
+								},
+								options: DELETE_OPTIONS.filter((option) => option.id !== "trash"),
+								readOnly,
+								selected: allDeleteMode(matrix, path, namespace.id, values)
+							})
+						}) : null
+					] })]
 				}),
 				/*#__PURE__*/ jsx("tbody", { children: rows.map((row) => {
-					const state = rowState(path, namespace.id, row, values);
-					return /*#__PURE__*/ jsxs("tr", { children: [/*#__PURE__*/ jsxs("th", {
-						scope: "row",
-						style: styles.rowHeader,
-						children: [/*#__PURE__*/ jsx("button", {
-							className: `${BASE_CLASS}__toggle`,
-							disabled: readOnly,
-							onClick: () => {
-								toggle({
-									kind: "row",
-									namespace: namespace.id,
-									fieldName: row.fieldName,
-									value: state !== "on"
-								});
-							},
-							style: styles.rowButton,
-							title: `Toggle every capability for ${row.label}`,
-							type: "button",
-							children: row.label
-						}), row.hint ? /*#__PURE__*/ jsx("span", {
-							style: styles.hint,
-							children: row.hint
-						}) : null]
-					}), columns.map((operation, column) => /*#__PURE__*/ jsx("td", {
-						style: cellStyle(column === columns.length - 1),
-						children: row[operation.id] ? /*#__PURE__*/ jsx(Box, {
-							label: `${operation.label} ${row.label}`,
-							onChange: () => {
-								toggle({
-									kind: "cell",
-									namespace: namespace.id,
-									fieldName: row.fieldName,
-									operation: operation.id,
-									value: values[cellPath(path, namespace.id, row.fieldName, operation.id)] !== true
-								});
-							},
-							readOnly,
-							state: values[cellPath(path, namespace.id, row.fieldName, operation.id)] === true ? "on" : "off"
-						}) : /*#__PURE__*/ jsx(Dash, {})
-					}, operation.id))] }, row.fieldName);
+					const options = accessOptions([row]);
+					const level = accessLevelOf(path, namespace.id, row, values);
+					return /*#__PURE__*/ jsxs("tr", { children: [
+						/*#__PURE__*/ jsxs("th", {
+							scope: "row",
+							style: styles.rowHeader,
+							children: [row.label, row.live ? /*#__PURE__*/ jsx(LiveBadge, {}) : null]
+						}),
+						/*#__PURE__*/ jsx("td", {
+							style: controlStyle(!withDelete),
+							children: /*#__PURE__*/ jsx(Segments, {
+								included: includedBelow(options, level),
+								label: `Access for ${row.label}`,
+								onSelect: (next) => {
+									toggle({
+										kind: "access",
+										namespace: namespace.id,
+										fieldName: row.fieldName,
+										level: next
+									});
+								},
+								options,
+								readOnly,
+								selected: level
+							})
+						}),
+						withDelete ? /*#__PURE__*/ jsx("td", {
+							style: controlStyle(true),
+							children: row.delete ? /*#__PURE__*/ jsx(Segments, {
+								label: `Delete for ${row.label}`,
+								onSelect: (mode) => {
+									toggle({
+										kind: "deleteMode",
+										namespace: namespace.id,
+										fieldName: row.fieldName,
+										mode
+									});
+								},
+								options: DELETE_OPTIONS.filter((option) => option.id !== "trash" || row.deleteUnattended),
+								readOnly,
+								selected: deleteModeOf(path, namespace.id, row, values)
+							}) : null
+						}) : null
+					] }, row.fieldName);
 				}) })
 			]
 		})
@@ -211,7 +361,7 @@ const ToolsTable = ({ matrix, path, readOnly, toggle, values }) => {
 		children: /*#__PURE__*/ jsxs("table", {
 			style: styles.table,
 			children: [
-				/*#__PURE__*/ jsx(Columns, { count: 1 }),
+				/*#__PURE__*/ jsx(Columns, { widths: [OPERATION_WIDTH] }),
 				/*#__PURE__*/ jsxs("thead", {
 					style: styles.head,
 					children: [/*#__PURE__*/ jsxs("tr", { children: [/*#__PURE__*/ jsx("th", {
@@ -237,7 +387,7 @@ const ToolsTable = ({ matrix, path, readOnly, toggle, values }) => {
 						children: "All"
 					}), /*#__PURE__*/ jsx("td", {
 						style: {
-							...cellStyle(true),
+							...lastCellStyle,
 							...styles.rule
 						},
 						children: /*#__PURE__*/ jsx(Box, {
@@ -261,7 +411,7 @@ const ToolsTable = ({ matrix, path, readOnly, toggle, values }) => {
 						children: tool.description
 					})]
 				}), /*#__PURE__*/ jsx("td", {
-					style: cellStyle(true),
+					style: lastCellStyle,
 					children: /*#__PURE__*/ jsx(Box, {
 						label: `Enable ${tool.name}`,
 						onChange: () => {
@@ -280,9 +430,10 @@ const ToolsTable = ({ matrix, path, readOnly, toggle, values }) => {
 	});
 };
 /**
-* What an API key may do, as one table per namespace: a row per entity, a
-* column per operation and a bulk toggle in each column header. The nested
-* checkbox fields back every cell, so the stored document is unaffected.
+* What an API key may do, as one table per namespace: a row per entity with
+* segmented Access and Delete controls, and an "All" row that sets every row.
+* The nested checkbox fields back every control, so the stored document is
+* unaffected.
 */ const McpxCapabilityMatrix = ({ field, matrix, path = CAPABILITIES_FIELD, readOnly = false, withinTab = false }) => {
 	const { dispatchFields, setModified } = useForm();
 	const paths = useMemo(() => capabilityPaths(matrix, path), [matrix, path]);