@abinnovision/payloadcms-mcpx 2.0.0-beta.19 → 2.0.0-beta.20

package/dist/auth/resolve.mjs

@@ -4,16 +4,18 @@ import { hashApiKey } from "../api-keys/key.mjs";
 const BEARER = /^Bearer\s+(\S+)\s*$/i;
 const LAST_USED_INTERVAL_MS = 36e5;
 const toTime = (value) => typeof value === "string" || value instanceof Date ? new Date(value).getTime() : NaN;
-const relationId = (value) => {
-	if (typeof value === "string" || typeof value === "number") return value;
-	if (typeof value === "object" && value !== null && "id" in value) return value.id;
+const isId = (value) => typeof value === "string" || typeof value === "number";
+/**
+* The id of a relationship value, populated or not.
+*/ const relationId = (value) => {
+	if (isId(value)) return value;
+	return isPlainObject(value) && isId(value["id"]) ? value["id"] : void 0;
 };
 const parseBearer = (headers) => {
 	const header = headers.get("authorization");
 	if (!header) return null;
 	return BEARER.exec(header.trim())?.[1] ?? null;
 };
-const isId = (value) => typeof value === "string" || typeof value === "number";
 /**
 * Whether a resolved auth, from the default or a custom resolver, may become
 * `req.user`: a user of the configured user collection with an id, and a key id.
@@ -58,6 +60,26 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 		capabilities: keyDoc.capabilities
 	};
 };
+const KEY_SELECT = {
+	enabled: true,
+	user: true,
+	capabilities: true,
+	expiresAt: true
+};
+/**
+* The user the key `id` acts as, or `null`, under the same checks as the
+* bearer lookup.
+*/ const resolveApiKeyById = async (req, options, id) => {
+	const keyDoc = await req.payload.findByID({
+		collection: options.apiKeysSlug,
+		id,
+		depth: 0,
+		overrideAccess: true,
+		disableErrors: true,
+		select: KEY_SELECT
+	});
+	return await checkApiKey(req, options, keyDoc ?? void 0);
+};
 /**
 * Resolves the bearer key of a request to the user it acts as.
 *
@@ -76,10 +98,7 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 		depth: 0,
 		overrideAccess: true,
 		select: {
-			enabled: true,
-			user: true,
-			capabilities: true,
-			expiresAt: true,
+			...KEY_SELECT,
 			lastUsedAt: true
 		}
 	});
@@ -99,10 +118,10 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 	} catch (error) {
 		payload.logger.warn({
 			err: error,
-			msg: "Could not record the last use of an MCP API key"
+			msg: "[payloadcms-mcpx] Could not record the last use of an MCP API key."
 		});
 	}
 	return auth;
 };
 //#endregion
-export { checkApiKey, isValidAuthResult, parseBearer, resolveApiKeyAuth };
+export { checkApiKey, isValidAuthResult, parseBearer, relationId, resolveApiKeyAuth, resolveApiKeyById };

package/dist/capabilities.d.mts

@@ -0,0 +1,2 @@
+import "./types.mjs";
+import "./options.mjs";

package/dist/capabilities.mjs

@@ -4,21 +4,60 @@ import { isPlainObject } from "./guards.mjs";
 * Group field holding the capability checkboxes on an API key document.
 */ const CAPABILITIES_FIELD = "capabilities";
 /**
-* Covers draft and live writes; {@link isLiveWrite} separates them.
-*/ const canWrite = (entity) => entity.write !== false;
+* The operations a collection or global can expose. The generated checkboxes
+* and the matrix segments share this wording. `requires` names the
+* operation a grant depends on, which the server and the matrix both enforce.
+*/ const CAPABILITY_OPERATIONS = [
+	{
+		id: "read",
+		label: "Read",
+		description: "Describe, find and read."
+	},
+	{
+		id: "write",
+		label: "Write",
+		description: "Create, patch and validate drafts.",
+		requires: "read"
+	},
+	{
+		id: "publish",
+		label: "Publish",
+		description: "Promote the current draft to what the public sees.",
+		requires: "write"
+	},
+	{
+		id: "delete",
+		label: "Delete",
+		description: "Delete documents. Each one is approved by this key's user in the admin panel, unless the config allows trashing directly and this key is set to.",
+		requires: "read"
+	}
+];
 /**
-* The config lets MCP change live content and a draft exists to promote.
-*/ const canPublish = (entity) => entity.write === "live" && entity.hasDrafts;
+* Stored as a checkbox of its own but drawn as the approval shield of the Delete
+* control.
+*/ const DELETE_UNATTENDED = {
+	id: "deleteUnattended",
+	label: "Trash directly",
+	description: "Move documents to trash without asking this key's user.",
+	requires: "delete"
+};
+/**
+* Every operation with a stored checkbox: the capability operations plus
+* the unattended delete. Each follows the one it requires, which the resolve
+* loop depends on.
+*/ const STORED_OPERATIONS = [...CAPABILITY_OPERATIONS, DELETE_UNATTENDED];
 /**
-* Any writable collection. An upload collection also needs a file, which
-* depends on the request, so the tools check it per call.
-*/ const canCreate = (entity) => canWrite(entity);
+* The operations in one run of the access levels, each requiring the one
+* before it. Delete is chosen separately.
+*/ const ACCESS_CHAIN = CAPABILITY_OPERATIONS.filter((operation) => operation.id !== "delete");
 /**
-* Without drafts there is no draft stage, so every write is live.
-*/ const isLiveWrite = (entity) => entity.write === "live" && !entity.hasDrafts;
+* What an operation depends on. `resolveCapabilities` discards a grant whose
+* prerequisite is off.
+*/ const requiresOf = (operation) => {
+	const found = STORED_OPERATIONS.find((candidate) => candidate.id === operation);
+	return found && "requires" in found ? found.requires : void 0;
+};
 const flag = (group, name) => isPlainObject(group) && group[name] === true;
-const writeFlag = (entity, group) => canWrite(entity) && entity.read && flag(group, "read") && flag(group, "write");
-const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, group) && flag(group, "publish");
 /**
 * Capabilities in force for a key: the plugin config decides what can exist,
 * the key's checkboxes decide what does. A missing checkbox is `false`, so keys
@@ -29,14 +68,18 @@ const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, g
 		const resolved = {};
 		for (const entity of entities) {
 			const group = isPlainObject(namespaceGroup) ? namespaceGroup[entity.fieldName] : void 0;
-			const deleting = entity.delete && flag(group, "read") && flag(group, "delete");
-			resolved[entity.slug] = {
-				read: entity.read && flag(group, "read"),
-				write: writeFlag(entity, group),
-				publish: publishFlag(entity, group),
-				delete: deleting,
-				deleteUnattended: deleting && entity.deleteUnattended && flag(group, "deleteUnattended")
+			const granted = {
+				read: false,
+				write: false,
+				publish: false,
+				delete: false,
+				deleteUnattended: false
 			};
+			for (const { id } of STORED_OPERATIONS) {
+				const needs = requiresOf(id);
+				granted[id] = entity[id] && flag(group, id) && (needs === void 0 || granted[needs]);
+			}
+			resolved[entity.slug] = granted;
 		}
 		return resolved;
 	};
@@ -62,4 +105,4 @@ const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, g
 	};
 };
 //#endregion
-export { CAPABILITIES_FIELD, canCreate, canPublish, canWrite, isLiveWrite, resolveCapabilities, scopeSlugs };
+export { ACCESS_CHAIN, CAPABILITIES_FIELD, CAPABILITY_OPERATIONS, STORED_OPERATIONS, requiresOf, resolveCapabilities, scopeSlugs };

package/dist/endpoint/confirmations.mjs

@@ -1,19 +1,20 @@
 import { isPlainObject } from "../guards.mjs";
-import { CONFIRMATIONS_PATH } from "../api-keys/confirmation-view.mjs";
-import { grantKvSlug } from "../grants/grant.mjs";
-import { confirmationHandle, decideConfirmations, issueConfirmation, listConfirmations } from "../grants/confirmation.mjs";
+import { grantContext, grantKvSlug, rowHandle } from "../grants/grant.mjs";
+import { respond } from "./http.mjs";
+import { CONFIRMATIONS_PATH, DECISIONS } from "../api-keys/confirmation-view.mjs";
+import { relationId } from "../auth/resolve.mjs";
+import { decideConfirmations, issueConfirmation, listConfirmations } from "../grants/confirmation.mjs";
+import { publicOrigin } from "../request.mjs";
 import { jsonResult } from "../result.mjs";
 import { BUILTIN_TOOLS } from "../tools/builtin.mjs";
 import { formatAdminURL } from "payload/shared";
 //#region src/endpoint/confirmations.ts
-const respond = (status, body) => Response.json(body, { status });
 const confirmableTool = (name) => BUILTIN_TOOLS.find((tool) => tool.name === name && tool.confirm);
 const keyViewUrl = (req, options, apiKeyId) => {
-	const { config } = req.payload;
 	return formatAdminURL({
-		adminRoute: config.routes.admin,
+		adminRoute: req.payload.config.routes.admin,
 		path: `/collections/${options.apiKeysSlug}/${String(apiKeyId)}`,
-		serverURL: config.serverURL || new URL(req.url ?? "").origin
+		serverURL: publicOrigin(req)
 	});
 };
 /**
@@ -24,9 +25,7 @@ const keyViewUrl = (req, options, apiKeyId) => {
 	confirmed: false,
 	request: async (args) => {
 		const { req } = scope;
-		const slug = grantKvSlug(req.payload.config);
-		const apiKeyId = req.context.mcpx?.apiKeyId;
-		if (slug === void 0 || apiKeyId === void 0) throw new Error("A confirmation was requested without a database KV.");
+		const { slug, apiKeyId } = grantContext(req);
 		const view = keyViewUrl(req, options, apiKeyId);
 		const { id, exp } = await issueConfirmation(req.payload, slug, {
 			apiKeyId,
@@ -54,8 +53,8 @@ const authorize = async (req, options, keyId) => {
 		disableErrors: true,
 		select: { user: true }
 	}).catch(() => null) : null;
-	const user = isPlainObject(key?.user) ? key.user["id"] : key?.user;
-	if (!key || typeof user !== "string" && typeof user !== "number" || String(user) !== String(req.user.id)) return respond(403, { error: "Only the user of this key may decide on its calls." });
+	const user = relationId(key?.user);
+	if (!key || user === void 0 || String(user) !== String(req.user.id)) return respond(403, { error: "Only the user of this key may decide on its calls." });
 	return {
 		slug,
 		apiKeyId: key.id
@@ -89,7 +88,7 @@ const viewOf = async (req, entry, highlight) => {
 	if (allowed instanceof Response) return allowed;
 	const { payload } = req;
 	const highlighted = req.searchParams.get("confirmation");
-	const highlight = highlighted === null ? void 0 : confirmationHandle(payload, highlighted);
+	const highlight = highlighted === null ? void 0 : rowHandle(payload, highlighted);
 	const entries = (await listConfirmations(payload, allowed.slug, allowed.apiKeyId)).filter((entry) => entry.confirmation.state === "pending");
 	const confirmations = [];
 	for (const entry of entries) confirmations.push(await viewOf(req, entry, highlight));
@@ -105,7 +104,8 @@ const viewOf = async (req, entry, highlight) => {
 	if (allowed instanceof Response) return allowed;
 	const handles = isPlainObject(body) ? body["handles"] : void 0;
 	const decision = isPlainObject(body) ? body["decision"] : void 0;
-	if (!Array.isArray(handles) || handles.length > 50 || !handles.every((handle) => typeof handle === "string") || decision !== "approved" && decision !== "rejected") return respond(400, { error: `Send "handles", at most ${String(50)}, and a "decision" of "approved" or "rejected".` });
+	const isDecision = (value) => DECISIONS.some((candidate) => candidate === value);
+	if (!Array.isArray(handles) || handles.length > 50 || !handles.every((handle) => typeof handle === "string") || !isDecision(decision)) return respond(400, { error: `Send "handles", at most ${String(50)}, and a "decision" of "approved" or "rejected".` });
 	const decided = await decideConfirmations(req.payload, allowed.slug, allowed.apiKeyId, handles, decision);
 	return respond(200, { decided });
 };

package/dist/endpoint/handler.mjs

@@ -1,5 +1,5 @@
 import { resolveCapabilities, scopeSlugs } from "../capabilities.mjs";
-import { grantKvSlug } from "../grants/grant.mjs";
+import { grantsAvailable, readCapped } from "./http.mjs";
 import { isValidAuthResult, resolveApiKeyAuth } from "../auth/resolve.mjs";
 import { jsonRpcError } from "./errors.mjs";
 import { createMcpServer } from "./server.mjs";
@@ -7,19 +7,6 @@ import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/
 //#region src/endpoint/handler.ts
 const BODY_BYTES_LIMIT = 4194304;
 const BATCH_MESSAGES_LIMIT = 10;
-const readBody = async (req) => {
-	if (Number(req.headers.get("content-length")) > BODY_BYTES_LIMIT) return null;
-	if (!req.body) return;
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	for await (const chunk of req.body) {
-		size += chunk.byteLength;
-		if (size > BODY_BYTES_LIMIT) return null;
-		text += decoder.decode(chunk, { stream: true });
-	}
-	return text + decoder.decode();
-};
 /**
 * The scope the tools of one request see: the key's resolved capabilities, the
 * slugs they reach, and the locales and limits of the config.
@@ -35,11 +22,8 @@ const readBody = async (req) => {
 			defaultLocale: localization.defaultLocale
 		} : null,
 		limits: options.limits,
-		uploads: options.auth?.resolve === void 0 && grantKvSlug(req.payload.config) !== void 0,
-		diagnostics: options.diagnostics ? {
-			name: options.serverInfo.name,
-			version: options.serverInfo.version
-		} : null,
+		uploads: grantsAvailable(req, options) !== void 0,
+		diagnostics: options.diagnostics ? options.serverInfo : null,
 		exposure: {
 			collections: options.collections,
 			globals: options.globals
@@ -94,13 +78,13 @@ const readBody = async (req) => {
 	const scope = authenticateAs(req, options, auth);
 	let parsedBody;
 	try {
-		const text = await readBody(req);
-		if (text === null) return jsonRpcError({
+		const body = await readCapped(req, BODY_BYTES_LIMIT);
+		if (body === null) return jsonRpcError({
 			status: 413,
 			code: -32e3,
 			message: `Request body too large: the limit is ${String(BODY_BYTES_LIMIT / 1024 / 1024)} MB.`
 		});
-		parsedBody = text === void 0 ? void 0 : JSON.parse(text);
+		parsedBody = body === void 0 ? void 0 : JSON.parse(new TextDecoder().decode(body));
 	} catch {
 		return jsonRpcError({
 			status: 400,

package/dist/endpoint/http.mjs

@@ -0,0 +1,27 @@
+import { grantKvSlug } from "../grants/grant.mjs";
+//#region src/endpoint/http.ts
+const respond = (status, body) => Response.json(body, { status });
+/**
+* The body, `null` once it passes `max` bytes, or `undefined` when there is
+* none. A declared length over `max` is refused unread. A chunked body
+* declares none, so bytes are counted as they arrive and reading stops at
+* `max`.
+*/ const readCapped = async (req, max) => {
+	if (Number(req.headers.get("content-length")) > max) return null;
+	if (!req.body) return;
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req.body) {
+		size += chunk.byteLength;
+		if (size > max) return null;
+		chunks.push(chunk);
+	}
+	return Buffer.concat(chunks);
+};
+/**
+* The grant KV slug where uploads, downloads and confirmations are possible:
+* the KV is database-backed and no custom `auth.resolve` is set, since the
+* grant endpoints cannot replay what such a resolver authenticated by.
+*/ const grantsAvailable = (req, options) => options.auth?.resolve === void 0 ? grantKvSlug(req.payload.config) : void 0;
+//#endregion
+export { grantsAvailable, readCapped, respond };

package/dist/endpoint/upload.mjs

@@ -1,66 +1,34 @@
 import { isToolEnabled, toolInputSchema } from "../define-tool.mjs";
-import { claimGrant, grantKvSlug } from "../grants/grant.mjs";
+import { claimGrant } from "../grants/grant.mjs";
+import { grantsAvailable, readCapped, respond } from "./http.mjs";
+import { resolveApiKeyById } from "../auth/resolve.mjs";
+import { parseResult } from "../result.mjs";
 import { downloadSlugs, setUploadedFile, uploadMaxBytes } from "../upload/file.mjs";
 import { BUILTIN_TOOLS } from "../tools/builtin.mjs";
-import { checkApiKey } from "../auth/resolve.mjs";
 import { runTool } from "./server.mjs";
 import { authenticateAs } from "./handler.mjs";
 //#region src/endpoint/upload.ts
 const UPLOAD_TOOLS = /* @__PURE__ */ new Set(["createDocument", "patchDocument"]);
-const respond = (status, body) => Response.json(body, { status });
 const refused = () => respond(403, { error: "The request was refused: the grant is unknown, expired or used, or the key no longer allows it. Call the tool again for a new one." });
-const readExactly = async (req, size) => {
-	const declared = req.headers.get("content-length");
-	if (declared !== null && Number(declared) !== size) return null;
-	if (!req.body) return null;
-	const chunks = [];
-	let total = 0;
-	for await (const chunk of req.body) {
-		total += chunk.byteLength;
-		if (total > size) return null;
-		chunks.push(chunk);
-	}
-	return total === size ? Buffer.concat(chunks) : null;
-};
 const statusOf = (result, data) => {
 	if (result.isError !== true) return 200;
 	if ("updatedAt" in data || data["status"] === 423) return 409;
 	if (data["status"] === 401 || data["status"] === 403) return 403;
 	return data["error"] === "Internal error" ? 500 : 422;
 };
-const parseResult = (result) => {
-	const [first] = result.content;
-	return first?.type === "text" ? JSON.parse(first.text) : {};
-};
 const NO_SESSION = {
 	signal: new AbortController().signal,
 	requestId: "upload",
 	sendNotification: () => Promise.resolve(),
 	sendRequest: () => Promise.reject(/* @__PURE__ */ new Error("No MCP session."))
 };
-const reauthenticate = async (req, options, grant) => {
-	const keyDoc = await req.payload.findByID({
-		collection: options.apiKeysSlug,
-		id: grant.apiKeyId,
-		depth: 0,
-		overrideAccess: true,
-		disableErrors: true,
-		select: {
-			enabled: true,
-			user: true,
-			capabilities: true,
-			expiresAt: true
-		}
-	});
-	return await checkApiKey(req, options, keyDoc ?? void 0);
-};
 const claimAs = async (req, options, kind) => {
-	const slug = grantKvSlug(req.payload.config);
+	const slug = grantsAvailable(req, options);
 	const grantId = req.headers.get("x-mcpx-grant");
-	if (slug === void 0 || options.auth?.resolve || grantId === null) return;
+	if (slug === void 0 || grantId === null) return;
 	const grant = await claimGrant(req.payload, slug, grantId);
 	if (grant?.kind !== kind) return;
-	const auth = await reauthenticate(req, options, grant);
+	const auth = await resolveApiKeyById(req, options, grant.apiKeyId);
 	if (!auth) return;
 	const scope = authenticateAs(req, options, auth);
 	req.query = {};
@@ -80,16 +48,16 @@ const claimAs = async (req, options, kind) => {
 */ const createUploadHandler = (options) => async (req) => {
 	const { payload } = req;
 	const claimed = await claimAs(req, options, "upload");
-	const file = claimed?.grant.args["file"];
-	if (!claimed || !UPLOAD_TOOLS.has(claimed.grant.tool) || !file) return refused();
+	if (!claimed || !UPLOAD_TOOLS.has(claimed.grant.tool) || !claimed.grant.file) return refused();
 	const { grant, scope } = claimed;
+	const { file } = grant;
 	const tool = BUILTIN_TOOLS.find((candidate) => candidate.name === grant.tool);
 	if (!tool || !isToolEnabled(tool, scope)) return refused();
 	const args = toolInputSchema(tool, scope).safeParse(grant.args);
 	if (!args.success) return refused();
 	if (file.size > uploadMaxBytes(payload.config)) return respond(413, { error: "The file is larger than allowed." });
-	const data = await readExactly(req, file.size);
-	if (data === null) return respond(400, { error: `The body must be exactly ${String(file.size)} bytes, the size the tool call declared.` });
+	const data = await readCapped(req, file.size);
+	if (data?.length !== file.size) return respond(400, { error: `The body must be exactly ${String(file.size)} bytes, the size the tool call declared.` });
 	setUploadedFile(req, {
 		data,
 		mimetype: file.mimeType,

package/dist/grants/confirmation.mjs

@@ -1,17 +1,8 @@
-import { isPlainObject } from "../guards.mjs";
-import { hashApiKey } from "../api-keys/key.mjs";
-import { GRANT_ID, NO_REQ, expOf, issueRow, rowsWith } from "./grant.mjs";
-import { ValidationError } from "payload";
+import { NO_REQ, ROW_ID, claimRow, expOf, issueRow, rowHandle, rowPrefixes, rowsWith } from "./grant.mjs";
 //#region src/grants/confirmation.ts
 const CONFIRMATION_TTL_MS = 9e5;
 const HANDLE = /^[\da-f]{64}$/;
-const entryPrefix = (apiKeyId) => `mcpx-confirmation:${String(apiKeyId)}:`;
-const usedPrefix = (apiKeyId) => `mcpx-confirmation-used:${String(apiKeyId)}:`;
-const asConfirmation = (row, now) => row && isPlainObject(row.data) && expOf(row.data) > now ? row.data : void 0;
-/**
-* The handle the admin panel uses for the entry of `id`: its HMAC, which is
-* also what the row key holds.
-*/ const confirmationHandle = (payload, id) => hashApiKey(payload.secret, id);
+const asConfirmation = (row, now) => row && expOf(row.data) > now ? row.data : void 0;
 /**
 * Stores a pending call and returns its id. A key may hold at most
 * {@link CONFIRMATIONS_PER_KEY} calls.
@@ -21,8 +12,7 @@ const asConfirmation = (row, now) => row && isPlainObject(row.data) && expOf(row
 		state: "pending"
 	};
 	return await issueRow(payload, slug, {
-		prefix: entryPrefix(call.apiKeyId),
-		usedPrefix: usedPrefix(call.apiKeyId),
+		...rowPrefixes("confirmation", call.apiKeyId),
 		cap: 50,
 		capMessage: `This key already has ${String(50)} calls waiting for approval. Run or abandon them first; each expires 15 minutes after it was requested.`,
 		ttlMs: CONFIRMATION_TTL_MS,
@@ -33,40 +23,19 @@ const asConfirmation = (row, now) => row && isPlainObject(row.data) && expOf(row
 * The unexpired call of `apiKeyId` with `id`, without claiming it. A call of
 * another key is `undefined`, as is a malformed id, before any database read.
 */ const readConfirmation = async (payload, slug, apiKeyId, id) => {
-	if (!GRANT_ID.test(id)) return;
-	const key = `${entryPrefix(apiKeyId)}${confirmationHandle(payload, id)}`;
+	if (!ROW_ID.test(id)) return;
+	const key = `${rowPrefixes("confirmation", apiKeyId).prefix}${rowHandle(payload, id)}`;
 	const rows = await rowsWith(payload, slug, [key]);
 	return asConfirmation(rows.find((row) => row.key === key), Date.now());
 };
 /**
-* Marks the call used and removes it. The marker is a unique-key insert, so
-* of two concurrent claims exactly one returns `true`.
-*/ const claimConfirmation = async (payload, slug, apiKeyId, id, exp) => {
-	const handle = confirmationHandle(payload, id);
-	try {
-		await payload.db.create({
-			collection: slug,
-			data: {
-				key: `${usedPrefix(apiKeyId)}${handle}`,
-				data: { exp }
-			},
-			req: NO_REQ
-		});
-	} catch (error) {
-		if (error instanceof ValidationError) return false;
-		throw error;
-	}
-	await payload.db.deleteOne({
-		collection: slug,
-		where: { key: { equals: `${entryPrefix(apiKeyId)}${handle}` } },
-		req: NO_REQ
-	});
-	return true;
-};
+* Marks the call used and removes it. Of two concurrent claims exactly one
+* returns `true`.
+*/ const claimConfirmation = async (payload, slug, apiKeyId, id, exp) => await claimRow(payload, slug, rowPrefixes("confirmation", apiKeyId), rowHandle(payload, id), exp);
 /**
 * Every unexpired call of `apiKeyId` with its handle, oldest first.
 */ const listConfirmations = async (payload, slug, apiKeyId) => {
-	const prefix = entryPrefix(apiKeyId);
+	const { prefix } = rowPrefixes("confirmation", apiKeyId);
 	const now = Date.now();
 	return (await rowsWith(payload, slug, [prefix])).flatMap((row) => {
 		const confirmation = asConfirmation(row, now);
@@ -81,7 +50,7 @@ const asConfirmation = (row, now) => row && isPlainObject(row.data) && expOf(row
 * returns the handles it changed. A call that was decided, run or expired is
 * left alone and not returned.
 */ const decideConfirmations = async (payload, slug, apiKeyId, handles, state) => {
-	const prefix = entryPrefix(apiKeyId);
+	const { prefix } = rowPrefixes("confirmation", apiKeyId);
 	const keys = new Set(handles.filter((handle) => HANDLE.test(handle)).map((handle) => `${prefix}${handle}`));
 	if (keys.size === 0) return [];
 	const now = Date.now();
@@ -103,4 +72,4 @@ const asConfirmation = (row, now) => row && isPlainObject(row.data) && expOf(row
 	return decided;
 };
 //#endregion
-export { claimConfirmation, confirmationHandle, decideConfirmations, issueConfirmation, listConfirmations, readConfirmation };
+export { claimConfirmation, decideConfirmations, issueConfirmation, listConfirmations, readConfirmation };