@abinnovision/payloadcms-mcpx 2.0.0-beta.19 → 2.0.0-beta.22

package/dist/api-keys/fields.mjs

@@ -1,5 +1,5 @@
 import { CAPABILITIES_FIELD } from "../capabilities.mjs";
-import { CAPABILITIES_DESCRIPTION, STORED_OPERATIONS, createCapabilityMatrix } from "./capability-matrix.mjs";
+import { CAPABILITIES_DESCRIPTION, createCapabilityMatrix, rowOperations } from "./capability-matrix.mjs";
 //#region src/api-keys/fields.ts
 const encryptKey = ({ req, value }) => typeof value === "string" ? req.payload.encrypt(value) : value;
 const decryptKey = ({ req, value }) => {
@@ -16,7 +16,24 @@ const checkbox = (name, description) => ({
 	defaultValue: false,
 	admin: { description }
 });
-const SETUP_GUIDE_FIELD = "setupGuide";
+/**
+* Access for fields only the server writes.
+*/ const SERVER_ONLY = {
+	create: () => false,
+	update: () => false
+};
+const adminField = (name, exportName, options) => ({
+	name,
+	type: "ui",
+	admin: {
+		disableListColumn: true,
+		components: { Field: {
+			path: "@abinnovision/payloadcms-mcpx/admin",
+			exportName,
+			clientProps: { endpointPath: options.endpointPath }
+		} }
+	}
+});
 /**
 * Fields every key carries. Key generation and the HMAC index live in the
 * collection-level `beforeChange` hook (see `collection.ts`), because sibling
@@ -45,10 +62,7 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 	{
 		name: "lastUsedAt",
 		type: "date",
-		access: {
-			create: () => false,
-			update: () => false
-		},
+		access: SERVER_ONLY,
 		admin: {
 			readOnly: true,
 			date: { pickerAppearance: "dayAndTime" },
@@ -58,10 +72,7 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 	{
 		name: "apiKey",
 		type: "text",
-		access: {
-			create: () => false,
-			update: () => false
-		},
+		access: SERVER_ONLY,
 		admin: {
 			readOnly: true,
 			description: "Generated when the key is created. Send it as `Authorization: Bearer <key>`."
@@ -83,26 +94,12 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 * a collection exposes `delete`. The component renders nothing while none is
 * pending and never touches the form, so deciding does not mark the key
 * modified.
-*/ const createConfirmationFields = (options) => options.confirmations ? [{
-	name: "confirmations",
-	type: "ui",
-	admin: {
-		disableListColumn: true,
-		components: { Field: {
-			path: "@abinnovision/payloadcms-mcpx/admin",
-			exportName: "McpxConfirmations",
-			clientProps: { endpointPath: options.endpointPath }
-		} }
-	}
-}] : [];
+*/ const createConfirmationFields = (options) => options.confirmations ? [adminField("confirmations", "McpxConfirmations", options)] : [];
 /**
-* Wraps the key fields, the capabilities and the setup guide in unnamed tabs,
-* so wide tables and snippets get the full form width. Named tabs would nest
-* the data and move `capabilities` off the document root, which capability
-* resolution reads.
-*
-* The guide tab only shows on update: on create there is no key to hand out.
-*/ const withKeyTabs = (keyFields, capabilityFields, options) => {
+* Wraps the key fields and the capabilities in unnamed tabs, so wide tables
+* get the full form width. Named tabs would nest the data and move
+* `capabilities` off the document root, which capability resolution reads.
+*/ const withKeyTabs = (keyFields, capabilityFields) => {
 	const tabs = [{
 		label: "Key",
 		fields: keyFields
@@ -111,22 +108,6 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 		label: "Capabilities",
 		fields: capabilityFields
 	});
-	if (options.setupGuide) tabs.push({
-		label: "Connect a client",
-		admin: { condition: (_data, _siblingData, { operation }) => operation === "update" },
-		fields: [{
-			name: SETUP_GUIDE_FIELD,
-			type: "ui",
-			admin: {
-				disableListColumn: true,
-				components: { Field: {
-					path: "@abinnovision/payloadcms-mcpx/admin",
-					exportName: "McpxSetupGuide",
-					clientProps: { endpointPath: options.endpointPath }
-				} }
-			}
-		}]
-	});
 	return [{
 		type: "tabs",
 		tabs
@@ -147,28 +128,17 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 		name: row.fieldName,
 		type: "group",
 		label: row.slug,
-		fields: STORED_OPERATIONS.filter((operation) => row[operation.id]).map((operation) => checkbox(operation.id, operation.description))
+		fields: rowOperations(row).map((operation) => checkbox(operation.id, operation.description))
 	}));
-	const collectionGroups = entityGroups(matrix.collections);
-	const globalGroups = entityGroups(matrix.globals);
-	const toolCheckboxes = matrix.tools.map((tool) => checkbox(tool.name, tool.description));
 	const groups = [
-		...collectionGroups.length > 0 ? [{
-			name: "collections",
-			type: "group",
-			fields: collectionGroups
-		}] : [],
-		...globalGroups.length > 0 ? [{
-			name: "globals",
-			type: "group",
-			fields: globalGroups
-		}] : [],
-		...toolCheckboxes.length > 0 ? [{
-			name: "tools",
-			type: "group",
-			fields: toolCheckboxes
-		}] : []
-	];
+		["collections", entityGroups(matrix.collections)],
+		["globals", entityGroups(matrix.globals)],
+		["tools", matrix.tools.map((tool) => checkbox(tool.name, tool.description))]
+	].filter(([, fields]) => fields.length > 0).map(([name, fields]) => ({
+		name,
+		type: "group",
+		fields
+	}));
 	if (groups.length === 0) return [];
 	return [{
 		name: CAPABILITIES_FIELD,
@@ -188,4 +158,4 @@ const SETUP_GUIDE_FIELD = "setupGuide";
 	}];
 };
 //#endregion
-export { createCapabilityFields, createConfirmationFields, createKeyFields, withKeyTabs };
+export { SERVER_ONLY, createCapabilityFields, createConfirmationFields, createKeyFields, withKeyTabs };

package/dist/auth/resolve.mjs

@@ -4,16 +4,18 @@ import { hashApiKey } from "../api-keys/key.mjs";
 const BEARER = /^Bearer\s+(\S+)\s*$/i;
 const LAST_USED_INTERVAL_MS = 36e5;
 const toTime = (value) => typeof value === "string" || value instanceof Date ? new Date(value).getTime() : NaN;
-const relationId = (value) => {
-	if (typeof value === "string" || typeof value === "number") return value;
-	if (typeof value === "object" && value !== null && "id" in value) return value.id;
+const isId = (value) => typeof value === "string" || typeof value === "number";
+/**
+* The id of a relationship value, populated or not.
+*/ const relationId = (value) => {
+	if (isId(value)) return value;
+	return isPlainObject(value) && isId(value["id"]) ? value["id"] : void 0;
 };
 const parseBearer = (headers) => {
 	const header = headers.get("authorization");
 	if (!header) return null;
 	return BEARER.exec(header.trim())?.[1] ?? null;
 };
-const isId = (value) => typeof value === "string" || typeof value === "number";
 /**
 * Whether a resolved auth, from the default or a custom resolver, may become
 * `req.user`: a user of the configured user collection with an id, and a key id.
@@ -58,6 +60,26 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 		capabilities: keyDoc.capabilities
 	};
 };
+const KEY_SELECT = {
+	enabled: true,
+	user: true,
+	capabilities: true,
+	expiresAt: true
+};
+/**
+* The user the key `id` acts as, or `null`, under the same checks as the
+* bearer lookup.
+*/ const resolveApiKeyById = async (req, options, id) => {
+	const keyDoc = await req.payload.findByID({
+		collection: options.apiKeysSlug,
+		id,
+		depth: 0,
+		overrideAccess: true,
+		disableErrors: true,
+		select: KEY_SELECT
+	});
+	return await checkApiKey(req, options, keyDoc ?? void 0);
+};
 /**
 * Resolves the bearer key of a request to the user it acts as.
 *
@@ -76,10 +98,7 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 		depth: 0,
 		overrideAccess: true,
 		select: {
-			enabled: true,
-			user: true,
-			capabilities: true,
-			expiresAt: true,
+			...KEY_SELECT,
 			lastUsedAt: true
 		}
 	});
@@ -99,10 +118,10 @@ const isId = (value) => typeof value === "string" || typeof value === "number";
 	} catch (error) {
 		payload.logger.warn({
 			err: error,
-			msg: "Could not record the last use of an MCP API key"
+			msg: "[payloadcms-mcpx] Could not record the last use of an MCP API key."
 		});
 	}
 	return auth;
 };
 //#endregion
-export { checkApiKey, isValidAuthResult, parseBearer, resolveApiKeyAuth };
+export { checkApiKey, isValidAuthResult, parseBearer, relationId, resolveApiKeyAuth, resolveApiKeyById };

package/dist/capabilities.d.mts

@@ -0,0 +1,2 @@
+import "./types.mjs";
+import "./options.mjs";

package/dist/capabilities.mjs

@@ -4,21 +4,60 @@ import { isPlainObject } from "./guards.mjs";
 * Group field holding the capability checkboxes on an API key document.
 */ const CAPABILITIES_FIELD = "capabilities";
 /**
-* Covers draft and live writes; {@link isLiveWrite} separates them.
-*/ const canWrite = (entity) => entity.write !== false;
+* The operations a collection or global can expose. The generated checkboxes
+* and the matrix segments share this wording. `requires` names the
+* operation a grant depends on, which the server and the matrix both enforce.
+*/ const CAPABILITY_OPERATIONS = [
+	{
+		id: "read",
+		label: "Read",
+		description: "Describe, find and read."
+	},
+	{
+		id: "write",
+		label: "Write",
+		description: "Create, patch and validate drafts.",
+		requires: "read"
+	},
+	{
+		id: "publish",
+		label: "Publish",
+		description: "Promote the current draft to what the public sees.",
+		requires: "write"
+	},
+	{
+		id: "delete",
+		label: "Delete",
+		description: "Delete documents. Each one is approved by this key's user in the admin panel, unless the config allows trashing directly and this key is set to.",
+		requires: "read"
+	}
+];
 /**
-* The config lets MCP change live content and a draft exists to promote.
-*/ const canPublish = (entity) => entity.write === "live" && entity.hasDrafts;
+* Stored as a checkbox of its own but drawn as the approval shield of the Delete
+* control.
+*/ const DELETE_UNATTENDED = {
+	id: "deleteUnattended",
+	label: "Trash directly",
+	description: "Move documents to trash without asking this key's user.",
+	requires: "delete"
+};
+/**
+* Every operation with a stored checkbox: the capability operations plus
+* the unattended delete. Each follows the one it requires, which the resolve
+* loop depends on.
+*/ const STORED_OPERATIONS = [...CAPABILITY_OPERATIONS, DELETE_UNATTENDED];
 /**
-* Any writable collection. An upload collection also needs a file, which
-* depends on the request, so the tools check it per call.
-*/ const canCreate = (entity) => canWrite(entity);
+* The operations in one run of the access levels, each requiring the one
+* before it. Delete is chosen separately.
+*/ const ACCESS_CHAIN = CAPABILITY_OPERATIONS.filter((operation) => operation.id !== "delete");
 /**
-* Without drafts there is no draft stage, so every write is live.
-*/ const isLiveWrite = (entity) => entity.write === "live" && !entity.hasDrafts;
+* What an operation depends on. `resolveCapabilities` discards a grant whose
+* prerequisite is off.
+*/ const requiresOf = (operation) => {
+	const found = STORED_OPERATIONS.find((candidate) => candidate.id === operation);
+	return found && "requires" in found ? found.requires : void 0;
+};
 const flag = (group, name) => isPlainObject(group) && group[name] === true;
-const writeFlag = (entity, group) => canWrite(entity) && entity.read && flag(group, "read") && flag(group, "write");
-const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, group) && flag(group, "publish");
 /**
 * Capabilities in force for a key: the plugin config decides what can exist,
 * the key's checkboxes decide what does. A missing checkbox is `false`, so keys
@@ -29,14 +68,18 @@ const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, g
 		const resolved = {};
 		for (const entity of entities) {
 			const group = isPlainObject(namespaceGroup) ? namespaceGroup[entity.fieldName] : void 0;
-			const deleting = entity.delete && flag(group, "read") && flag(group, "delete");
-			resolved[entity.slug] = {
-				read: entity.read && flag(group, "read"),
-				write: writeFlag(entity, group),
-				publish: publishFlag(entity, group),
-				delete: deleting,
-				deleteUnattended: deleting && entity.deleteUnattended && flag(group, "deleteUnattended")
+			const granted = {
+				read: false,
+				write: false,
+				publish: false,
+				delete: false,
+				deleteUnattended: false
 			};
+			for (const { id } of STORED_OPERATIONS) {
+				const needs = requiresOf(id);
+				granted[id] = entity[id] && flag(group, id) && (needs === void 0 || granted[needs]);
+			}
+			resolved[entity.slug] = granted;
 		}
 		return resolved;
 	};
@@ -62,4 +105,4 @@ const publishFlag = (entity, group) => canPublish(entity) && writeFlag(entity, g
 	};
 };
 //#endregion
-export { CAPABILITIES_FIELD, canCreate, canPublish, canWrite, isLiveWrite, resolveCapabilities, scopeSlugs };
+export { ACCESS_CHAIN, CAPABILITIES_FIELD, CAPABILITY_OPERATIONS, STORED_OPERATIONS, requiresOf, resolveCapabilities, scopeSlugs };

package/dist/endpoint/confirmations.mjs

@@ -1,19 +1,20 @@
 import { isPlainObject } from "../guards.mjs";
-import { CONFIRMATIONS_PATH } from "../api-keys/confirmation-view.mjs";
-import { grantKvSlug } from "../grants/grant.mjs";
-import { confirmationHandle, decideConfirmations, issueConfirmation, listConfirmations } from "../grants/confirmation.mjs";
+import { grantContext, grantKvSlug, rowHandle } from "../grants/grant.mjs";
+import { respond } from "./http.mjs";
+import { CONFIRMATIONS_PATH, DECISIONS } from "../api-keys/confirmation-view.mjs";
+import { relationId } from "../auth/resolve.mjs";
+import { decideConfirmations, issueConfirmation, listConfirmations } from "../grants/confirmation.mjs";
+import { publicOrigin } from "../request.mjs";
 import { jsonResult } from "../result.mjs";
 import { BUILTIN_TOOLS } from "../tools/builtin.mjs";
 import { formatAdminURL } from "payload/shared";
 //#region src/endpoint/confirmations.ts
-const respond = (status, body) => Response.json(body, { status });
 const confirmableTool = (name) => BUILTIN_TOOLS.find((tool) => tool.name === name && tool.confirm);
 const keyViewUrl = (req, options, apiKeyId) => {
-	const { config } = req.payload;
 	return formatAdminURL({
-		adminRoute: config.routes.admin,
+		adminRoute: req.payload.config.routes.admin,
 		path: `/collections/${options.apiKeysSlug}/${String(apiKeyId)}`,
-		serverURL: config.serverURL || new URL(req.url ?? "").origin
+		serverURL: publicOrigin(req)
 	});
 };
 /**
@@ -24,9 +25,7 @@ const keyViewUrl = (req, options, apiKeyId) => {
 	confirmed: false,
 	request: async (args) => {
 		const { req } = scope;
-		const slug = grantKvSlug(req.payload.config);
-		const apiKeyId = req.context.mcpx?.apiKeyId;
-		if (slug === void 0 || apiKeyId === void 0) throw new Error("A confirmation was requested without a database KV.");
+		const { slug, apiKeyId } = grantContext(req);
 		const view = keyViewUrl(req, options, apiKeyId);
 		const { id, exp } = await issueConfirmation(req.payload, slug, {
 			apiKeyId,
@@ -54,8 +53,8 @@ const authorize = async (req, options, keyId) => {
 		disableErrors: true,
 		select: { user: true }
 	}).catch(() => null) : null;
-	const user = isPlainObject(key?.user) ? key.user["id"] : key?.user;
-	if (!key || typeof user !== "string" && typeof user !== "number" || String(user) !== String(req.user.id)) return respond(403, { error: "Only the user of this key may decide on its calls." });
+	const user = relationId(key?.user);
+	if (!key || user === void 0 || String(user) !== String(req.user.id)) return respond(403, { error: "Only the user of this key may decide on its calls." });
 	return {
 		slug,
 		apiKeyId: key.id
@@ -89,7 +88,7 @@ const viewOf = async (req, entry, highlight) => {
 	if (allowed instanceof Response) return allowed;
 	const { payload } = req;
 	const highlighted = req.searchParams.get("confirmation");
-	const highlight = highlighted === null ? void 0 : confirmationHandle(payload, highlighted);
+	const highlight = highlighted === null ? void 0 : rowHandle(payload, highlighted);
 	const entries = (await listConfirmations(payload, allowed.slug, allowed.apiKeyId)).filter((entry) => entry.confirmation.state === "pending");
 	const confirmations = [];
 	for (const entry of entries) confirmations.push(await viewOf(req, entry, highlight));
@@ -105,7 +104,8 @@ const viewOf = async (req, entry, highlight) => {
 	if (allowed instanceof Response) return allowed;
 	const handles = isPlainObject(body) ? body["handles"] : void 0;
 	const decision = isPlainObject(body) ? body["decision"] : void 0;
-	if (!Array.isArray(handles) || handles.length > 50 || !handles.every((handle) => typeof handle === "string") || decision !== "approved" && decision !== "rejected") return respond(400, { error: `Send "handles", at most ${String(50)}, and a "decision" of "approved" or "rejected".` });
+	const isDecision = (value) => DECISIONS.some((candidate) => candidate === value);
+	if (!Array.isArray(handles) || handles.length > 50 || !handles.every((handle) => typeof handle === "string") || !isDecision(decision)) return respond(400, { error: `Send "handles", at most ${String(50)}, and a "decision" of "approved" or "rejected".` });
 	const decided = await decideConfirmations(req.payload, allowed.slug, allowed.apiKeyId, handles, decision);
 	return respond(200, { decided });
 };

package/dist/endpoint/handler.mjs

@@ -1,5 +1,5 @@
 import { resolveCapabilities, scopeSlugs } from "../capabilities.mjs";
-import { grantKvSlug } from "../grants/grant.mjs";
+import { grantsAvailable, readCapped } from "./http.mjs";
 import { isValidAuthResult, resolveApiKeyAuth } from "../auth/resolve.mjs";
 import { jsonRpcError } from "./errors.mjs";
 import { createMcpServer } from "./server.mjs";
@@ -7,19 +7,6 @@ import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/
 //#region src/endpoint/handler.ts
 const BODY_BYTES_LIMIT = 4194304;
 const BATCH_MESSAGES_LIMIT = 10;
-const readBody = async (req) => {
-	if (Number(req.headers.get("content-length")) > BODY_BYTES_LIMIT) return null;
-	if (!req.body) return;
-	const decoder = new TextDecoder();
-	let text = "";
-	let size = 0;
-	for await (const chunk of req.body) {
-		size += chunk.byteLength;
-		if (size > BODY_BYTES_LIMIT) return null;
-		text += decoder.decode(chunk, { stream: true });
-	}
-	return text + decoder.decode();
-};
 /**
 * The scope the tools of one request see: the key's resolved capabilities, the
 * slugs they reach, and the locales and limits of the config.
@@ -35,11 +22,8 @@ const readBody = async (req) => {
 			defaultLocale: localization.defaultLocale
 		} : null,
 		limits: options.limits,
-		uploads: options.auth?.resolve === void 0 && grantKvSlug(req.payload.config) !== void 0,
-		diagnostics: options.diagnostics ? {
-			name: options.serverInfo.name,
-			version: options.serverInfo.version
-		} : null,
+		uploads: grantsAvailable(req, options) !== void 0,
+		diagnostics: options.diagnostics ? options.serverInfo : null,
 		exposure: {
 			collections: options.collections,
 			globals: options.globals
@@ -94,13 +78,13 @@ const readBody = async (req) => {
 	const scope = authenticateAs(req, options, auth);
 	let parsedBody;
 	try {
-		const text = await readBody(req);
-		if (text === null) return jsonRpcError({
+		const body = await readCapped(req, BODY_BYTES_LIMIT);
+		if (body === null) return jsonRpcError({
 			status: 413,
 			code: -32e3,
 			message: `Request body too large: the limit is ${String(BODY_BYTES_LIMIT / 1024 / 1024)} MB.`
 		});
-		parsedBody = text === void 0 ? void 0 : JSON.parse(text);
+		parsedBody = body === void 0 ? void 0 : JSON.parse(new TextDecoder().decode(body));
 	} catch {
 		return jsonRpcError({
 			status: 400,

package/dist/endpoint/http.mjs

@@ -0,0 +1,27 @@
+import { grantKvSlug } from "../grants/grant.mjs";
+//#region src/endpoint/http.ts
+const respond = (status, body) => Response.json(body, { status });
+/**
+* The body, `null` once it passes `max` bytes, or `undefined` when there is
+* none. A declared length over `max` is refused unread. A chunked body
+* declares none, so bytes are counted as they arrive and reading stops at
+* `max`.
+*/ const readCapped = async (req, max) => {
+	if (Number(req.headers.get("content-length")) > max) return null;
+	if (!req.body) return;
+	const chunks = [];
+	let size = 0;
+	for await (const chunk of req.body) {
+		size += chunk.byteLength;
+		if (size > max) return null;
+		chunks.push(chunk);
+	}
+	return Buffer.concat(chunks);
+};
+/**
+* The grant KV slug where uploads, downloads and confirmations are possible:
+* the KV is database-backed and no custom `auth.resolve` is set, since the
+* grant endpoints cannot replay what such a resolver authenticated by.
+*/ const grantsAvailable = (req, options) => options.auth?.resolve === void 0 ? grantKvSlug(req.payload.config) : void 0;
+//#endregion
+export { grantsAvailable, readCapped, respond };

package/dist/endpoint/upload.mjs

@@ -1,66 +1,34 @@
 import { isToolEnabled, toolInputSchema } from "../define-tool.mjs";
-import { claimGrant, grantKvSlug } from "../grants/grant.mjs";
+import { claimGrant } from "../grants/grant.mjs";
+import { grantsAvailable, readCapped, respond } from "./http.mjs";
+import { resolveApiKeyById } from "../auth/resolve.mjs";
+import { parseResult } from "../result.mjs";
 import { downloadSlugs, setUploadedFile, uploadMaxBytes } from "../upload/file.mjs";
 import { BUILTIN_TOOLS } from "../tools/builtin.mjs";
-import { checkApiKey } from "../auth/resolve.mjs";
 import { runTool } from "./server.mjs";
 import { authenticateAs } from "./handler.mjs";
 //#region src/endpoint/upload.ts
 const UPLOAD_TOOLS = /* @__PURE__ */ new Set(["createDocument", "patchDocument"]);
-const respond = (status, body) => Response.json(body, { status });
 const refused = () => respond(403, { error: "The request was refused: the grant is unknown, expired or used, or the key no longer allows it. Call the tool again for a new one." });
-const readExactly = async (req, size) => {
-	const declared = req.headers.get("content-length");
-	if (declared !== null && Number(declared) !== size) return null;
-	if (!req.body) return null;
-	const chunks = [];
-	let total = 0;
-	for await (const chunk of req.body) {
-		total += chunk.byteLength;
-		if (total > size) return null;
-		chunks.push(chunk);
-	}
-	return total === size ? Buffer.concat(chunks) : null;
-};
 const statusOf = (result, data) => {
 	if (result.isError !== true) return 200;
 	if ("updatedAt" in data || data["status"] === 423) return 409;
 	if (data["status"] === 401 || data["status"] === 403) return 403;
 	return data["error"] === "Internal error" ? 500 : 422;
 };
-const parseResult = (result) => {
-	const [first] = result.content;
-	return first?.type === "text" ? JSON.parse(first.text) : {};
-};
 const NO_SESSION = {
 	signal: new AbortController().signal,
 	requestId: "upload",
 	sendNotification: () => Promise.resolve(),
 	sendRequest: () => Promise.reject(/* @__PURE__ */ new Error("No MCP session."))
 };
-const reauthenticate = async (req, options, grant) => {
-	const keyDoc = await req.payload.findByID({
-		collection: options.apiKeysSlug,
-		id: grant.apiKeyId,
-		depth: 0,
-		overrideAccess: true,
-		disableErrors: true,
-		select: {
-			enabled: true,
-			user: true,
-			capabilities: true,
-			expiresAt: true
-		}
-	});
-	return await checkApiKey(req, options, keyDoc ?? void 0);
-};
 const claimAs = async (req, options, kind) => {
-	const slug = grantKvSlug(req.payload.config);
+	const slug = grantsAvailable(req, options);
 	const grantId = req.headers.get("x-mcpx-grant");
-	if (slug === void 0 || options.auth?.resolve || grantId === null) return;
+	if (slug === void 0 || grantId === null) return;
 	const grant = await claimGrant(req.payload, slug, grantId);
 	if (grant?.kind !== kind) return;
-	const auth = await reauthenticate(req, options, grant);
+	const auth = await resolveApiKeyById(req, options, grant.apiKeyId);
 	if (!auth) return;
 	const scope = authenticateAs(req, options, auth);
 	req.query = {};
@@ -80,16 +48,16 @@ const claimAs = async (req, options, kind) => {
 */ const createUploadHandler = (options) => async (req) => {
 	const { payload } = req;
 	const claimed = await claimAs(req, options, "upload");
-	const file = claimed?.grant.args["file"];
-	if (!claimed || !UPLOAD_TOOLS.has(claimed.grant.tool) || !file) return refused();
+	if (!claimed || !UPLOAD_TOOLS.has(claimed.grant.tool) || !claimed.grant.file) return refused();
 	const { grant, scope } = claimed;
+	const { file } = grant;
 	const tool = BUILTIN_TOOLS.find((candidate) => candidate.name === grant.tool);
 	if (!tool || !isToolEnabled(tool, scope)) return refused();
 	const args = toolInputSchema(tool, scope).safeParse(grant.args);
 	if (!args.success) return refused();
 	if (file.size > uploadMaxBytes(payload.config)) return respond(413, { error: "The file is larger than allowed." });
-	const data = await readExactly(req, file.size);
-	if (data === null) return respond(400, { error: `The body must be exactly ${String(file.size)} bytes, the size the tool call declared.` });
+	const data = await readCapped(req, file.size);
+	if (data?.length !== file.size) return respond(400, { error: `The body must be exactly ${String(file.size)} bytes, the size the tool call declared.` });
 	setUploadedFile(req, {
 		data,
 		mimetype: file.mimeType,