@namzu/sdk 30.2.0 → 31.1.0

package/src/manager/connector/lifecycle.ts

@@ -1,13 +1,21 @@
 import type { BaseConnector } from '../../connector/BaseConnector.js'
+import { managedConnectorOptions } from '../../connector/execution-contract.js'
 import type { ConnectorRegistry } from '../../registry/connector/definitions.js'
+import { renderToolSchema } from '../../registry/tool/schema.js'
 import type {
+	AuthConfig,
+	AuthType,
 	ConnectorConfig,
+	ConnectorDefinition,
 	ConnectorEventListener,
 	ConnectorExecuteParams,
 	ConnectorExecuteResult,
 	ConnectorInstance,
 	ConnectorLifecycleEvent,
+	ConnectorMethod,
+	ConnectorOperationOptions,
 	ConnectorStatus,
+	ConnectorTrigger,
 } from '../../types/connector/index.js'
 import type { ConnectorId, ConnectorInstanceId } from '../../types/ids/index.js'
 import { toErrorMessage } from '../../utils/error.js'
@@ -28,16 +36,159 @@ export interface ConnectorManagerConfig {
 	log?: Logger
 }
 
+type Settled<T> = { kind: 'fulfilled'; value: T } | { kind: 'rejected'; reason: unknown }
+
+interface InstanceAdmission {
+	readonly connectorId: ConnectorId
+	readonly definition: ConnectorDefinition
+	readonly supportedAuth?: ReadonlySet<AuthType>
+}
+
+function copyAuth(auth: AuthConfig): AuthConfig {
+	return {
+		type: auth.type,
+		...(auth.credentials ? { credentials: { ...auth.credentials } } : {}),
+	}
+}
+
+function sameAuthPolicy(
+	registered: readonly AuthType[] | undefined,
+	implementation: readonly AuthType[] | undefined,
+): boolean {
+	if (registered === undefined || implementation === undefined) {
+		return registered === implementation
+	}
+	const expected = new Set(registered)
+	const actual = new Set(implementation)
+	return expected.size === actual.size && [...expected].every((authType) => actual.has(authType))
+}
+
+function sameMethodSurface(
+	registered: readonly ConnectorMethod[],
+	implementation: readonly ConnectorMethod[],
+): boolean {
+	const expected = new Set(registered.map((method) => method.name))
+	const actual = new Set(implementation.map((method) => method.name))
+	return (
+		expected.size === registered.length &&
+		actual.size === implementation.length &&
+		expected.size === actual.size &&
+		[...expected].every((name) => actual.has(name))
+	)
+}
+
+function copyMethod(method: ConnectorMethod): ConnectorMethod {
+	return { ...method }
+}
+
+function copyTrigger(trigger: ConnectorTrigger): ConnectorTrigger {
+	return { ...trigger }
+}
+
+function copyDefinition(definition: ConnectorDefinition): ConnectorDefinition {
+	return {
+		...definition,
+		...(definition.supportedAuth ? { supportedAuth: [...definition.supportedAuth] } : {}),
+		methods: definition.methods.map(copyMethod),
+		...(definition.triggers ? { triggers: definition.triggers.map(copyTrigger) } : {}),
+	}
+}
+
+function assertMethodSchemas(definition: ConnectorDefinition): void {
+	for (const method of definition.methods) {
+		try {
+			renderToolSchema(method.inputSchema)
+			if (method.outputSchema) renderToolSchema(method.outputSchema)
+		} catch (err) {
+			throw new Error(
+				`Connector method "${method.name}" on "${definition.id}" has a schema that cannot be projected: ${toErrorMessage(err)}`,
+			)
+		}
+	}
+}
+
+function formatSchemaIssues(issues: readonly { path: PropertyKey[]; message: string }[]): string {
+	return issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.message}`).join('; ')
+}
+
+function formatOutputSchemaIssues(
+	issues: readonly { path: PropertyKey[]; code: string }[],
+): string {
+	return issues.map((issue) => `${issue.path.join('.') || '(root)'}: ${issue.code}`).join('; ')
+}
+
+function notStartedFailure(error: string): ConnectorExecuteResult {
+	return {
+		success: false,
+		output: null,
+		error,
+		durationMs: 0,
+		metadata: { remoteOutcome: 'not_started', retrySafety: 'safe' },
+	}
+}
+
+async function settleWithSignal<T>(
+	operation: Promise<T>,
+	signal: AbortSignal | undefined,
+	acceptAfterAbort?: (value: T) => boolean,
+): Promise<T> {
+	if (!signal) return operation
+	const settled: Promise<Settled<T>> = operation.then(
+		(value) => ({ kind: 'fulfilled', value }),
+		(reason) => ({ kind: 'rejected', reason }),
+	)
+	let onAbort: (() => void) | undefined
+	const aborted = new Promise<{ kind: 'aborted' }>((resolve) => {
+		onAbort = () => resolve({ kind: 'aborted' })
+		if (signal.aborted) {
+			onAbort()
+			return
+		}
+		signal.addEventListener('abort', onAbort, { once: true })
+	})
+
+	try {
+		const winner = await Promise.race([settled, aborted])
+		if (winner.kind !== 'aborted') {
+			if (winner.kind === 'rejected') throw winner.reason
+			if (signal.aborted && !acceptAfterAbort?.(winner.value)) throw signal.reason
+			return winner.value
+		}
+
+		// A cooperative connector can preserve richer phase information (for
+		// example response headers received but body unavailable). Give its abort
+		// continuation one event-loop turn before abandoning an uncooperative
+		// custom connector with the caller's reason.
+		let timer: ReturnType<typeof setTimeout> | undefined
+		const grace = await Promise.race([
+			settled,
+			new Promise<{ kind: 'grace_elapsed' }>((resolve) => {
+				timer = setTimeout(() => resolve({ kind: 'grace_elapsed' }), 0)
+			}),
+		]).finally(() => {
+			if (timer !== undefined) clearTimeout(timer)
+		})
+		if (grace.kind === 'fulfilled' && acceptAfterAbort?.(grace.value)) return grace.value
+		if (grace.kind === 'rejected') throw grace.reason
+		throw signal.reason
+	} finally {
+		if (onAbort) signal.removeEventListener('abort', onAbort)
+	}
+}
+
 export class ConnectorManager {
 	private registry: ConnectorRegistry
 	private instances: Map<ConnectorInstanceId, ConnectorInstance> = new Map()
 	private liveConnectors: Map<ConnectorInstanceId, BaseConnector<unknown>> = new Map()
+	private admissions: Map<ConnectorInstanceId, InstanceAdmission> = new Map()
 	private listeners: ConnectorEventListener[] = []
 	private log: Logger
 
 	constructor(config: ConnectorManagerConfig) {
 		this.registry = config.registry
-		this.log = resolveLogger(config.log).child({ [SCOPE_ATTRIBUTE]: 'manager/connector' })
+		this.log = resolveLogger(config.log).child({
+			[SCOPE_ATTRIBUTE]: 'manager/connector',
+		})
 	}
 
 	on(listener: ConnectorEventListener): void {
@@ -54,6 +205,31 @@ export class ConnectorManager {
 		connector: BaseConnector<unknown>,
 	): Promise<ConnectorInstance> {
 		const definition = this.registry.getOrThrow(config.connectorId)
+		if (connector.id !== config.connectorId) {
+			throw new Error(
+				`Connector implementation id "${connector.id}" does not match requested definition "${config.connectorId}"`,
+			)
+		}
+		if (!sameAuthPolicy(definition.supportedAuth, connector.supportedAuth)) {
+			throw new Error(
+				`Connector implementation "${connector.id}" does not match its registered auth policy`,
+			)
+		}
+		assertMethodSchemas(definition)
+		if (!sameMethodSurface(definition.methods, connector.methods)) {
+			throw new Error(
+				`Connector implementation "${connector.id}" does not match its registered method surface`,
+			)
+		}
+		const capturedDefinition = copyDefinition(definition)
+		const admission: InstanceAdmission = {
+			connectorId: config.connectorId,
+			definition: capturedDefinition,
+			...(capturedDefinition.supportedAuth
+				? { supportedAuth: new Set(capturedDefinition.supportedAuth) }
+				: {}),
+		}
+		if (config.auth) this.requireSupportedAuth(admission, config.connectorId, config.auth.type)
 
 		const parsedConfig = definition.configSchema.safeParse(config.options ?? {})
 		if (!parsedConfig.success) {
@@ -74,7 +250,12 @@ export class ConnectorManager {
 
 		this.instances.set(instanceId, instance)
 		this.liveConnectors.set(instanceId, connector)
-		this.emit({ type: 'instance_created', instanceId, connectorId: config.connectorId })
+		this.admissions.set(instanceId, admission)
+		this.emit({
+			type: 'instance_created',
+			instanceId,
+			connectorId: config.connectorId,
+		})
 		this.log.info('Connector instance created', {
 			'namzu.connector.instance_id': instanceId,
 			'namzu.connector.id': config.connectorId,
@@ -86,18 +267,24 @@ export class ConnectorManager {
 	async connect(instanceId: ConnectorInstanceId): Promise<void> {
 		const instance = this.getInstanceOrThrow(instanceId)
 		const connector = this.getConnectorOrThrow(instanceId)
-
-		this.updateStatus(instanceId, 'connecting')
-		this.emit({ type: 'instance_connecting', instanceId })
+		const admission = this.getAdmissionOrThrow(instanceId)
 
 		try {
-			const definition = this.registry.getOrThrow(instance.connectorId)
-			const parsedConfig = definition.configSchema.parse(instance.config.options ?? {})
+			const parsedConfig = admission.definition.configSchema.parse(instance.config.options ?? {})
+			this.requireSupportedAuth(
+				admission,
+				admission.connectorId,
+				instance.config.auth?.type ?? 'none',
+			)
+			this.updateStatus(instanceId, 'connecting')
+			this.emit({ type: 'instance_connecting', instanceId })
 			await connector.connect(parsedConfig, instance.config.auth)
 			this.updateStatus(instanceId, 'connected')
 			instance.connectedAt = Date.now()
 			this.emit({ type: 'instance_connected', instanceId })
-			this.log.info('Connector connected', { 'namzu.connector.instance_id': instanceId })
+			this.log.info('Connector connected', {
+				'namzu.connector.instance_id': instanceId,
+			})
 		} catch (err) {
 			const message = toErrorMessage(err)
 			this.updateStatus(instanceId, 'error', message)
@@ -117,7 +304,9 @@ export class ConnectorManager {
 			await connector.disconnect()
 			this.updateStatus(instanceId, 'disconnected')
 			this.emit({ type: 'instance_disconnected', instanceId })
-			this.log.info('Connector disconnected', { 'namzu.connector.instance_id': instanceId })
+			this.log.info('Connector disconnected', {
+				'namzu.connector.instance_id': instanceId,
+			})
 		} catch (err) {
 			const message = toErrorMessage(err)
 			this.log.error('Connector disconnect failed', {
@@ -128,10 +317,14 @@ export class ConnectorManager {
 		}
 	}
 
-	async healthCheck(instanceId: ConnectorInstanceId): Promise<boolean> {
+	async healthCheck(
+		instanceId: ConnectorInstanceId,
+		options?: ConnectorOperationOptions,
+	): Promise<boolean> {
 		const connector = this.getConnectorOrThrow(instanceId)
+		if (options?.signal?.aborted) return false
 		try {
-			return await connector.healthCheck()
+			return await settleWithSignal(connector.healthCheck(options), options?.signal)
 		} catch {
 			return false
 		}
@@ -140,29 +333,119 @@ export class ConnectorManager {
 	async execute(params: ConnectorExecuteParams): Promise<ConnectorExecuteResult> {
 		const instance = this.getInstanceOrThrow(params.instanceId)
 		const connector = this.getConnectorOrThrow(params.instanceId)
+		const admission = this.getAdmissionOrThrow(params.instanceId)
+		if (params.signal?.aborted) {
+			return notStartedFailure(
+				`Connector execution was cancelled before it started: ${toErrorMessage(params.signal.reason)}. No remote request was started; retry is safe.`,
+			)
+		}
+
+		const method = admission.definition.methods.find(
+			(candidate) => candidate.name === params.method,
+		)
+		if (!method) {
+			const available = admission.definition.methods.map((candidate) => candidate.name).join(', ')
+			return notStartedFailure(
+				`Connector method "${params.method}" is not registered for "${admission.connectorId}". Available: ${available || '(none)'}. No remote request was started; retry is safe after correcting the method.`,
+			)
+		}
 
 		if (instance.status !== 'connected') {
-			return {
-				success: false,
-				output: null,
-				error: `Connector "${params.instanceId}" is not connected (status: ${instance.status})`,
-				durationMs: 0,
+			return notStartedFailure(
+				`Connector "${params.instanceId}" is not connected (status: ${instance.status}). No remote request was started; retry is safe after connecting it.`,
+			)
+		}
+
+		let canonicalInput: unknown
+		try {
+			const parsedInput = await settleWithSignal(
+				method.inputSchema.safeParseAsync(params.input),
+				params.signal,
+			)
+			if (!parsedInput.success) {
+				return notStartedFailure(
+					`Invalid input for connector method "${params.method}": ${formatSchemaIssues(parsedInput.error.issues)}. No remote request was started; retry is safe after correcting the input.`,
+				)
+			}
+			canonicalInput = parsedInput.data
+		} catch (err) {
+			if (params.signal?.aborted) {
+				return notStartedFailure(
+					`Connector execution was cancelled during input validation: ${toErrorMessage(params.signal.reason)}. No remote request was started; retry is safe.`,
+				)
 			}
+			return notStartedFailure(
+				`Input validation failed for connector method "${params.method}": ${toErrorMessage(err)}. No remote request was started; retry is safe after correcting the connector schema or input.`,
+			)
 		}
 
-		this.emit({ type: 'action_executing', instanceId: params.instanceId, method: params.method })
+		if (params.signal?.aborted) {
+			return notStartedFailure(
+				`Connector execution was cancelled before it started: ${toErrorMessage(params.signal.reason)}. No remote request was started; retry is safe.`,
+			)
+		}
+
+		this.emit({
+			type: 'action_executing',
+			instanceId: params.instanceId,
+			method: params.method,
+		})
 		const start = performance.now()
 		try {
-			const result = await connector.execute(params.method, params.input)
+			const result = await settleWithSignal(
+				connector.execute(
+					params.method,
+					canonicalInput,
+					managedConnectorOptions({ signal: params.signal }),
+				),
+				params.signal,
+				(result) =>
+					result.metadata?.remoteOutcome === 'response_received' ||
+					(!result.success && result.metadata?.remoteOutcome !== undefined),
+			)
 			instance.lastUsedAt = Date.now()
+			let published = result
+			if (result.success && method.outputSchema) {
+				try {
+					const parsedOutput = await settleWithSignal(
+						method.outputSchema.safeParseAsync(result.output),
+						params.signal,
+					)
+					published = parsedOutput.success
+						? { ...result, output: parsedOutput.data }
+						: {
+								success: false,
+								output: null,
+								error: `Connector method "${params.method}" returned output that violates its registered schema: ${formatOutputSchemaIssues(parsedOutput.error.issues)}. A remote response was received; do not automatically retry.`,
+								durationMs: result.durationMs,
+								metadata: {
+									...result.metadata,
+									remoteOutcome: 'response_received',
+									retrySafety: 'unsafe',
+								},
+							}
+				} catch {
+					published = {
+						success: false,
+						output: null,
+						error: `Connector method "${params.method}" output validation could not establish the registered contract. A remote response was received; do not automatically retry.`,
+						durationMs: result.durationMs,
+						metadata: {
+							...result.metadata,
+							remoteOutcome: 'response_received',
+							retrySafety: 'unsafe',
+						},
+					}
+				}
+			}
 			this.emit({
 				type: 'action_completed',
 				instanceId: params.instanceId,
 				method: params.method,
-				success: result.success,
-				durationMs: result.durationMs,
+				success: published.success,
+				durationMs: published.durationMs,
 			})
-			return result
+			return published
 		} catch (err) {
 			const message = toErrorMessage(err)
 			const durationMs = Math.round(performance.now() - start)
@@ -176,8 +459,18 @@ export class ConnectorManager {
 			return {
 				success: false,
 				output: null,
-				error: `Execution failed: ${message}`,
+				error: params.signal?.aborted
+					? `Connector execution was interrupted: ${message}. The remote outcome is unknown; do not automatically retry.`
+					: `Execution failed: ${message}`,
 				durationMs,
+				...(params.signal?.aborted
+					? {
+							metadata: {
+								remoteOutcome: 'unknown' as const,
+								retrySafety: 'unknown' as const,
+							},
+						}
+					: {}),
 			}
 		}
 	}
@@ -197,8 +490,11 @@ export class ConnectorManager {
 
 		this.instances.delete(instanceId)
 		this.liveConnectors.delete(instanceId)
+		this.admissions.delete(instanceId)
 		this.emit({ type: 'instance_removed', instanceId })
-		this.log.info('Connector instance removed', { 'namzu.connector.instance_id': instanceId })
+		this.log.info('Connector instance removed', {
+			'namzu.connector.instance_id': instanceId,
+		})
 	}
 
 	getRegistry(): ConnectorRegistry {
@@ -213,12 +509,35 @@ export class ConnectorManager {
 		return this.liveConnectors.get(instanceId)
 	}
 
+	getInstanceConnectorId(instanceId: ConnectorInstanceId): ConnectorId {
+		return this.getAdmissionOrThrow(instanceId).connectorId
+	}
+
+	getInstanceDefinition(instanceId: ConnectorInstanceId): ConnectorDefinition {
+		return copyDefinition(this.getAdmissionOrThrow(instanceId).definition)
+	}
+
+	supportsAuth(instanceId: ConnectorInstanceId, authType: AuthType): boolean {
+		const supported = this.getAdmissionOrThrow(instanceId).supportedAuth
+		return supported === undefined || supported.has(authType)
+	}
+
+	/** Validate before mutating the live instance's effective credential. */
+	setInstanceAuth(instanceId: ConnectorInstanceId, auth: AuthConfig): void {
+		const instance = this.getInstanceOrThrow(instanceId)
+		const admission = this.getAdmissionOrThrow(instanceId)
+		this.requireSupportedAuth(admission, admission.connectorId, auth.type)
+		instance.config.auth = copyAuth(auth)
+	}
+
 	listInstances(): ConnectorInstance[] {
 		return Array.from(this.instances.values())
 	}
 
 	listInstancesByConnector(connectorId: ConnectorId): ConnectorInstance[] {
-		return this.listInstances().filter((i) => i.connectorId === connectorId)
+		return this.listInstances().filter(
+			(instance) => this.getAdmissionOrThrow(instance.id).connectorId === connectorId,
+		)
 	}
 
 	listConnectedInstances(): ConnectorInstance[] {
@@ -246,6 +565,27 @@ export class ConnectorManager {
 		return connector
 	}
 
+	private getAdmissionOrThrow(instanceId: ConnectorInstanceId): InstanceAdmission {
+		const admission = this.admissions.get(instanceId)
+		if (!admission) {
+			throw new Error(`Connector admission policy not found for instance: "${instanceId}"`)
+		}
+		return admission
+	}
+
+	private requireSupportedAuth(
+		admission: InstanceAdmission,
+		connectorId: ConnectorId,
+		authType: AuthType,
+	): void {
+		const supported = admission.supportedAuth
+		if (supported === undefined || supported.has(authType)) return
+		const available = [...supported].join(', ') || 'none'
+		throw new Error(
+			`Connector "${connectorId}" does not support auth scheme "${authType}". Supported: ${available}`,
+		)
+	}
+
 	private updateStatus(
 		instanceId: ConnectorInstanceId,
 		status: ConnectorStatus,

package/src/manager/connector/tenant.ts

@@ -2,12 +2,15 @@ import type { BaseConnector } from '../../connector/BaseConnector.js'
 import { NAMZU } from '../../constants/telemetry/index.js'
 import type { ConnectorRegistry } from '../../registry/connector/definitions.js'
 import type {
+	AuthConfig,
+	AuthType,
 	ConnectorConfig,
 	ConnectorEventListener,
 	ConnectorExecuteParams,
 	ConnectorExecuteResult,
 	ConnectorInstance,
 	ConnectorLifecycleEvent,
+	ConnectorOperationOptions,
 	CredentialVault,
 	TenantDescriptor,
 	TenantRateLimitConfig,
@@ -63,17 +66,24 @@ export class TenantConnectorManager {
 		this.registry = config.registry
 		this.credentialVault = config.credentialVault
 		this.defaultRateLimit = config.defaultRateLimit
-		this.log = resolveLogger(config.log).child({ [SCOPE_ATTRIBUTE]: 'manager/connector' })
+		this.log = resolveLogger(config.log).child({
+			[SCOPE_ATTRIBUTE]: 'manager/connector',
+		})
 	}
 
 	registerTenant(descriptor: TenantDescriptor, rateLimit?: TenantRateLimitConfig): void {
 		if (this.tenants.has(descriptor.id)) {
-			this.log.warn('Tenant already registered, skipping', { [NAMZU.TENANT_ID]: descriptor.id })
+			this.log.warn('Tenant already registered, skipping', {
+				[NAMZU.TENANT_ID]: descriptor.id,
+			})
 			return
 		}
 
 		const tenantLog = this.log.child({ [NAMZU.TENANT_ID]: descriptor.id })
-		const manager = new ConnectorManager({ registry: this.registry, log: tenantLog })
+		const manager = new ConnectorManager({
+			registry: this.registry,
+			log: tenantLog,
+		})
 
 		manager.on((event) => {
 			this.emitTenantEvent(descriptor.id, event)
@@ -150,18 +160,19 @@ export class TenantConnectorManager {
 		if (this.credentialVault) {
 			const instance = state.manager.getInstance(instanceId)
 			if (instance && !instance.config.auth) {
-				const creds = await this.credentialVault.list(tenantId, instance.connectorId)
-				const credId = creds[0]?.id
-				if (credId) {
-					const auth = await this.credentialVault.retrieve(credId)
-					if (auth) {
-						instance.config.auth = auth
-						this.log.info('Auto-resolved credential for instance', {
-							[NAMZU.CREDENTIAL_ID]: credId,
-							'namzu.connector.instance_id': instanceId,
-							[NAMZU.TENANT_ID]: tenantId,
-						})
-					}
+				const connectorId = state.manager.getInstanceConnectorId(instanceId)
+				const creds = await this.credentialVault.list(tenantId, connectorId)
+				for (const ref of creds) {
+					if (!state.manager.supportsAuth(instanceId, ref.authType)) continue
+					const auth = await this.credentialVault.retrieveForScope(tenantId, connectorId, ref.id)
+					if (!auth || !state.manager.supportsAuth(instanceId, auth.type)) continue
+					state.manager.setInstanceAuth(instanceId, auth)
+					this.log.info('Auto-resolved credential for instance', {
+						[NAMZU.CREDENTIAL_ID]: ref.id,
+						'namzu.connector.instance_id': instanceId,
+						[NAMZU.TENANT_ID]: tenantId,
+					})
+					break
 				}
 			}
 		}
@@ -183,13 +194,16 @@ export class TenantConnectorManager {
 		if (!instance) {
 			throw new Error(`Connector instance not found: "${instanceId}"`)
 		}
+		const connectorId = state.manager.getInstanceConnectorId(instanceId)
 
-		const auth = await this.credentialVault.retrieve(credentialId)
+		const auth = await this.credentialVault.retrieveForScope(tenantId, connectorId, credentialId)
 		if (!auth) {
-			throw new Error(`Credential not found: "${credentialId}"`)
+			throw new Error(
+				`Credential "${credentialId}" is unavailable for tenant "${tenantId}" and connector "${connectorId}"`,
+			)
 		}
 
-		instance.config.auth = auth
+		state.manager.setInstanceAuth(instanceId, auth)
 		this.log.info('Credential applied to instance', {
 			[NAMZU.CREDENTIAL_ID]: credentialId,
 			'namzu.connector.instance_id': instanceId,
@@ -202,12 +216,13 @@ export class TenantConnectorManager {
 		tenantId: TenantId,
 		connectorId: ConnectorId,
 		label: string,
-		auth: import('../../types/connector/index.js').AuthConfig,
+		auth: AuthConfig,
 	): Promise<import('../../types/connector/index.js').CredentialRef> {
 		if (!this.credentialVault) {
 			throw new Error('No credential vault configured on TenantConnectorManager')
 		}
 		this.getTenantOrThrow(tenantId)
+		this.requireDefinitionSupportsAuth(connectorId, auth.type)
 		return this.credentialVault.store(tenantId, connectorId, label, auth)
 	}
 
@@ -222,11 +237,12 @@ export class TenantConnectorManager {
 		return this.credentialVault.list(tenantId, connectorId)
 	}
 
-	async revokeCredential(credentialId: CredentialId): Promise<boolean> {
+	async revokeCredential(tenantId: TenantId, credentialId: CredentialId): Promise<boolean> {
 		if (!this.credentialVault) {
 			return false
 		}
-		return this.credentialVault.revoke(credentialId)
+		this.getTenantOrThrow(tenantId)
+		return this.credentialVault.revokeForTenant(tenantId, credentialId)
 	}
 
 	async disconnect(tenantId: TenantId, instanceId: ConnectorInstanceId): Promise<void> {
@@ -239,6 +255,11 @@ export class TenantConnectorManager {
 		params: ConnectorExecuteParams,
 	): Promise<ConnectorExecuteResult> {
 		const state = this.getTenantOrThrow(tenantId)
+		// A caller that has already withdrawn authority did not attempt a remote
+		// operation and must not spend the tenant's next admission slot. Delegate
+		// first so the ordinary manager still validates the instance and returns
+		// the canonical not-started phase result.
+		if (params.signal?.aborted) return state.manager.execute(params)
 
 		if (!this.checkRateLimit(state, params.instanceId)) {
 			return {
@@ -252,9 +273,13 @@ export class TenantConnectorManager {
 		return state.manager.execute(params)
 	}
 
-	async healthCheck(tenantId: TenantId, instanceId: ConnectorInstanceId): Promise<boolean> {
+	async healthCheck(
+		tenantId: TenantId,
+		instanceId: ConnectorInstanceId,
+		options?: ConnectorOperationOptions,
+	): Promise<boolean> {
 		const state = this.getTenantOrThrow(tenantId)
-		return state.manager.healthCheck(instanceId)
+		return state.manager.healthCheck(instanceId, options)
 	}
 
 	async removeInstance(tenantId: TenantId, instanceId: ConnectorInstanceId): Promise<void> {
@@ -317,4 +342,12 @@ export class TenantConnectorManager {
 		}
 		return state
 	}
+
+	private requireDefinitionSupportsAuth(connectorId: ConnectorId, authType: AuthType): void {
+		const supported = this.registry.getOrThrow(connectorId).supportedAuth
+		if (supported === undefined || supported.includes(authType)) return
+		throw new Error(
+			`Connector "${connectorId}" does not support auth scheme "${authType}". Supported: ${supported.join(', ') || 'none'}`,
+		)
+	}
 }