@zackbart/connecta 0.1.0

package/dist/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAIA,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;OAM7B,CAAC;AASR,MAAM,UAAU,eAAe,CAC7B,QAA2B;IAE3B,OAAO;QACL,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,UAAU;QACxD,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE;YAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC5B,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACP,WAAW,EACT,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;YAC7B,uEAAuE;KAC1E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoDD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,KAAa;IAEb,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG;YACpB,SAAS,CAAC,EAAE;YACZ,SAAS,CAAC,KAAK;YACf,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,MAAM;SACjB;aACE,IAAI,CAAC,GAAG,CAAC;aACT,WAAW,EAAE,CAAC;QACjB,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC;YACF,gBAAgB;YAChB,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAkB,EAClB,OAAe,EACf,UAA6C,EAC7C,eAAiC,EACjC,eAAe,GAAG,KAAK;IAEvB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAwB,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,0CAA0C;QAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,KAAK,GAAG,CACN,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CACrD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,IAAI,UAAqC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,CACvB,QAA2D,EAC3D,EAAE,CACF,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,UAAU;oBACxC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;oBAClC,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC;4BACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,SAAS,EAAE,aAAa,CAAC,SAAS;yBACnC;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC1C,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,MAAM,EAAE,MAAM;wBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC3C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAC5B,GAAG,CAAC,QAAQ;wBACV,CAAC,CAAC;4BACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;yBAC9B;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC;iBACzD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC;oBACxD,KAAK,EAAE,sCAAsC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK;YACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAqB,EACrB,MAAM,GAAG,MAAM,EACf,QAA2B;IAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS;QAC3B,CAAC,CAAC,GAAG,KAAK,CAAC,WAAW,MAAM,KAAK,CAAC,SAAS,EAAE;QAC7C,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,kCAAkC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;YAC5G,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS;QACnE,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,yBAAyB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS;QACrE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GACf,MAAM,EAAE,IAAI,KAAK,OAAO;QACtB,CAAC,CAAC,qEAAqE,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,yDAAyD;QACpN,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;;;;SAQA,cAAc,CAAC,KAAK,CAAC;EAC5B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2QT,KAAK;;MAEH,OAAO;;;;;;;;;;;;;;;;WAgBF,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;eA+D7B,mBAAmB,CAAC,IAAI,CAAC;kBACtB,mBAAmB,CAAC,MAAM,CAAC;6BAChB,kBAAkB,CAAC,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA4clD,CAAC;AACT,CAAC"}

package/package.json

@@ -0,0 +1,96 @@
+{
+  "name": "@zackbart/connecta",
+  "version": "0.1.0",
+  "type": "module",
+  "sideEffects": false,
+  "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind nine meta-tools.",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20.9.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zackbart/connecta.git"
+  },
+  "homepage": "https://github.com/zackbart/connecta#readme",
+  "bugs": {
+    "url": "https://github.com/zackbart/connecta/issues"
+  },
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "cloudflare-workers",
+    "connectors"
+  ],
+  "files": [
+    "dist",
+    "src",
+    "assets",
+    "README.md",
+    "CHANGELOG.md",
+    "SECURITY.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./node": {
+      "types": "./dist/node.d.ts",
+      "import": "./dist/node.js"
+    },
+    "./quickjs": {
+      "types": "./dist/executors/quickjs.d.ts",
+      "import": "./dist/executors/quickjs.js"
+    },
+    "./auth/clerk": {
+      "types": "./dist/auth/clerk.d.ts",
+      "import": "./dist/auth/clerk.js"
+    }
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\"",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "check:examples": "tsc -p tsconfig.examples.node.json && tsc -p tsconfig.examples.worker.json",
+    "check:security": "npm audit --omit=dev --audit-level=high",
+    "check:package": "node scripts/check-package.mjs",
+    "check": "npm run typecheck && npm run test && npm run build && npm run check:examples",
+    "release:check": "npm run check && npm run check:security && npm run check:package",
+    "prepack": "npm run check",
+    "prepublishOnly": "npm run check:security"
+  },
+  "dependencies": {
+    "@cfworker/json-schema": "^4.1.1",
+    "@modelcontextprotocol/sdk": "1.29.0",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "@clerk/backend": "^3.12.0",
+    "quickjs-emscripten": "^0.32.0"
+  },
+  "peerDependenciesMeta": {
+    "@clerk/backend": {
+      "optional": true
+    },
+    "quickjs-emscripten": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@clerk/backend": "^3.12.0",
+    "@cloudflare/codemode": "^0.4.4",
+    "@cloudflare/workers-types": "^4.20250101.0 || ^5.0.0",
+    "@types/node": "^22.0.0",
+    "quickjs-emscripten": "^0.32.0",
+    "tsx": "^4.23.1",
+    "typescript": "^5.6.0",
+    "vitest": "^4.1.6",
+    "wrangler": "^4.114.0"
+  }
+}

package/src/activity.ts

@@ -0,0 +1,144 @@
+import type { Logger } from "./types.js";
+
+export type ActivityCallSource =
+  | "call_tool"
+  | "call_destructive_tool"
+  | "batch_call"
+  | "execute_code";
+
+export type ActivityOutcome = "success" | "error" | "timeout";
+
+/**
+ * Authenticated identity attached to an activity event. `id` is intentionally
+ * optional: open deployments and shared bearer tokens cannot honestly identify
+ * a person.
+ */
+export interface ActivityActor {
+  kind: string;
+  id?: string;
+}
+
+/**
+ * Privacy-minimal history of one resolved downstream connector call.
+ *
+ * Arguments, results, generated code, search text, and raw errors are excluded
+ * by construction. Deployments that need a safe human summary can add a
+ * separate, explicit connector-level feature later.
+ */
+export interface ToolCallActivityEvent {
+  schemaVersion: 1;
+  id: string;
+  occurredAt: string;
+  requestId: string;
+  actor: ActivityActor;
+  connectorId: string;
+  toolName: string;
+  address: string;
+  source: ActivityCallSource;
+  outcome: ActivityOutcome;
+  durationMs: number;
+  attempts: number;
+  errorCode?: string;
+  serverName: string;
+  serverVersion: string;
+  deploymentId?: string;
+}
+
+export interface ActivityPage {
+  events: ToolCallActivityEvent[];
+  nextCursor?: string;
+}
+
+/** Write-only deployments can implement only this small, vendor-neutral seam. */
+export interface ActivitySink {
+  record(event: ToolCallActivityEvent): void | Promise<void>;
+}
+
+/** Optional read side used by Connecta's authenticated Activity UI. */
+export interface ActivityReader {
+  list(options: { cursor?: string; limit: number }): Promise<ActivityPage>;
+}
+
+export interface ActivityStore extends ActivitySink {
+  list?: ActivityReader["list"];
+}
+
+/** Reader implementations throw this for an opaque cursor they cannot decode. */
+export class InvalidActivityCursorError extends Error {
+  override name = "InvalidActivityCursorError";
+
+  constructor() {
+    super("invalid activity cursor");
+  }
+}
+
+export type ActivityReadGate = (
+  actor: ActivityActor,
+) => boolean | Promise<boolean>;
+
+/** Request-scoped context shared by direct, batch, and code-mode call paths. */
+export interface ActivityRequestContext {
+  sink: ActivitySink;
+  actor: ActivityActor;
+  requestId: string;
+  serverInfo: { name: string; version: string };
+  deploymentId?: string;
+  defer?: (promise: Promise<unknown>) => void;
+  logger: Logger;
+}
+
+export type ActivityEventInput = Pick<
+  ToolCallActivityEvent,
+  | "connectorId"
+  | "toolName"
+  | "address"
+  | "source"
+  | "outcome"
+  | "durationMs"
+  | "attempts"
+  | "errorCode"
+>;
+
+/**
+ * Best-effort by design: activity storage can never change a tool result.
+ * Workers attach async sinks to waitUntil; synchronous sinks such as Analytics
+ * Engine complete inline; Node promises remain detached from the response.
+ */
+export function recordToolActivity(
+  context: ActivityRequestContext | undefined,
+  input: ActivityEventInput,
+): void {
+  if (!context) return;
+  const event: ToolCallActivityEvent = {
+    schemaVersion: 1,
+    id: crypto.randomUUID(),
+    occurredAt: new Date().toISOString(),
+    requestId: context.requestId,
+    actor: context.actor,
+    connectorId: input.connectorId,
+    toolName: input.toolName,
+    address: input.address,
+    source: input.source,
+    outcome: input.outcome,
+    durationMs: Math.max(0, Math.trunc(input.durationMs)),
+    attempts: Math.max(1, Math.trunc(input.attempts)),
+    ...(input.errorCode ? { errorCode: input.errorCode } : {}),
+    serverName: context.serverInfo.name,
+    serverVersion: context.serverInfo.version,
+    ...(context.deploymentId
+      ? { deploymentId: context.deploymentId }
+      : {}),
+  };
+  try {
+    const result = context.sink.record(event);
+    if (!result || typeof (result as Promise<unknown>).then !== "function") {
+      return;
+    }
+    const pending = Promise.resolve(result).catch((error) => {
+      context.logger.warn("[connecta] activity record failed", error);
+    });
+    if (context.defer) context.defer(pending);
+  } catch (error) {
+    context.logger.warn("[connecta] activity record failed", error);
+  }
+}

package/src/auth/bearer.ts

@@ -0,0 +1,54 @@
+import type { AuthResult, InboundAuth } from "../types.js";
+
+const encoder = new TextEncoder();
+
+/** Constant-time byte comparison. Differing lengths still iterate to reduce leak. */
+function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {
+  if (a.length !== b.length) {
+    let r = 1;
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++) r |= (a[i] ?? 0) ^ (b[i] ?? 0);
+    return false;
+  }
+  let r = 0;
+  for (let i = 0; i < a.length; i++) r |= a[i] ^ b[i];
+  return r === 0;
+}
+
+/**
+ * Static bearer-token inbound auth. Constant-time compares the Bearer token
+ * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
+ * falls through so a co-configured Clerk provider can still admit the request.
+ */
+export function bearerToken(
+  secret: string,
+  options: { subjectId?: string } = {},
+): InboundAuth {
+  const secretBytes = encoder.encode(secret);
+  return {
+    kind: "bearer",
+    authorize(request): AuthResult {
+      const header = request.headers.get("authorization") ?? "";
+      const match = /^Bearer\s+(.+)$/i.exec(header);
+      if (match && timingSafeEqual(encoder.encode(match[1]), secretBytes)) {
+        return {
+          ok: true,
+          ...(options.subjectId ? { subjectId: options.subjectId } : {}),
+        };
+      }
+      return {
+        ok: false,
+        response: new Response(
+          JSON.stringify({ error: "unauthorized" }),
+          {
+            status: 401,
+            headers: {
+              "Content-Type": "application/json",
+              "WWW-Authenticate": "Bearer",
+            },
+          },
+        ),
+      };
+    },
+  };
+}

package/src/auth/clerk.ts

@@ -0,0 +1,226 @@
+// Clerk as the OAuth 2.1 authorization server; connecta is the resource server.
+// Single tenant, no tenant-tag requirement, optional gate() with ~60s identity
+// caching.
+
+import { createClerkClient } from "@clerk/backend";
+import type { AuthResult, InboundAuth } from "../types.js";
+
+type ClerkClient = ReturnType<typeof createClerkClient>;
+
+export interface ClerkAuthOptions {
+  publishableKey: string;
+  secretKey: string;
+  /** Public base URL of this deployment. Defaults to the request origin. */
+  publicUrl?: string;
+  /** Optional allow-list hook. Return false to reject an authenticated user. */
+  gate?: (userId: string, clerk: ClerkClient) => boolean | Promise<boolean>;
+  /** Advertised scopes in protected-resource metadata. */
+  scopes?: string[];
+  /** Optional hosted Account Portal sign-in URL for `/ui`. */
+  signInUrl?: string;
+  /** Optional hosted Account Portal sign-up URL for `/ui`. */
+  signUpUrl?: string;
+}
+
+const CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers":
+    "Content-Type, Authorization, mcp-protocol-version",
+};
+
+/** Coarse bearer shape for diagnostics — never the token itself. */
+function tokenShape(request: Request): string {
+  const header = request.headers.get("authorization");
+  if (!header) return "none";
+  const token = header.replace(/^Bearer\s+/i, "");
+  if (token.startsWith("oat_")) return "oauth-opaque";
+  if (token.startsWith("eyJ")) return "jwt";
+  return "other";
+}
+
+/** Clerk Frontend API origin, derived from pk_(test|live)_<b64 domain>. */
+function fapiUrl(publishableKey: string): string {
+  const key = publishableKey.replace(/^pk_(test|live)_/, "");
+  const decoded = atob(key).replace(/\$$/, "");
+  return `https://${decoded}`;
+}
+
+const GATE_ALLOWED_TTL_MS = 60 * 1000;
+const GATE_FORBIDDEN_TTL_MS = 30 * 1000;
+
+export function clerkAuth(opts: ClerkAuthOptions): InboundAuth {
+  const clerk = createClerkClient({
+    secretKey: opts.secretKey,
+    publishableKey: opts.publishableKey,
+  });
+  const scopes = opts.scopes ?? ["openid", "profile", "email"];
+  const gateCache = new Map<string, { allowed: boolean; exp: number }>();
+
+  const resolveBase = (baseUrl: string) => opts.publicUrl ?? baseUrl;
+
+  const unauthorized = (baseUrl: string, tokenPresent: boolean): Response => {
+    const error = tokenPresent ? `error="invalid_token", ` : "";
+    const meta = `${resolveBase(baseUrl)}/.well-known/oauth-protected-resource`;
+    return new Response(
+      JSON.stringify({ error: "unauthorized" }),
+      {
+        status: 401,
+        headers: {
+          "Content-Type": "application/json",
+          "WWW-Authenticate": `Bearer ${error}resource_metadata="${meta}"`,
+        },
+      },
+    );
+  };
+
+  const forbidden = (): Response =>
+    new Response(
+      JSON.stringify({ error: "forbidden" }),
+      { status: 403, headers: { "Content-Type": "application/json" } },
+    );
+
+  const checkGate = async (userId: string): Promise<boolean> => {
+    if (!opts.gate) return true;
+    const hit = gateCache.get(userId);
+    if (hit && Date.now() < hit.exp) return hit.allowed;
+    let allowed = false;
+    try {
+      allowed = await opts.gate(userId, clerk);
+    } catch {
+      allowed = false;
+    }
+    gateCache.set(userId, {
+      allowed,
+      exp:
+        Date.now() +
+        (allowed ? GATE_ALLOWED_TTL_MS : GATE_FORBIDDEN_TTL_MS),
+    });
+    return allowed;
+  };
+
+  return {
+    kind: "clerk",
+    uiAuth: {
+      kind: "clerk",
+      publishableKey: opts.publishableKey,
+      frontendApiUrl: fapiUrl(opts.publishableKey),
+      ...(opts.signInUrl ? { signInUrl: opts.signInUrl } : {}),
+      ...(opts.signUpUrl ? { signUpUrl: opts.signUpUrl } : {}),
+    },
+
+    async handleMetadata(request, baseUrl) {
+      const { pathname } = new URL(request.url);
+      if (!pathname.startsWith("/.well-known/")) return null;
+
+      if (request.method === "OPTIONS") {
+        return new Response(null, { status: 204, headers: CORS_HEADERS });
+      }
+
+      const base = resolveBase(baseUrl);
+      if (
+        pathname === "/.well-known/oauth-protected-resource" ||
+        pathname === "/.well-known/oauth-protected-resource/mcp"
+      ) {
+        return Response.json(
+          {
+            resource: `${base}/mcp`,
+            authorization_servers: [fapiUrl(opts.publishableKey)],
+            bearer_methods_supported: ["header"],
+            scopes_supported: scopes,
+          },
+          { headers: CORS_HEADERS },
+        );
+      }
+
+      if (pathname === "/.well-known/oauth-authorization-server") {
+        try {
+          const upstream = await fetch(
+            `${fapiUrl(opts.publishableKey)}/.well-known/oauth-authorization-server`,
+          );
+          if (!upstream.ok) {
+            return Response.json(
+              { error: "upstream authorization server metadata unavailable" },
+              { status: 502, headers: CORS_HEADERS },
+            );
+          }
+          return Response.json(await upstream.json(), { headers: CORS_HEADERS });
+        } catch {
+          return Response.json(
+            { error: "upstream authorization server metadata unavailable" },
+            { status: 502, headers: CORS_HEADERS },
+          );
+        }
+      }
+
+      return null;
+    },
+
+    async authorize(request, baseUrl): Promise<AuthResult> {
+      const tokenPresent = Boolean(request.headers.get("authorization"));
+      let userId: string | undefined;
+      try {
+        const state = await clerk.authenticateRequest(request, {
+          // MCP clients use Clerk OAuth access tokens; the browser dashboard
+          // uses the signed-in operator's short-lived Clerk session token.
+          // authorizedParties must NOT be passed here: OAuth access tokens may
+          // be JWTs without an azp claim, and Clerk rejects azp=undefined when
+          // that option is set. The sibling-subdomain pin it provided is
+          // enforced below, only for session tokens that actually carry azp.
+          acceptsToken: ["oauth_token", "session_token"],
+        });
+        const auth = state.toAuth();
+        if (!auth?.isAuthenticated) {
+          // Reason (not the token) in the logs: bearer rejections are
+          // otherwise indistinguishable 401s in `wrangler tail`.
+          const detail = state as { reason?: string; message?: string };
+          console.warn(
+            `[connecta] clerk rejected request: status=${state.status}` +
+              ` reason=${detail.reason ?? "?"} message=${detail.message ?? ""}` +
+              ` tokenShape=${tokenShape(request)}`,
+          );
+          return {
+            ok: false,
+            response: unauthorized(baseUrl, tokenPresent),
+          };
+        }
+        // Session JWTs carry `azp` (the origin they were minted for); pin it
+        // to this connecta deployment so a sibling subdomain's cookie/token
+        // cannot be replayed here. OAuth access tokens may have no azp.
+        const typed = auth as {
+          tokenType?: string;
+          sessionClaims?: { azp?: string } | null;
+          userId?: string | null;
+        };
+        if (typed.tokenType === "session_token") {
+          const azp = typed.sessionClaims?.azp;
+          const origin = new URL(resolveBase(baseUrl)).origin;
+          if (azp && azp !== origin) {
+            console.warn(
+              `[connecta] session token azp mismatch: azp=${azp} expected=${origin}`,
+            );
+            return {
+              ok: false,
+              response: unauthorized(baseUrl, tokenPresent),
+            };
+          }
+        }
+        userId = typed.userId ?? undefined;
+      } catch (error) {
+        console.warn(
+          `[connecta] clerk authenticateRequest threw: ${
+            error instanceof Error ? error.message : String(error)
+          } tokenShape=${tokenShape(request)}`,
+        );
+        return { ok: false, response: unauthorized(baseUrl, true) };
+      }
+      if (!userId) {
+        return { ok: false, response: unauthorized(baseUrl, true) };
+      }
+      if (!(await checkGate(userId))) {
+        return { ok: false, response: forbidden() };
+      }
+      return { ok: true, userId };
+    },
+  };
+}