@zackbart/connecta 0.18.3 → 0.20.0

package/CHANGELOG.md

@@ -2,6 +2,126 @@
 
 All notable changes to this package are documented here.
 
+## 0.20.0 — 2026-08-26
+
+This release removes the two side languages that had grown around the seven
+tools: direct-call field projection and live reads from program-rendered HTML.
+Agents now shape data in JavaScript, page a genuinely large direct result with
+`get_result`, and render a display-only view. Configuration becomes strict at
+the same boundary, so a typo fails at startup instead of surviving as inert
+deployment state. Existing deployments using current documented options need
+only bump the pin and reconcile generation B; callers that send `fields`,
+programs that bind UI reads, and JavaScript deployments carrying retired or
+misspelled options must migrate. The implementation stack deletes 2,866 lines
+and adds 1,063 before these release notes, while preserving exactly seven MCP
+tools and the Node and Worker deployment shapes.
+
+### Changed
+
+- **One data-shaping language.** `call_tool` and `call_destructive_tool` no
+  longer advertise or accept `fields`; the path resolver, schema walker,
+  projection recovery records, guidance, and tests are gone. `execute_code`
+  remains the projection surface, while `get_result` still pages oversized
+  direct reads byte-exactly. The 21-scenario current-version audit passes, fixed
+  tool definitions fall from 1,625 to 1,587 tokens, and a deterministic
+  52,396-byte document succeeds 3/3 through `call_tool` then `get_result`
+  (#482).
+- **Display-only program UI.** `connecta.ui(html)` keeps success-only Apps
+  delivery, sandboxing, one shared rich-output budget, executor parity, and the
+  compact mirrored return. Its read manifest, host-call bridge, and second
+  argument are removed. All seven tools explicitly remain model-only, and only
+  `execute_code` advertises the cache-busted v3 display resource, so neither a
+  current nor cached shell can call Connecta tools (#484).
+- **Strict configuration.** `createConnecta` rejects unknown own options at
+  every closed configuration path without reading or quoting their values.
+  Each closed schema is compile-time exhaustive against its public type;
+  connector, auth, storage, activity-store, logger, deployment-metadata, and
+  executor implementations remain open leaves (#485).
+- **Smaller package and tests.** Generated operator assets publish explicit
+  95-byte string declarations instead of embedding about 95 KB of literals,
+  with byte-identical runtime output and a packed-package size guard (#486).
+  The remaining copied UI credential and meta-tool fixtures are shared without
+  changing any test or assertion count, removing another 127 repository lines
+  (#479).
+
+### Removed
+
+- The direct-call `fields` projection option and its dot/array path language.
+- Program UI read bindings, `connecta.read`, and the Apps-to-host tool-call
+  bridge.
+
+### Declined with evidence
+
+- Discovery filtering did not ship: its sealed qualification retained complete
+  scenario coverage but missed top-1, recall, default-page recall, and negative
+  false-positive gates. The holdout cases were not inspected or tuned (#481).
+- Lean object-result text did not ship: Codex and Claude read ordinary
+  structured values, but Claude's error route took extra recovery actions and
+  Cursor was unavailable for the required matrix. The compatibility JSON copy
+  remains (#483).
+
+## 0.19.0 — 2026-08-25
+
+This release is a smaller, simpler package with no behavioral change for a
+deployment. A deployment can ignore everything here. The one packaging change
+is to maintainer history: six finished design records now live in the repository
+at their GitHub URLs instead of shipping in the npm package, cutting 91 KB from
+the package. The constitution is a fifth of its former size and keeps the same
+decisions. The core shrank from 28,756 to 27,417 lines and the tests from 42,341
+to 40,375 before the final pure-suite splits, which put 198 lines back — a
+copied preamble the next pass moves into a fixture (#479). Two dead paths
+finally left with the rest: write-only health accessors on `RegistryView`,
+residue from #179, and the v1 persisted-catalog reader, unreachable since
+2026-07-28.
+
+### Changed
+
+- **Providers.** Every Cloudflare tool is built through `cfTool()` and
+  `compact()`, so the repeated schema headers, scope properties, and
+  conditional-spread projections are written once; the paged-list, delete-ack,
+  and passthrough handlers are shared while every tool keeps its own literal
+  name, description, annotations, and schemas; the authentication `Symbol` is
+  gone because the scheme is fixed per connector (#465, #467). Cloudflare and
+  Notion share one Retry-After parser and one guarded JSON accessor, and
+  `callCloudflareContent` still classifies an unreadable error body by status
+  (#468). The hosted providers' comment blocks point at their guides instead of
+  restating them, and `api()` omits undefined options once (#463).
+- **Core.** Internal option types accept `undefined`, so `createConnecta` and
+  the registration helpers forward configuration directly (#462). One deadline,
+  sleep, and message helper serve the whole call path; `invocation.ts` lost its
+  hand-rolled controller, timer, and listener choreography with Retry-After,
+  per-phase timing, and health exclusion unchanged (#466). The catalog,
+  execution, remote-MCP, and operator-data paths share their failure envelopes,
+  close helpers, and result shapers (#472).
+- **Package and docs.** Six finished design records moved to
+  [`records/`](https://github.com/zackbart/connecta/tree/main/records), outside
+  the published files, and packed-link validation folded into the documentation
+  checker: −1,342 shipped lines, −91 KB (#464). `ethos.md` is the constitution
+  again — refusals, invariants, and what this is, at 1,188 words instead of
+  3,174, with every decision intact and a word cap replacing the line cap
+  (#471).
+- **Tests.** Shared fixtures replace 122 hand-rolled connector literals, five
+  fake downstream MCP servers, four fake Clerk auths, and the per-suite JSON-RPC
+  readers, deferreds, and logger spies (#473, #474, #475); the six
+  provider-registry suites are one `describe.each` and the provider error
+  mappings are tables (#476); repeated cases are `it.each` tables and the
+  duplicated assertion layers are gone (#477); the two largest suites are split
+  by subject (#460). Every `it()` and `expect()` that pins behavior survived —
+  3,400 fewer lines, no assertion dropped.
+- **Declined with numbers**, so nobody re-runs the experiment: a shared bounded
+  queue under both admission controllers measured −17 lines for a
+  hook-parameterised abstraction (#453); Effect as the core effect system
+  measured −4% of the core for +75 KB gzip and a second async paradigm (#470).
+
+### Removed
+
+- The write-only `HealthLog` and its `RegistryView` accessors: `healthFor`,
+  `hasObservedSuccess`, `observedSuccessAt`, and `peekTools`. `refreshTools` is
+  now private. This was residue from the removed proactive credential-liveness
+  design (#179).
+- The v1 persisted-catalog reader, unreachable since 2026-07-28. Its fixtures
+  now use the v2 manifest-and-chunks format.
+
 ## 0.18.3 — 2026-08-25
 
 This change gives code mode memory where downstream MCP catalogs are usually
@@ -29,6 +149,13 @@ one or several real results from masquerading as a provider contract.
   live deployment audits: BePresent had 246/378 tools without output schemas,
   while OneMany's maintained connectors declared all 90 (#442).
 
+### Changed
+
+- Removed the write-only per-connector call health log. Payload-free call
+  outcomes remain available through the activity sink.
+- Persisted catalog reads now require the version 2 manifest-and-chunks shape;
+  version 1 single-value catalogs are ignored and refreshed.
+
 ## 0.18.2 — 2026-08-18
 
 This patch closes the gap the RevenueCat rollout exposed on the same day 0.18.1
@@ -752,7 +879,7 @@ it back byte-identical after each operator mutation.
   constructor, schemas, validation path, handlers, and catalog service run, and
   only `fetch` is a probe that records the request (#350).
 - **Five provider audit reports** in
-  [`documentation/provider-audit.md`](./documentation/provider-audit.md), with
+  [`records/provider-audit.md`](https://github.com/zackbart/connecta/blob/main/records/provider-audit.md), with
   a verdict per convention, the fix for every miss, and every accepted
   exception recorded with its argument (#342).
 - **A convention test over the shipped surface.**
@@ -1535,7 +1662,7 @@ The channel is additive — a program that never calls `connecta.ui` produces th
 byte-for-byte prior response, no executor changed to carry it, and there is no
 new budget knob. Deployments do gain a `resources` capability and one extension
 declaration, both of which the design requires before any host will render.
-The design record is `documentation/mcp-ui-design.md` (#266); the contract is
+The design record is [`records/mcp-ui-design.md`](https://github.com/zackbart/connecta/blob/main/records/mcp-ui-design.md) (#266); the contract is
 `code-mode.md`'s "Rendered output" clauses (#277).
 
 ### Added
@@ -1611,7 +1738,7 @@ that cannot be projected, like a screenshot a downstream tool returned. The
 channel is additive: a program that never emits produces the byte-for-byte
 prior response, no executor changed to carry it, and deployments that do
 nothing get sensible budgets. The design record is
-`documentation/rich-output-design.md` (#267); the contract is `code-mode.md`'s
+[`records/rich-output-design.md`](https://github.com/zackbart/connecta/blob/main/records/rich-output-design.md) (#267); the contract is `code-mode.md`'s
 "Emitted output" clauses (#270).
 
 Agent recovery is now executable data instead of prose at the remaining local
@@ -2024,7 +2151,7 @@ tests confirm SDK v2 client close does not make it redundant.
   advances the existing generation fence before the SDK starts a fresh grant;
   pre-upgrade credentials bind in place on their first validated read.
 - **A complete in-repo disposition of the revision** in
-  [`documentation/mcp-2026-07-28.md`](./documentation/mcp-2026-07-28.md),
+  [`records/mcp-2026-07-28.md`](https://github.com/zackbart/connecta/blob/main/records/mcp-2026-07-28.md),
   including the declined and gated surfaces.
 
 ### Changed

package/dist/apps-shell.d.ts

@@ -3,16 +3,16 @@
  *
  * A build-time string constant, not a file read at startup: the core is
  * Web-API-only so it runs unchanged on Workers, and the same bytes have to
- * serve everywhere. It renders whatever HTML a program handed `connecta.ui`
- * inside a nested `srcdoc` frame. The one-argument form forwards no channel;
- * an explicitly bound view gets only named read calls through the trusted
- * shell, never a raw host channel.
+ * serve everywhere. The shell is display-only: it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
  *
  * The address carries a version segment because hosts are permitted to
  * prefetch and cache templates by URI: change these bytes, bump the version.
  */
 /** The only `ui://` URI in the system. No program input reaches it. */
-export declare const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v2";
+export declare const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v3";
 /** The mimeType the Apps spec requires of an HTML template. */
 export declare const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
 /**
@@ -29,11 +29,9 @@ export declare const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
  * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
  * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
  * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
- * delivered tool result, and puts it in a frame. An optional read manifest
- * installs one narrow `connecta.read(name, args)` bridge in that inner frame;
- * the outer shell maps declared names to the existing `call_tool` meta-tool.
- * It declares no CSP domains, so the host applies its restrictive default and
- * the `srcdoc` frame inherits `default-src 'none'` — program markup still gets
- * no direct network.
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'`. The payload gets scripts and local interactivity, and
+ * no network.
  */
-export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The outer shell is the only host peer. The payload frame is\n        // sandboxed to scripts alone, with no same-origin escape. Its one\n        // optional message dialect is handled below and translated into\n        // bounded call_tool requests; raw JSON-RPC is never forwarded.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n        var reads = null;\n        var hostCanCallTools = false;\n        var nextHostRequestId = 0;\n        var pendingHostReads = Object.create(null);\n        var activeHostReads = 0;\n        var maxActiveHostReads = 8;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // content-height bridge to the payload frame, so it can never learn\n        // the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payload(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var value = meta[\"connecta/ui\"];\n          if (!value || typeof value !== \"object\") return null;\n          return typeof value.html === \"string\" && value.html.length > 0\n            ? value\n            : null;\n        }\n\n        // This function is serialized into the opaque-origin payload frame.\n        // It knows no addresses and has no host channel of its own: one named\n        // read request goes to the trusted outer shell and one correlated\n        // result comes back.\n        function payloadReadBridge() {\n          \"use strict\";\n          var pending = Object.create(null);\n          var nextId = 0;\n\n          function read(name, args) {\n            return new Promise(function (resolve, reject) {\n              var id = String(++nextId);\n              pending[id] = { resolve: resolve, reject: reject };\n              try {\n                window.parent.postMessage({\n                  type: \"connecta/read\",\n                  id: id,\n                  name: name,\n                  args: args === undefined ? {} : args\n                }, \"*\");\n              } catch (error) {\n                delete pending[id];\n                reject(error);\n              }\n            });\n          }\n\n          Object.defineProperty(globalThis, \"connecta\", {\n            value: Object.freeze({ read: read }),\n            configurable: false,\n            enumerable: true,\n            writable: false\n          });\n\n          window.addEventListener(\"message\", function (event) {\n            if (event.source !== window.parent) return;\n            var message = event.data;\n            if (!message || message.type !== \"connecta/read-result\") return;\n            var waiter = pending[message.id];\n            if (!waiter) return;\n            delete pending[message.id];\n            if (message.ok) waiter.resolve(message.value);\n            else waiter.reject(new Error(message.error || \"Read failed\"));\n          });\n        }\n\n        function htmlWithReadBridge(html) {\n          var script =\n            \"<scr\" + \"ipt>(\" + payloadReadBridge.toString() + \")();</scr\" + \"ipt>\";\n          var head = /<head(?:\\s[^>]*)?>/i.exec(html);\n          if (head) {\n            var at = (head.index || 0) + head[0].length;\n            return html.slice(0, at) + script + html.slice(at);\n          }\n          var document = /<html(?:\\s[^>]*)?>/i.exec(html);\n          if (document) {\n            var afterHtml = (document.index || 0) + document[0].length;\n            return html.slice(0, afterHtml) + \"<head>\" + script + \"</head>\" + html.slice(afterHtml);\n          }\n          return script + html;\n        }\n\n        function render(params) {\n          var value =\n            payload(params) ||\n            payload(params && params.result) ||\n            payload(params && params.toolResult);\n          if (value === null) return;\n          reads = value.reads && typeof value.reads === \"object\"\n            ? value.reads\n            : null;\n          view.srcdoc = reads\n            ? htmlWithReadBridge(value.html)\n            : value.html;\n          reportSize();\n        }\n\n        function readError(message, fallback) {\n          if (message && typeof message.message === \"string\") return message.message;\n          if (message && message.data && typeof message.data.message === \"string\") {\n            return message.data.message;\n          }\n          return fallback;\n        }\n\n        function finishInnerRead(innerId, ok, value) {\n          if (!view.contentWindow) return;\n          view.contentWindow.postMessage(ok\n            ? { type: \"connecta/read-result\", id: innerId, ok: true, value: value }\n            : { type: \"connecta/read-result\", id: innerId, ok: false, error: value }, \"*\");\n        }\n\n        function beginInnerRead(message) {\n          if (!hostCanCallTools) {\n            finishInnerRead(message && message.id, false, \"This host does not support app-initiated server tool calls\");\n            return;\n          }\n          if (!message || typeof message.id !== \"string\" || typeof message.name !== \"string\") return;\n          if (!reads || !Object.prototype.hasOwnProperty.call(reads, message.name)) {\n            finishInnerRead(message.id, false, \"Unknown read binding\");\n            return;\n          }\n          if (activeHostReads >= maxActiveHostReads) {\n            finishInnerRead(message.id, false, \"Too many concurrent reads\");\n            return;\n          }\n          var binding = reads[message.name];\n          if (!binding || typeof binding !== \"object\" || typeof binding.address !== \"string\") {\n            finishInnerRead(message.id, false, \"Invalid read binding\");\n            return;\n          }\n          var supplied = message.args;\n          if (!supplied || typeof supplied !== \"object\" || Array.isArray(supplied)) {\n            finishInnerRead(message.id, false, \"Read arguments must be an object\");\n            return;\n          }\n          var allowed = Array.isArray(binding.viewArgs) ? binding.viewArgs : [];\n          var suppliedKeys = Object.keys(supplied);\n          for (var i = 0; i < suppliedKeys.length; i++) {\n            var key = suppliedKeys[i];\n            if (allowed.indexOf(key) === -1) {\n              finishInnerRead(message.id, false, \"Undeclared read argument \" + JSON.stringify(key));\n              return;\n            }\n          }\n          var args = Object.create(null);\n          var fixed = binding.fixedArgs && typeof binding.fixedArgs === \"object\"\n            ? binding.fixedArgs\n            : {};\n          Object.keys(fixed).forEach(function (key) { args[key] = fixed[key]; });\n          suppliedKeys.forEach(function (key) { args[key] = supplied[key]; });\n\n          var hostId = \"connecta-ui-read-\" + String(++nextHostRequestId);\n          pendingHostReads[hostId] = { innerId: message.id };\n          activeHostReads++;\n          send({\n            jsonrpc: \"2.0\",\n            id: hostId,\n            method: \"tools/call\",\n            params: {\n              name: \"call_tool\",\n              arguments: {\n                address: binding.address,\n                args: args,\n                resultMode: \"value\"\n              }\n            }\n          });\n        }\n\n        function finishHostRead(message) {\n          var pending = pendingHostReads[message.id];\n          if (!pending) return false;\n          delete pendingHostReads[message.id];\n          activeHostReads--;\n          if (message.error) {\n            finishInnerRead(pending.innerId, false, readError(message.error, \"Host rejected read\"));\n            return true;\n          }\n          var toolResult = message.result;\n          if (!toolResult || typeof toolResult !== \"object\") {\n            finishInnerRead(pending.innerId, false, \"Host returned an invalid tool result\");\n            return true;\n          }\n          var structured = toolResult.structuredContent;\n          if (toolResult.isError || (structured && structured.ok === false)) {\n            var detail = structured && structured.error;\n            var content = Array.isArray(toolResult.content)\n              ? toolResult.content.find(function (block) { return block && block.type === \"text\"; })\n              : null;\n            finishInnerRead(\n              pending.innerId,\n              false,\n              readError(detail, content && content.text ? content.text : \"Read failed\")\n            );\n            return true;\n          }\n          var value = structured && structured.ok === true &&\n              Object.prototype.hasOwnProperty.call(structured, \"data\")\n            ? structured.data\n            : structured !== undefined\n              ? structured\n              : toolResult;\n          finishInnerRead(pending.innerId, true, value);\n          return true;\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          var message = event.data;\n          if (event.source === view.contentWindow) {\n            if (message && message.type === \"connecta/read\") beginInnerRead(message);\n            return;\n          }\n          if (event.source !== host) return;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.id !== undefined && finishHostRead(message)) return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            var capabilities = message.result.hostCapabilities;\n            hostCanCallTools = Boolean(capabilities && capabilities.serverTools);\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";
+export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The host frame is the only peer this shell speaks to, in either\n        // direction. The payload frame below is sandboxed to scripts alone,\n        // with no same-origin escape, and is never handed a reply path:\n        // anything it posts fails the source check and is dropped. There is\n        // no bridge from program HTML to the host, by construction rather\n        // than by validation.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // bridge to the payload frame \u2014 that is the security posture, not an\n        // omission \u2014 so it can never learn the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payloadHtml(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var payload = meta[\"connecta/ui\"];\n          if (!payload || typeof payload !== \"object\") return null;\n          var html = payload.html;\n          return typeof html === \"string\" && html.length > 0 ? html : null;\n        }\n\n        function render(params) {\n          var html =\n            payloadHtml(params) ||\n            payloadHtml(params && params.result) ||\n            payloadHtml(params && params.toolResult);\n          if (html === null) return;\n          view.srcdoc = html;\n          reportSize();\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          if (event.source !== host) return;\n          var message = event.data;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";

package/dist/apps-shell.js

@@ -3,16 +3,16 @@
  *
  * A build-time string constant, not a file read at startup: the core is
  * Web-API-only so it runs unchanged on Workers, and the same bytes have to
- * serve everywhere. It renders whatever HTML a program handed `connecta.ui`
- * inside a nested `srcdoc` frame. The one-argument form forwards no channel;
- * an explicitly bound view gets only named read calls through the trusted
- * shell, never a raw host channel.
+ * serve everywhere. The shell is display-only: it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
  *
  * The address carries a version segment because hosts are permitted to
  * prefetch and cache templates by URI: change these bytes, bump the version.
  */
 /** The only `ui://` URI in the system. No program input reaches it. */
-export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v2";
+export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v3";
 /** The mimeType the Apps spec requires of an HTML template. */
 export const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
 /**
@@ -29,12 +29,10 @@ export const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
  * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
  * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
  * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
- * delivered tool result, and puts it in a frame. An optional read manifest
- * installs one narrow `connecta.read(name, args)` bridge in that inner frame;
- * the outer shell maps declared names to the existing `call_tool` meta-tool.
- * It declares no CSP domains, so the host applies its restrictive default and
- * the `srcdoc` frame inherits `default-src 'none'` — program markup still gets
- * no direct network.
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'`. The payload gets scripts and local interactivity, and
+ * no network.
  */
 export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
 <html lang="en">
@@ -67,21 +65,17 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
     <script>
       (function () {
         "use strict";
-        // The outer shell is the only host peer. The payload frame is
-        // sandboxed to scripts alone, with no same-origin escape. Its one
-        // optional message dialect is handled below and translated into
-        // bounded call_tool requests; raw JSON-RPC is never forwarded.
+        // The host frame is the only peer this shell speaks to, in either
+        // direction. The payload frame below is sandboxed to scripts alone,
+        // with no same-origin escape, and is never handed a reply path:
+        // anything it posts fails the source check and is dropped. There is
+        // no bridge from program HTML to the host, by construction rather
+        // than by validation.
         var host = window.parent;
         var view = document.getElementById("program-view");
         var initializeId = "connecta-ui-initialize";
         var lastWidth = 0;
         var lastHeight = 0;
-        var reads = null;
-        var hostCanCallTools = false;
-        var nextHostRequestId = 0;
-        var pendingHostReads = Object.create(null);
-        var activeHostReads = 0;
-        var maxActiveHostReads = 8;
 
         function send(message) {
           if (!host || host === window) return;
@@ -93,8 +87,8 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
         }
 
         // Program views are fixed-height by construction. The shell has no
-        // content-height bridge to the payload frame, so it can never learn
-        // the payload's content height, and
+        // bridge to the payload frame — that is the security posture, not an
+        // omission — so it can never learn the payload's content height, and
         // what it reports here is its own box: the min-height above, unless
         // the host has given it more. Taller content scrolls inside the inner
         // frame rather than growing the view. Raising the min-height is the
@@ -111,213 +105,30 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
           });
         }
 
-        function payload(result) {
+        function payloadHtml(result) {
           if (!result || typeof result !== "object") return null;
           var meta = result._meta;
           if (!meta || typeof meta !== "object") return null;
-          var value = meta["connecta/ui"];
-          if (!value || typeof value !== "object") return null;
-          return typeof value.html === "string" && value.html.length > 0
-            ? value
-            : null;
-        }
-
-        // This function is serialized into the opaque-origin payload frame.
-        // It knows no addresses and has no host channel of its own: one named
-        // read request goes to the trusted outer shell and one correlated
-        // result comes back.
-        function payloadReadBridge() {
-          "use strict";
-          var pending = Object.create(null);
-          var nextId = 0;
-
-          function read(name, args) {
-            return new Promise(function (resolve, reject) {
-              var id = String(++nextId);
-              pending[id] = { resolve: resolve, reject: reject };
-              try {
-                window.parent.postMessage({
-                  type: "connecta/read",
-                  id: id,
-                  name: name,
-                  args: args === undefined ? {} : args
-                }, "*");
-              } catch (error) {
-                delete pending[id];
-                reject(error);
-              }
-            });
-          }
-
-          Object.defineProperty(globalThis, "connecta", {
-            value: Object.freeze({ read: read }),
-            configurable: false,
-            enumerable: true,
-            writable: false
-          });
-
-          window.addEventListener("message", function (event) {
-            if (event.source !== window.parent) return;
-            var message = event.data;
-            if (!message || message.type !== "connecta/read-result") return;
-            var waiter = pending[message.id];
-            if (!waiter) return;
-            delete pending[message.id];
-            if (message.ok) waiter.resolve(message.value);
-            else waiter.reject(new Error(message.error || "Read failed"));
-          });
-        }
-
-        function htmlWithReadBridge(html) {
-          var script =
-            "<scr" + "ipt>(" + payloadReadBridge.toString() + ")();</scr" + "ipt>";
-          var head = /<head(?:\\s[^>]*)?>/i.exec(html);
-          if (head) {
-            var at = (head.index || 0) + head[0].length;
-            return html.slice(0, at) + script + html.slice(at);
-          }
-          var document = /<html(?:\\s[^>]*)?>/i.exec(html);
-          if (document) {
-            var afterHtml = (document.index || 0) + document[0].length;
-            return html.slice(0, afterHtml) + "<head>" + script + "</head>" + html.slice(afterHtml);
-          }
-          return script + html;
+          var payload = meta["connecta/ui"];
+          if (!payload || typeof payload !== "object") return null;
+          var html = payload.html;
+          return typeof html === "string" && html.length > 0 ? html : null;
         }
 
         function render(params) {
-          var value =
-            payload(params) ||
-            payload(params && params.result) ||
-            payload(params && params.toolResult);
-          if (value === null) return;
-          reads = value.reads && typeof value.reads === "object"
-            ? value.reads
-            : null;
-          view.srcdoc = reads
-            ? htmlWithReadBridge(value.html)
-            : value.html;
+          var html =
+            payloadHtml(params) ||
+            payloadHtml(params && params.result) ||
+            payloadHtml(params && params.toolResult);
+          if (html === null) return;
+          view.srcdoc = html;
           reportSize();
         }
 
-        function readError(message, fallback) {
-          if (message && typeof message.message === "string") return message.message;
-          if (message && message.data && typeof message.data.message === "string") {
-            return message.data.message;
-          }
-          return fallback;
-        }
-
-        function finishInnerRead(innerId, ok, value) {
-          if (!view.contentWindow) return;
-          view.contentWindow.postMessage(ok
-            ? { type: "connecta/read-result", id: innerId, ok: true, value: value }
-            : { type: "connecta/read-result", id: innerId, ok: false, error: value }, "*");
-        }
-
-        function beginInnerRead(message) {
-          if (!hostCanCallTools) {
-            finishInnerRead(message && message.id, false, "This host does not support app-initiated server tool calls");
-            return;
-          }
-          if (!message || typeof message.id !== "string" || typeof message.name !== "string") return;
-          if (!reads || !Object.prototype.hasOwnProperty.call(reads, message.name)) {
-            finishInnerRead(message.id, false, "Unknown read binding");
-            return;
-          }
-          if (activeHostReads >= maxActiveHostReads) {
-            finishInnerRead(message.id, false, "Too many concurrent reads");
-            return;
-          }
-          var binding = reads[message.name];
-          if (!binding || typeof binding !== "object" || typeof binding.address !== "string") {
-            finishInnerRead(message.id, false, "Invalid read binding");
-            return;
-          }
-          var supplied = message.args;
-          if (!supplied || typeof supplied !== "object" || Array.isArray(supplied)) {
-            finishInnerRead(message.id, false, "Read arguments must be an object");
-            return;
-          }
-          var allowed = Array.isArray(binding.viewArgs) ? binding.viewArgs : [];
-          var suppliedKeys = Object.keys(supplied);
-          for (var i = 0; i < suppliedKeys.length; i++) {
-            var key = suppliedKeys[i];
-            if (allowed.indexOf(key) === -1) {
-              finishInnerRead(message.id, false, "Undeclared read argument " + JSON.stringify(key));
-              return;
-            }
-          }
-          var args = Object.create(null);
-          var fixed = binding.fixedArgs && typeof binding.fixedArgs === "object"
-            ? binding.fixedArgs
-            : {};
-          Object.keys(fixed).forEach(function (key) { args[key] = fixed[key]; });
-          suppliedKeys.forEach(function (key) { args[key] = supplied[key]; });
-
-          var hostId = "connecta-ui-read-" + String(++nextHostRequestId);
-          pendingHostReads[hostId] = { innerId: message.id };
-          activeHostReads++;
-          send({
-            jsonrpc: "2.0",
-            id: hostId,
-            method: "tools/call",
-            params: {
-              name: "call_tool",
-              arguments: {
-                address: binding.address,
-                args: args,
-                resultMode: "value"
-              }
-            }
-          });
-        }
-
-        function finishHostRead(message) {
-          var pending = pendingHostReads[message.id];
-          if (!pending) return false;
-          delete pendingHostReads[message.id];
-          activeHostReads--;
-          if (message.error) {
-            finishInnerRead(pending.innerId, false, readError(message.error, "Host rejected read"));
-            return true;
-          }
-          var toolResult = message.result;
-          if (!toolResult || typeof toolResult !== "object") {
-            finishInnerRead(pending.innerId, false, "Host returned an invalid tool result");
-            return true;
-          }
-          var structured = toolResult.structuredContent;
-          if (toolResult.isError || (structured && structured.ok === false)) {
-            var detail = structured && structured.error;
-            var content = Array.isArray(toolResult.content)
-              ? toolResult.content.find(function (block) { return block && block.type === "text"; })
-              : null;
-            finishInnerRead(
-              pending.innerId,
-              false,
-              readError(detail, content && content.text ? content.text : "Read failed")
-            );
-            return true;
-          }
-          var value = structured && structured.ok === true &&
-              Object.prototype.hasOwnProperty.call(structured, "data")
-            ? structured.data
-            : structured !== undefined
-              ? structured
-              : toolResult;
-          finishInnerRead(pending.innerId, true, value);
-          return true;
-        }
-
         window.addEventListener("message", function (event) {
-          var message = event.data;
-          if (event.source === view.contentWindow) {
-            if (message && message.type === "connecta/read") beginInnerRead(message);
-            return;
-          }
           if (event.source !== host) return;
+          var message = event.data;
           if (!message || message.jsonrpc !== "2.0") return;
-          if (message.id !== undefined && finishHostRead(message)) return;
           if (message.method === "ui/notifications/tool-result") {
             render(message.params);
             return;
@@ -335,8 +146,6 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
           // response carries the same id, and announcing initialization on one
           // would assert a handshake that never happened.
           if (message.id === initializeId && message.result !== undefined) {
-            var capabilities = message.result.hostCapabilities;
-            hostCanCallTools = Boolean(capabilities && capabilities.serverTools);
             notify("ui/notifications/initialized", {});
           }
         });

package/dist/catalog-service.d.ts

@@ -151,13 +151,13 @@ export declare class CatalogService {
     private readonly loaded;
     private readonly loading;
     constructor(registry: RegistryView, baseUrl: string, options?: {
-        requestScope?: object;
-        probeTimeoutMs?: number;
-        concurrency?: number;
+        requestScope?: object | undefined;
+        probeTimeoutMs?: number | undefined;
+        concurrency?: number | undefined;
         /** The discovery route recovery records name. Default `search_tools`. */
-        searchRoute?: SearchRoute;
+        searchRoute?: SearchRoute | undefined;
         /** Runtime-owned tail for stale-while-revalidate catalog reads. */
-        defer?: DeferredWork;
+        defer?: DeferredWork | undefined;
     });
     /**
      * Send a caller back to discovery through the surface it can actually reach.
@@ -177,6 +177,9 @@ export declare class CatalogService {
     loadConnector(id: string, callOptions?: ConnectorOperationOptions): Promise<ToolDef[]>;
     private loadForDiscovery;
     private outputSchema;
+    private unknownAddressFailure;
+    private catalogLoadFailure;
+    private unknownToolFailure;
     resolveTool(address: string, callOptions?: ConnectorOperationOptions): Promise<CatalogResolution>;
     /**
      * Resolve the JavaScript-safe property used by a lazy code-mode namespace
@@ -206,6 +209,10 @@ export declare function groupedSearchResult(page: CatalogSearchPage): {
     };
     matchMode?: "partial";
     nextOffset?: number;
+    total: number;
+    offset: number;
+    limit: number;
+    hasMore: boolean;
     connectors: {
         id: string;
         title?: string;
@@ -213,10 +220,6 @@ export declare function groupedSearchResult(page: CatalogSearchPage): {
         guideSummary?: string;
         tools: CatalogSearchEntry["tool"][];
     }[];
-    total: number;
-    offset: number;
-    limit: number;
-    hasMore: boolean;
 };
 export declare function flatSearchResult(page: CatalogSearchPage): {
     queryAnalysis?: {
@@ -237,6 +240,10 @@ export declare function flatSearchResult(page: CatalogSearchPage): {
     };
     matchMode?: "partial";
     nextOffset?: number;
+    total: number;
+    offset: number;
+    limit: number;
+    hasMore: boolean;
     tools: {
         guideSummary?: string;
         guide?: string;
@@ -255,9 +262,5 @@ export declare function flatSearchResult(page: CatalogSearchPage): {
         guideRequired?: true;
         guideRequiredReasons?: GuideRequiredReason[];
     }[];
-    total: number;
-    offset: number;
-    limit: number;
-    hasMore: boolean;
 };
 export {};