@zackbart/connecta 0.19.0 → 0.20.0

package/dist/execute.js

@@ -7,7 +7,6 @@ import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, }
 import { boundedEchoText, classifyCallError, msg } from "./errors.js";
 import { InvocationFailure, InvocationService, } from "./invocation.js";
 import { hasConnectorGuides } from "./skills.js";
-import { isExplicitlyReadOnly } from "./tool-safety.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
 const EXECUTE_MAX_HOST_CALLS = 20;
 export const EXECUTE_MAX_BATCH_CALLS = 10;
@@ -149,11 +148,7 @@ function requireEmittedBlock(raw) {
     }
     return raw;
 }
-const UI_SHAPE_HINT = "connecta.ui accepts exactly one HTML argument and, optionally, one read-binding options object";
-const MAX_UI_READ_BINDINGS = 32;
-const MAX_UI_VIEW_ARGS = 32;
-const UI_READ_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
-const FORBIDDEN_UI_KEY = new Set(["__proto__", "constructor", "prototype"]);
+const UI_SHAPE_HINT = "connecta.ui accepts exactly one argument: a non-empty string of HTML";
 /** What the argument was, named the way the emit validator names a bad field. */
 function describeUiArgument(raw) {
     if (raw === null)
@@ -168,9 +163,9 @@ function describeUiArgument(raw) {
     return `${/^[aeiou]/.test(kind) ? "an" : "a"} ${kind}`;
 }
 /**
- * Strict U1/V1 validation. The first argument remains HTML; the only second
- * argument is one read-binding manifest. There are no alternate object or MCP
- * block forms.
+ * Strict U1 validation. There is no options parameter and no sugar form, for
+ * M1's reason: sugar is how a one-shape contract grows hair. An options bag or
+ * an MCP block object is just a non-string, and fails as one.
  */
 function requireUiHtml(raw) {
     if (typeof raw !== "string" || raw.length === 0) {
@@ -178,80 +173,11 @@ function requireUiHtml(raw) {
     }
     return raw;
 }
-function requireRecord(raw, label) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw guestFailure("invalid_args", `${label} must be an object`);
-    }
-    return raw;
-}
-function requireExactKeys(value, allowed, label) {
-    const extras = Object.keys(value).filter((key) => !allowed.includes(key));
-    if (extras.length > 0) {
-        throw guestFailure("invalid_args", `${label} carries unsupported field(s) ${extras.map((key) => JSON.stringify(key)).join(", ")}`);
-    }
-}
-function requireUiReadKey(raw, label) {
-    if (typeof raw !== "string" ||
-        raw.length === 0 ||
-        raw.length > 128 ||
-        FORBIDDEN_UI_KEY.has(raw)) {
-        throw guestFailure("invalid_args", `${label} must be a non-empty string of at most 128 characters and cannot be __proto__, constructor, or prototype`);
-    }
-    return raw;
-}
-function requireUiReads(raw) {
-    const record = requireRecord(raw, "connecta.ui options.reads");
-    const names = Object.keys(record);
-    if (names.length === 0 || names.length > MAX_UI_READ_BINDINGS) {
-        throw guestFailure("invalid_args", `connecta.ui options.reads must contain from 1 through ${MAX_UI_READ_BINDINGS} named bindings`);
-    }
-    const reads = Object.create(null);
-    for (const name of names) {
-        if (!UI_READ_NAME.test(name) || FORBIDDEN_UI_KEY.has(name)) {
-            throw guestFailure("invalid_args", `connecta.ui read binding name ${JSON.stringify(name)} must match ${UI_READ_NAME}`);
-        }
-        const value = requireRecord(record[name], `connecta.ui read binding ${JSON.stringify(name)}`);
-        requireExactKeys(value, ["address", "fixedArgs", "viewArgs"], `connecta.ui read binding ${JSON.stringify(name)}`);
-        if (typeof value.address !== "string" || value.address.length === 0) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} address must be a non-empty string`);
-        }
-        const fixedArgs = value.fixedArgs === undefined
-            ? {}
-            : requireRecord(value.fixedArgs, `connecta.ui read binding ${JSON.stringify(name)} fixedArgs`);
-        const rawViewArgs = value.viewArgs ?? [];
-        if (!Array.isArray(rawViewArgs) || rawViewArgs.length > MAX_UI_VIEW_ARGS) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} viewArgs must be an array of at most ${MAX_UI_VIEW_ARGS} strings`);
-        }
-        const viewArgs = rawViewArgs.map((key) => requireUiReadKey(key, `connecta.ui read binding ${JSON.stringify(name)} viewArgs entry`));
-        if (new Set(viewArgs).size !== viewArgs.length) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} viewArgs must not repeat a key`);
-        }
-        for (const key of viewArgs) {
-            if (Object.prototype.hasOwnProperty.call(fixedArgs, key)) {
-                throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} view argument ${JSON.stringify(key)} cannot override a fixed argument`);
-            }
-        }
-        reads[name] = {
-            address: value.address,
-            fixedArgs,
-            viewArgs,
-        };
-    }
-    return reads;
-}
 function requireUiPayload(values) {
-    if (values.length !== 1 && values.length !== 2) {
+    if (values.length !== 1) {
         throw guestFailure("invalid_args", `${UI_SHAPE_HINT}; got ${values.length} arguments`);
     }
-    const html = requireUiHtml(values[0]);
-    if (values.length === 1)
-        return { html };
-    const options = requireRecord(values[1], "connecta.ui options");
-    requireExactKeys(options, ["reads"], "connecta.ui options");
-    if (!Object.prototype.hasOwnProperty.call(options, "reads")) {
-        throw guestFailure("invalid_args", "connecta.ui options must contain reads");
-    }
-    return { html, reads: requireUiReads(options.reads) };
+    return { html: requireUiHtml(values[0]) };
 }
 /**
  * Request-local collection for `connecta.emit` and `connecta.ui`. Budgets fail
@@ -309,10 +235,6 @@ export class EmitCollector {
         this.assertUiVacant();
         this.acceptUiPayload(requireUiPayload(values));
     }
-    acceptValidatedUi(payload) {
-        this.assertUiVacant();
-        this.acceptUiPayload(payload);
-    }
     assertUiVacant() {
         if (this.ui) {
             throw guestFailure("invalid_args", "connecta.ui accepts at most one payload per run: a view was already accepted and stands");
@@ -595,36 +517,6 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
     const callNamespace = async (connectorId, toolAlias, args) => {
         return called("call", () => invocation.invokeToolAlias(String(connectorId), String(toolAlias), sanitizeIdentifier, args ?? {}, invocationContext()));
     };
-    /**
-     * A read binding is admitted while the program still owns the request. The
-     * shell later calls the ordinary `call_tool`, which repeats this same
-     * fail-closed check against the then-current catalog; validating here keeps
-     * a typo or destructive address from producing a view whose controls can
-     * never work, while validation at use keeps a stale view from retaining old
-     * authority.
-     */
-    const validateUiReads = async (payload) => {
-        if (!payload.reads)
-            return payload;
-        const reads = Object.create(null);
-        for (const [name, binding] of Object.entries(payload.reads)) {
-            const resolution = await catalog.resolveTool(binding.address, limits.signal !== undefined ? { signal: limits.signal } : {});
-            if (!resolution.ok) {
-                throw new InvocationFailure({
-                    ...resolution.error,
-                    message: `connecta.ui read binding ${JSON.stringify(name)} could not resolve ${JSON.stringify(binding.address)}: ${resolution.error.message}`,
-                });
-            }
-            if (!isExplicitlyReadOnly(resolution.resolved.definition)) {
-                throw guestFailure("destructive_tool_requires_approval", `connecta.ui read binding ${JSON.stringify(name)} refuses ${JSON.stringify(binding.address)}: the tool is not explicitly read-only`);
-            }
-            reads[name] = {
-                ...binding,
-                address: `${resolution.resolved.connector.id}.${resolution.resolved.toolName}`,
-            };
-        }
-        return { html: payload.html, reads };
-    };
     const fns = {
         __callNamespace: callNamespace,
         call: (address, args) => callAddress(address, args),
@@ -646,8 +538,7 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
             if (!limits.emitCollector) {
                 throw guestFailure("unavailable", "connecta.ui is unavailable: no emission collector was configured for this execution", true);
             }
-            const payload = await validateUiReads(requireUiPayload(values));
-            limits.emitCollector.acceptValidatedUi(payload);
+            limits.emitCollector.acceptUi(...values);
         },
         batch: async (calls) => {
             const started = Date.now();
@@ -996,7 +887,7 @@ Write one plain-JavaScript async arrow function. Use only:
 - <connectorId>.<toolName>(args) for a sanitized shortcut, or connecta.call(address, args) for a canonical address.
 - connecta.search(args), connecta.describe(args), and connecta.batch(calls) for discovery and independent read-only calls.
 - connecta.emit(block) — { type: "text", text } or { type: "image" | "audio", data (base64), mimeType }. Success-only; ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes; invalid/over-budget throws.
-- connecta.ui(html, options?) for one success-only view; return the same initial summary the HTML renders.
+- connecta.ui(html) for one display-only, success-only view; return the same summary the HTML renders.
 - console.log(...) — captured.
 
 Programs have no portable ambient capabilities. Return JSON and reduce large results before they truncate. Fetch skills({ name: "usage" }) once for selection rules, exact result shapes, repair, examples, guide handling${connectorGuides ? ", connector-guide rules" : ""}, and runtime differences.`;

package/dist/index.js

@@ -42,71 +42,116 @@ function normalizeAuth(auth) {
         return rank(a) - rank(b);
     });
 }
-const LEGACY_CONFIG_MIGRATIONS = [
-    ["activityReadGate", "activity.readGate"],
-    ["activityDeploymentId", "activity.deploymentId"],
-    ["credentialEncryptionKey", "credentials.encryptionKey"],
-    ["toolCacheTtlSeconds", "discovery.catalogTtlSeconds"],
-    ["persistToolCatalog", "discovery.persistCatalog"],
-    ["toolCatalogStaleSeconds", "discovery.staleCatalogSeconds"],
-    ["probeTimeoutMs", "discovery.probeTimeoutMs"],
-    ["defaultToolTimeoutMs", "calls.defaultTimeoutMs"],
-    ["maxResultBytes", "calls.maxResultBytes"],
-];
-const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-/**
- * Fail closed at the public boundary: a JavaScript caller on the v0.6 shape
- * must receive one complete migration error, never silently lose an option to
- * a default. This runs before createConnecta reads any other config field.
- */
-function assertNoLegacyConfig(config) {
-    const candidate = config;
-    if (hasOwn(candidate, "toolkits")) {
-        throw new Error("ConnectaConfig.toolkits was removed in issue #178. Deploy one " +
-            "connecta instance per audience instead; see ethos.md.");
-    }
-    const credentials = candidate.credentials;
-    const hasNestedHealth = typeof credentials === "object" &&
-        credentials !== null &&
-        hasOwn(credentials, "health");
-    if (hasOwn(candidate, "credentialHealth") || hasNestedHealth) {
-        throw new Error("`credentials.health` and legacy `credentialHealth` were removed in " +
-            "issue #179. Credentials now fail at use; see ethos.md.");
-    }
-    const calls = candidate.calls;
-    if (typeof calls === "object" &&
-        calls !== null &&
-        hasOwn(calls, "maxBatchResultBytes")) {
-        throw new Error("`calls.maxBatchResultBytes` was removed in issue #273 along with " +
-            "batch_call. Remove it; a program's batching is bounded by " +
-            "execute_code's own limits — connecta.batch's per-run call ceiling " +
-            "and the executor result cap — while each call inside it still honours " +
-            "calls.maxResultBytes and any per-connector override.");
-    }
-    const found = [];
-    if (hasOwn(candidate, "activity")) {
-        const activity = candidate.activity;
-        const isObject = typeof activity === "object" && activity !== null;
-        // A valid v0.6 ActivityStore can itself own a backend field named `store`.
-        // Its required `record` method (including a prototype method) therefore
-        // takes precedence over the otherwise-new wrapper shape.
-        const hasLegacyRecord = isObject &&
-            typeof activity.record === "function";
-        if (activity !== undefined &&
-            (!isObject ||
-                hasLegacyRecord ||
-                !hasOwn(activity, "store"))) {
-            found.push(["activity", "activity.store"]);
-        }
+const admissionPoolSchema = {
+    concurrency: null,
+    maxQueueSize: null,
+    queueTimeoutMs: null,
+    retryAfterMs: null,
+};
+const CONFIG_SCHEMA = {
+    connectors: null,
+    auth: null,
+    storage: null,
+    publicUrl: null,
+    activity: {
+        store: null,
+        readGate: null,
+        deploymentId: null,
+    },
+    credentials: {
+        encryptionKey: null,
+    },
+    accessTokens: {
+        maxActive: null,
+    },
+    discovery: {
+        concurrency: null,
+        catalogTtlSeconds: null,
+        persistCatalog: null,
+        staleCatalogSeconds: null,
+        probeTimeoutMs: null,
+    },
+    calls: {
+        defaultTimeoutMs: null,
+        maxResultBytes: null,
+    },
+    execute: {
+        maxEmittedBytes: null,
+        maxEmittedBlocks: null,
+    },
+    admission: {
+        requests: admissionPoolSchema,
+        code: admissionPoolSchema,
+    },
+    branding: {
+        productName: null,
+        productUrl: null,
+        ownerName: null,
+        ownerUrl: null,
+        description: null,
+        pageTitle: null,
+        favicon: {
+            svg: null,
+            ico: null,
+            href: null,
+        },
+        themeColor: null,
+    },
+    logger: null,
+    serverInfo: {
+        name: null,
+        version: null,
+        title: null,
+        websiteUrl: null,
+        icons: [
+            {
+                src: null,
+                mimeType: null,
+                sizes: null,
+            },
+        ],
+    },
+    deploymentInfo: null,
+    executor: null,
+};
+function unknownOptionPaths(value, path, schema) {
+    if (schema === null)
+        return [];
+    if (Array.isArray(schema)) {
+        if (!Array.isArray(value))
+            return [];
+        return value.flatMap((entry, index) => unknownOptionPaths(entry, `${path}[${index}]`, schema[0]));
     }
-    for (const migration of LEGACY_CONFIG_MIGRATIONS) {
-        if (hasOwn(candidate, migration[0]))
-            found.push(migration);
+    if (typeof value !== "object" || value === null)
+        return [];
+    const known = new Set(Object.keys(schema));
+    const unknown = Reflect.ownKeys(value)
+        .filter((key) => typeof key !== "string" || !known.has(key))
+        .map((key) => `${path}.${String(key)}`)
+        .sort();
+    if (unknown.length > 0)
+        return unknown;
+    for (const [key, childSchema] of Object.entries(schema)) {
+        unknown.push(...unknownOptionPaths(value[key], `${path}.${key}`, childSchema));
     }
-    if (found.length === 0)
+    return unknown;
+}
+function rejectUnknownOptions(paths) {
+    if (paths.length === 0)
         return;
-    throw new Error("Unsupported v0.6.x ConnectaConfig options. Migrate each path for v0.7.0:\n" +
-        found.map(([oldPath, newPath]) => `- ${oldPath} -> ${newPath}`).join("\n"));
+    throw new Error(`Unknown Connecta configuration option${paths.length === 1 ? "" : "s"}:\n` +
+        paths.map((path) => `- ${path}`).join("\n"));
+}
+/** Reject JavaScript typos and removed options before construction does work. */
+function assertKnownConfig(config) {
+    rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    const activity = config.activity;
+    if (activity !== undefined &&
+        (typeof activity !== "object" ||
+            activity === null ||
+            typeof activity.store?.record !== "function")) {
+        throw new Error("ConnectaConfig.activity.store must implement record(event)");
+    }
 }
 /**
  * One-time construction warnings for deployment shapes that run fine but are
@@ -193,11 +238,7 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     }
 }
 export function createConnecta(config) {
-    assertNoLegacyConfig(config);
-    if (hasOwn(config, "surface")) {
-        throw new Error("ConnectaConfig.surface was removed in issue #273. Remove it; connecta " +
-            "now serves one seven-tool surface.");
-    }
+    assertKnownConfig(config);
     if (!config.executor) {
         throw new Error("ConnectaConfig.executor is required. Configure quickJsExecutor() from " +
             '"@zackbart/connecta/quickjs" on Node, or ' +

package/dist/invocation.d.ts

@@ -57,7 +57,7 @@ export interface InvocationContext<T> {
     requestSignal?: AbortSignal;
     unwrapResult?: boolean;
     /**
-     * Caller-owned result policy. MCP passes fields + paging here; code mode
+     * Caller-owned result policy. MCP applies result paging here; code mode
      * normally accepts the already-unwrapped value unchanged.
      */
     processResult?: (value: unknown, resolved: ResolvedCatalogTool) => T | Promise<T>;

package/dist/meta-tools.d.ts

@@ -46,7 +46,6 @@ type ResultMode = "mcp" | "value";
 export interface CallArgs {
     address: string;
     args?: Record<string, unknown>;
-    fields?: string[];
     resultMode?: ResultMode;
     timeoutMs?: number;
     /** Retries after the first attempt; honored only for safely annotated tools. */