@zackbart/connecta 0.19.0 → 0.21.0

package/CHANGELOG.md

@@ -2,6 +2,113 @@
 
 All notable changes to this package are documented here.
 
+## 0.21.0 — 2026-08-28
+
+Cloudflare Access becomes the canonical interactive-auth path for Worker
+deployments. It authenticates both MCP clients and human operators before the
+Worker runs, while connecta consumes only the trusted runtime identity. Clerk
+is unchanged and remains supported: existing deployments can add Access,
+verify the edge cutover, and remove Clerk later, with no storage migration or
+token conversion. Node deployments can ignore this release beyond the version
+pin.
+
+### Added
+
+- **Direct Worker Access auth.** `cloudflareAccessAuth()` ships from
+  `@zackbart/connecta/auth/cloudflare-access` with no dependency and no JWT
+  verifier. Human `ctx.access` identities may use MCP and operator routes;
+  service-token identities may use MCP but cannot mutate operator state. Since
+  Cloudflare exposes no user identity for a service token, its Access
+  application audience is the shared activity subject. The same suite runs
+  under Node and workerd (#506).
+- **Ambient operator sessions.** The operator shell selects Cloudflare Access
+  when the current invocation carries it, sends no browser-readable token, and
+  signs out through Cloudflare. A co-configured Clerk provider remains the
+  shell before Access is attached and the rollback path after it is detached
+  (#506).
+- **Access-aware doctor.** `connecta doctor` accepts
+  `CF_ACCESS_CLIENT_ID`/`CF_ACCESS_CLIENT_SECRET` and sends the pair to health
+  and MCP requests. A partial pair fails before network access (#506).
+
+### Changed
+
+- **Cold reads stay in code mode.** One known canonical address still uses
+  `call_tool`, while an unknown-address read now starts with one
+  `execute_code` program and keeps discovery results off the model-facing
+  route. The current-version benchmark is reset to four deterministic
+  whole-agent cases covering both routes, exact provider semantics, private
+  pagination, forwarding bytes, tokens, and latency.
+- **Worker deployment path.** The shipped Worker example uses Access and
+  Managed OAuth through a Worker-level `worker` destination, carries a local
+  `access.dev` identity, and documents service tokens for unattended callers.
+  A hostname-only Access application gates the URL but does not supply
+  `ctx.access`. The Clerk shape stays beside the provider as the reversible
+  migration seam. Static connecta and operator-issued bearers remain supported
+  by core but are not standalone credentials through a whole-Worker Access
+  gate (#506).
+- **Operator capability is vendor-neutral.** Inbound auth providers now declare
+  interactive-operator capability explicitly, and runtime context reaches
+  their authorization hook as an optional third argument. Existing custom
+  providers with the two-argument hook remain source-compatible (#506).
+
+## 0.20.0 — 2026-08-26
+
+This release removes the two side languages that had grown around the seven
+tools: direct-call field projection and live reads from program-rendered HTML.
+Agents now shape data in JavaScript, page a genuinely large direct result with
+`get_result`, and render a display-only view. Configuration becomes strict at
+the same boundary, so a typo fails at startup instead of surviving as inert
+deployment state. Existing deployments using current documented options need
+only bump the pin and reconcile generation B; callers that send `fields`,
+programs that bind UI reads, and JavaScript deployments carrying retired or
+misspelled options must migrate. The implementation stack deletes 2,866 lines
+and adds 1,063 before these release notes, while preserving exactly seven MCP
+tools and the Node and Worker deployment shapes.
+
+### Changed
+
+- **One data-shaping language.** `call_tool` and `call_destructive_tool` no
+  longer advertise or accept `fields`; the path resolver, schema walker,
+  projection recovery records, guidance, and tests are gone. `execute_code`
+  remains the projection surface, while `get_result` still pages oversized
+  direct reads byte-exactly. The 21-scenario current-version audit passes, fixed
+  tool definitions fall from 1,625 to 1,587 tokens, and a deterministic
+  52,396-byte document succeeds 3/3 through `call_tool` then `get_result`
+  (#482).
+- **Display-only program UI.** `connecta.ui(html)` keeps success-only Apps
+  delivery, sandboxing, one shared rich-output budget, executor parity, and the
+  compact mirrored return. Its read manifest, host-call bridge, and second
+  argument are removed. All seven tools explicitly remain model-only, and only
+  `execute_code` advertises the cache-busted v3 display resource, so neither a
+  current nor cached shell can call Connecta tools (#484).
+- **Strict configuration.** `createConnecta` rejects unknown own options at
+  every closed configuration path without reading or quoting their values.
+  Each closed schema is compile-time exhaustive against its public type;
+  connector, auth, storage, activity-store, logger, deployment-metadata, and
+  executor implementations remain open leaves (#485).
+- **Smaller package and tests.** Generated operator assets publish explicit
+  95-byte string declarations instead of embedding about 95 KB of literals,
+  with byte-identical runtime output and a packed-package size guard (#486).
+  The remaining copied UI credential and meta-tool fixtures are shared without
+  changing any test or assertion count, removing another 127 repository lines
+  (#479).
+
+### Removed
+
+- The direct-call `fields` projection option and its dot/array path language.
+- Program UI read bindings, `connecta.read`, and the Apps-to-host tool-call
+  bridge.
+
+### Declined with evidence
+
+- Discovery filtering did not ship: its sealed qualification retained complete
+  scenario coverage but missed top-1, recall, default-page recall, and negative
+  false-positive gates. The holdout cases were not inspected or tuned (#481).
+- Lean object-result text did not ship: Codex and Claude read ordinary
+  structured values, but Claude's error route took extra recovery actions and
+  Cursor was unavailable for the required matrix. The compatibility JSON copy
+  remains (#483).
+
 ## 0.19.0 — 2026-08-25
 
 This release is a smaller, simpler package with no behavioral change for a

package/README.md

@@ -78,7 +78,9 @@ Fifty issues in, one small object out. Your context window notices.
 
 There is also an operator surface, off until you turn it on: sign-in, an
 encrypted credential vault with rotation, revocable per-client tokens, and a
-payload-free activity log.
+payload-free activity log. Worker deployments can use Cloudflare Access for
+both MCP and operator identity; Node deployments and existing Workers can use
+Clerk.
 
 Connecta is not a platform, a marketplace, a policy engine, or a multi-tenant
 service. Those are decisions, and the [ethos](./ethos.md) records each one

package/bin/connecta.mjs

@@ -27,7 +27,8 @@ function shellCd(path) {
 function usage() {
   console.log(`Usage:
   connecta init [directory]
-  CONNECTA_TOKEN=<bearer> connecta doctor [--url http://localhost:8787]`);
+  CONNECTA_TOKEN=<bearer> connecta doctor [--url http://localhost:8787]
+  CF_ACCESS_CLIENT_ID=<id> CF_ACCESS_CLIENT_SECRET=<secret> connecta doctor --url https://worker.example`);
 }
 
 async function init() {
@@ -169,19 +170,35 @@ async function doctor() {
     !loopbackHosts.has(parsedUrl.hostname)
   ) {
     throw new Error(
-      "Refusing to send a bearer token over remote plaintext HTTP. Use HTTPS.",
+      "Refusing to send authentication credentials over remote plaintext HTTP. Use HTTPS.",
     );
   }
   const baseUrl = requestedUrl.replace(/\/+$/, "");
   const token = process.env.CONNECTA_TOKEN;
-  if (!token) {
+  const accessClientId = process.env.CF_ACCESS_CLIENT_ID;
+  const accessClientSecret = process.env.CF_ACCESS_CLIENT_SECRET;
+  if (Boolean(accessClientId) !== Boolean(accessClientSecret)) {
     throw new Error(
-      "Set CONNECTA_TOKEN so doctor can inspect the MCP surface.",
+      "Set both CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET.",
     );
   }
+  if (!token && !accessClientId) {
+    throw new Error(
+      "Set CONNECTA_TOKEN or a CF_ACCESS_CLIENT_ID/CF_ACCESS_CLIENT_SECRET pair so doctor can inspect the MCP surface.",
+    );
+  }
+  const authHeaders = {
+    ...(token ? { Authorization: `Bearer ${token}` } : {}),
+    ...(accessClientId && accessClientSecret
+      ? {
+          "CF-Access-Client-Id": accessClientId,
+          "CF-Access-Client-Secret": accessClientSecret,
+        }
+      : {}),
+  };
 
   const health = await jsonResponse(
-    await doctorFetch(`${baseUrl}/health`),
+    await doctorFetch(`${baseUrl}/health`, { headers: authHeaders }),
   );
   if (health.status !== "ok") {
     throw new Error(`Unexpected health status: ${String(health.status)}`);
@@ -206,7 +223,7 @@ async function doctor() {
       await doctorFetch(`${baseUrl}/mcp`, {
       method: "POST",
       headers: {
-        Authorization: `Bearer ${token}`,
+        ...authHeaders,
         "Content-Type": "application/json",
         Accept: "application/json, text/event-stream",
       },

package/dist/apps-shell.d.ts

@@ -3,16 +3,16 @@
  *
  * A build-time string constant, not a file read at startup: the core is
  * Web-API-only so it runs unchanged on Workers, and the same bytes have to
- * serve everywhere. It renders whatever HTML a program handed `connecta.ui`
- * inside a nested `srcdoc` frame. The one-argument form forwards no channel;
- * an explicitly bound view gets only named read calls through the trusted
- * shell, never a raw host channel.
+ * serve everywhere. The shell is display-only: it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
  *
  * The address carries a version segment because hosts are permitted to
  * prefetch and cache templates by URI: change these bytes, bump the version.
  */
 /** The only `ui://` URI in the system. No program input reaches it. */
-export declare const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v2";
+export declare const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v3";
 /** The mimeType the Apps spec requires of an HTML template. */
 export declare const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
 /**
@@ -29,11 +29,9 @@ export declare const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
  * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
  * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
  * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
- * delivered tool result, and puts it in a frame. An optional read manifest
- * installs one narrow `connecta.read(name, args)` bridge in that inner frame;
- * the outer shell maps declared names to the existing `call_tool` meta-tool.
- * It declares no CSP domains, so the host applies its restrictive default and
- * the `srcdoc` frame inherits `default-src 'none'` — program markup still gets
- * no direct network.
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'`. The payload gets scripts and local interactivity, and
+ * no network.
  */
-export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The outer shell is the only host peer. The payload frame is\n        // sandboxed to scripts alone, with no same-origin escape. Its one\n        // optional message dialect is handled below and translated into\n        // bounded call_tool requests; raw JSON-RPC is never forwarded.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n        var reads = null;\n        var hostCanCallTools = false;\n        var nextHostRequestId = 0;\n        var pendingHostReads = Object.create(null);\n        var activeHostReads = 0;\n        var maxActiveHostReads = 8;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // content-height bridge to the payload frame, so it can never learn\n        // the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payload(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var value = meta[\"connecta/ui\"];\n          if (!value || typeof value !== \"object\") return null;\n          return typeof value.html === \"string\" && value.html.length > 0\n            ? value\n            : null;\n        }\n\n        // This function is serialized into the opaque-origin payload frame.\n        // It knows no addresses and has no host channel of its own: one named\n        // read request goes to the trusted outer shell and one correlated\n        // result comes back.\n        function payloadReadBridge() {\n          \"use strict\";\n          var pending = Object.create(null);\n          var nextId = 0;\n\n          function read(name, args) {\n            return new Promise(function (resolve, reject) {\n              var id = String(++nextId);\n              pending[id] = { resolve: resolve, reject: reject };\n              try {\n                window.parent.postMessage({\n                  type: \"connecta/read\",\n                  id: id,\n                  name: name,\n                  args: args === undefined ? {} : args\n                }, \"*\");\n              } catch (error) {\n                delete pending[id];\n                reject(error);\n              }\n            });\n          }\n\n          Object.defineProperty(globalThis, \"connecta\", {\n            value: Object.freeze({ read: read }),\n            configurable: false,\n            enumerable: true,\n            writable: false\n          });\n\n          window.addEventListener(\"message\", function (event) {\n            if (event.source !== window.parent) return;\n            var message = event.data;\n            if (!message || message.type !== \"connecta/read-result\") return;\n            var waiter = pending[message.id];\n            if (!waiter) return;\n            delete pending[message.id];\n            if (message.ok) waiter.resolve(message.value);\n            else waiter.reject(new Error(message.error || \"Read failed\"));\n          });\n        }\n\n        function htmlWithReadBridge(html) {\n          var script =\n            \"<scr\" + \"ipt>(\" + payloadReadBridge.toString() + \")();</scr\" + \"ipt>\";\n          var head = /<head(?:\\s[^>]*)?>/i.exec(html);\n          if (head) {\n            var at = (head.index || 0) + head[0].length;\n            return html.slice(0, at) + script + html.slice(at);\n          }\n          var document = /<html(?:\\s[^>]*)?>/i.exec(html);\n          if (document) {\n            var afterHtml = (document.index || 0) + document[0].length;\n            return html.slice(0, afterHtml) + \"<head>\" + script + \"</head>\" + html.slice(afterHtml);\n          }\n          return script + html;\n        }\n\n        function render(params) {\n          var value =\n            payload(params) ||\n            payload(params && params.result) ||\n            payload(params && params.toolResult);\n          if (value === null) return;\n          reads = value.reads && typeof value.reads === \"object\"\n            ? value.reads\n            : null;\n          view.srcdoc = reads\n            ? htmlWithReadBridge(value.html)\n            : value.html;\n          reportSize();\n        }\n\n        function readError(message, fallback) {\n          if (message && typeof message.message === \"string\") return message.message;\n          if (message && message.data && typeof message.data.message === \"string\") {\n            return message.data.message;\n          }\n          return fallback;\n        }\n\n        function finishInnerRead(innerId, ok, value) {\n          if (!view.contentWindow) return;\n          view.contentWindow.postMessage(ok\n            ? { type: \"connecta/read-result\", id: innerId, ok: true, value: value }\n            : { type: \"connecta/read-result\", id: innerId, ok: false, error: value }, \"*\");\n        }\n\n        function beginInnerRead(message) {\n          if (!hostCanCallTools) {\n            finishInnerRead(message && message.id, false, \"This host does not support app-initiated server tool calls\");\n            return;\n          }\n          if (!message || typeof message.id !== \"string\" || typeof message.name !== \"string\") return;\n          if (!reads || !Object.prototype.hasOwnProperty.call(reads, message.name)) {\n            finishInnerRead(message.id, false, \"Unknown read binding\");\n            return;\n          }\n          if (activeHostReads >= maxActiveHostReads) {\n            finishInnerRead(message.id, false, \"Too many concurrent reads\");\n            return;\n          }\n          var binding = reads[message.name];\n          if (!binding || typeof binding !== \"object\" || typeof binding.address !== \"string\") {\n            finishInnerRead(message.id, false, \"Invalid read binding\");\n            return;\n          }\n          var supplied = message.args;\n          if (!supplied || typeof supplied !== \"object\" || Array.isArray(supplied)) {\n            finishInnerRead(message.id, false, \"Read arguments must be an object\");\n            return;\n          }\n          var allowed = Array.isArray(binding.viewArgs) ? binding.viewArgs : [];\n          var suppliedKeys = Object.keys(supplied);\n          for (var i = 0; i < suppliedKeys.length; i++) {\n            var key = suppliedKeys[i];\n            if (allowed.indexOf(key) === -1) {\n              finishInnerRead(message.id, false, \"Undeclared read argument \" + JSON.stringify(key));\n              return;\n            }\n          }\n          var args = Object.create(null);\n          var fixed = binding.fixedArgs && typeof binding.fixedArgs === \"object\"\n            ? binding.fixedArgs\n            : {};\n          Object.keys(fixed).forEach(function (key) { args[key] = fixed[key]; });\n          suppliedKeys.forEach(function (key) { args[key] = supplied[key]; });\n\n          var hostId = \"connecta-ui-read-\" + String(++nextHostRequestId);\n          pendingHostReads[hostId] = { innerId: message.id };\n          activeHostReads++;\n          send({\n            jsonrpc: \"2.0\",\n            id: hostId,\n            method: \"tools/call\",\n            params: {\n              name: \"call_tool\",\n              arguments: {\n                address: binding.address,\n                args: args,\n                resultMode: \"value\"\n              }\n            }\n          });\n        }\n\n        function finishHostRead(message) {\n          var pending = pendingHostReads[message.id];\n          if (!pending) return false;\n          delete pendingHostReads[message.id];\n          activeHostReads--;\n          if (message.error) {\n            finishInnerRead(pending.innerId, false, readError(message.error, \"Host rejected read\"));\n            return true;\n          }\n          var toolResult = message.result;\n          if (!toolResult || typeof toolResult !== \"object\") {\n            finishInnerRead(pending.innerId, false, \"Host returned an invalid tool result\");\n            return true;\n          }\n          var structured = toolResult.structuredContent;\n          if (toolResult.isError || (structured && structured.ok === false)) {\n            var detail = structured && structured.error;\n            var content = Array.isArray(toolResult.content)\n              ? toolResult.content.find(function (block) { return block && block.type === \"text\"; })\n              : null;\n            finishInnerRead(\n              pending.innerId,\n              false,\n              readError(detail, content && content.text ? content.text : \"Read failed\")\n            );\n            return true;\n          }\n          var value = structured && structured.ok === true &&\n              Object.prototype.hasOwnProperty.call(structured, \"data\")\n            ? structured.data\n            : structured !== undefined\n              ? structured\n              : toolResult;\n          finishInnerRead(pending.innerId, true, value);\n          return true;\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          var message = event.data;\n          if (event.source === view.contentWindow) {\n            if (message && message.type === \"connecta/read\") beginInnerRead(message);\n            return;\n          }\n          if (event.source !== host) return;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.id !== undefined && finishHostRead(message)) return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            var capabilities = message.result.hostCapabilities;\n            hostCanCallTools = Boolean(capabilities && capabilities.serverTools);\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";
+export declare const PROGRAM_UI_SHELL_HTML = "<!doctype html>\n<html lang=\"en\">\n  <head>\n    <meta charset=\"utf-8\" />\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n    <title>connecta program view</title>\n    <style>\n      html,\n      body {\n        margin: 0;\n        padding: 0;\n        background: transparent;\n      }\n      #program-view {\n        display: block;\n        width: 100%;\n        min-height: 480px;\n        border: 0;\n      }\n    </style>\n  </head>\n  <body>\n    <iframe\n      id=\"program-view\"\n      title=\"Program-rendered view\"\n      sandbox=\"allow-scripts\"\n      srcdoc=\"\"\n    ></iframe>\n    <script>\n      (function () {\n        \"use strict\";\n        // The host frame is the only peer this shell speaks to, in either\n        // direction. The payload frame below is sandboxed to scripts alone,\n        // with no same-origin escape, and is never handed a reply path:\n        // anything it posts fails the source check and is dropped. There is\n        // no bridge from program HTML to the host, by construction rather\n        // than by validation.\n        var host = window.parent;\n        var view = document.getElementById(\"program-view\");\n        var initializeId = \"connecta-ui-initialize\";\n        var lastWidth = 0;\n        var lastHeight = 0;\n\n        function send(message) {\n          if (!host || host === window) return;\n          host.postMessage(message, \"*\");\n        }\n\n        function notify(method, params) {\n          send({ jsonrpc: \"2.0\", method: method, params: params });\n        }\n\n        // Program views are fixed-height by construction. The shell has no\n        // bridge to the payload frame \u2014 that is the security posture, not an\n        // omission \u2014 so it can never learn the payload's content height, and\n        // what it reports here is its own box: the min-height above, unless\n        // the host has given it more. Taller content scrolls inside the inner\n        // frame rather than growing the view. Raising the min-height is the\n        // only lever; a content-height signal would cost the isolation.\n        function reportSize() {\n          var width = Math.ceil(document.documentElement.clientWidth);\n          var height = Math.ceil(document.documentElement.scrollHeight);\n          if (width === lastWidth && height === lastHeight) return;\n          lastWidth = width;\n          lastHeight = height;\n          notify(\"ui/notifications/size-changed\", {\n            width: width,\n            height: height\n          });\n        }\n\n        function payloadHtml(result) {\n          if (!result || typeof result !== \"object\") return null;\n          var meta = result._meta;\n          if (!meta || typeof meta !== \"object\") return null;\n          var payload = meta[\"connecta/ui\"];\n          if (!payload || typeof payload !== \"object\") return null;\n          var html = payload.html;\n          return typeof html === \"string\" && html.length > 0 ? html : null;\n        }\n\n        function render(params) {\n          var html =\n            payloadHtml(params) ||\n            payloadHtml(params && params.result) ||\n            payloadHtml(params && params.toolResult);\n          if (html === null) return;\n          view.srcdoc = html;\n          reportSize();\n        }\n\n        window.addEventListener(\"message\", function (event) {\n          if (event.source !== host) return;\n          var message = event.data;\n          if (!message || message.jsonrpc !== \"2.0\") return;\n          if (message.method === \"ui/notifications/tool-result\") {\n            render(message.params);\n            return;\n          }\n          if (message.method === \"ui/resource-teardown\") {\n            // A host->view request, not a notification: the host waits for\n            // this reply before it tears the view down. There is nothing to\n            // release, so answer immediately rather than make it time out.\n            if (message.id !== undefined && message.id !== null) {\n              send({ jsonrpc: \"2.0\", id: message.id, result: {} });\n            }\n            return;\n          }\n          // Only a completed handshake earns \"initialized\". A JSON-RPC error\n          // response carries the same id, and announcing initialization on one\n          // would assert a handshake that never happened.\n          if (message.id === initializeId && message.result !== undefined) {\n            notify(\"ui/notifications/initialized\", {});\n          }\n        });\n\n        window.addEventListener(\"resize\", reportSize);\n        view.addEventListener(\"load\", reportSize);\n\n        // Every field here is required by the Apps initialize schema, and a\n        // conforming host rejects the request outright when one is missing \u2014\n        // which would strand the shell before any tool result arrives.\n        send({\n          jsonrpc: \"2.0\",\n          id: initializeId,\n          method: \"ui/initialize\",\n          params: {\n            appInfo: { name: \"connecta program view\", version: \"1\" },\n            appCapabilities: {},\n            protocolVersion: \"2026-01-26\"\n          }\n        });\n        reportSize();\n      })();\n    </script>\n  </body>\n</html>\n";

package/dist/apps-shell.js

@@ -3,16 +3,16 @@
  *
  * A build-time string constant, not a file read at startup: the core is
  * Web-API-only so it runs unchanged on Workers, and the same bytes have to
- * serve everywhere. It renders whatever HTML a program handed `connecta.ui`
- * inside a nested `srcdoc` frame. The one-argument form forwards no channel;
- * an explicitly bound view gets only named read calls through the trusted
- * shell, never a raw host channel.
+ * serve everywhere. The shell is display-only: it renders whatever HTML a
+ * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
+ * channel back from that frame to the host, so program-authored markup is
+ * inert beyond its own pixels.
  *
  * The address carries a version segment because hosts are permitted to
  * prefetch and cache templates by URI: change these bytes, bump the version.
  */
 /** The only `ui://` URI in the system. No program input reaches it. */
-export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v2";
+export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v3";
 /** The mimeType the Apps spec requires of an HTML template. */
 export const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
 /**
@@ -29,12 +29,10 @@ export const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
  * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
  * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
  * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
- * delivered tool result, and puts it in a frame. An optional read manifest
- * installs one narrow `connecta.read(name, args)` bridge in that inner frame;
- * the outer shell maps declared names to the existing `call_tool` meta-tool.
- * It declares no CSP domains, so the host applies its restrictive default and
- * the `srcdoc` frame inherits `default-src 'none'` — program markup still gets
- * no direct network.
+ * delivered tool result, and puts it in a frame. It declares no CSP domains,
+ * so the host applies its restrictive default and the `srcdoc` frame inherits
+ * `default-src 'none'`. The payload gets scripts and local interactivity, and
+ * no network.
  */
 export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
 <html lang="en">
@@ -67,21 +65,17 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
     <script>
       (function () {
         "use strict";
-        // The outer shell is the only host peer. The payload frame is
-        // sandboxed to scripts alone, with no same-origin escape. Its one
-        // optional message dialect is handled below and translated into
-        // bounded call_tool requests; raw JSON-RPC is never forwarded.
+        // The host frame is the only peer this shell speaks to, in either
+        // direction. The payload frame below is sandboxed to scripts alone,
+        // with no same-origin escape, and is never handed a reply path:
+        // anything it posts fails the source check and is dropped. There is
+        // no bridge from program HTML to the host, by construction rather
+        // than by validation.
         var host = window.parent;
         var view = document.getElementById("program-view");
         var initializeId = "connecta-ui-initialize";
         var lastWidth = 0;
         var lastHeight = 0;
-        var reads = null;
-        var hostCanCallTools = false;
-        var nextHostRequestId = 0;
-        var pendingHostReads = Object.create(null);
-        var activeHostReads = 0;
-        var maxActiveHostReads = 8;
 
         function send(message) {
           if (!host || host === window) return;
@@ -93,8 +87,8 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
         }
 
         // Program views are fixed-height by construction. The shell has no
-        // content-height bridge to the payload frame, so it can never learn
-        // the payload's content height, and
+        // bridge to the payload frame — that is the security posture, not an
+        // omission — so it can never learn the payload's content height, and
         // what it reports here is its own box: the min-height above, unless
         // the host has given it more. Taller content scrolls inside the inner
         // frame rather than growing the view. Raising the min-height is the
@@ -111,213 +105,30 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
           });
         }
 
-        function payload(result) {
+        function payloadHtml(result) {
           if (!result || typeof result !== "object") return null;
           var meta = result._meta;
           if (!meta || typeof meta !== "object") return null;
-          var value = meta["connecta/ui"];
-          if (!value || typeof value !== "object") return null;
-          return typeof value.html === "string" && value.html.length > 0
-            ? value
-            : null;
-        }
-
-        // This function is serialized into the opaque-origin payload frame.
-        // It knows no addresses and has no host channel of its own: one named
-        // read request goes to the trusted outer shell and one correlated
-        // result comes back.
-        function payloadReadBridge() {
-          "use strict";
-          var pending = Object.create(null);
-          var nextId = 0;
-
-          function read(name, args) {
-            return new Promise(function (resolve, reject) {
-              var id = String(++nextId);
-              pending[id] = { resolve: resolve, reject: reject };
-              try {
-                window.parent.postMessage({
-                  type: "connecta/read",
-                  id: id,
-                  name: name,
-                  args: args === undefined ? {} : args
-                }, "*");
-              } catch (error) {
-                delete pending[id];
-                reject(error);
-              }
-            });
-          }
-
-          Object.defineProperty(globalThis, "connecta", {
-            value: Object.freeze({ read: read }),
-            configurable: false,
-            enumerable: true,
-            writable: false
-          });
-
-          window.addEventListener("message", function (event) {
-            if (event.source !== window.parent) return;
-            var message = event.data;
-            if (!message || message.type !== "connecta/read-result") return;
-            var waiter = pending[message.id];
-            if (!waiter) return;
-            delete pending[message.id];
-            if (message.ok) waiter.resolve(message.value);
-            else waiter.reject(new Error(message.error || "Read failed"));
-          });
-        }
-
-        function htmlWithReadBridge(html) {
-          var script =
-            "<scr" + "ipt>(" + payloadReadBridge.toString() + ")();</scr" + "ipt>";
-          var head = /<head(?:\\s[^>]*)?>/i.exec(html);
-          if (head) {
-            var at = (head.index || 0) + head[0].length;
-            return html.slice(0, at) + script + html.slice(at);
-          }
-          var document = /<html(?:\\s[^>]*)?>/i.exec(html);
-          if (document) {
-            var afterHtml = (document.index || 0) + document[0].length;
-            return html.slice(0, afterHtml) + "<head>" + script + "</head>" + html.slice(afterHtml);
-          }
-          return script + html;
+          var payload = meta["connecta/ui"];
+          if (!payload || typeof payload !== "object") return null;
+          var html = payload.html;
+          return typeof html === "string" && html.length > 0 ? html : null;
         }
 
         function render(params) {
-          var value =
-            payload(params) ||
-            payload(params && params.result) ||
-            payload(params && params.toolResult);
-          if (value === null) return;
-          reads = value.reads && typeof value.reads === "object"
-            ? value.reads
-            : null;
-          view.srcdoc = reads
-            ? htmlWithReadBridge(value.html)
-            : value.html;
+          var html =
+            payloadHtml(params) ||
+            payloadHtml(params && params.result) ||
+            payloadHtml(params && params.toolResult);
+          if (html === null) return;
+          view.srcdoc = html;
           reportSize();
         }
 
-        function readError(message, fallback) {
-          if (message && typeof message.message === "string") return message.message;
-          if (message && message.data && typeof message.data.message === "string") {
-            return message.data.message;
-          }
-          return fallback;
-        }
-
-        function finishInnerRead(innerId, ok, value) {
-          if (!view.contentWindow) return;
-          view.contentWindow.postMessage(ok
-            ? { type: "connecta/read-result", id: innerId, ok: true, value: value }
-            : { type: "connecta/read-result", id: innerId, ok: false, error: value }, "*");
-        }
-
-        function beginInnerRead(message) {
-          if (!hostCanCallTools) {
-            finishInnerRead(message && message.id, false, "This host does not support app-initiated server tool calls");
-            return;
-          }
-          if (!message || typeof message.id !== "string" || typeof message.name !== "string") return;
-          if (!reads || !Object.prototype.hasOwnProperty.call(reads, message.name)) {
-            finishInnerRead(message.id, false, "Unknown read binding");
-            return;
-          }
-          if (activeHostReads >= maxActiveHostReads) {
-            finishInnerRead(message.id, false, "Too many concurrent reads");
-            return;
-          }
-          var binding = reads[message.name];
-          if (!binding || typeof binding !== "object" || typeof binding.address !== "string") {
-            finishInnerRead(message.id, false, "Invalid read binding");
-            return;
-          }
-          var supplied = message.args;
-          if (!supplied || typeof supplied !== "object" || Array.isArray(supplied)) {
-            finishInnerRead(message.id, false, "Read arguments must be an object");
-            return;
-          }
-          var allowed = Array.isArray(binding.viewArgs) ? binding.viewArgs : [];
-          var suppliedKeys = Object.keys(supplied);
-          for (var i = 0; i < suppliedKeys.length; i++) {
-            var key = suppliedKeys[i];
-            if (allowed.indexOf(key) === -1) {
-              finishInnerRead(message.id, false, "Undeclared read argument " + JSON.stringify(key));
-              return;
-            }
-          }
-          var args = Object.create(null);
-          var fixed = binding.fixedArgs && typeof binding.fixedArgs === "object"
-            ? binding.fixedArgs
-            : {};
-          Object.keys(fixed).forEach(function (key) { args[key] = fixed[key]; });
-          suppliedKeys.forEach(function (key) { args[key] = supplied[key]; });
-
-          var hostId = "connecta-ui-read-" + String(++nextHostRequestId);
-          pendingHostReads[hostId] = { innerId: message.id };
-          activeHostReads++;
-          send({
-            jsonrpc: "2.0",
-            id: hostId,
-            method: "tools/call",
-            params: {
-              name: "call_tool",
-              arguments: {
-                address: binding.address,
-                args: args,
-                resultMode: "value"
-              }
-            }
-          });
-        }
-
-        function finishHostRead(message) {
-          var pending = pendingHostReads[message.id];
-          if (!pending) return false;
-          delete pendingHostReads[message.id];
-          activeHostReads--;
-          if (message.error) {
-            finishInnerRead(pending.innerId, false, readError(message.error, "Host rejected read"));
-            return true;
-          }
-          var toolResult = message.result;
-          if (!toolResult || typeof toolResult !== "object") {
-            finishInnerRead(pending.innerId, false, "Host returned an invalid tool result");
-            return true;
-          }
-          var structured = toolResult.structuredContent;
-          if (toolResult.isError || (structured && structured.ok === false)) {
-            var detail = structured && structured.error;
-            var content = Array.isArray(toolResult.content)
-              ? toolResult.content.find(function (block) { return block && block.type === "text"; })
-              : null;
-            finishInnerRead(
-              pending.innerId,
-              false,
-              readError(detail, content && content.text ? content.text : "Read failed")
-            );
-            return true;
-          }
-          var value = structured && structured.ok === true &&
-              Object.prototype.hasOwnProperty.call(structured, "data")
-            ? structured.data
-            : structured !== undefined
-              ? structured
-              : toolResult;
-          finishInnerRead(pending.innerId, true, value);
-          return true;
-        }
-
         window.addEventListener("message", function (event) {
-          var message = event.data;
-          if (event.source === view.contentWindow) {
-            if (message && message.type === "connecta/read") beginInnerRead(message);
-            return;
-          }
           if (event.source !== host) return;
+          var message = event.data;
           if (!message || message.jsonrpc !== "2.0") return;
-          if (message.id !== undefined && finishHostRead(message)) return;
           if (message.method === "ui/notifications/tool-result") {
             render(message.params);
             return;
@@ -335,8 +146,6 @@ export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
           // response carries the same id, and announcing initialization on one
           // would assert a handshake that never happened.
           if (message.id === initializeId && message.result !== undefined) {
-            var capabilities = message.result.hostCapabilities;
-            hostCanCallTools = Boolean(capabilities && capabilities.serverTools);
             notify("ui/notifications/initialized", {});
           }
         });

package/dist/auth/bearer.d.ts

@@ -5,7 +5,7 @@ export interface BearerTokenOptions {
 }
 /**
  * Static bearer-token inbound auth. Constant-time compares the Bearer token
- * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
- * falls through so a co-configured Clerk provider can still admit the request.
+ * against `secret`. Checked before interactive providers in the server; a
+ * mismatch falls through so another configured provider can admit the request.
  */
 export declare function bearerToken(secret: string, options?: BearerTokenOptions): InboundAuth;

package/dist/auth/bearer.js

@@ -16,8 +16,8 @@ function timingSafeEqual(a, b) {
 }
 /**
  * Static bearer-token inbound auth. Constant-time compares the Bearer token
- * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
- * falls through so a co-configured Clerk provider can still admit the request.
+ * against `secret`. Checked before interactive providers in the server; a
+ * mismatch falls through so another configured provider can admit the request.
  */
 export function bearerToken(secret, options = {}) {
     assertNoRetiredToolkitOptions("bearerToken", options);

package/dist/auth/clerk.js

@@ -366,6 +366,7 @@ export function clerkAuth(opts) {
     };
     return {
         kind: "clerk",
+        interactiveOperator: true,
         activityActorNamespace: frontendApiUrl,
         activityActorLabel: resolveActivityLabel,
         uiAuth: {

package/dist/auth/cloudflare-access.d.ts

@@ -0,0 +1,8 @@
+import type { InboundAuth } from "../types.js";
+/**
+ * Trust the identity Cloudflare Access attached to this direct Worker
+ * invocation. Access has already validated the browser session, Managed OAuth
+ * token, or service-token headers before the Worker runs; this adapter does
+ * not accept or parse a caller-supplied JWT.
+ */
+export declare function cloudflareAccessAuth(): InboundAuth;