@zackbart/connecta 0.19.0 → 0.21.0

package/dist/auth/cloudflare-access.js

@@ -0,0 +1,66 @@
+function identityString(identity, field) {
+    const value = identity[field];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function unauthorized() {
+    return {
+        ok: false,
+        response: Response.json({ error: "Cloudflare Access authentication required" }, { status: 401 }),
+    };
+}
+/**
+ * Trust the identity Cloudflare Access attached to this direct Worker
+ * invocation. Access has already validated the browser session, Managed OAuth
+ * token, or service-token headers before the Worker runs; this adapter does
+ * not accept or parse a caller-supplied JWT.
+ */
+export function cloudflareAccessAuth() {
+    return {
+        kind: "cloudflare-access",
+        interactiveOperator: true,
+        activityActorNamespace: "cloudflare-access",
+        uiAuth: { kind: "cloudflare-access" },
+        async authorize(_request, _baseUrl, runtimeContext) {
+            const access = runtimeContext?.access;
+            if (!access)
+                return unauthorized();
+            let identity;
+            try {
+                identity = await access.getIdentity();
+            }
+            catch {
+                return unauthorized();
+            }
+            if (!identity) {
+                // Access service-token policies authenticate the request and attach
+                // ctx.access, but getIdentity() is a user-identity API and returns
+                // undefined. Cloudflare strips the service-token headers before the
+                // Worker, so the Access application audience is the only trusted,
+                // stable service attribution available without parsing a JWT.
+                return { ok: true, subjectId: access.aud };
+            }
+            const userId = identityString(identity, "user_uuid") ??
+                identityString(identity, "email");
+            const commonName = identityString(identity, "common_name");
+            const serviceTokenId = identityString(identity, "service_token_id");
+            if (identity.service_token_status === true ||
+                serviceTokenId ||
+                (!userId && commonName)) {
+                const subjectId = serviceTokenId ?? commonName;
+                return subjectId
+                    ? { ok: true, subjectId }
+                    : {
+                        ok: false,
+                        response: Response.json({ error: "Cloudflare Access service identity required" }, { status: 403 }),
+                    };
+            }
+            if (!userId) {
+                return {
+                    ok: false,
+                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403 }),
+                };
+            }
+            return { ok: true, userId, subjectId: userId };
+        },
+    };
+}

package/dist/execute.d.ts

@@ -91,14 +91,8 @@ export type EmittedBlock = {
     data: string;
     mimeType: string;
 };
-interface UiReadBinding {
-    address: string;
-    fixedArgs: Record<string, unknown>;
-    viewArgs: string[];
-}
 interface UiPayload {
     html: string;
-    reads?: Record<string, UiReadBinding>;
 }
 /**
  * Request-local collection for `connecta.emit` and `connecta.ui`. Budgets fail
@@ -136,7 +130,6 @@ export declare class EmitCollector {
      * complaint about its type would send the author to fix the wrong thing.
      */
     acceptUi(...values: unknown[]): void;
-    acceptValidatedUi(payload: UiPayload): void;
     private assertUiVacant;
     private acceptUiPayload;
 }

package/dist/execute.js

@@ -6,8 +6,7 @@ import { guardExecuteResultValue, MAX_EXECUTE_LOG_CHARS, truncateExecuteText, }
 import { ExecutorAdmissionError, ExecutorExecutionError, isAdmittingExecutor, } from "./executor-admission.js";
 import { boundedEchoText, classifyCallError, msg } from "./errors.js";
 import { InvocationFailure, InvocationService, } from "./invocation.js";
-import { hasConnectorGuides } from "./skills.js";
-import { isExplicitlyReadOnly } from "./tool-safety.js";
+import { connectorGuide, connectorGuideRequired, connectorSkillName, hasConnectorGuides, } from "./skills.js";
 /** Keep one model-written program from amplifying into an unbounded fan-out. */
 const EXECUTE_MAX_HOST_CALLS = 20;
 export const EXECUTE_MAX_BATCH_CALLS = 10;
@@ -149,11 +148,7 @@ function requireEmittedBlock(raw) {
     }
     return raw;
 }
-const UI_SHAPE_HINT = "connecta.ui accepts exactly one HTML argument and, optionally, one read-binding options object";
-const MAX_UI_READ_BINDINGS = 32;
-const MAX_UI_VIEW_ARGS = 32;
-const UI_READ_NAME = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
-const FORBIDDEN_UI_KEY = new Set(["__proto__", "constructor", "prototype"]);
+const UI_SHAPE_HINT = "connecta.ui accepts exactly one argument: a non-empty string of HTML";
 /** What the argument was, named the way the emit validator names a bad field. */
 function describeUiArgument(raw) {
     if (raw === null)
@@ -168,9 +163,9 @@ function describeUiArgument(raw) {
     return `${/^[aeiou]/.test(kind) ? "an" : "a"} ${kind}`;
 }
 /**
- * Strict U1/V1 validation. The first argument remains HTML; the only second
- * argument is one read-binding manifest. There are no alternate object or MCP
- * block forms.
+ * Strict U1 validation. There is no options parameter and no sugar form, for
+ * M1's reason: sugar is how a one-shape contract grows hair. An options bag or
+ * an MCP block object is just a non-string, and fails as one.
  */
 function requireUiHtml(raw) {
     if (typeof raw !== "string" || raw.length === 0) {
@@ -178,80 +173,11 @@ function requireUiHtml(raw) {
     }
     return raw;
 }
-function requireRecord(raw, label) {
-    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
-        throw guestFailure("invalid_args", `${label} must be an object`);
-    }
-    return raw;
-}
-function requireExactKeys(value, allowed, label) {
-    const extras = Object.keys(value).filter((key) => !allowed.includes(key));
-    if (extras.length > 0) {
-        throw guestFailure("invalid_args", `${label} carries unsupported field(s) ${extras.map((key) => JSON.stringify(key)).join(", ")}`);
-    }
-}
-function requireUiReadKey(raw, label) {
-    if (typeof raw !== "string" ||
-        raw.length === 0 ||
-        raw.length > 128 ||
-        FORBIDDEN_UI_KEY.has(raw)) {
-        throw guestFailure("invalid_args", `${label} must be a non-empty string of at most 128 characters and cannot be __proto__, constructor, or prototype`);
-    }
-    return raw;
-}
-function requireUiReads(raw) {
-    const record = requireRecord(raw, "connecta.ui options.reads");
-    const names = Object.keys(record);
-    if (names.length === 0 || names.length > MAX_UI_READ_BINDINGS) {
-        throw guestFailure("invalid_args", `connecta.ui options.reads must contain from 1 through ${MAX_UI_READ_BINDINGS} named bindings`);
-    }
-    const reads = Object.create(null);
-    for (const name of names) {
-        if (!UI_READ_NAME.test(name) || FORBIDDEN_UI_KEY.has(name)) {
-            throw guestFailure("invalid_args", `connecta.ui read binding name ${JSON.stringify(name)} must match ${UI_READ_NAME}`);
-        }
-        const value = requireRecord(record[name], `connecta.ui read binding ${JSON.stringify(name)}`);
-        requireExactKeys(value, ["address", "fixedArgs", "viewArgs"], `connecta.ui read binding ${JSON.stringify(name)}`);
-        if (typeof value.address !== "string" || value.address.length === 0) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} address must be a non-empty string`);
-        }
-        const fixedArgs = value.fixedArgs === undefined
-            ? {}
-            : requireRecord(value.fixedArgs, `connecta.ui read binding ${JSON.stringify(name)} fixedArgs`);
-        const rawViewArgs = value.viewArgs ?? [];
-        if (!Array.isArray(rawViewArgs) || rawViewArgs.length > MAX_UI_VIEW_ARGS) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} viewArgs must be an array of at most ${MAX_UI_VIEW_ARGS} strings`);
-        }
-        const viewArgs = rawViewArgs.map((key) => requireUiReadKey(key, `connecta.ui read binding ${JSON.stringify(name)} viewArgs entry`));
-        if (new Set(viewArgs).size !== viewArgs.length) {
-            throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} viewArgs must not repeat a key`);
-        }
-        for (const key of viewArgs) {
-            if (Object.prototype.hasOwnProperty.call(fixedArgs, key)) {
-                throw guestFailure("invalid_args", `connecta.ui read binding ${JSON.stringify(name)} view argument ${JSON.stringify(key)} cannot override a fixed argument`);
-            }
-        }
-        reads[name] = {
-            address: value.address,
-            fixedArgs,
-            viewArgs,
-        };
-    }
-    return reads;
-}
 function requireUiPayload(values) {
-    if (values.length !== 1 && values.length !== 2) {
+    if (values.length !== 1) {
         throw guestFailure("invalid_args", `${UI_SHAPE_HINT}; got ${values.length} arguments`);
     }
-    const html = requireUiHtml(values[0]);
-    if (values.length === 1)
-        return { html };
-    const options = requireRecord(values[1], "connecta.ui options");
-    requireExactKeys(options, ["reads"], "connecta.ui options");
-    if (!Object.prototype.hasOwnProperty.call(options, "reads")) {
-        throw guestFailure("invalid_args", "connecta.ui options must contain reads");
-    }
-    return { html, reads: requireUiReads(options.reads) };
+    return { html: requireUiHtml(values[0]) };
 }
 /**
  * Request-local collection for `connecta.emit` and `connecta.ui`. Budgets fail
@@ -309,10 +235,6 @@ export class EmitCollector {
         this.assertUiVacant();
         this.acceptUiPayload(requireUiPayload(values));
     }
-    acceptValidatedUi(payload) {
-        this.assertUiVacant();
-        this.acceptUiPayload(payload);
-    }
     assertUiVacant() {
         if (this.ui) {
             throw guestFailure("invalid_args", "connecta.ui accepts at most one payload per run: a view was already accepted and stands");
@@ -595,36 +517,6 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
     const callNamespace = async (connectorId, toolAlias, args) => {
         return called("call", () => invocation.invokeToolAlias(String(connectorId), String(toolAlias), sanitizeIdentifier, args ?? {}, invocationContext()));
     };
-    /**
-     * A read binding is admitted while the program still owns the request. The
-     * shell later calls the ordinary `call_tool`, which repeats this same
-     * fail-closed check against the then-current catalog; validating here keeps
-     * a typo or destructive address from producing a view whose controls can
-     * never work, while validation at use keeps a stale view from retaining old
-     * authority.
-     */
-    const validateUiReads = async (payload) => {
-        if (!payload.reads)
-            return payload;
-        const reads = Object.create(null);
-        for (const [name, binding] of Object.entries(payload.reads)) {
-            const resolution = await catalog.resolveTool(binding.address, limits.signal !== undefined ? { signal: limits.signal } : {});
-            if (!resolution.ok) {
-                throw new InvocationFailure({
-                    ...resolution.error,
-                    message: `connecta.ui read binding ${JSON.stringify(name)} could not resolve ${JSON.stringify(binding.address)}: ${resolution.error.message}`,
-                });
-            }
-            if (!isExplicitlyReadOnly(resolution.resolved.definition)) {
-                throw guestFailure("destructive_tool_requires_approval", `connecta.ui read binding ${JSON.stringify(name)} refuses ${JSON.stringify(binding.address)}: the tool is not explicitly read-only`);
-            }
-            reads[name] = {
-                ...binding,
-                address: `${resolution.resolved.connector.id}.${resolution.resolved.toolName}`,
-            };
-        }
-        return { html: payload.html, reads };
-    };
     const fns = {
         __callNamespace: callNamespace,
         call: (address, args) => callAddress(address, args),
@@ -646,8 +538,7 @@ export async function buildSandboxProviders(registry, baseUrl, logger, activity,
             if (!limits.emitCollector) {
                 throw guestFailure("unavailable", "connecta.ui is unavailable: no emission collector was configured for this execution", true);
             }
-            const payload = await validateUiReads(requireUiPayload(values));
-            limits.emitCollector.acceptValidatedUi(payload);
+            limits.emitCollector.acceptUi(...values);
         },
         batch: async (calls) => {
             const started = Date.now();
@@ -965,9 +856,15 @@ function connectorInventory(connectors) {
         return `${prefix}none.`;
     const entries = connectors.map((connector) => {
         const shortcut = sanitizeIdentifier(connector.id);
-        return shortcut === connector.id
+        const address = shortcut === connector.id
             ? connector.id
             : `${connector.id} (shortcut ${shortcut})`;
+        if (!connectorGuide(connector))
+            return address;
+        const requirement = connectorGuideRequired(connector)
+            ? "required guide"
+            : "guide";
+        return `${address} (${requirement} ${connectorSkillName(connector.id)})`;
     });
     const shown = [];
     for (let index = 0; index < entries.length; index++) {
@@ -988,18 +885,18 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, connectorGuides, connectors) => `Choose the route before discovery. Exactly one unknown-address read uses top-level search_tools then call_tool. execute_code is the primary surface for everything wider: make exactly one execute_code call that searches, selects, calls, and reduces. A discovery-only program wastes its round trip: finish here, don't return catalog matches for a later call. Only readOnlyHint: true tools are available. Limits: ${EXECUTE_MAX_HOST_CALLS} host calls per run, ${EXECUTE_MAX_BATCH_CALLS} per batch, ${EXECUTE_HOST_CALL_TIMEOUT_MS / 1_000}-second host deadline.
+const executeDescription = (emitBudgets, connectorGuides, connectors) => `Choose the route before discovery. A known address uses call_tool. Unknown-address and wider read-only work use exactly one execute_code call that discovers, calls, and returns the answer. Finish in that program; don't return catalog matches for a later call. Only readOnlyHint: true tools are available. Limits: ${EXECUTE_MAX_HOST_CALLS} host calls per run, ${EXECUTE_MAX_BATCH_CALLS} per batch, ${EXECUTE_HOST_CALL_TIMEOUT_MS / 1_000}-second host deadline.
 
 ${connectorInventory(connectors)}
 
-Write one plain-JavaScript async arrow function. Use only:
+Fetch required guides named above before executing. Write one plain-JavaScript async arrow function. Use only:
 - <connectorId>.<toolName>(args) for a sanitized shortcut, or connecta.call(address, args) for a canonical address.
-- connecta.search(args), connecta.describe(args), and connecta.batch(calls) for discovery and independent read-only calls.
+- connecta.search(args) returns { tools }; connecta.describe(args) returns { tools }; use entry key lists. connecta.batch(calls) accepts canonical connector addresses only.
 - connecta.emit(block) — { type: "text", text } or { type: "image" | "audio", data (base64), mimeType }. Success-only; ${emitBudgets.maxBlocks} blocks/${emitBudgets.maxBytes} bytes; invalid/over-budget throws.
-- connecta.ui(html, options?) for one success-only view; return the same initial summary the HTML renders.
+- connecta.ui(html) for one display-only, success-only view; return the same summary the HTML renders.
 - console.log(...) — captured.
 
-Programs have no portable ambient capabilities. Return JSON and reduce large results before they truncate. Fetch skills({ name: "usage" }) once for selection rules, exact result shapes, repair, examples, guide handling${connectorGuides ? ", connector-guide rules" : ""}, and runtime differences.`;
+No portable ambient capabilities. Return JSON; reduce large results before truncation. Build arguments from required input keys and schemas, never descriptions or output keys. Fetch skills({ name: "usage" }) only when this is insufficient or repair is needed; it has full rules, examples${connectorGuides ? ", guide handling" : ""}, and runtime details.`;
 /** Register the execute_code meta-tool. Only called when an executor is configured. */
 export function registerExecuteTool(server, registry, ctx) {
     // Resolved once so the description and the collector cannot disagree about

package/dist/index.d.ts

@@ -132,7 +132,7 @@ export interface ConnectaConfig {
     credentials?: ConnectaCredentialsConfig;
     /**
      * Named, revocable Bearer tokens for MCP clients. Creation and mutation
-     * require an eligible Clerk operator; token secrets are returned once.
+     * require an eligible interactive operator; token secrets are returned once.
      */
     accessTokens?: ConnectaAccessTokensConfig;
     /** Tool-catalog caching, persistence, stale fallback, and probe deadlines. */
@@ -192,6 +192,6 @@ export { CONNECTA_VERSION } from "./version.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
-export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, UiAuthConfig, AuthResult, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, CatalogDriftActivityEvent, ToolCallActivityEvent, } from "./activity.js";
 export { InvalidActivityCursorError } from "./activity.js";

package/dist/index.js

@@ -42,71 +42,116 @@ function normalizeAuth(auth) {
         return rank(a) - rank(b);
     });
 }
-const LEGACY_CONFIG_MIGRATIONS = [
-    ["activityReadGate", "activity.readGate"],
-    ["activityDeploymentId", "activity.deploymentId"],
-    ["credentialEncryptionKey", "credentials.encryptionKey"],
-    ["toolCacheTtlSeconds", "discovery.catalogTtlSeconds"],
-    ["persistToolCatalog", "discovery.persistCatalog"],
-    ["toolCatalogStaleSeconds", "discovery.staleCatalogSeconds"],
-    ["probeTimeoutMs", "discovery.probeTimeoutMs"],
-    ["defaultToolTimeoutMs", "calls.defaultTimeoutMs"],
-    ["maxResultBytes", "calls.maxResultBytes"],
-];
-const hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
-/**
- * Fail closed at the public boundary: a JavaScript caller on the v0.6 shape
- * must receive one complete migration error, never silently lose an option to
- * a default. This runs before createConnecta reads any other config field.
- */
-function assertNoLegacyConfig(config) {
-    const candidate = config;
-    if (hasOwn(candidate, "toolkits")) {
-        throw new Error("ConnectaConfig.toolkits was removed in issue #178. Deploy one " +
-            "connecta instance per audience instead; see ethos.md.");
-    }
-    const credentials = candidate.credentials;
-    const hasNestedHealth = typeof credentials === "object" &&
-        credentials !== null &&
-        hasOwn(credentials, "health");
-    if (hasOwn(candidate, "credentialHealth") || hasNestedHealth) {
-        throw new Error("`credentials.health` and legacy `credentialHealth` were removed in " +
-            "issue #179. Credentials now fail at use; see ethos.md.");
-    }
-    const calls = candidate.calls;
-    if (typeof calls === "object" &&
-        calls !== null &&
-        hasOwn(calls, "maxBatchResultBytes")) {
-        throw new Error("`calls.maxBatchResultBytes` was removed in issue #273 along with " +
-            "batch_call. Remove it; a program's batching is bounded by " +
-            "execute_code's own limits — connecta.batch's per-run call ceiling " +
-            "and the executor result cap — while each call inside it still honours " +
-            "calls.maxResultBytes and any per-connector override.");
-    }
-    const found = [];
-    if (hasOwn(candidate, "activity")) {
-        const activity = candidate.activity;
-        const isObject = typeof activity === "object" && activity !== null;
-        // A valid v0.6 ActivityStore can itself own a backend field named `store`.
-        // Its required `record` method (including a prototype method) therefore
-        // takes precedence over the otherwise-new wrapper shape.
-        const hasLegacyRecord = isObject &&
-            typeof activity.record === "function";
-        if (activity !== undefined &&
-            (!isObject ||
-                hasLegacyRecord ||
-                !hasOwn(activity, "store"))) {
-            found.push(["activity", "activity.store"]);
-        }
+const admissionPoolSchema = {
+    concurrency: null,
+    maxQueueSize: null,
+    queueTimeoutMs: null,
+    retryAfterMs: null,
+};
+const CONFIG_SCHEMA = {
+    connectors: null,
+    auth: null,
+    storage: null,
+    publicUrl: null,
+    activity: {
+        store: null,
+        readGate: null,
+        deploymentId: null,
+    },
+    credentials: {
+        encryptionKey: null,
+    },
+    accessTokens: {
+        maxActive: null,
+    },
+    discovery: {
+        concurrency: null,
+        catalogTtlSeconds: null,
+        persistCatalog: null,
+        staleCatalogSeconds: null,
+        probeTimeoutMs: null,
+    },
+    calls: {
+        defaultTimeoutMs: null,
+        maxResultBytes: null,
+    },
+    execute: {
+        maxEmittedBytes: null,
+        maxEmittedBlocks: null,
+    },
+    admission: {
+        requests: admissionPoolSchema,
+        code: admissionPoolSchema,
+    },
+    branding: {
+        productName: null,
+        productUrl: null,
+        ownerName: null,
+        ownerUrl: null,
+        description: null,
+        pageTitle: null,
+        favicon: {
+            svg: null,
+            ico: null,
+            href: null,
+        },
+        themeColor: null,
+    },
+    logger: null,
+    serverInfo: {
+        name: null,
+        version: null,
+        title: null,
+        websiteUrl: null,
+        icons: [
+            {
+                src: null,
+                mimeType: null,
+                sizes: null,
+            },
+        ],
+    },
+    deploymentInfo: null,
+    executor: null,
+};
+function unknownOptionPaths(value, path, schema) {
+    if (schema === null)
+        return [];
+    if (Array.isArray(schema)) {
+        if (!Array.isArray(value))
+            return [];
+        return value.flatMap((entry, index) => unknownOptionPaths(entry, `${path}[${index}]`, schema[0]));
     }
-    for (const migration of LEGACY_CONFIG_MIGRATIONS) {
-        if (hasOwn(candidate, migration[0]))
-            found.push(migration);
+    if (typeof value !== "object" || value === null)
+        return [];
+    const known = new Set(Object.keys(schema));
+    const unknown = Reflect.ownKeys(value)
+        .filter((key) => typeof key !== "string" || !known.has(key))
+        .map((key) => `${path}.${String(key)}`)
+        .sort();
+    if (unknown.length > 0)
+        return unknown;
+    for (const [key, childSchema] of Object.entries(schema)) {
+        unknown.push(...unknownOptionPaths(value[key], `${path}.${key}`, childSchema));
     }
-    if (found.length === 0)
+    return unknown;
+}
+function rejectUnknownOptions(paths) {
+    if (paths.length === 0)
         return;
-    throw new Error("Unsupported v0.6.x ConnectaConfig options. Migrate each path for v0.7.0:\n" +
-        found.map(([oldPath, newPath]) => `- ${oldPath} -> ${newPath}`).join("\n"));
+    throw new Error(`Unknown Connecta configuration option${paths.length === 1 ? "" : "s"}:\n` +
+        paths.map((path) => `- ${path}`).join("\n"));
+}
+/** Reject JavaScript typos and removed options before construction does work. */
+function assertKnownConfig(config) {
+    rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    const activity = config.activity;
+    if (activity !== undefined &&
+        (typeof activity !== "object" ||
+            activity === null ||
+            typeof activity.store?.record !== "function")) {
+        throw new Error("ConnectaConfig.activity.store must implement record(event)");
+    }
 }
 /**
  * One-time construction warnings for deployment shapes that run fine but are
@@ -193,11 +238,7 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     }
 }
 export function createConnecta(config) {
-    assertNoLegacyConfig(config);
-    if (hasOwn(config, "surface")) {
-        throw new Error("ConnectaConfig.surface was removed in issue #273. Remove it; connecta " +
-            "now serves one seven-tool surface.");
-    }
+    assertKnownConfig(config);
     if (!config.executor) {
         throw new Error("ConnectaConfig.executor is required. Configure quickJsExecutor() from " +
             '"@zackbart/connecta/quickjs" on Node, or ' +
@@ -221,8 +262,8 @@ export function createConnecta(config) {
         ? new AccessTokenManager(storage, config.accessTokens)
         : undefined;
     if (accessTokens &&
-        !configuredAuth.some((provider) => provider.uiAuth?.kind === "clerk")) {
-        throw new Error("accessTokens requires a Clerk auth provider: only an eligible Clerk " +
+        !configuredAuth.some((provider) => provider.interactiveOperator)) {
+        throw new Error("accessTokens requires an interactive operator auth provider: only an eligible " +
             "operator may create, rename, or revoke deployment access tokens");
     }
     const serverInfo = {

package/dist/invocation.d.ts

@@ -57,7 +57,7 @@ export interface InvocationContext<T> {
     requestSignal?: AbortSignal;
     unwrapResult?: boolean;
     /**
-     * Caller-owned result policy. MCP passes fields + paging here; code mode
+     * Caller-owned result policy. MCP applies result paging here; code mode
      * normally accepts the already-unwrapped value unchanged.
      */
     processResult?: (value: unknown, resolved: ResolvedCatalogTool) => T | Promise<T>;

package/dist/meta-tools.d.ts

@@ -46,7 +46,6 @@ type ResultMode = "mcp" | "value";
 export interface CallArgs {
     address: string;
     args?: Record<string, unknown>;
-    fields?: string[];
     resultMode?: ResultMode;
     timeoutMs?: number;
     /** Retries after the first attempt; honored only for safely annotated tools. */