@zackbart/connecta 0.21.1 → 0.22.0

package/CHANGELOG.md

@@ -2,6 +2,89 @@
 
 All notable changes to this package are documented here.
 
+## 0.22.0 — 2026-08-31
+
+This release lets one deployment serve several authenticated people without
+becoming an account system. Connector visibility comes from deployment config,
+and downstream auth may be shared across the tenant or isolated per human.
+Existing connectors stay shared, every visible connector stays visible, and
+every interactive human stays an operator unless the deployment opts into the
+new identity rules. A signed-in human may manage authentication for every
+connector their code-derived view includes; operator status separately controls
+tokens and global activity. Worker deployments also gain the complete Managed
+OAuth callback allowlist in the shipped example and agent instructions. The
+one upgrade seam is deliberate: in-flight `get_result` ids created by a named
+caller do not cross into the new subject partition, so finish paging them
+before deployment. Single-user deployments need no identity configuration,
+and non-Worker deployments can ignore the callback-policy change.
+
+### Added
+
+- **Identity-derived connector views.** `identity.connectorAccess` selects
+  declared connector ids from the authenticated actor, subject, and principal.
+  The view reaches discovery, direct and program calls, status, catalogs,
+  observed output shapes, and paged results. Unknown ids and resolver failures
+  fail closed.
+- **Shared and personal connector auth.** `authScope: "personal"` partitions
+  connector storage, encrypted credentials, OAuth state and tokens, catalogs,
+  and runtime observations by a hashed principal identity. Interactive members
+  manage auth for every visible connector: their own partition for personal
+  auth, or the deployment-wide grant for shared auth. `identity.operatorAccess`
+  reserves deployment access tokens and global activity for configured
+  operators.
+- **Principal-bound access tokens and OAuth callbacks.** A new connecta access
+  token retains its creator's principal without gaining operator rights.
+  Personal OAuth handoffs bind a hash of state to the initiating principal for
+  15 minutes before the public callback can exchange a code.
+
+### Changed
+
+- **Result pages follow authenticated subjects.** `get_result` storage is now
+  partitioned for every namespaced subject, including existing Clerk, Access,
+  and connecta-token callers. In-flight result ids created before upgrading do
+  not cross that storage boundary; finish paging them before deployment when
+  that matters.
+- **Worker Managed OAuth setup.** The Worker guide, source comment, upgrade
+  guide, and local `AGENTS.md` require Claude's fixed callback plus ChatGPT's
+  stable and callback-id forms in
+  `dynamic_client_registration.allowed_uris`.
+- **One tenant, several people.** The ethos now refuses a connecta-owned account
+  model while allowing externally authenticated principals, config-derived
+  connector visibility, and personal downstream credentials inside one tenant.
+- **Reviewed Cloudflare deletion contract.** Cloudflare removed a spurious
+  required empty request body from Worker script deletion. Connecta already
+  sent no body, so only the reviewed endpoint digest changes (#517).
+
+## 0.21.2 — 2026-08-31
+
+This patch closes two runtime isolation gaps: concurrent request scopes now
+share one downstream OAuth refresh inside a connector runtime, and QuickJS
+children no longer inherit the deployment process environment. Existing
+deployments need no configuration or storage migration. OAuth deployments get
+the refresh fix automatically; Node deployments using QuickJS get the tighter
+child boundary automatically. Deployments using neither path can ignore this
+release.
+
+### Changed
+
+- **Empty QuickJS child environments.** The Node process hosting the QuickJS
+  guest runtime starts with an explicit empty environment, so deployment
+  credentials and Node startup configuration such as `NODE_OPTIONS` never
+  cross the child-process boundary (#515).
+
+### Fixed
+
+- **One rotating-token redemption per runtime.** Concurrent request scopes for
+  one OAuth connector generation share the owner's refresh result or bounded
+  failure instead of independently redeeming the same refresh token. The gate
+  remains request-safe across follower and owner cancellation, storage
+  failures, force reauthorization, and issuer-generation changes (#514).
+- **Late and byte-identical refresh races.** Generation-scoped mutation and
+  success identities close token-save TOCTOU and complete-flight ABA windows,
+  including authorization servers that preserve the refresh token or return
+  byte-identical credentials. The guarantee is deliberately runtime-local;
+  `KVStorage` still has no cross-isolate compare-and-set primitive (#514).
+
 ## 0.21.1 — 2026-08-30
 
 This patch aligns the handwritten Cloudflare and Notion contracts and the four

package/README.md

@@ -82,6 +82,13 @@ payload-free activity log. Worker deployments can use Cloudflare Access for
 both MCP and operator identity; Node deployments and existing Workers can use
 Clerk.
 
+One deployment may serve several authenticated people inside the same tenant.
+Configuration can derive connector visibility from the admitted identity, and
+each connector may keep one shared downstream grant or a separate encrypted
+grant per human. Connecta does not own accounts or groups; Clerk or Cloudflare
+Access remains the identity provider. See [inbound auth](./documentation/auth.md#principals-visibility-and-operators)
+and [shared and personal auth](./documentation/storage-and-credentials.md#shared-and-personal-auth).
+
 Connecta is not a platform, a marketplace, a policy engine, or a multi-tenant
 service. Those are decisions, and the [ethos](./ethos.md) records each one
 and why.

package/dist/access-tokens.d.ts

@@ -1,4 +1,4 @@
-import type { InboundAuth, KVStorage } from "./types.js";
+import type { IdentityReference, InboundAuth, KVStorage } from "./types.js";
 export interface AccessTokenMetadata {
     id: string;
     name: string;
@@ -24,7 +24,7 @@ export declare class AccessTokenManager {
     });
     private read;
     list(): Promise<AccessTokenMetadata[]>;
-    create(name: unknown, createdBy: string): Promise<CreatedAccessToken>;
+    create(name: unknown, createdBy: string | IdentityReference): Promise<CreatedAccessToken>;
     rename(id: string, name: unknown): Promise<AccessTokenMetadata | null>;
     revoke(id: string, revokedBy: string): Promise<AccessTokenMetadata | null>;
     private authorize;

package/dist/access-tokens.js

@@ -1,3 +1,4 @@
+import { validIdentityReference } from "./identity.js";
 const TOKEN_PREFIX = "cta_";
 const TOKEN_BYTES = 32;
 const TOKEN_VALUE_RE = /^cta_[A-Za-z0-9_-]{43}$/;
@@ -54,6 +55,8 @@ function parseRecord(raw) {
             typeof value.tokenPrefix !== "string" ||
             typeof value.createdAt !== "string" ||
             typeof value.createdBy !== "string" ||
+            (value.principal !== undefined &&
+                !validIdentityReference(value.principal)) ||
             (value.revokedAt !== undefined &&
                 typeof value.revokedAt !== "string") ||
             (value.revokedBy !== undefined &&
@@ -167,7 +170,12 @@ export class AccessTokenManager {
             tokenHash: hash,
             tokenPrefix: token.slice(0, 12),
             createdAt: new Date().toISOString(),
-            createdBy,
+            createdBy: typeof createdBy === "string"
+                ? createdBy
+                : `${createdBy.namespace}:${createdBy.id}`,
+            ...(typeof createdBy === "string"
+                ? {}
+                : { principal: { ...createdBy } }),
         };
         await this.storage.set(recordKey(record.id), JSON.stringify(record));
         try {
@@ -219,6 +227,10 @@ export class AccessTokenManager {
         if (!record || record.revokedAt || record.tokenHash !== hash) {
             return unauthorized();
         }
-        return { ok: true, subjectId: record.id };
+        return {
+            ok: true,
+            subjectId: record.id,
+            ...(record.principal ? { principal: { ...record.principal } } : {}),
+        };
     }
 }

package/dist/auth/downstream-oauth.d.ts

@@ -1,5 +1,55 @@
-import type { OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthTokens } from "@modelcontextprotocol/client";
+import type { FetchLike, OAuthClientInformationContext, OAuthClientInformationMixed, OAuthClientMetadata, OAuthClientProvider, OAuthTokens } from "@modelcontextprotocol/client";
 import type { KVStorage } from "../types.js";
+type OAuthRefreshFlightOutcome = {
+    status: "refreshed";
+} | {
+    status: "retired";
+} | {
+    status: "failed";
+    error: unknown;
+};
+interface OAuthRefreshFlight {
+    done: Promise<OAuthRefreshFlightOutcome>;
+    release: (outcome: OAuthRefreshFlightOutcome) => void;
+    stopObservingOwnerAbort: () => void;
+    mutationId: object;
+}
+/**
+ * Share one rotating-token redemption within one connector runtime and OAuth
+ * generation. The first request still owns the real fetch and response. Its
+ * abort signal has one bounded listener until the exact flight settles, so a
+ * cancellation after the response cannot strand waiters during token storage.
+ * Followers wait for that provider to save tokens, then re-read storage. The
+ * map never retains a token response or transport.
+ *
+ * This is intentionally runtime-local. KVStorage has no atomic coordination
+ * operation, so a second isolate can still race the same refresh token.
+ */
+export declare class OAuthRefreshCoordinator {
+    private readonly flights;
+    /** Opaque identities only: no request promise, signal, callback, or response. */
+    private readonly pendingMutations;
+    /** One bounded latest-success slot, containing only generation + identity. */
+    private successfulRefresh;
+    /** Replaced on every map mutation, closing flight/pending ABA across awaits. */
+    private stateRevision;
+    private advanceStateRevision;
+    private observeAuthoritativeGeneration;
+    private settle;
+    private markMutationPending;
+    private finishMutation;
+    /** @internal Opaque basis for issuer-aware provider token reads. */
+    successfulRefreshIdentity(generation: string): object | undefined;
+    coordinatedFetch(provider: KvOAuthProvider, baseFetch: FetchLike, requestSignal?: AbortSignal): FetchLike;
+    /** Publish one exact owner's successful save without disturbing a newer try. */
+    succeedMutation(generation: string, flight: OAuthRefreshFlight): void;
+    /** Give joined callers a fetch/flow failure, without rejecting the gate. */
+    fail(generation: string, flight: OAuthRefreshFlight, error: unknown): void;
+    /** Finish an exact failed credential write, then publish its failure. */
+    failMutation(generation: string, flight: OAuthRefreshFlight, error: unknown): void;
+    /** Force reauthorization fences and wakes every waiter on the retired epoch. */
+    retire(generation: string): void;
+}
 /**
  * Physical key for an OAuth value in one authorization epoch. Legacy values
  * keep their historical names so upgrades can read an existing grant. Modern
@@ -20,19 +70,31 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     private readonly connectorId;
     private readonly storage;
     private readonly redirectUri;
+    private readonly refreshCoordinator?;
     /**
      * The reset generation this provider's flow started under. Every OAuth value
      * it writes carries this epoch, so a late write can land after a reset without
      * becoming readable under the new generation.
      */
     private capturedGeneration;
-    constructor(connectorId: string, storage: KVStorage, redirectUri: string);
+    private refreshFlight;
+    /** Tokens this request's issuer-aware auth flow decided to refresh. */
+    private refreshBasis;
+    constructor(connectorId: string, storage: KVStorage, redirectUri: string, refreshCoordinator?: OAuthRefreshCoordinator | undefined);
     /**
      * Stamp the force-reauth generation the current connect flow started under.
      * Called by the connector once per connect, before c.connect(). The callback
      * path captures the generation stored beside its verified state instead.
      */
     captureGeneration(gen: string): void;
+    /** The generation captured for this flow, before a concurrent reset. */
+    flowGeneration(): Promise<string>;
+    /** @internal Record the refresh attempt this provider owns. */
+    captureRefreshFlight(generation: string, flight: OAuthRefreshFlight): void;
+    private succeedRefreshFlight;
+    private failRefreshFlight;
+    /** True when another request saved a refresh result after this flow's read. */
+    refreshBasisChanged(current: OAuthTokens, generation: string): boolean;
     /**
      * The epoch this provider writes under. Direct unit/custom use lazily captures
      * the current generation; connector-driven connect and callback paths stamp it
@@ -121,3 +183,4 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     resetAuthorization(operatorDisconnected?: boolean): Promise<void>;
     invalidateCredentials(scope: "all" | "client" | "tokens" | "verifier" | "discovery"): Promise<void>;
 }
+export {};