@zackbart/connecta 0.21.1 → 0.22.0

package/dist/routes/shared.d.ts

@@ -5,11 +5,13 @@ import type { CredentialVault } from "../credentials.js";
 import type { DeferredWork } from "../connector-scope.js";
 import type { AdmissionController } from "../executor-admission.js";
 import type { Registry } from "../registry.js";
-import type { ConnectaBranding, Executor, InboundAuth, InboundAuthRuntimeContext, Logger } from "../types.js";
+import type { AuthenticatedIdentity, ConnectaBranding, Executor, IdentityReference, InboundAuth, InboundAuthRuntimeContext, Logger } from "../types.js";
+import type { ConnectaIdentityConfig } from "../index.js";
 export { msg } from "../errors.js";
 export interface ServerOptions {
     registry: Registry;
     auth: InboundAuth[];
+    identity?: ConnectaIdentityConfig | undefined;
     publicUrl?: string | undefined;
     serverInfo: Implementation;
     logger: Logger;
@@ -64,21 +66,35 @@ export declare function privateJson(body: unknown, init?: ResponseInit): Respons
  */
 export declare function loggableValue(requested: string): string;
 export declare function activityActorNamespace(provider: InboundAuth): string | undefined;
-export declare function authorize(request: Request, baseUrl: string, auth: InboundAuth[], runtimeContext?: RuntimeExecutionContext): Promise<{
+export declare function authorize(request: Request, baseUrl: string, auth: InboundAuth[], runtimeContext?: RuntimeExecutionContext, identityConfig?: ConnectaIdentityConfig, partitionIdentity?: boolean): Promise<{
     ok: true;
     actor: ActivityActor;
-    /** True only when the admitting provider can also authorize UI mutation. */
+    identity: AuthenticatedIdentity;
+    subjectKey?: string;
+    principalKey?: string;
+    connectorIds: "all" | readonly string[];
+    operator: boolean;
+    /** Backward-compatible name used by operator views. */
     uiAdminEligible?: boolean;
 } | {
     ok: false;
     response: Response;
 }>;
-export declare function authorizeUiAdmin(request: Request, baseUrl: string, auth: InboundAuth[], purpose?: string, runtimeContext?: RuntimeExecutionContext): Promise<{
+export declare function authorizeUiAdmin(request: Request, baseUrl: string, auth: InboundAuth[], purpose?: string, runtimeContext?: RuntimeExecutionContext, identityConfig?: ConnectaIdentityConfig): Promise<{
     ok: true;
     userId: string;
+    principal?: IdentityReference;
+    principalKey?: string;
+    connectorIds: "all" | readonly string[];
 } | {
     ok: false;
     response: Response;
 }>;
+export declare function authorizeUiIdentity(request: Request, baseUrl: string, auth: InboundAuth[], purpose: string, runtimeContext?: RuntimeExecutionContext, identityConfig?: ConnectaIdentityConfig): Promise<Extract<Awaited<ReturnType<typeof authorize>>, {
+    ok: true;
+}> | {
+    ok: false;
+    response: Response;
+}>;
 export declare function isSameOrigin(request: Request, baseUrl: string): boolean;
 export declare function withSecurityHeaders(response: Response, requestUrl: URL, path: string): Response;

package/dist/routes/shared.js

@@ -1,3 +1,4 @@
+import { identityStorageKey, validIdentityReference } from "../identity.js";
 import { operatorPageForPath } from "../ui.js";
 export { msg } from "../errors.js";
 export function privateJson(body, init = {}) {
@@ -29,9 +30,21 @@ export function activityActorNamespace(provider) {
         ? provider.activityActorNamespace
         : undefined;
 }
-export async function authorize(request, baseUrl, auth, runtimeContext) {
+export async function authorize(request, baseUrl, auth, runtimeContext, identityConfig, partitionIdentity = true) {
     if (auth.length === 0) {
-        return { ok: true, actor: { kind: "anonymous" } };
+        const actor = { kind: "anonymous" };
+        const identity = { actor, interactive: false };
+        let connectorIds = "all";
+        try {
+            connectorIds = await identityConfig?.connectorAccess?.(identity) ?? "all";
+        }
+        catch {
+            return {
+                ok: false,
+                response: privateJson({ error: "identity access resolution failed" }, { status: 403 }),
+            };
+        }
+        return { ok: true, actor, identity, connectorIds, operator: false };
     }
     let lastResponse = null;
     for (const provider of auth) {
@@ -39,18 +52,56 @@ export async function authorize(request, baseUrl, auth, runtimeContext) {
         if (result.ok) {
             const subjectId = result.subjectId ?? result.userId;
             const actorNamespace = activityActorNamespace(provider);
+            const subject = subjectId && actorNamespace
+                ? { namespace: actorNamespace, id: subjectId }
+                : undefined;
+            const derivedPrincipal = result.userId && actorNamespace
+                ? { namespace: actorNamespace, id: result.userId }
+                : undefined;
+            const principal = validIdentityReference(result.principal)
+                ? result.principal
+                : derivedPrincipal;
+            const interactive = Boolean(result.userId && provider.interactiveOperator);
+            const actor = {
+                kind: provider.kind,
+                ...(subjectId ? { id: subjectId } : {}),
+                ...(subject ? { namespace: subject.namespace } : {}),
+            };
+            const identity = {
+                actor,
+                ...(subject ? { subject } : {}),
+                ...(principal ? { principal } : {}),
+                interactive,
+            };
+            let operator = interactive;
+            let connectorIds = "all";
+            try {
+                if (identityConfig?.operatorAccess) {
+                    operator = interactive && principal
+                        ? await identityConfig.operatorAccess(principal)
+                        : false;
+                }
+                connectorIds = await identityConfig?.connectorAccess?.(identity) ?? "all";
+            }
+            catch {
+                return {
+                    ok: false,
+                    response: privateJson({ error: "identity access resolution failed" }, { status: 403 }),
+                };
+            }
             return {
                 ok: true,
-                actor: {
-                    kind: provider.kind,
-                    ...(subjectId ? { id: subjectId } : {}),
-                    ...(subjectId && actorNamespace
-                        ? { namespace: actorNamespace }
-                        : {}),
-                },
-                ...(result.userId && provider.interactiveOperator
-                    ? { uiAdminEligible: true }
+                actor,
+                identity,
+                ...(subject && partitionIdentity
+                    ? { subjectKey: await identityStorageKey(subject) }
+                    : {}),
+                ...(principal && partitionIdentity
+                    ? { principalKey: await identityStorageKey(principal) }
                     : {}),
+                connectorIds,
+                operator,
+                ...(operator ? { uiAdminEligible: true } : {}),
             };
         }
         lastResponse = result.response;
@@ -67,7 +118,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext) {
             }),
     };
 }
-export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "credential management", runtimeContext) {
+export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "credential management", runtimeContext, identityConfig) {
     // Operator mutation is intentionally narrower than /mcp and /ui/data: only
     // an interactive provider may admit it. A static bearer token is useful
     // for headless tool calls but must not become a deployment-admin key.
@@ -76,30 +127,47 @@ export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "creden
     // Stopping at the first would make admission depend on config order: a failed gate or
     // missing user may simply mean a later provider is the one meant to admit.
     // The last refusal is returned if none do.
+    const authz = await authorizeUiIdentity(request, baseUrl, auth, purpose, runtimeContext, identityConfig);
+    if (!authz.ok)
+        return authz;
+    if (!authz.operator || !authz.actor.id) {
+        return {
+            ok: false,
+            response: privateJson({ error: `${purpose} requires operator access` }, { status: 403 }),
+        };
+    }
+    return {
+        ok: true,
+        userId: authz.identity.principal?.id ?? authz.actor.id,
+        ...(authz.identity.principal
+            ? { principal: authz.identity.principal }
+            : {}),
+        ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+        connectorIds: authz.connectorIds,
+    };
+}
+export async function authorizeUiIdentity(request, baseUrl, auth, purpose, runtimeContext, identityConfig) {
     const providers = auth.filter((candidate) => candidate.interactiveOperator);
     if (providers.length === 0) {
         return {
             ok: false,
-            response: privateJson({ error: `${purpose} requires interactive operator authentication` }, { status: 403 }),
+            response: privateJson({ error: `${purpose} requires interactive user authentication` }, { status: 403 }),
         };
     }
-    let lastResponse = null;
+    let lastResponse;
     for (const provider of providers) {
-        const result = await provider.authorize(request, baseUrl, runtimeContext);
-        if (!result.ok) {
-            lastResponse = result.response;
+        const authz = await authorize(request, baseUrl, [provider], runtimeContext, identityConfig);
+        if (!authz.ok) {
+            lastResponse = authz.response;
             continue;
         }
-        if (!result.userId) {
-            lastResponse = privateJson({ error: "authenticated user required" }, { status: 403 });
-            continue;
-        }
-        return { ok: true, userId: result.userId };
+        if (authz.identity.interactive)
+            return authz;
+        lastResponse = privateJson({ error: "authenticated user required" }, { status: 403 });
     }
     return {
         ok: false,
-        response: lastResponse ??
-            privateJson({ error: "forbidden" }, { status: 403 }),
+        response: lastResponse ?? privateJson({ error: `${purpose} requires interactive user authentication` }, { status: 403 }),
     };
 }
 export function isSameOrigin(request, baseUrl) {

package/dist/routes/ui.js

@@ -1,6 +1,6 @@
 import { CONNECTA_FAVICON_ICO } from "../favicon.js";
 import { buildUiData, CONNECTA_FAVICON_SVG, credentialManagementCapability, operatorPageForPath, renderUiHtml, } from "../ui.js";
-import { authorize, privateJson, } from "./shared.js";
+import { authorize, msg, privateJson, } from "./shared.js";
 /**
  * Headers that make an operator-supplied favicon body inert on this origin.
  * The SVG route is the sharp one: `image/svg+xml` is an *active* content type,
@@ -99,17 +99,35 @@ export async function routeUi(context) {
     }
     if (path !== "/ui/data")
         return null;
-    const authz = await authorize(request, baseUrl, opts.auth, runtimeContext);
+    const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity);
     if (!authz.ok)
         return authz.response;
+    let registry;
+    try {
+        registry = opts.registry.scoped({
+            connectorIds: authz.connectorIds,
+            ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
+            ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+        });
+    }
+    catch (error) {
+        return privateJson({ error: msg(error) }, { status: 403 });
+    }
     const eligibleOperator = authz.uiAdminEligible === true;
-    const credentialManagement = credentialManagementCapability({
-        eligibleOperator,
-        hasCredentialSlots: opts.registry
-            .listConnectors()
-            .some((connector) => Boolean(connector.credential)),
-        hasCredentialVault: Boolean(opts.credentialVault),
-    });
+    const interactiveManager = authz.identity.interactive;
+    const personalManager = Boolean(interactiveManager && authz.principalKey);
+    const visibleConnectors = registry.listConnectors();
+    const hasManageableCredentialSlot = visibleConnectors.some((connector) => Boolean(connector.credential) &&
+        (connector.authScope !== "personal" || personalManager));
+    const credentialManagement = interactiveManager && hasManageableCredentialSlot
+        ? opts.credentialVault
+            ? "available"
+            : "vault_not_configured"
+        : credentialManagementCapability({
+            eligibleOperator: interactiveManager,
+            hasCredentialSlots: visibleConnectors.some((connector) => Boolean(connector.credential)),
+            hasCredentialVault: Boolean(opts.credentialVault),
+        });
     // As with connector credentials, a Bearer-authenticated observer learns
     // only that an interactive operator is required, not whether this deployment has opted into
     // token issuance. Configuration topology is operator data.
@@ -118,9 +136,10 @@ export async function routeUi(context) {
         : opts.accessTokens
             ? "available"
             : "not_configured";
-    const data = await buildUiData(opts.registry, baseUrl, opts.serverInfo, 
-    // The static headless bearer may read connector health, but only a
-    // Clerk-authenticated operator receives credential metadata.
-    eligibleOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, defer, eligibleOperator, opts.discoveryConcurrency, accessTokenManagement);
+    const data = await buildUiData(registry, baseUrl, opts.serverInfo, 
+    // A static headless bearer may read connector health, but only an
+    // interactive human receives credential metadata for visible connectors.
+    interactiveManager ? opts.credentialVault : undefined, Boolean(opts.activity?.list) &&
+        (!opts.identity?.operatorAccess || eligibleOperator), credentialManagement, defer, interactiveManager, opts.discoveryConcurrency, accessTokenManagement, personalManager ? authz.principalKey : undefined);
     return privateJson(data);
 }

package/dist/types.d.ts

@@ -138,7 +138,7 @@ export interface ConnectorContext {
     /** Public base URL of this deployment (origin), used for OAuth callbacks. */
     baseUrl: string;
     /**
-     * Read-only access to this connector's operator-managed credential. Present
+     * Read-only access to this connector's human-managed credential. Present
      * only when the connector declares `credential` and the deployment configures
      * `credentials.encryptionKey`.
      */
@@ -208,6 +208,12 @@ export interface ConnectorStatus {
 /** The whole plugin contract — the one open seam. */
 export interface Connector {
     id: string;
+    /**
+     * Who owns this connector's downstream authentication. `shared` keeps one
+     * deployment-wide grant. `personal` isolates storage and credentials by the
+     * authenticated human principal. Defaults to `shared`.
+     */
+    authScope?: "shared" | "personal";
     /** Human-readable display name; the stable `id` remains the tool-address prefix. */
     title?: string;
     /** How call_tool wraps results. "mcp" passes the content array through; anything else is JSON-wrapped. */
@@ -240,7 +246,7 @@ export interface Connector {
      * configuration; no runtime registration or shared mutable copy exists.
      */
     usageGuide?: string | ConnectorUsageGuide;
-    /** Optional operator-managed credential slot rendered on /credentials. */
+    /** Optional human-managed credential slot rendered on /credentials. */
     credential?: ConnectorCredentialConfig;
     /** Optional server-side check used by /credentials' Test action. */
     testCredential?(value: string, ctx: ConnectorContext): Promise<CredentialTestResult>;
@@ -420,10 +426,30 @@ export type AuthResult = {
     ok: true;
     userId?: string;
     subjectId?: string;
+    /** Human owner represented by a non-interactive access credential. */
+    principal?: IdentityReference;
 } | {
     ok: false;
     response: Response;
 };
+/** Stable identity inside one configured authentication directory. */
+export interface IdentityReference {
+    namespace: string;
+    id: string;
+}
+/** Identity data passed to config-owned access resolvers. */
+export interface AuthenticatedIdentity {
+    actor: {
+        kind: string;
+        id?: string;
+        namespace?: string;
+    };
+    /** Any stable admitted caller, including service identities and tokens. */
+    subject?: IdentityReference;
+    /** Human owner of personal connector authentication. */
+    principal?: IdentityReference;
+    interactive: boolean;
+}
 /** Public browser-auth configuration exposed to connecta's status UI. */
 export type UiAuthConfig = {
     kind: "cloudflare-access";

package/dist/ui.d.ts

@@ -1,7 +1,7 @@
 import type { CredentialVault } from "./credentials.js";
 import { type DeferredWork } from "./connector-scope.js";
 import { type CredentialManagementCapability, type AccessTokenManagementCapability, type UiData } from "./operator-ui/model.js";
-import type { Registry } from "./registry.js";
+import type { RegistryView } from "./registry.js";
 import type { ConnectaBranding, UiAuthConfig } from "./types.js";
 export { filterUiConnectors, type AccessTokenManagementCapability, type CredentialManagementCapability, type UiConnector, type UiData, } from "./operator-ui/model.js";
 /** Connecta's default monochrome "C" mark. */
@@ -82,10 +82,10 @@ export declare function credentialManagementCapability(input: {
  * isolated: they surface status "error" with an empty tool list rather than
  * failing the whole payload.
  */
-export declare function buildUiData(registry: Registry, baseUrl: string, serverInfo: {
+export declare function buildUiData(registry: RegistryView, baseUrl: string, serverInfo: {
     name: string;
     version: string;
-}, credentialVault?: CredentialVault, activityEnabled?: boolean, credentialManagement?: CredentialManagementCapability, defer?: DeferredWork, oauthManagement?: boolean, discoveryConcurrency?: number, accessTokenManagement?: AccessTokenManagementCapability): Promise<UiData>;
+}, credentialVault?: CredentialVault, activityEnabled?: boolean, credentialManagement?: CredentialManagementCapability, defer?: DeferredWork, oauthManagement?: boolean, discoveryConcurrency?: number, accessTokenManagement?: AccessTokenManagementCapability, personalCredentialOwner?: string): Promise<UiData>;
 /**
  * Every operator page serves this same data-free shell. Connector, credential,
  * and activity data arrives only through the authenticated `/ui/*` APIs.

package/dist/ui.js

@@ -223,7 +223,7 @@ export function credentialManagementCapability(input) {
  */
 export async function buildUiData(registry, baseUrl, serverInfo, credentialVault, activityEnabled = false, credentialManagement = credentialVault
     ? "available"
-    : "requires_operator", defer, oauthManagement = false, discoveryConcurrency, accessTokenManagement = "not_configured") {
+    : "requires_operator", defer, oauthManagement = false, discoveryConcurrency, accessTokenManagement = "not_configured", personalCredentialOwner) {
     const requestScope = {};
     const connectorSet = registry.listConnectors();
     const concurrency = resolveDiscoveryConcurrency(discoveryConcurrency);
@@ -232,6 +232,9 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
         const status = drift
             ? { state: "auth_required", message: drift }
             : await registry.statusFor(c.id, baseUrl, requestScope);
+        if (status.authorizationUrl) {
+            await registry.bindOAuthHandoff(c.id, status.authorizationUrl);
+        }
         let tools = [];
         // `status()` on an unauthenticated remote connector starts OAuth and
         // stores its state + PKCE verifier. Probing listTools immediately
@@ -253,7 +256,10 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
             }
         }
         let credential;
-        if (c.credential && credentialVault) {
+        const mayManageAuth = c.authScope === "personal"
+            ? Boolean(personalCredentialOwner)
+            : oauthManagement;
+        if (c.credential && credentialVault && mayManageAuth) {
             // One rule, shared with the test route: only the hook matching the
             // declared credential shape can run, so the button is offered only
             // where a click can succeed (src/credentials.ts).
@@ -289,7 +295,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
                     : {}),
             };
             try {
-                const metadata = await credentialVault.metadata(c.id);
+                const metadata = await credentialVault.metadata(c.id, c.authScope === "personal" ? personalCredentialOwner : undefined);
                 const fields = credentialFields(metadata);
                 const shape = storedCredentialShape(c.credential, metadata?.fields ?? null);
                 credential = {
@@ -331,6 +337,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
         }
         return {
             id: c.id,
+            authScope: c.authScope ?? "shared",
             ...(c.title ? { title: c.title } : {}),
             ...(c.description !== undefined
                 ? { description: c.description }
@@ -350,7 +357,13 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
             ...(status.catalogAccess
                 ? { catalogAccess: status.catalogAccess }
                 : {}),
-            ...(c.disconnectAuth && c.startAuth ? { oauth: true } : {}),
+            ...(c.disconnectAuth &&
+                c.startAuth &&
+                (oauthManagement ||
+                    c.authScope === "personal" ||
+                    !personalCredentialOwner)
+                ? { oauth: true }
+                : {}),
             ...(credential ? { credential } : {}),
         };
     });
@@ -367,7 +380,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
         activityEnabled,
         credentialManagement,
         accessTokenManagement,
-        oauthManagement,
+        oauthManagement: oauthManagement || Boolean(personalCredentialOwner),
     };
 }
 function escapeHtmlAttr(value) {

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.21.1";
+export declare const CONNECTA_VERSION = "0.22.0";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.21.1";
+export const CONNECTA_VERSION = "0.22.0";

package/documentation/architecture.md

@@ -20,6 +20,23 @@ isolate or process —
 on Workers that means a lazy module-scope singleton, which is why both
 deployment shapes build it outside the request handler.
 
+An OAuth `remoteMcp()` connector also owns a runtime-local refresh completion
+gate. It coordinates credential mutation across concurrent request scopes but
+never shares their clients, transports, or responses, and never lets a follower
+cancel the owner. Every participant still awaits the refresh inside its own
+request lifetime; a cancelled follower leaves the shared owner untouched and
+removes only its own wait. The owner's request signal belongs to its token
+fetch. Cancelling that owner fails current joiners too because promoting one
+could replay a refresh token the authorization server already consumed.
+
+The coordinator retains the owner's abort signal only through one temporary
+listener on the exact active refresh. Save, failure, cancellation, or
+generation retirement removes it along with the map entry. It never retains a
+token response, client, or transport. If cancellation lands after a valid
+response while its credential write is still running, a generation-keyed
+identity marker rejects new owners until that exact write finishes. The marker
+contains no promise and generation retirement removes it.
+
 **Per request, and no longer.** The MCP server, its transport, downstream MCP
 clients, abort signals, and the connector scope a probe opens all belong to the
 request that created them. `Nothing request-bound survives a request` is an
@@ -53,7 +70,7 @@ read top to bottom.
 | 2 | `OPTIONS` | Each auth provider's `handleMetadata` gets a chance (CORS preflight for browser MCP clients); otherwise 204 with MCP CORS. |
 | 3 | `/.well-known/*` | Auth providers' `handleMetadata`, open. 404 when none handles it. |
 | 4 | `/health` | Open JSON: status, connector count, `serverInfo`, the configured executor's sanitized name when it has one, catalog-drift counts, admission snapshots, reserved route names, and `deployment` when `deploymentInfo` is set. Payload-free by construction, and it never joins the MCP queue. |
-| 5 | `/oauth/callback/<connectorId>` | Downstream-OAuth completion, open, `verifyState` before `finishAuth`. |
+| 5 | `/oauth/callback/<connectorId>` | Downstream-OAuth completion, open, `verifyState` before `finishAuth`. Personal flows first resolve the short-lived state hash to the principal partition. |
 | 6 | `/favicon.*`, `/ui` → `/`, the operator shells, `/ui/data` | The operator surface ([operator UI](./operator-ui.md)). The shells are open and data-free; `/ui/data` behind them is gated. Built-ins are matched before connector routes, so a connector cannot shadow a page. |
 | 7 | `/ui/activity` | Gated, plus the optional `activity.readGate`. `GET` only; 404 with no `activity.store.list`. |
 | 8 | `/mcp` | **Admission before auth**, then the auth gate, then a fresh MCP server. |
@@ -76,11 +93,15 @@ any one file and a reordering reads like a harmless refactor.
    before interactive providers. First `ok` admits; if all fail, the last provider's challenge
    response is returned. No providers configured means open — development
    only, and it warns at construction.
-3. **Refuse `?toolkit=`.** Toolkits were removed ([#178](https://github.com/zackbart/connecta/issues/178))
+3. **Derive the registry view.** Auth supplies a namespaced subject and, for a
+   human, a principal. `identity.connectorAccess` selects declared connector
+   ids. Personal connectors use the principal partition; result paging uses
+   the subject partition. No caller parameter selects either.
+4. **Refuse `?toolkit=`.** Caller-selected toolkits were removed ([#178](https://github.com/zackbart/connecta/issues/178))
    but the URLs naming them were handed out, so the parameter is a 404 rather
    than silently serving the full registry. Retiring a scoping boundary into
    fail-open is the one outcome worse than the 404.
-4. **Serve.** A fresh `McpServer` per request, the seven meta-tools registered
+5. **Serve.** A fresh `McpServer` per request, the seven meta-tools registered
    against the registry, the Apps shell resource registered (and
    `resources/list` deliberately answering with nothing), and the response
    handed back.
@@ -92,7 +113,7 @@ owns or hands out, and a change usually belongs in exactly one of them:
 
 | Module | Owns |
 | --- | --- |
-| `src/registry.ts` | The connector set, address resolution, catalog TTL/persistence/completeness, shared refresh single-flight, connector health, per-connector call limiters, and drift. Construction-time refusals live here. |
+| `src/registry.ts` | The connector set, identity-scoped views, personal storage partitions, address resolution, catalog TTL/persistence/completeness, refresh single-flight, connector health, per-connector call limiters, and drift. Construction-time refusals live here. |
 | `src/catalog-service.ts` | Request-local tool listing, search, and describe. It coalesces reads inside one request and opts agent reads into the runtime's deferred catalog channel when one exists. |
 | `src/invocation.ts` | One tool call: argument validation, call admission, per-attempt timeout, retry with the connector's own `Retry-After` honoured exactly or declined, result unwrapping, size capping, and the activity record. |
 | `src/catalog.ts` | Ranking, description summarizing, and the compact schema renderer discovery shows. |
@@ -167,10 +188,12 @@ src/
 
 ## Sharp edges
 
-- **The registry is shared; the request is not.** Anything you cache on the
-  registry is visible to every later request in that isolate. Anything you
-  cache per request dies with it. Putting a downstream client on the wrong side
-  of that line is the highest-severity mistake available here.
+- **The root registry is shared; identity views are partitioned.** Shared
+  connector caches are visible to later requests in the isolate. Personal
+  connectors use a bounded principal registry, and transient results use the
+  authenticated subject. Anything cached per request still dies with it.
+  Putting a downstream client or credential on the wrong side of those lines
+  is the highest-severity mistake available here.
 - **Route order is behavior.** Moving a built-in below the connector dispatch
   hands a connector the ability to shadow it. Moving a mutation route below the
   wildcard `OPTIONS` opts it into CORS preflight.