@zackbart/connecta 0.21.2 → 0.22.0

package/documentation/code-mode.md

@@ -785,8 +785,8 @@ The human message is unchanged; a mismatched frame is ordinary untyped prose.
 
 ## Changes from earlier code mode
 
-Six behaviors changed with this contract, matching the changelog's Unreleased
-entry. Programs that ran before still run.
+Six behaviors changed with this contract, matching the 0.10.0 release notes.
+Programs that ran before still run.
 
 - **Caught Connecta failures expose their classification** (`E1`, `X11`). Their human message and thrown semantics stay unchanged; `code`, `retryable`, and `details` are additive.
 

package/documentation/connectors.md

@@ -1,5 +1,18 @@
 # Connectors
 
+Every connector may set `authScope: "shared" | "personal"`. Shared is the
+default and keeps one deployment-wide downstream grant. Personal auth requires
+a stable human principal and partitions connector state, credentials, OAuth,
+catalogs, and observed shapes by that principal. Connector visibility is a
+separate deployment rule under `identity.connectorAccess`; hiding a connector
+does not change who owns its auth. See [shared and personal auth](./storage-and-credentials.md#shared-and-personal-auth).
+
+`authScope` partitions connecta-owned context, not arbitrary variables captured
+by connector code. A custom personal connector must read auth from
+`ctx.credential` or `ctx.storage`; a secret closed over by its handler remains
+shared JavaScript state. `remoteMcp()` rejects the equivalent mistake when
+literal headers are combined with personal scope.
+
 Connectors are the boundary between Connecta's fixed meta-tool surface and
 downstream capabilities. Prefer a prebuilt connection when Connecta maintains
 one for the provider. Use `api()` to define a deliberate HTTP API surface and

package/documentation/meta-tools.md

@@ -307,9 +307,10 @@ credential.
 
 The tool accepts no secret. `force` applies only to OAuth and may discard its
 stored grant before restarting consent. Static credential values are written
-only through the same-origin, Clerk-operator credential route. After OAuth
-consent or an operator update, retry the original operation; a static update is
-read from the vault on the next call and needs no redeploy.
+only through the same-origin interactive-user credential route, and only for a
+connector visible to that user. After OAuth consent or a human update, retry
+the original operation; a static update is read from the vault on the next call
+and needs no redeploy.
 
 ## Routing recovery
 

package/documentation/operations.md

@@ -84,6 +84,7 @@ optional.
 | `connectors` | — (required) | the connector set ([connectors](./connectors.md)) |
 | `executor` | — (required) | the sandbox `execute_code` runs in ([code mode](./code-mode.md#what-an-executor-must-implement)) |
 | `auth?` | none ⇒ open (dev only) | one `InboundAuth` or an array; bearer providers are checked before interactive providers ([inbound auth](./auth.md)) |
+| `identity?` | all connectors; every interactive human is an operator | `{ connectorAccess?, operatorAccess? }` derives the request's connector view and shared-auth authority from its authenticated identity ([principals](./auth.md#principals-visibility-and-operators)) |
 | `storage?` | `memoryStorage()` | the one state seam for catalogs, result paging, credentials, and access tokens ([storage](./storage-and-credentials.md)) |
 | `publicUrl?` | per-request origin | public base URL; an HTTPS value also redirects inbound HTTP |
 | `logger?` | `console`, prefixed `[connecta]` | `{ debug, info, warn, error }` |
@@ -247,6 +248,7 @@ in.
 | `executor-admission.test.ts` | the portable bounded FIFO both pools use: active and queue ceilings, stable retryable overload, queue timeout, cancellation removal, idempotent release, shutdown |
 | `guarded-fetch.test.ts` | the guarded transport — construction, request building, destination confinement, and response handling |
 | `guest-api-contract.test.ts` | the shared guest contract on the Dynamic Worker, including caught call, typed inline describe recovery, discovery, utility, batch, and budget failure codes; plus the real authority boundary — local `data:` fetch, denied egress, unresolved DNS, empty environment paths, unavailable filesystem/HTTP builtins, and present runtime globals |
+| `identity-scope.test.ts` | identity-derived connector visibility, personal credential isolation, shared-auth operator control, and personal OAuth callback ownership |
 | `linear-provider.test.ts` | the Linear proxy's construction, guide, plan-aware catalog superset, and current workspace, template, and issue-sharing classifications |
 | `meta-tools-call.test.ts` | registry-backed calls: structured errors, truncation and `get_result`, per-connector result bounds, JSON representation failures, MCP content bounds, and offset alignment |
 | `meta-tools-search.test.ts` | registry-backed discovery: bounded search with page and address maxima, compact and JSON schemas with constraints, typed describe recovery and suggestions, and structured-result compatibility |
@@ -280,7 +282,7 @@ justification for *not* re-running it in workerd, so "it was easier" is not one.
 
 | Suite | Covers | Why Node |
 | --- | --- | --- |
-| `deployment-shapes.test.ts` | the Worker as the only example with a loader-only sandbox, one Node template that is also its own container, the same source running locally and in the container, the Node template's pinned esbuild install-script approval, the full operator surface in both, a template that cannot start on its own `.env.example`, a Worker README naming every optional peer its entrypoint imports, and the initializer's `.gitignore` staying in step | walks the template and example trees with Node filesystem APIs |
+| `deployment-shapes.test.ts` | the Worker as the only example with a loader-only sandbox, its agent instructions and setup guide pinning Claude and both ChatGPT Managed OAuth callback forms, one Node template that is also its own container, the same source running locally and in the container, the Node template's pinned esbuild install-script approval, the full operator surface in both, a template that cannot start on its own `.env.example`, a Worker README naming every optional peer its entrypoint imports, and the initializer's `.gitignore` staying in step | walks the template and example trees with Node filesystem APIs |
 | `doc-links.test.ts` | the documentation checker itself — local file and fragment resolution, repository URLs resolved back to the checkout, duplicate heading slugs, fenced-code exclusion, and useful failures | spawns the Node checker against filesystem fixtures |
 | `doctor-cli.test.ts` | `connecta doctor`'s executor line and credentials end to end — the sandbox the deployment reports is the one named, an unidentifiable executor gets an executor-neutral line, a hostile name is bounded, and a complete Cloudflare Access service-token pair is accepted while a partial pair is refused | spawns the CLI against a Node HTTP deployment over real sockets |
 | `drift-check.test.ts` | the maintainer drift checker — hosted-provider credential framing, recorded touched endpoints, a quiet revision bump, clear failures for an unavailable spec/manifest/credential, `$ref` traversal, and one well-formed row per endpoint | spawns the Node checker against filesystem fixtures |

package/documentation/operator-ui.md

@@ -5,10 +5,10 @@ the authentication material behind it. It is a small Preact app compiled by the
 repository's own esbuild step and inlined into a data-free server shell.
 
 Read [`ethos.md`](../ethos.md) first. The boundary this subsystem lives inside
-is the operator row in its decisions table: **operator routes may manage
-authentication material for capabilities declared in deployment configuration,
-and may not change the connector set, the tool catalog or annotations, requested
-OAuth scopes, admission policy, authorization rules, or caller tool scope.**
+is the human-management invariant: **members may manage authentication material
+for every connector their code-derived view includes, operators may also manage
+deployment tokens and global activity, and neither may change the connector set, tool catalog,
+annotations, requested OAuth scopes, admission policy, or identity rules.**
 `test/operator-boundary.test.ts` proves it after every mutation route.
 
 Both deployment shapes ship the whole feature set behind it, because pages for
@@ -52,6 +52,15 @@ server reads the resulting runtime identity. Sign out navigates to
 `/cdn-cgi/access/logout`. Mutations still require an exact same-origin
 `Origin`; an ambient cookie does not weaken the CSRF boundary.
 
+The shell is shared by members and operators. `/ui/data` uses the same
+identity-scoped registry view as `/mcp`, so it cannot list a connector the
+current caller cannot discover. A member sees credential and OAuth controls for
+every visible connector. Personal actions resolve to that member's principal
+partition; shared actions change the deployment-wide grant. The access-token
+and global activity pages require `identity.operatorAccess`. Existing
+deployments that omit that resolver keep every interactive human as an
+operator.
+
 This runtime selection is the Clerk migration seam. A deployment may contain
 both providers: before Worker-level Access is attached, the data-free shell
 selects Clerk; after Access supplies `ctx.access`, it selects ambient auth. That

package/documentation/request-admission.md

@@ -49,7 +49,8 @@ which is also why `/health` always has a code-admission shape to report.
 
 The request pool is global FIFO across identities. It is a capacity boundary,
 not tenant fairness: one busy caller can occupy it. Per-tenant fairness needs a
-policy above connecta, and one deployment serves one audience anyway
+policy above connecta, and one deployment still serves one tenant even when
+identity rules give its principals different connector views
 ([`ethos.md`](../ethos.md)), so a global queue is not pretending to supply
 something it does not.
 

package/documentation/storage-and-credentials.md

@@ -6,7 +6,7 @@ token is an independent record rather than one shared, race-prone manifest.
 The built-in memory and file adapters implement it, as does the Cloudflare KV
 example.
 
-Connectors may declare an operator-managed `credential` slot. When
+Connectors may declare a human-managed `credential` slot. When
 `credentials.encryptionKey` is configured, Connecta encrypts values in the
 deployment storage and exposes read-only access only through that connector's
 `ctx.credential`. Values, masked values, call arguments, and raw errors never
@@ -27,13 +27,40 @@ Credential mutation is intentionally narrower than MCP access:
 
 - a static bearer may call tools and receive the operator handoff, but it
   cannot write credentials;
-- only an admitted Clerk user may use the same-origin credential mutation
-  routes; and
+- an admitted interactive human may mutate credentials for every visible
+  connector: their own partition for personal auth, or the deployment-wide
+  value for shared auth; and
 - saving, replacing, testing, or removing a value never returns that value.
 
-The vault is read for each call. Once an operator saves a replacement,
+The vault is read for each call. Once a signed-in human saves a replacement,
 the agent can retry immediately without restarting or redeploying Connecta.
 
+## Shared and personal auth
+
+Connector auth defaults to `authScope: "shared"`. Its credential, OAuth state,
+tokens, catalog cache, and connector storage belong to the deployment. Set
+`authScope: "personal"` when every human principal needs a separate downstream
+account:
+
+```ts
+remoteMcp("linear", {
+  url: "https://mcp.linear.app/mcp",
+  authScope: "personal",
+  auth: { type: "oauth" },
+});
+```
+
+Personal connectors disappear from a request that has no stable human
+principal. For a principal that can see one, connecta partitions connector
+storage, encrypted vault records, catalog caches, OAuth generations, and
+observed result shapes under an opaque SHA-256 identity key. Results used by
+`get_result` are partitioned by the authenticated subject, so one token cannot
+page another token's call even when both tokens belong to the same principal.
+
+Literal `auth: { type: "headers" }` cannot be personal because its secret lives
+in deployment code. `remoteMcp()` refuses that combination at construction.
+Use operator-managed credential auth or OAuth instead.
+
 ## A remote MCP connector's static credential
 
 `remoteMcp()` accepts a third auth shape beside OAuth and literal headers:
@@ -97,6 +124,17 @@ Registration and token envelopes are bound to the validated authorization
 server `issuer`. An unbound pre-0.9 envelope is upgraded in place on its first
 issuer-aware read, preserving the existing grant.
 
+For personal OAuth, the authorization handoff also stores a 15-minute mapping
+from a SHA-256 digest of `state` to the principal partition. The public callback
+uses that mapping before it verifies state or exchanges the code. Neither the
+browser nor a callback parameter can select a principal. The callback deletes
+the mapping before it exchanges the code, so a second callback cannot replay
+the principal handoff in strongly consistent storage. Cloudflare KV deletion
+is eventually consistent, so handoff consumption there is best-effort across
+PoPs; the downstream authorization code remains single-use. If the callback
+request also carries an interactive identity, Connecta refuses it when that
+principal did not start the flow.
+
 If later discovery resolves a different issuer, Connecta does not send the old
 client identifier or tokens to it. The provider publishes a new generation
 epoch, makes every older credential namespace unreadable, cleans up the retired

package/documentation/upgrading.md

@@ -57,7 +57,7 @@ exist so far:
 | --- | --- | --- |
 | **pre-template** | before 0.10.2 | no `connecta init` existed; hand-written, or copied from the retired `examples/node` |
 | **A** | 0.10.2 – 0.15.1 | `.env.example`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`, `README.md`, `package.json`, `src/index.ts`, `tsconfig.json` |
-| **B** | 0.16.0 – 0.21.2 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
+| **B** | 0.16.0 – 0.22.0 | adds `.dockerignore`, `Dockerfile`, `docker-compose.yml`, and `src/file-activity.ts`; `src/index.ts` grows the four commented operator blocks; `.env.example` ships `CONNECTA_TOKEN=` empty |
 
 Generation A is a decade in template years and identifying it precisely does
 not matter, because you are about to reconstruct it exactly rather than guess
@@ -106,7 +106,7 @@ know what to preserve, once to know what to re-verify at the end.
 ### Bump the pin and install
 
 ```sh
-npm pkg set dependencies.@zackbart/connecta=0.21.2
+npm pkg set dependencies.@zackbart/connecta=0.22.0
 npm install
 ```
 
@@ -130,7 +130,7 @@ Generate the *current* template beside the base you already made, into the same
 `$SCRATCH`:
 
 ```sh
-(cd "$SCRATCH" && npx @zackbart/connecta@0.21.2 init current)
+(cd "$SCRATCH" && npx @zackbart/connecta@0.22.0 init current)
 ```
 
 You now have a three-way merge with a real base: `$SCRATCH/base` is what this
@@ -186,7 +186,7 @@ A deployment older than 0.10.2 has no base to diff against. Do not try to
 manufacture one. Instead:
 
 1. `SCRATCH=$(mktemp -d)`, then
-   `(cd "$SCRATCH" && npx @zackbart/connecta@0.21.2 init current)` — there is no
+   `(cd "$SCRATCH" && npx @zackbart/connecta@0.22.0 init current)` — there is no
    `base` leg here, only the current template to read from.
 2. Copy `$SCRATCH/current` into the deployment file by file, **skipping
    `src/index.ts`**.
@@ -207,6 +207,22 @@ first, so cross them bottom-up: start at the oldest one still above this
 deployment's pin and work back up the page, because each boundary assumes the
 older ones are already done.
 
+### 0.21.2 → 0.22.0
+
+Connector and user policy remain config-as-code. If `identity.connectorAccess`
+is configured, every interactive human may now manage the authentication of
+each connector that resolver makes visible. A personal connector changes only
+that principal's partition; a shared connector changes the deployment-wide
+grant. Keep shared connectors out of a member's view, or change them to
+`authScope: "personal"`, when that member must not rotate the shared grant.
+`identity.operatorAccess` continues to govern deployment access tokens and
+global activity.
+
+Paged results also move under the authenticated subject's storage partition.
+Finish any important in-flight `get_result` sequence before upgrading; its old
+result id is not readable from the new partition after deployment. No persisted
+connector catalog or credential migration is required.
+
 ### 0.20.0 → 0.21.2
 
 0.21.2 adds no deployment migration beyond 0.21.0. The boundary is additive
@@ -244,6 +260,21 @@ For a Worker currently using Clerk, keep rollback live through the cutover:
    tag>" }`, not a hostname application for the `workers.dev` URL: the latter
    gates traffic but does not provide `ctx.access`. Create an Access service
    token and a **Service Auth** policy for doctor and fully unattended clients.
+   In the application's Managed OAuth settings, enable Dynamic Client
+   Registration and add these three **Allowed redirect URIs**:
+
+   ```text
+   https://claude.ai/api/mcp/auth_callback
+   https://chatgpt.com/connector_platform_oauth_redirect
+   https://chatgpt.com/connector/oauth/*
+   ```
+
+   They map to
+   `oauth_configuration.dynamic_client_registration.allowed_uris` in the
+   Access API, not to the identity policy. The two ChatGPT entries cover its
+   stable and callback-id forms. An empty list fails client registration only
+   after discovery, so do not treat a working `/.well-known/*` response as
+   proof that this step is complete.
    Do not create a bypass for `/.well-known/*`; Managed OAuth owns that
    discovery surface.
 

package/ethos.md

@@ -8,8 +8,8 @@ preserve. A contradiction needs a design decision, not a drive-by edit.
 - **One MCP endpoint, one programmable surface.** Every integration you chose
   sits behind a capability catalog that agents reach by writing JavaScript,
   ringed by a few explicit tools for the boundaries code must not cross.
-- **A deployment is a small config-as-code file.** Changing what agents can
-  reach is an edit and a redeploy. One deployment, one tenant, one audience.
+- **A deployment is config-as-code.** One tenant and connector set; principals
+  receive config-derived views.
 - **Curated when available, open when not.** Prefer a maintained prebuilt
   connection; `remoteMcp()` and `api()` stay first-class for everything else.
   Every path yields the same `Connector` with the same rules.
@@ -30,8 +30,8 @@ preserve. A contradiction needs a design decision, not a drive-by edit.
 - **Not a platform.** No runtime registration, admin-editable capability,
   policy engine, approvals, or pauses.
 - **Not a schema ingester.** No OpenAPI or GraphQL → tools.
-- **Not multi-tenant.** No account model or per-user credential store; scope
-  stays connector-level, and ambiguity stops rather than guesses.
+- **Not multi-tenant.** No accounts, groups, or sessions. Inbound auth owns
+  identity; personal state stays within one tenant.
 - **Not stateful.** No protocol sessions, no server push; scope resolves per
   request.
 - **Not a nanny.** Credentials fail loudly at use; nothing probes one.
@@ -47,7 +47,7 @@ CHANGELOG, not here.
 | Decision | Verdict | Why |
 | --- | --- | --- |
 | OpenAPI / GraphQL ingestion | refused | the disease is a tool nobody chose — a document authored it; hand-written literals, even through a shared factory, are still authorship |
-| Multi-tenancy / account model | refused | one deployment per tenant; deploy again |
+| Multi-tenancy / account model | refused | one deployment per tenant; inbound auth owns identity |
 | Policy engine, approvals, pauses | refused | the host asks the human; connecta only annotates |
 | Runtime connector registration | refused | config-as-code is the security model |
 | Provider registry / marketplace | refused | prebuilt connections are imports; discovery happens in docs ([#297](https://github.com/zackbart/connecta/issues/297)) |
@@ -67,7 +67,7 @@ CHANGELOG, not here.
 | Legacy embedded `UIResource` delivery | refused | superseded upstream, rendered by no client we face ([#266](https://github.com/zackbart/connecta/issues/266)) |
 | Effect as the core effect system | refused | −4% of the core for +75 KB gzip and a second async paradigm; re-measure at v4 stable ([#470](https://github.com/zackbart/connecta/issues/470)) |
 | Shared bounded queue under both admission controllers | refused | built and measured −17 lines for a hook-parameterised abstraction ([#453](https://github.com/zackbart/connecta/issues/453)) |
-| Toolkits (scoped views) | removed | deploy per audience ([#178](https://github.com/zackbart/connecta/issues/178)) |
+| Caller-selected toolkits | removed | only config may derive an identity's connector view ([#178](https://github.com/zackbart/connecta/issues/178)) |
 | Proactive credential liveness | removed | fail-at-use is enough ([#179](https://github.com/zackbart/connecta/issues/179)) |
 | Classic (executor-free) surface | removed | an executor is mandatory ([#273](https://github.com/zackbart/connecta/issues/273)) |
 | Per-result lexical query coverage | removed | did not earn its response bytes in a precommitted gate ([#323](https://github.com/zackbart/connecta/issues/323)) |
@@ -91,10 +91,10 @@ Breaking one is a design change wearing a disguise.
 - **A downstream catalog is complete or it is a failure.** A partial catalog is never cached, persisted, or served.
 - **Activity is payload-free by construction.** The event type has nowhere to put arguments, results, code, or raw errors.
 - **An observed shape is never a declaration.** Names and broad types only, labeled, and gone behind any declared schema.
-- **Credentials never leave the host.** Encrypted at rest, readable only by the owning connector, rendered by nothing.
+- **Credentials never leave the host.** Encrypted at rest, readable only by the owning connector and, for personal auth, its owning principal; rendered by nothing.
 - **Import-graph purity.** Nothing reachable from the root entry imports a `node:` builtin.
 - **The published surface is a boundary.** Heavyweight or platform-bound code goes behind an optional-peer subpath.
-- **Operator routes manage authentication material, never declared capability.** A downstream catalog is discovered, not declared.
+- **Human routes manage auth, never capability.** Signed-in humans manage auth for visible connectors; operators also manage tokens and global activity.
 - **Structural mistakes throw at construction.** Booting into the wrong shape is worse than not booting.
 
 Connecta began as a radical simplification of

package/examples/worker/AGENTS.md

@@ -0,0 +1,44 @@
+# Working on this Connecta Worker deployment
+
+This repository is deployment configuration, not a copy of Connecta itself.
+
+- Edit `src/index.ts` for connectors, authentication, storage, and public URL.
+- Keep `cloudflareAccessAuth()` as the inbound auth provider. Cloudflare Access
+  authenticates the request before the Worker runs; do not add JWT parsing or a
+  second Worker-side identity gate.
+- Attach Access to the Worker itself, not only its hostname. Enable Managed
+  OAuth and Dynamic Client Registration on that Access application.
+- Managed OAuth's **Allowed redirect URIs** must contain all three entries
+  below. This is application configuration under
+  `oauth_configuration.dynamic_client_registration.allowed_uris`, not an
+  Access Allow policy:
+
+  ```text
+  https://claude.ai/api/mcp/auth_callback
+  https://chatgpt.com/connector_platform_oauth_redirect
+  https://chatgpt.com/connector/oauth/*
+  ```
+
+  The first is Claude's hosted MCP callback. The two ChatGPT entries cover its
+  stable callback and its callback-id form. An empty allowlist lets Access
+  discovery work but makes client registration fail with `redirect_uri` not
+  allowed. If a client presents a different callback, copy that exact URI from
+  its registration attempt and add the narrowest matching entry rather than
+  broadening the allowlist to an entire origin.
+- Keep `new DynamicWorkerExecutor({ loader: env.LOADER })` loader-only. Do not
+  add bindings, modules, or outbound access to generated code.
+- Keep credentials in Worker secrets. Never commit credential values, Access
+  service-token secrets, or `CREDENTIAL_ENCRYPTION_KEY`.
+- Add application logic only inside deliberate `api()` connector handlers.
+  Do not copy or modify Connecta package internals here.
+- Prefer `api()` when the agent must see an exact reviewed capability set;
+  `remoteMcp()` follows the downstream server's evolving tool catalog.
+- Use Access service credentials for `connecta doctor` and unattended clients.
+  A `cta_` token or static Connecta bearer cannot cross the Access edge alone.
+- Run the repository's `npm run check:examples` after configuration changes.
+  After deployment, connect both Claude and ChatGPT to `<PUBLIC_URL>/mcp` and
+  complete their browser authorization flows before calling setup complete.
+
+Do not add alternate entrypoints, policy layers, generated connector catalogs,
+or runtime connector registration. Keep the deployment small enough to review
+as configuration.

package/examples/worker/README.md

@@ -46,15 +46,56 @@ wrangler deploy
 Cloudflare Access to the Worker itself (the API destination type is `worker`,
 not a hostname application) and choose the account, email-domain, or
 advanced Zero Trust policy that owns admission. Enable **Managed OAuth** on
-that Access application for interactive MCP clients. Access then serves OAuth
-discovery and turns the client's opaque token into the trusted `ctx.access`
-identity connecta reads. A cron job or CI client uses an Access service token
-instead.
+that Access application for interactive MCP clients, turn on Dynamic Client
+Registration, and add these three entries under **Allowed redirect URIs**:
+
+```text
+https://claude.ai/api/mcp/auth_callback
+https://chatgpt.com/connector_platform_oauth_redirect
+https://chatgpt.com/connector/oauth/*
+```
+
+The Claude entry is its fixed hosted-MCP callback. ChatGPT may register either
+its stable callback or a callback-id URL, so both forms are intentional. These
+are Managed OAuth application settings, represented by
+`oauth_configuration.dynamic_client_registration.allowed_uris` in the Access
+API; they do not belong in the Access Allow policy that decides who may sign
+in. Leaving the list empty is a footgun: discovery still works, then Dynamic
+Client Registration fails because the callback is not allowed. If either
+client presents a new redirect URI, copy that exact value from the registration
+attempt and add the narrowest matching entry rather than allowing its entire
+origin.
+
+Access then serves OAuth discovery and turns the client's opaque token into the
+trusted `ctx.access` identity connecta reads. A cron job or CI client uses an
+Access service token instead.
+
+Through the API, the relevant part of the application is:
+
+```json
+{
+  "oauth_configuration": {
+    "enabled": true,
+    "dynamic_client_registration": {
+      "enabled": true,
+      "allowed_uris": [
+        "https://claude.ai/api/mcp/auth_callback",
+        "https://chatgpt.com/connector_platform_oauth_redirect",
+        "https://chatgpt.com/connector/oauth/*"
+      ]
+    }
+  }
+}
+```
 
 Cloudflare's [Worker Access guide](https://developers.cloudflare.com/workers/configuration/cloudflare-access/)
 owns the dashboard/API steps; its [Managed OAuth guide](https://developers.cloudflare.com/cloudflare-one/access-controls/applications/http-apps/managed-oauth/)
 owns client registration, redirect allowlists, and token lifetimes.
 
+[`AGENTS.md`](./AGENTS.md) repeats the callback invariant for coding agents
+working in a copied deployment. Do not remove the entries there when changing
+the Access policy or application.
+
 The checked-in `access.dev` block gives `wrangler dev` a local operator
 identity. Remove the block to test the missing-Access refusal. It has no effect
 on a deployed Worker's production identity.
@@ -75,13 +116,9 @@ connecta's manifest but never installed with it, and published as
 one outside and npm says so at install time instead of leaving a Worker to
 discover the skew in production ([#376](https://github.com/zackbart/connecta/issues/376)).
 
-`cloudflareAccessAuth()` has no dependency of its own. A deployment keeping
-Clerk for rollback still installs `@clerk/backend` and keeps the commented
-provider shape in `src/index.ts` until the migration is verified.
-
-```sh
-npm install @clerk/backend   # migration window only
-```
+`cloudflareAccessAuth()` has no dependency of its own. This Worker example has
+no Clerk import, secret, package, or fallback provider. Docker deployments keep
+the Clerk path in the Node template.
 
 Then point an MCP client at `<PUBLIC_URL>/mcp`, and open `<PUBLIC_URL>/` for
 Connections. Credentials is at `/credentials`, named MCP access tokens are at
@@ -96,9 +133,21 @@ as deployed; the fourth needs a database, so it is commented in place.
 
 **Operator sign-in** is the `cloudflareAccessAuth()` entry in `src/index.ts`.
 Access authenticates before the Worker runs. A human Access identity can use
-MCP and operator pages; a service-token identity can use MCP but cannot write a
-credential, run downstream OAuth, or issue a connecta token. Narrow admission
-in the Access policy rather than repeating email domains or groups in code.
+MCP and human-management pages; a service-token identity can use MCP but cannot
+write a credential, run downstream OAuth, or issue a connecta token. Cloudflare
+still owns the outer application admission policy, but Connecta's user roster,
+connector access, and deployment roles stay in `src/index.ts`.
+
+**Several users** need no second auth system or Connecta account dashboard.
+Uncomment the `identity` block in `src/index.ts` to derive connector ids and
+deployment-operator membership from the Access principal. Connectors remain
+visible to everyone and every human remains an operator when that block is
+absent. A signed-in human may edit auth for every connector their view includes.
+Add `authScope: "personal"` when each user should connect a different downstream
+account; leave it shared only when any user with connector access may rotate the
+deployment-wide grant. Static headers stay shared because their value lives in
+deployment configuration. See [inbound identity](../../documentation/auth.md#principals-visibility-and-operators)
+for the resolver contract.
 
 **The credential vault** is `credentials: { encryptionKey: … }`, backed by the
 same KV namespace as everything else and encrypted with the

package/examples/worker/src/index.ts

@@ -17,15 +17,17 @@
  *   1. `npm install` in the connecta package root (../../ from here) so the
  *      package import and wrangler resolve. A copy in its own repository
  *      installs `@zackbart/connecta @cloudflare/codemode` instead. Codemode is
- *      an optional peer; a migrating deployment also keeps `@clerk/backend`
- *      until it removes the commented rollback provider below.
+ *      an optional peer.
  *   2. Create a KV namespace and put its id in wrangler.jsonc under `kv_namespaces`.
  *   3. Set secrets:
  *        wrangler secret put DOWNSTREAM_TOKEN
  *        wrangler secret put CREDENTIAL_ENCRYPTION_KEY
  *      and PUBLIC_URL as a plain var in wrangler.jsonc.
- *   4. Attach Cloudflare Access to this Worker. Enable Managed OAuth on the
- *      Access application for interactive MCP clients.
+ *   4. Attach Cloudflare Access to this Worker. Enable Managed OAuth and
+ *      Dynamic Client Registration. Its Allowed redirect URIs must include
+ *      Claude's https://claude.ai/api/mcp/auth_callback plus ChatGPT's
+ *      https://chatgpt.com/connector_platform_oauth_redirect and
+ *      https://chatgpt.com/connector/oauth/* forms (see ../AGENTS.md).
  *   5. Use the Workers Paid plan required by the `worker_loaders` binding.
  *   6. `wrangler deploy` from this folder (examples/worker), where wrangler.jsonc
  *      lives. Point your MCP client at `<PUBLIC_URL>/mcp`.
@@ -37,17 +39,12 @@ import {
   remoteMcp,
 } from "@zackbart/connecta";
 import { cloudflareAccessAuth } from "@zackbart/connecta/auth/cloudflare-access";
-// Rollback for a deployment migrating from Clerk:
-// import { clerkAuth } from "@zackbart/connecta/auth/clerk";
 import { cloudflareKvStorage } from "./cloudflare-kv.js";
 // Activity history, off by default because it needs a D1 database.
 // import { d1ActivityStore } from "./d1-activity.js";
 
 interface Env {
   CONNECTA_KV: KVNamespace;
-  // Keep these during a Clerk migration until Access has been verified:
-  // CLERK_PUBLISHABLE_KEY: string;
-  // CLERK_SECRET_KEY: string;
   /**
    * Base64 32-byte AES key encrypting operator-managed credentials in KV.
    * Unset means no vault: /credentials stays read-only and connecta says so at
@@ -75,20 +72,24 @@ function build(env: Env) {
       // operator pages; a service token may use MCP but cannot mutate operator
       // state. Neither path asks connecta to parse a JWT.
       cloudflareAccessAuth(),
-      // Leave the previous Clerk provider below this entry during migration.
-      // It is a rollback path until Worker-level Access is detached; Access
-      // itself decides whether a request reaches this array.
-      // clerkAuth({
-      //   publishableKey: env.CLERK_PUBLISHABLE_KEY,
-      //   secretKey: env.CLERK_SECRET_KEY,
-      //   publicUrl: env.PUBLIC_URL,
-      //   allowedDomains: ["acme.com"],
-      // }),
     ],
-    // Connectors that declare a `credential` slot become editable at
-    // /credentials, encrypted with this key before anything reaches KV. A
-    // saved replacement takes effect on the next call — no redeploy, and no
-    // liveness probe: credentials fail at use.
+    // Optional code-owned roster. Access proves the identity; connecta derives
+    // connector visibility and deployment-operator status from the stable id
+    // it supplies. A signed-in human may manage auth for every connector this
+    // view includes. Omit the block to keep every connector visible and every
+    // human a deployment operator.
+    // identity: {
+    //   connectorAccess: ({ principal }) =>
+    //     principal?.id === "ACCESS_USER_UUID"
+    //       ? ["notion", "echo"]
+    //       : ["echo"],
+    //   operatorAccess: ({ id }) => id === "ACCESS_USER_UUID",
+    // },
+    // Connectors that declare a `credential` slot become editable by every
+    // signed-in human who can see that connector at /credentials, encrypted
+    // with this key before anything reaches KV. A saved replacement takes
+    // effect on the next call — no redeploy, and no liveness probe:
+    // credentials fail at use.
     //
     // The key is the vault, not the page: /credentials is a list of connector
     // slots, so it stays hidden until a connector declares one. Neither
@@ -123,6 +124,9 @@ function build(env: Env) {
           //   type: "credential",
           //   credential: { label: "Notion internal integration token" },
         },
+        // Use `authScope: "personal"` with OAuth or credential auth when each
+        // Access user connects their own downstream account. Literal headers
+        // are deployment-owned and cannot be personal.
       }),
       api("echo", {
         description: "Echo — text transforms",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.21.2",
+  "version": "0.22.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of seven meta-tools.",

package/templates/node/README.md

@@ -68,6 +68,13 @@ import, the two `process.env.CLERK_*` reads, and the `clerkAuth({ … })` entry
 Applications → DCR) if MCP clients should sign in through it too, and set
 `PUBLIC_URL` first — Clerk redirects back to it.
 
+Clerk remains the identity provider when several people share this Docker
+deployment. Uncomment the `identity` block in `src/index.ts` to give each Clerk
+principal a config-derived connector view and to choose operators. Add
+`authScope: "personal"` to a connector when each person should supply their own
+credential or finish their own downstream OAuth flow. Without those options,
+all connectors and auth stay shared exactly as before.
+
 **2. Credential vault.** Uncomment `credentials` and set
 `CONNECTA_CREDENTIAL_KEY` to a base64 32-byte AES key:
 

package/templates/node/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.21.2",
+    "@zackbart/connecta": "0.22.0",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {

package/templates/node/src/index.ts

@@ -42,10 +42,10 @@ const stateFile = process.env.CONNECTA_STATE_FILE || "./.connecta-state.json";
 const publicUrl = process.env.PUBLIC_URL || `http://localhost:${port}`;
 
 // Operator sign-in. A bearer token is a client key: it may call tools and read
-// connector status, but only a Clerk-authenticated operator may write a
-// credential or issue an access token. Without this block the operator pages
-// still render — an operator pastes the bearer to read them — and Credentials
-// and Tokens stay read-only.
+// connector status, but only a Clerk-authenticated human may write a visible
+// connector's credential, and only an operator may issue an access token.
+// Without this block the operator pages still render — an operator pastes the
+// bearer to read them — and Credentials and Tokens stay read-only.
 // const clerkPublishableKey = process.env.CLERK_PUBLISHABLE_KEY;
 // const clerkSecretKey = process.env.CLERK_SECRET_KEY;
 // if (!clerkPublishableKey || !clerkSecretKey) {
@@ -67,6 +67,15 @@ const connecta = createConnecta({
     //   // allowedDomains: ["acme.com"],
     // }),
   ],
+  // Optional member/operator split for Clerk-backed Docker deployments.
+  // Connector access is derived from the authenticated identity and cannot be
+  // selected by an MCP argument. Omit this block for the legacy all-visible,
+  // all-interactive-users-are-operators behavior.
+  // identity: {
+  //   connectorAccess: ({ principal }) =>
+  //     principal?.id === "user_admin" ? "all" : ["time"],
+  //   operatorAccess: ({ id }) => id === "user_admin",
+  // },
   publicUrl,
   // Required: model-written programs run in a bounded QuickJS child.
   executor: quickJsExecutor(),