@zackbart/connecta 0.21.2 → 0.22.1

package/CHANGELOG.md

@@ -2,6 +2,75 @@
 
 All notable changes to this package are documented here.
 
+## 0.22.1 — 2026-08-31
+
+This patch adds a maintained Vercel connection over the public REST API. It is
+a new opt-in provider subpath: existing imports, connector declarations,
+credentials, and deployment behavior do not change. Deployments that do not
+import the Vercel provider can ignore this release.
+
+### Added
+
+- **Maintained Vercel REST connection.** `@zackbart/connecta/providers/vercel`
+  ships 18 projected project, deployment, log, domain, environment-variable,
+  and lifecycle tools plus separate GET, JSON-mutation, and upload hatches. It
+  uses one operator-managed access token, defaults account calls to an optional
+  team, never decrypts environment values in named reads, and adds no Vercel
+  SDK dependency.
+
+## 0.22.0 — 2026-08-31
+
+This release lets one deployment serve several authenticated people without
+becoming an account system. Connector visibility comes from deployment config,
+and downstream auth may be shared across the tenant or isolated per human.
+Existing connectors stay shared, every visible connector stays visible, and
+every interactive human stays an operator unless the deployment opts into the
+new identity rules. A signed-in human may manage authentication for every
+connector their code-derived view includes; operator status separately controls
+tokens and global activity. Worker deployments also gain the complete Managed
+OAuth callback allowlist in the shipped example and agent instructions. The
+one upgrade seam is deliberate: in-flight `get_result` ids created by a named
+caller do not cross into the new subject partition, so finish paging them
+before deployment. Single-user deployments need no identity configuration,
+and non-Worker deployments can ignore the callback-policy change.
+
+### Added
+
+- **Identity-derived connector views.** `identity.connectorAccess` selects
+  declared connector ids from the authenticated actor, subject, and principal.
+  The view reaches discovery, direct and program calls, status, catalogs,
+  observed output shapes, and paged results. Unknown ids and resolver failures
+  fail closed.
+- **Shared and personal connector auth.** `authScope: "personal"` partitions
+  connector storage, encrypted credentials, OAuth state and tokens, catalogs,
+  and runtime observations by a hashed principal identity. Interactive members
+  manage auth for every visible connector: their own partition for personal
+  auth, or the deployment-wide grant for shared auth. `identity.operatorAccess`
+  reserves deployment access tokens and global activity for configured
+  operators.
+- **Principal-bound access tokens and OAuth callbacks.** A new connecta access
+  token retains its creator's principal without gaining operator rights.
+  Personal OAuth handoffs bind a hash of state to the initiating principal for
+  15 minutes before the public callback can exchange a code.
+
+### Changed
+
+- **Result pages follow authenticated subjects.** `get_result` storage is now
+  partitioned for every namespaced subject, including existing Clerk, Access,
+  and connecta-token callers. In-flight result ids created before upgrading do
+  not cross that storage boundary; finish paging them before deployment when
+  that matters.
+- **Worker Managed OAuth setup.** The Worker guide, source comment, upgrade
+  guide, and local `AGENTS.md` require Claude's fixed callback plus ChatGPT's
+  stable and callback-id forms in
+  `dynamic_client_registration.allowed_uris`.
+- **One tenant, several people.** The ethos now refuses a connecta-owned account
+  model while allowing externally authenticated principals, config-derived
+  connector visibility, and personal downstream credentials inside one tenant.
+- **Reviewed Cloudflare deletion contract.** Cloudflare removed a spurious
+  required empty request body from Worker script deletion. Connecta already
+  sent no body, so only the reviewed endpoint digest changes (#517).
+
 ## 0.21.2 — 2026-08-31
 
 This patch closes two runtime isolation gaps: concurrent request scopes now

package/README.md

@@ -33,7 +33,7 @@ flowchart TB
         Explicit["call_destructive_tool<br/>one visible call per write<br/>your client can ask you first"]
     end
 
-    Integrations["The integrations you chose<br/>Linear · Stripe · Notion · your HTTP API · any MCP server"]
+    Integrations["The integrations you chose<br/>Linear · Stripe · Notion · Vercel · your HTTP API · any MCP server"]
 
     Client -->|"one connection"| Sandbox
     Client --> Explicit
@@ -63,8 +63,8 @@ Fifty issues in, one small object out. Your context window notices.
 - **Wrap any HTTP API by hand.** A few lines per tool. No OpenAPI conversion —
   generated tool sprawl is the problem, not the fix.
 - **Use maintained connections** for Cloudflare, Linear, Mixpanel, Notion,
-  RevenueCat, and Stripe — known endpoints, auth defaults, and vetted read/write
-  classifications, imported one at a time.
+  RevenueCat, Stripe, and Vercel — known endpoints, auth defaults, and vetted
+  read/write classifications, imported one at a time.
 - **Let the agent work in code.** Search, chain, filter, join, and reduce
   inside the sandbox instead of round-tripping every call through the model.
 - **Teach undeclared result shapes by using them.** Successful read-only calls
@@ -82,6 +82,13 @@ payload-free activity log. Worker deployments can use Cloudflare Access for
 both MCP and operator identity; Node deployments and existing Workers can use
 Clerk.
 
+One deployment may serve several authenticated people inside the same tenant.
+Configuration can derive connector visibility from the admitted identity, and
+each connector may keep one shared downstream grant or a separate encrypted
+grant per human. Connecta does not own accounts or groups; Clerk or Cloudflare
+Access remains the identity provider. See [inbound auth](./documentation/auth.md#principals-visibility-and-operators)
+and [shared and personal auth](./documentation/storage-and-credentials.md#shared-and-personal-auth).
+
 Connecta is not a platform, a marketplace, a policy engine, or a multi-tenant
 service. Those are decisions, and the [ethos](./ethos.md) records each one
 and why.

package/dist/access-tokens.d.ts

@@ -1,4 +1,4 @@
-import type { InboundAuth, KVStorage } from "./types.js";
+import type { IdentityReference, InboundAuth, KVStorage } from "./types.js";
 export interface AccessTokenMetadata {
     id: string;
     name: string;
@@ -24,7 +24,7 @@ export declare class AccessTokenManager {
     });
     private read;
     list(): Promise<AccessTokenMetadata[]>;
-    create(name: unknown, createdBy: string): Promise<CreatedAccessToken>;
+    create(name: unknown, createdBy: string | IdentityReference): Promise<CreatedAccessToken>;
     rename(id: string, name: unknown): Promise<AccessTokenMetadata | null>;
     revoke(id: string, revokedBy: string): Promise<AccessTokenMetadata | null>;
     private authorize;

package/dist/access-tokens.js

@@ -1,3 +1,4 @@
+import { validIdentityReference } from "./identity.js";
 const TOKEN_PREFIX = "cta_";
 const TOKEN_BYTES = 32;
 const TOKEN_VALUE_RE = /^cta_[A-Za-z0-9_-]{43}$/;
@@ -54,6 +55,8 @@ function parseRecord(raw) {
             typeof value.tokenPrefix !== "string" ||
             typeof value.createdAt !== "string" ||
             typeof value.createdBy !== "string" ||
+            (value.principal !== undefined &&
+                !validIdentityReference(value.principal)) ||
             (value.revokedAt !== undefined &&
                 typeof value.revokedAt !== "string") ||
             (value.revokedBy !== undefined &&
@@ -167,7 +170,12 @@ export class AccessTokenManager {
             tokenHash: hash,
             tokenPrefix: token.slice(0, 12),
             createdAt: new Date().toISOString(),
-            createdBy,
+            createdBy: typeof createdBy === "string"
+                ? createdBy
+                : `${createdBy.namespace}:${createdBy.id}`,
+            ...(typeof createdBy === "string"
+                ? {}
+                : { principal: { ...createdBy } }),
         };
         await this.storage.set(recordKey(record.id), JSON.stringify(record));
         try {
@@ -219,6 +227,10 @@ export class AccessTokenManager {
         if (!record || record.revokedAt || record.tokenHash !== hash) {
             return unauthorized();
         }
-        return { ok: true, subjectId: record.id };
+        return {
+            ok: true,
+            subjectId: record.id,
+            ...(record.principal ? { principal: { ...record.principal } } : {}),
+        };
     }
 }

package/dist/connectors/api.d.ts

@@ -34,6 +34,8 @@ export interface ApiOptions {
     /** Human-readable display name; the connector id remains the address prefix. */
     title?: string;
     description?: string;
+    /** Downstream auth ownership. Defaults to one shared deployment grant. */
+    authScope?: "shared" | "personal";
     /**
      * Max inline result size (bytes) for this connector's tools before
      * call_tool truncates and stashes the full text for get_result

package/dist/connectors/api.js

@@ -40,6 +40,7 @@ export function api(id, opts) {
         kind: "api",
         ...defined({
             description: opts.description,
+            authScope: opts.authScope,
             maxResultBytes: opts.maxResultBytes,
             callAdmission: opts.callAdmission,
             usageGuide: opts.usageGuide,

package/dist/connectors/remote-mcp.d.ts

@@ -59,6 +59,8 @@ export interface RemoteMcpOptions {
     /** Human-readable display name; the connector id remains the address prefix. */
     title?: string;
     description?: string;
+    /** Downstream auth ownership. Defaults to one shared deployment grant. */
+    authScope?: "shared" | "personal";
     /**
      * Max inline result size (bytes) for this connector's tools before
      * call_tool truncates and stashes the full text for get_result

package/dist/connectors/remote-mcp.js

@@ -320,6 +320,11 @@ export function redirectSafeFetch(connectorId, policy = "none", baseFetch = fetc
  * server or hide other connectors).
  */
 export function remoteMcp(id, opts) {
+    if (opts.authScope === "personal" && opts.auth?.type === "headers") {
+        throw new Error(`[connecta] connector "${id}" cannot combine authScope "personal" ` +
+            "with static headers. Use credential or OAuth auth so each principal " +
+            "can own a different grant.");
+    }
     // Weak keys ensure a completed request does not leave its SDK client,
     // transport, response bodies, AbortSignals, or connection promise reachable
     // from the isolate singleton. Those are request-bound in Cloudflare Workers.
@@ -753,6 +758,7 @@ export function remoteMcp(id, opts) {
         ...(opts.description !== undefined
             ? { description: opts.description }
             : {}),
+        ...(opts.authScope !== undefined ? { authScope: opts.authScope } : {}),
         ...(opts.maxResultBytes !== undefined
             ? { maxResultBytes: opts.maxResultBytes }
             : {}),

package/dist/credentials.d.ts

@@ -107,11 +107,11 @@ export declare class CredentialVault {
     constructor(storage: KVStorage, encryptionKey: string);
     private additionalData;
     private read;
-    get(connectorId: string, field?: string): Promise<string | null>;
-    getAll(connectorId: string): Promise<ConnectorCredentialValues | null>;
-    metadata(connectorId: string): Promise<CredentialMetadata | null>;
-    set(connectorId: string, value: string, updatedBy: string): Promise<CredentialMetadata>;
-    setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string): Promise<CredentialMetadata>;
-    delete(connectorId: string): Promise<void>;
+    get(connectorId: string, field?: string, owner?: string): Promise<string | null>;
+    getAll(connectorId: string, owner?: string): Promise<ConnectorCredentialValues | null>;
+    metadata(connectorId: string, owner?: string): Promise<CredentialMetadata | null>;
+    set(connectorId: string, value: string, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
+    setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
+    delete(connectorId: string, owner?: string): Promise<void>;
 }
 export {};

package/dist/credentials.js

@@ -110,8 +110,10 @@ export function describeCredentialTestMismatch(mismatch) {
             "`testCredential(value, ctx)` can test, but implements " +
             "`testCredentials`";
 }
-function storageKey(connectorId) {
-    return `conn:${connectorId}:credential:v1`;
+function storageKey(connectorId, owner) {
+    return owner
+        ? `principal:${owner}:conn:${connectorId}:credential:v1`
+        : `conn:${connectorId}:credential:v1`;
 }
 function bytesToBase64(bytes) {
     let binary = "";
@@ -205,11 +207,13 @@ export class CredentialVault {
         }
         this.key = crypto.subtle.importKey("raw", raw, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
     }
-    additionalData(connectorId) {
-        return encoder.encode(`connecta:credential:${connectorId}:v1`);
+    additionalData(connectorId, owner) {
+        return encoder.encode(owner
+            ? `connecta:credential:principal:${owner}:${connectorId}:v1`
+            : `connecta:credential:${connectorId}:v1`);
     }
-    async read(connectorId) {
-        const raw = await this.storage.get(storageKey(connectorId));
+    async read(connectorId, owner) {
+        const raw = await this.storage.get(storageKey(connectorId, owner));
         if (!raw)
             return null;
         const envelope = parseEnvelope(raw);
@@ -217,7 +221,7 @@ export class CredentialVault {
             const plaintext = await crypto.subtle.decrypt({
                 name: "AES-GCM",
                 iv: base64ToBytes(envelope.iv),
-                additionalData: this.additionalData(connectorId),
+                additionalData: this.additionalData(connectorId, owner),
             }, await this.key, base64ToBytes(envelope.ciphertext));
             return parsePlaintext(decoder.decode(plaintext));
         }
@@ -225,15 +229,15 @@ export class CredentialVault {
             throw new Error("Stored credential could not be decrypted");
         }
     }
-    async get(connectorId, field = "value") {
-        return (await this.read(connectorId))?.values[field] ?? null;
+    async get(connectorId, field = "value", owner) {
+        return (await this.read(connectorId, owner))?.values[field] ?? null;
     }
-    async getAll(connectorId) {
-        const credential = await this.read(connectorId);
+    async getAll(connectorId, owner) {
+        const credential = await this.read(connectorId, owner);
         return credential ? { ...credential.values } : null;
     }
-    async metadata(connectorId) {
-        const credential = await this.read(connectorId);
+    async metadata(connectorId, owner) {
+        const credential = await this.read(connectorId, owner);
         if (!credential)
             return null;
         const fields = Object.fromEntries(Object.entries(credential.values).map(([field, value]) => [
@@ -254,13 +258,13 @@ export class CredentialVault {
             fields,
         };
     }
-    async set(connectorId, value, updatedBy) {
+    async set(connectorId, value, updatedBy, owner) {
         // `await` (not a bare promise return) so a validation throw inside setAll
         // never sits handler-less for the thenable-adoption microtask — workerd
         // reports that gap as an unhandled rejection.
-        return await this.setAll(connectorId, { value }, updatedBy);
+        return await this.setAll(connectorId, { value }, updatedBy, owner);
     }
-    async setAll(connectorId, values, updatedBy) {
+    async setAll(connectorId, values, updatedBy, owner) {
         const normalized = validateValues(values);
         const plaintext = {
             values: normalized,
@@ -271,7 +275,7 @@ export class CredentialVault {
         const ciphertext = await crypto.subtle.encrypt({
             name: "AES-GCM",
             iv,
-            additionalData: this.additionalData(connectorId),
+            additionalData: this.additionalData(connectorId, owner),
         }, await this.key, encoder.encode(JSON.stringify(plaintext)));
         const envelope = {
             version: 1,
@@ -279,10 +283,10 @@ export class CredentialVault {
             iv: bytesToBase64(iv),
             ciphertext: bytesToBase64(new Uint8Array(ciphertext)),
         };
-        await this.storage.set(storageKey(connectorId), JSON.stringify(envelope));
-        return (await this.metadata(connectorId));
+        await this.storage.set(storageKey(connectorId, owner), JSON.stringify(envelope));
+        return (await this.metadata(connectorId, owner));
     }
-    async delete(connectorId) {
-        await this.storage.delete(storageKey(connectorId));
+    async delete(connectorId, owner) {
+        await this.storage.delete(storageKey(connectorId, owner));
     }
 }

package/dist/identity.d.ts

@@ -0,0 +1,4 @@
+import type { IdentityReference } from "./types.js";
+export declare function validIdentityReference(value: IdentityReference | undefined): value is IdentityReference;
+/** Deterministic pseudonymous partition; raw emails and ids do not enter keys. */
+export declare function identityStorageKey(identity: IdentityReference): Promise<string>;

package/dist/identity.js

@@ -0,0 +1,17 @@
+const IDENTITY_PART_RE = /^[\x21-\x7e]{1,256}$/;
+const encoder = new TextEncoder();
+export function validIdentityReference(value) {
+    return Boolean(value &&
+        IDENTITY_PART_RE.test(value.namespace) &&
+        IDENTITY_PART_RE.test(value.id));
+}
+function bytesToHex(bytes) {
+    return [...bytes]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+/** Deterministic pseudonymous partition; raw emails and ids do not enter keys. */
+export async function identityStorageKey(identity) {
+    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(`${identity.namespace}\n${identity.id}`));
+    return bytesToHex(new Uint8Array(digest));
+}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { Registry } from "./registry.js";
 import type { ActivityReadGate, ActivityStore } from "./activity.js";
-import type { Connector, ConnectaBranding, Executor, InboundAuth, KVStorage, Logger } from "./types.js";
+import type { AuthenticatedIdentity, Connector, ConnectaBranding, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
 /** Payload-free activity storage and operator-read policy. */
 export interface ConnectaActivityConfig {
     /**
@@ -115,10 +115,24 @@ export interface ConnectaAdmissionConfig {
      */
     code?: AdmissionPoolConfig;
 }
+/** Config-owned identity rules for one deployment and tenant. */
+export interface ConnectaIdentityConfig {
+    /** Connector ids this admitted identity may discover and call. */
+    connectorAccess?(identity: Readonly<AuthenticatedIdentity>): "all" | readonly string[] | Promise<"all" | readonly string[]>;
+    /**
+     * Whether a human may manage deployment access tokens and global activity.
+     * Connector access already permits that human to manage the visible
+     * connector's shared or personal auth. Omit to preserve the existing
+     * all-interactive-humans operator rule.
+     */
+    operatorAccess?(principal: Readonly<IdentityReference>): boolean | Promise<boolean>;
+}
 export interface ConnectaConfig {
     connectors: Connector[];
     /** Inbound auth adapters. Includes bearerToken(...); omit for open (dev). */
     auth?: InboundAuth | InboundAuth[];
+    /** Identity-derived connector visibility and deployment operator membership. */
+    identity?: ConnectaIdentityConfig;
     /** KVStorage impl. Defaults to memoryStorage(). */
     storage?: KVStorage;
     /**
@@ -192,6 +206,6 @@ export { CONNECTA_VERSION } from "./version.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
-export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, CatalogDriftActivityEvent, ToolCallActivityEvent, } from "./activity.js";
 export { InvalidActivityCursorError } from "./activity.js";

package/dist/index.js

@@ -51,6 +51,10 @@ const admissionPoolSchema = {
 const CONFIG_SCHEMA = {
     connectors: null,
     auth: null,
+    identity: {
+        connectorAccess: null,
+        operatorAccess: null,
+    },
     storage: null,
     publicUrl: null,
     activity: {
@@ -250,7 +254,7 @@ export function createConnecta(config) {
     const credentialConnectors = config.connectors.filter((c) => c.credential);
     const encryptionKey = config.credentials?.encryptionKey;
     if (credentialConnectors.length > 0 && !encryptionKey) {
-        logger.warn("Operator-managed credentials are unavailable because " +
+        logger.warn("Human-managed credentials are unavailable because " +
             "credentials.encryptionKey is not configured for connectors: " +
             credentialConnectors.map((c) => c.id).join(", "));
     }
@@ -310,6 +314,7 @@ export function createConnecta(config) {
     const handler = createFetchHandler({
         registry,
         auth: inboundAuth,
+        identity: config.identity,
         publicUrl: config.publicUrl,
         serverInfo,
         logger,

package/dist/meta-tools.js

@@ -479,13 +479,18 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     },
                     operatorUrl: new URL("/credentials", baseUrl).toString(),
                     instructions: "Have the operator open operatorUrl, set and test the credential, " +
-                        "then retry the original call. No redeploy is needed. Credential " +
-                        "mutation requires a Clerk-authenticated operator.",
+                        "then retry the original call. No redeploy is needed. " +
+                        (connector.authScope === "personal"
+                            ? "Credential mutation requires the signed-in principal who owns this connection."
+                            : "Shared credential mutation requires a signed-in human with access to this connector."),
                 });
             }
             const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
             try {
                 const status = await connector.startAuth(ctx, args.force !== undefined ? { force: args.force } : {});
+                if (status.authorizationUrl) {
+                    await registry.bindOAuthHandoff(connector.id, status.authorizationUrl);
+                }
                 if (status.state === "auth_required" && !status.authorizationUrl) {
                     // auth_required with nothing to open is a dead end for the operator.
                     return errorResult(`Connector "${connector.id}": authorization required but no URL is available — retry authorize_connector.`);