npm - @zackbart/connecta - Versions diffs - 0.22.3 → 0.24.0 - Mend

@zackbart/connecta 0.22.3 → 0.24.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (94) hide show

package/AGENTS.md +5 -0
package/CHANGELOG.md +82 -0
package/README.md +19 -11
package/dist/activity-friction.d.ts +3 -0
package/dist/activity-friction.js +19 -0
package/dist/activity.d.ts +11 -2
package/dist/activity.js +15 -19
package/dist/auth/downstream-oauth.d.ts +2 -1
package/dist/auth/downstream-oauth.js +10 -1
package/dist/branding.d.ts +67 -0
package/dist/branding.js +176 -0
package/dist/catalog-service.d.ts +1 -6
package/dist/catalog-service.js +3 -53
package/dist/connectors/remote-mcp.js +3 -5
package/dist/credential-contract.d.ts +24 -0
package/dist/credential-contract.js +1 -0
package/dist/credential-rules.d.ts +85 -0
package/dist/credential-rules.js +107 -0
package/dist/credentials.d.ts +4 -100
package/dist/credentials.js +3 -107
package/dist/errors.d.ts +1 -1
package/dist/execute.d.ts +5 -52
package/dist/execute.js +40 -347
package/dist/executors/quickjs-protocol.d.ts +0 -7
package/dist/executors/quickjs-protocol.js +2 -10
package/dist/executors/quickjs.js +1 -1
package/dist/index.d.ts +23 -56
package/dist/index.js +30 -58
package/dist/invocation.d.ts +0 -33
package/dist/invocation.js +56 -124
package/dist/meta-tools.d.ts +7 -6
package/dist/meta-tools.js +14 -21
package/dist/module-contracts.d.ts +19 -0
package/dist/module-contracts.js +1 -0
package/dist/operator-ui/generated.js +2 -2
package/dist/operator-ui/model.d.ts +6 -3
package/dist/operator-ui/view.d.ts +2 -18
package/dist/operator-ui/view.js +3 -20
package/dist/registry.d.ts +4 -1
package/dist/registry.js +8 -6
package/dist/routes/activity.js +1 -1
package/dist/routes/credentials.js +5 -2
package/dist/routes/mcp.js +7 -51
package/dist/routes/oauth-management.d.ts +2 -0
package/dist/routes/oauth-management.js +108 -0
package/dist/routes/oauth.d.ts +0 -1
package/dist/routes/oauth.js +21 -121
package/dist/routes/shared.d.ts +19 -17
package/dist/routes/shared.js +48 -44
package/dist/routes/ui.js +36 -33
package/dist/server.d.ts +1 -2
package/dist/server.js +7 -45
package/dist/skills.d.ts +1 -1
package/dist/skills.js +55 -19
package/dist/types.d.ts +3 -15
package/dist/ui.d.ts +15 -70
package/dist/ui.js +176 -317
package/dist/version.d.ts +1 -1
package/dist/version.js +1 -1
package/documentation/architecture.md +31 -26
package/documentation/auth.md +65 -111
package/documentation/call-admission.md +10 -11
package/documentation/cloudflare.md +1 -1
package/documentation/code-mode.md +65 -260
package/documentation/connectors.md +8 -6
package/documentation/linear.md +1 -1
package/documentation/meta-tools.md +37 -18
package/documentation/mixpanel.md +1 -1
package/documentation/notion.md +2 -2
package/documentation/operations.md +19 -23
package/documentation/operator-ui.md +82 -104
package/documentation/optional-modules-upgrade.md +243 -0
package/documentation/provider-conventions.md +7 -5
package/documentation/revenuecat.md +1 -1
package/documentation/storage-and-credentials.md +59 -40
package/documentation/stripe.md +1 -1
package/documentation/upgrading.md +83 -8
package/ethos.md +36 -43
package/examples/worker/AGENTS.md +3 -1
package/examples/worker/README.md +68 -84
package/examples/worker/src/d1-activity.ts +1 -1
package/examples/worker/src/index.ts +11 -6
package/package.json +18 -2
package/templates/node/AGENTS.md +8 -6
package/templates/node/README.md +56 -67
package/templates/node/package.json +1 -1
package/templates/node/src/file-activity.ts +1 -1
package/templates/node/src/index.ts +11 -12
package/dist/access-tokens.d.ts +0 -31
package/dist/access-tokens.js +0 -236
package/dist/apps-shell.d.ts +0 -37
package/dist/apps-shell.js +0 -174
package/dist/routes/access-tokens.d.ts +0 -6
package/dist/routes/access-tokens.js +0 -83

package/dist/apps-shell.js DELETED Viewed

@@ -1,174 +0,0 @@
-/**
- * The one MCP Apps template connecta serves (`U5`, `U6`).
- *
- * A build-time string constant, not a file read at startup: the core is
- * Web-API-only so it runs unchanged on Workers, and the same bytes have to
- * serve everywhere. The shell is display-only: it renders whatever HTML a
- * program handed `connecta.ui` inside a nested `srcdoc` frame and forwards no
- * channel back from that frame to the host, so program-authored markup is
- * inert beyond its own pixels.
- *
- * The address carries a version segment because hosts are permitted to
- * prefetch and cache templates by URI: change these bytes, bump the version.
- */
-/** The only `ui://` URI in the system. No program input reaches it. */
-export const PROGRAM_UI_RESOURCE_URI = "ui://connecta/program-ui/v3";
-/** The mimeType the Apps spec requires of an HTML template. */
-export const PROGRAM_UI_MIME_TYPE = "text/html;profile=mcp-app";
-/**
- * The result `_meta` key carrying the payload (`U3`). A plain single-label
- * prefix rather than the reverse-DNS form MCP's SHOULD prefers: connecta has
- * no domain to reverse, and fabricating one to satisfy a SHOULD is a worse
- * answer than the shape the key format's MUST already permits.
- */
-export const PROGRAM_UI_META_KEY = "connecta/ui";
-/** The one extension identifier connecta advertises (`U11`). */
-export const MCP_APPS_EXTENSION = "io.modelcontextprotocol/ui";
-/**
- * The shell document. Dependency-free and deliberately small: it speaks the
- * Apps postMessage dialect (`ui/initialize`, `ui/notifications/initialized`,
- * `ui/notifications/tool-result`, `ui/notifications/size-changed`,
- * `ui/resource-teardown`), lifts `_meta["connecta/ui"].html` out of the
- * delivered tool result, and puts it in a frame. It declares no CSP domains,
- * so the host applies its restrictive default and the `srcdoc` frame inherits
- * `default-src 'none'`. The payload gets scripts and local interactivity, and
- * no network.
- */
-export const PROGRAM_UI_SHELL_HTML = `<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="utf-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <title>connecta program view</title>
-    <style>
-      html,
-      body {
-        margin: 0;
-        padding: 0;
-        background: transparent;
-      }
-      #program-view {
-        display: block;
-        width: 100%;
-        min-height: 480px;
-        border: 0;
-      }
-    </style>
-  </head>
-  <body>
-    <iframe
-      id="program-view"
-      title="Program-rendered view"
-      sandbox="allow-scripts"
-      srcdoc=""
-    ></iframe>
-    <script>
-      (function () {
-        "use strict";
-        // The host frame is the only peer this shell speaks to, in either
-        // direction. The payload frame below is sandboxed to scripts alone,
-        // with no same-origin escape, and is never handed a reply path:
-        // anything it posts fails the source check and is dropped. There is
-        // no bridge from program HTML to the host, by construction rather
-        // than by validation.
-        var host = window.parent;
-        var view = document.getElementById("program-view");
-        var initializeId = "connecta-ui-initialize";
-        var lastWidth = 0;
-        var lastHeight = 0;
-        function send(message) {
-          if (!host || host === window) return;
-          host.postMessage(message, "*");
-        }
-        function notify(method, params) {
-          send({ jsonrpc: "2.0", method: method, params: params });
-        }
-        // Program views are fixed-height by construction. The shell has no
-        // bridge to the payload frame — that is the security posture, not an
-        // omission — so it can never learn the payload's content height, and
-        // what it reports here is its own box: the min-height above, unless
-        // the host has given it more. Taller content scrolls inside the inner
-        // frame rather than growing the view. Raising the min-height is the
-        // only lever; a content-height signal would cost the isolation.
-        function reportSize() {
-          var width = Math.ceil(document.documentElement.clientWidth);
-          var height = Math.ceil(document.documentElement.scrollHeight);
-          if (width === lastWidth && height === lastHeight) return;
-          lastWidth = width;
-          lastHeight = height;
-          notify("ui/notifications/size-changed", {
-            width: width,
-            height: height
-          });
-        }
-        function payloadHtml(result) {
-          if (!result || typeof result !== "object") return null;
-          var meta = result._meta;
-          if (!meta || typeof meta !== "object") return null;
-          var payload = meta["connecta/ui"];
-          if (!payload || typeof payload !== "object") return null;
-          var html = payload.html;
-          return typeof html === "string" && html.length > 0 ? html : null;
-        }
-        function render(params) {
-          var html =
-            payloadHtml(params) ||
-            payloadHtml(params && params.result) ||
-            payloadHtml(params && params.toolResult);
-          if (html === null) return;
-          view.srcdoc = html;
-          reportSize();
-        }
-        window.addEventListener("message", function (event) {
-          if (event.source !== host) return;
-          var message = event.data;
-          if (!message || message.jsonrpc !== "2.0") return;
-          if (message.method === "ui/notifications/tool-result") {
-            render(message.params);
-            return;
-          }
-          if (message.method === "ui/resource-teardown") {
-            // A host->view request, not a notification: the host waits for
-            // this reply before it tears the view down. There is nothing to
-            // release, so answer immediately rather than make it time out.
-            if (message.id !== undefined && message.id !== null) {
-              send({ jsonrpc: "2.0", id: message.id, result: {} });
-            }
-            return;
-          }
-          // Only a completed handshake earns "initialized". A JSON-RPC error
-          // response carries the same id, and announcing initialization on one
-          // would assert a handshake that never happened.
-          if (message.id === initializeId && message.result !== undefined) {
-            notify("ui/notifications/initialized", {});
-          }
-        });
-        window.addEventListener("resize", reportSize);
-        view.addEventListener("load", reportSize);
-        // Every field here is required by the Apps initialize schema, and a
-        // conforming host rejects the request outright when one is missing —
-        // which would strand the shell before any tool result arrives.
-        send({
-          jsonrpc: "2.0",
-          id: initializeId,
-          method: "ui/initialize",
-          params: {
-            appInfo: { name: "connecta program view", version: "1" },
-            appCapabilities: {},
-            protocolVersion: "2026-01-26"
-          }
-        });
-        reportSize();
-      })();
-    </script>
-  </body>
-</html>
-`;

package/dist/routes/access-tokens.d.ts DELETED Viewed

@@ -1,6 +0,0 @@
-import { type RouteContext } from "./shared.js";
-/**
- * Interactive-operator lifecycle for deployment access tokens. The token itself
- * is deliberately never an administrator credential and cannot reach here.
- */
-export declare function routeAccessTokens(context: RouteContext): Promise<Response | null>;

package/dist/routes/access-tokens.js DELETED Viewed

@@ -1,83 +0,0 @@
-import { authorizeUiAdmin, isSameOrigin, msg, privateJson, } from "./shared.js";
-async function readName(request) {
-    if (!request.headers
-        .get("content-type")
-        ?.toLowerCase()
-        .startsWith("application/json")) {
-        return {
-            ok: false,
-            response: privateJson({ error: "Content-Type must be application/json" }, { status: 415 }),
-        };
-    }
-    const raw = await request.text();
-    if (raw.length > 1_000) {
-        return {
-            ok: false,
-            response: privateJson({ error: "request body is too large" }, { status: 413 }),
-        };
-    }
-    try {
-        const body = JSON.parse(raw);
-        return { ok: true, name: body.name };
-    }
-    catch {
-        return {
-            ok: false,
-            response: privateJson({ error: "invalid JSON body" }, { status: 400 }),
-        };
-    }
-}
-/**
- * Interactive-operator lifecycle for deployment access tokens. The token itself
- * is deliberately never an administrator credential and cannot reach here.
- */
-export async function routeAccessTokens(context) {
-    const match = /^\/ui\/access-tokens(?:\/([0-9a-f-]{36}))?$/.exec(context.path);
-    if (!match)
-        return null;
-    const { request, baseUrl, opts } = context;
-    if (request.method === "OPTIONS") {
-        return privateJson({ error: "CORS is not allowed" }, { status: 403 });
-    }
-    if (!opts.accessTokens) {
-        return privateJson({ error: "access token management is not configured" }, { status: 404 });
-    }
-    const mutating = request.method !== "GET";
-    if (mutating && !isSameOrigin(request, baseUrl)) {
-        return privateJson({ error: "same-origin request required" }, { status: 403 });
-    }
-    const admin = await authorizeUiAdmin(request, baseUrl, opts.auth, "access token management", context.runtimeContext, opts.identity);
-    if (!admin.ok)
-        return admin.response;
-    const id = match[1];
-    try {
-        if (!id && request.method === "GET") {
-            return privateJson({ accessTokens: await opts.accessTokens.list() });
-        }
-        if (!id && request.method === "POST") {
-            const input = await readName(request);
-            if (!input.ok)
-                return input.response;
-            return privateJson(await opts.accessTokens.create(input.name, admin.principal ?? admin.userId), { status: 201 });
-        }
-        if (id && request.method === "PUT") {
-            const input = await readName(request);
-            if (!input.ok)
-                return input.response;
-            const accessToken = await opts.accessTokens.rename(id, input.name);
-            return accessToken
-                ? privateJson({ accessToken })
-                : privateJson({ error: "unknown access token" }, { status: 404 });
-        }
-        if (id && request.method === "DELETE") {
-            const accessToken = await opts.accessTokens.revoke(id, admin.userId);
-            return accessToken
-                ? privateJson({ accessToken })
-                : privateJson({ error: "unknown access token" }, { status: 404 });
-        }
-        return privateJson({ error: "method not allowed" }, { status: 405 });
-    }
-    catch (error) {
-        return privateJson({ error: msg(error) }, { status: 400 });
-    }
-}