@zackbart/connecta 0.22.3 → 0.24.0

package/dist/operator-ui/view.js

@@ -1,13 +1,9 @@
 export const OPERATOR_PAGES = [
     "connections",
-    "credentials",
-    "tokens",
     "activity",
 ];
 export const PAGE_META = {
     connections: { path: "/", label: "Connections" },
-    credentials: { path: "/credentials", label: "Credentials" },
-    tokens: { path: "/tokens", label: "Access tokens" },
     activity: { path: "/activity", label: "Activity" },
 };
 export function pageForPath(path) {
@@ -45,12 +41,6 @@ function identityScopedState() {
         credentialNotice: null,
         credentialEditing: null,
         credentialBusy: null,
-        tokenPhase: "idle",
-        tokenNotice: null,
-        tokens: [],
-        createdToken: null,
-        tokenRenaming: null,
-        tokenBusy: false,
         activityPhase: "idle",
         activityNotice: null,
         activityEvents: [],
@@ -82,9 +72,6 @@ export function withPage(state, page) {
     return {
         ...state,
         page,
-        createdToken: null,
-        tokenRenaming: null,
-        tokenNotice: null,
         credentialEditing: null,
         credentialNotice: null,
     };
@@ -94,17 +81,13 @@ export function credentialUnavailableCopy(capability) {
         return "No connectors declare operator-managed credential slots. Connector credentials remain configuration-as-code until a slot is declared.";
     }
     if (capability === "vault_not_configured") {
-        return "Credential storage is not configured. Set credentials.encryptionKey before managing connector credentials here.";
+        return "Credential storage is not configured. Configure a vault before managing connector credentials here.";
     }
     return "Credential management requires an interactive user. Bearer-authenticated sessions can inspect connections but cannot manage stored credentials.";
 }
-export function accessTokenUnavailableCopy(capability) {
-    if (capability === "not_configured") {
-        return "Access tokens are not configured for this deployment. Add accessTokens to the deployment configuration to enable them.";
-    }
-    return "Access token management requires an eligible interactive operator. A Bearer token can connect to MCP, but it cannot create or revoke other tokens.";
-}
 export function connectorStatusLabel(status) {
+    if (status === "loading")
+        return "Loading details";
     if (status === "ok")
         return "Connected";
     if (status === "auth_required")

package/dist/registry.d.ts

@@ -1,7 +1,7 @@
+import type { CredentialVault } from "./credential-contract.js";
 import type { CatalogDriftReport, Connector, ConnectorContext, ConnectorStatus, KVStorage, Logger, ToolDef } from "./types.js";
 import { type DeferredWork } from "./connector-scope.js";
 import { type CatalogDriftActivityContext } from "./activity.js";
-import { type CredentialVault } from "./credentials.js";
 import { type CallAdmissionPermit, type ConnectorCallAdmissionSnapshot } from "./call-admission.js";
 /**
  * Split `"<connectorId>.<toolName>"` on the first dot. Connector ids contain
@@ -47,6 +47,7 @@ export interface RegistryOptions {
     storage: KVStorage;
     logger: Logger;
     credentialVault?: CredentialVault | undefined;
+    credentialUi?: boolean | undefined;
     /** Internal owner partition used by a personal registry. */
     credentialOwner?: string | undefined;
     /** Internal child registries skip deployment-wide construction warnings. */
@@ -84,6 +85,7 @@ export interface CatalogReadOptions {
  * or its construction-only methods.
  */
 export interface RegistryView {
+    credentialUiAvailable(): boolean;
     /** Deployment-wide result-size cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
     listConnectors(): Connector[];
@@ -217,6 +219,7 @@ export declare class Registry implements RegistryView {
      * separate from any connector's `conn:<id>:` namespace. Backs get_result.
      */
     resultsStorage(): KVStorage;
+    credentialUiAvailable(): boolean;
     bindOAuthHandoff(): Promise<void>;
     observedOutputSchema(connectorId: string, definition: ToolDef): ToolDef["outputSchema"] | undefined;
     observeOutputShape(connectorId: string, definition: ToolDef, value: unknown): void;

package/dist/registry.js

@@ -1,6 +1,5 @@
 import { closeConnectorScope, } from "./connector-scope.js";
-import { recordCatalogDriftActivity, } from "./activity.js";
-import { storedCredentialShape, } from "./credentials.js";
+import { storedCredentialShape, } from "./credential-rules.js";
 import { ConnectorCallError, msg } from "./errors.js";
 import { ConnectorCallAdmissionController, } from "./call-admission.js";
 import { boundedCatalogDrift } from "./catalog-drift.js";
@@ -131,6 +130,10 @@ export class Registry {
         this.persistToolCatalog = opts.persistToolCatalog ?? true;
         this.maxResultBytes = resolveMaxResultBytes(opts.maxResultBytes, DEFAULT_MAX_RESULT_BYTES);
         for (const c of connectors) {
+            if ("handleRequest" in c) {
+                throw new Error(`Connector "${c.id}" declares removed handleRequest. ` +
+                    "Move custom HTTP routes into the deployment's fetch handler.");
+            }
             if (!ID_RE.test(c.id)) {
                 throw new Error(`Invalid connector id "${c.id}": must match ${ID_RE.source}`);
             }
@@ -389,7 +392,7 @@ export class Registry {
         this.reportedDrift.set(connector.id, counts);
         if (previous === undefined && clean)
             return;
-        recordCatalogDriftActivity(this.opts.catalogDriftActivity
+        this.opts.catalogDriftActivity?.recordDrift?.(this.opts.catalogDriftActivity
             ? { ...this.opts.catalogDriftActivity, logger: this.opts.logger }
             : undefined, { connectorId: connector.id, ...counts });
     }
@@ -405,6 +408,7 @@ export class Registry {
     resultsStorage() {
         return namespaced(this.opts.storage, "results:");
     }
+    credentialUiAvailable() { return Boolean(this.opts.credentialUi); }
     async bindOAuthHandoff() {
         // Shared OAuth already resolves in deployment-wide connector storage.
     }
@@ -986,9 +990,6 @@ export class Registry {
             // observation when this runtime has not made one.
             const boundedStatus = {
                 state: status.state,
-                ...(status.authorizationUrl !== undefined
-                    ? { authorizationUrl: status.authorizationUrl }
-                    : {}),
                 ...(status.message !== undefined ? { message: status.message } : {}),
             };
             return {
@@ -1123,6 +1124,7 @@ class ScopedRegistryView {
         const registry = this.registryFor(id);
         return registry ? registry.invalidateStored(id) : Promise.resolve();
     }
+    credentialUiAvailable() { return this.root.credentialUiAvailable(); }
     async bindOAuthHandoff(id, authorizationUrl) {
         const connector = this.getConnector(id);
         if (connector?.authScope !== "personal" || !this.scope.principalKey)

package/dist/routes/activity.js

@@ -137,7 +137,7 @@ export async function routeActivity(context) {
     const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity, false);
     if (!authz.ok)
         return authz.response;
-    if (opts.identity?.operatorAccess && !authz.operator) {
+    if (!authz.operator) {
         return privateJson({ error: "operator access required" }, { status: 403 });
     }
     if (opts.activityReadGate &&

package/dist/routes/credentials.js

@@ -1,5 +1,5 @@
-import { credentialTestRule, describeCredentialTestMismatch, storedCredentialShape, } from "../credentials.js";
-import { authorizeUiIdentity, isSameOrigin, msg, privateJson, } from "./shared.js";
+import { credentialTestRule, describeCredentialTestMismatch, storedCredentialShape, } from "../credential-rules.js";
+import { authorizeUiIdentity, mayManageConnector, validateAuthPermissions, isSameOrigin, msg, privateJson, } from "./shared.js";
 async function readCredentialInput(request, config) {
     if (!request.headers
         .get("content-type")
@@ -78,6 +78,7 @@ async function handleCredentialRequest(context, connectorId, action) {
         return authz.response;
     let registry;
     try {
+        validateAuthPermissions(authz, opts.registry);
         registry = opts.registry.scoped({
             connectorIds: authz.connectorIds,
             ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
@@ -91,6 +92,8 @@ async function handleCredentialRequest(context, connectorId, action) {
     if (!connector?.credential) {
         return privateJson({ error: "unknown credential slot" }, { status: 404 });
     }
+    if (!mayManageConnector(authz, connector))
+        return privateJson({ error: "credential management is not permitted" }, { status: 403 });
     const personal = connector.authScope === "personal";
     if (personal && !authz.principalKey) {
         return privateJson({ error: "forbidden" }, { status: 403 });

package/dist/routes/mcp.js

@@ -1,11 +1,10 @@
 import { createMcpHandler, isLegacyRequest, McpServer, WebStandardStreamableHTTPServerTransport, } from "@modelcontextprotocol/server";
-import { MCP_APPS_EXTENSION, PROGRAM_UI_MIME_TYPE, PROGRAM_UI_RESOURCE_URI, PROGRAM_UI_SHELL_HTML, } from "../apps-shell.js";
 import { registerExecuteTool } from "../execute.js";
 import { ExecutorAdmissionError, } from "../executor-admission.js";
 import { registerMetaTools } from "../meta-tools.js";
 import { instructionsFor } from "../skills.js";
 import { msg } from "../errors.js";
-import { authorize, } from "./shared.js";
+import { authorize, mayManageConnector, validateAuthPermissions, } from "./shared.js";
 export const MCP_CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, DELETE, OPTIONS",
@@ -149,56 +148,10 @@ function toolkitRetired(logger) {
         },
     });
 }
-/**
- * U5: one static template, served by a handler that answers exactly one URI
- * and fails on every other. Registering it is also what declares the
- * `resources` capability — which is why `resources/list` has to answer, and
- * why it answers with nothing. That is the Apps spec's permitted omission of
- * UI-only resources from listing, taken exactly: the capability stays honest
- * because the method answers, and nothing downstream is ever listed or
- * aggregated. Widening this handler to proxy downstream templates is a
- * decision (see the design record), not a diff.
- */
-function registerProgramUiResource(server) {
-    server.registerResource("connecta-program-ui", PROGRAM_UI_RESOURCE_URI, {
-        title: "connecta program view",
-        description: "The MCP Apps shell that renders HTML an execute_code program handed connecta.ui.",
-        mimeType: PROGRAM_UI_MIME_TYPE,
-    }, (uri) => ({
-        contents: [
-            {
-                uri: uri.href,
-                mimeType: PROGRAM_UI_MIME_TYPE,
-                text: PROGRAM_UI_SHELL_HTML,
-            },
-        ],
-    }));
-    // The SDK's generated listing would advertise the template it just
-    // registered. Replace it rather than accept that: the URI reaches the host
-    // through tool metadata, so the listing has nothing to carry.
-    server.server.setRequestHandler("resources/list", () => ({ resources: [] }));
-}
-async function serveMcp(request, opts, baseUrl, actor, registry, runtimeContext) {
+async function serveMcp(request, opts, baseUrl, actor, registry, canManageAuth, runtimeContext) {
     const createServer = () => {
         const server = new McpServer(opts.serverInfo, {
             instructions: instructionsFor(),
-            // U11: the Apps extension must be explicitly negotiated, and a
-            // conforming client acts on an extension only when both sides declare
-            // it — without this line no host reads execute_code's _meta.ui, no host
-            // fetches the shell, and the whole design is inert. This is the one
-            // extension connecta advertises; the versioned extensions framework
-            // stays declined as a general surface (https://github.com/zackbart/connecta/blob/main/records/mcp-2026-07-28.md).
-            capabilities: {
-                extensions: {
-                    [MCP_APPS_EXTENSION]: { mimeTypes: [PROGRAM_UI_MIME_TYPE] },
-                },
-                // Registering the shell below declares `resources` on its own, but it
-                // would default `listChanged` to true. Connecta serves one build-time
-                // template and never sends a list_changed notification, so say so:
-                // a client that subscribes on the strength of that flag would wait
-                // forever for an event this server has no way to produce.
-                resources: { listChanged: false },
-            },
             cacheHints: {
                 "tools/list": {
                     ttlMs: 3_600_000,
@@ -206,10 +159,10 @@ async function serveMcp(request, opts, baseUrl, actor, registry, runtimeContext)
                 },
             },
         });
-        registerProgramUiResource(server);
         const activity = opts.activity
             ? {
                 sink: opts.activity,
+                recordTool: opts.activityModule?.recordTool,
                 actor,
                 requestId: crypto.randomUUID(),
                 serverInfo: opts.serverInfo,
@@ -224,6 +177,8 @@ async function serveMcp(request, opts, baseUrl, actor, registry, runtimeContext)
             : undefined;
         registerMetaTools(server, registry, {
             baseUrl,
+            canManageAuth,
+            credentialHandoffUrl: opts.ui?.credentialHandoffUrl(baseUrl),
             ...(activity ? { activity } : {}),
             ...(opts.defaultToolTimeoutMs !== undefined
                 ? { defaultToolTimeoutMs: opts.defaultToolTimeoutMs }
@@ -336,6 +291,7 @@ export function createMcpRoute(opts) {
             }
             let scopedRegistry;
             try {
+                validateAuthPermissions(authz, opts.registry);
                 scopedRegistry = opts.registry.scoped({
                     connectorIds: authz.connectorIds,
                     ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
@@ -351,7 +307,7 @@ export function createMcpRoute(opts) {
             if (new URL(request.url).searchParams.has("toolkit")) {
                 return releaseAdmissionWithResponse(withMcpCors(toolkitRetired(opts.logger)), admission, request.signal);
             }
-            return releaseAdmissionWithResponse(withMcpCors(await serveMcp(request, opts, baseUrl, authz.actor, scopedRegistry, runtimeContext)), admission, request.signal);
+            return releaseAdmissionWithResponse(withMcpCors(await serveMcp(request, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext)), admission, request.signal);
         }
         catch (error) {
             admission.release();

package/dist/routes/oauth-management.d.ts

@@ -0,0 +1,2 @@
+import { type RouteContext } from "./shared.js";
+export declare function routeOAuthManagement(context: RouteContext): Promise<Response | null>;

package/dist/routes/oauth-management.js

@@ -0,0 +1,108 @@
+import { closeConnectorScope } from "../connector-scope.js";
+import { isSafeHttpUrl } from "../ui.js";
+import { authorizeUiIdentity, mayManageConnector, validateAuthPermissions, isSameOrigin, msg, privateJson, } from "./shared.js";
+async function handleOAuthManagementRequest(context, connectorId) {
+    const { request, baseUrl, opts, defer } = context;
+    if (!isSameOrigin(request, baseUrl)) {
+        return privateJson({ error: "same-origin request required" }, { status: 403 });
+    }
+    const authz = await authorizeUiIdentity(request, baseUrl, opts.auth, "OAuth management", context.runtimeContext, opts.identity);
+    if (!authz.ok)
+        return authz.response;
+    let registry;
+    try {
+        validateAuthPermissions(authz, opts.registry);
+        registry = opts.registry.scoped({
+            connectorIds: authz.connectorIds,
+            ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
+            ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
+        });
+    }
+    catch (error) {
+        return privateJson({ error: msg(error) }, { status: 403 });
+    }
+    const connector = registry.getConnector(connectorId);
+    if (!connector?.disconnectAuth || !connector.startAuth) {
+        return privateJson({ error: "unknown OAuth connector" }, { status: 404 });
+    }
+    if (!mayManageConnector(authz, connector))
+        return privateJson({ error: "credential management is not permitted" }, { status: 403 });
+    if (connector.authScope === "personal" && !authz.principalKey) {
+        return privateJson({ error: "forbidden" }, { status: 403 });
+    }
+    if (request.method !== "DELETE" && request.method !== "POST") {
+        return privateJson({ error: "method not allowed" }, { status: 405 });
+    }
+    const requestScope = {};
+    const ctx = registry.contextFor(connectorId, baseUrl, requestScope);
+    try {
+        let result;
+        let operationError;
+        try {
+            if (request.method === "DELETE") {
+                await connector.disconnectAuth(ctx);
+            }
+            else {
+                result = await connector.startAuth(ctx, { force: true });
+                if (result.authorizationUrl) {
+                    await registry.bindOAuthHandoff(connectorId, result.authorizationUrl);
+                }
+            }
+        }
+        catch (error) {
+            operationError = error;
+        }
+        // The old grant and its cached catalog are invalid after either operation,
+        // including a partially failed physical cleanup whose epoch fence succeeded.
+        try {
+            await registry.invalidateStored(connectorId);
+        }
+        catch (error) {
+            operationError ??= error;
+        }
+        if (operationError) {
+            return privateJson({ error: msg(operationError) }, { status: 400 });
+        }
+        if (request.method === "DELETE") {
+            return new Response(null, {
+                status: 204,
+                headers: {
+                    "Cache-Control": "no-store",
+                    "Referrer-Policy": "no-referrer",
+                },
+            });
+        }
+        const authorizationUrl = isSafeHttpUrl(result.authorizationUrl)
+            ? result.authorizationUrl
+            : undefined;
+        if (result.state === "error") {
+            return privateJson({ error: result.message || "OAuth authorization could not start" }, { status: 502 });
+        }
+        if (result.state === "auth_required" && !authorizationUrl) {
+            return privateJson({
+                error: result.message ||
+                    "OAuth authorization requires consent but no safe URL is available",
+            }, { status: 502 });
+        }
+        return privateJson({
+            state: result.state,
+            ...(result.message ? { message: result.message } : {}),
+            ...(authorizationUrl ? { authorizationUrl } : {}),
+        });
+    }
+    finally {
+        await closeConnectorScope(connector, ctx, defer);
+    }
+}
+export async function routeOAuthManagement(context) {
+    const match = /^\/ui\/oauth\/([a-z0-9_-]+)$/.exec(context.path);
+    if (!match)
+        return null;
+    const connectorId = match[1];
+    if (!connectorId)
+        return null;
+    if (context.request.method === "OPTIONS") {
+        return privateJson({ error: "method not allowed" }, { status: 405 });
+    }
+    return handleOAuthManagementRequest(context, connectorId);
+}

package/dist/routes/oauth.d.ts

@@ -1,3 +1,2 @@
 import { type RouteContext } from "./shared.js";
-export declare function routeOAuthManagement(context: RouteContext): Promise<Response | null>;
 export declare function routeOAuthCallback(context: RouteContext): Promise<Response | null>;

package/dist/routes/oauth.js

@@ -1,109 +1,6 @@
 import { oauthValueStorageKey } from "../auth/downstream-oauth.js";
-import { closeConnectorScope } from "../connector-scope.js";
-import { isSafeHttpUrl, resolveBranding } from "../ui.js";
-import { authorizeUiIdentity, isSameOrigin, loggableValue, msg, privateJson, } from "./shared.js";
-async function handleOAuthManagementRequest(context, connectorId) {
-    const { request, baseUrl, opts, defer } = context;
-    if (!isSameOrigin(request, baseUrl)) {
-        return privateJson({ error: "same-origin request required" }, { status: 403 });
-    }
-    const authz = await authorizeUiIdentity(request, baseUrl, opts.auth, "OAuth management", context.runtimeContext, opts.identity);
-    if (!authz.ok)
-        return authz.response;
-    let registry;
-    try {
-        registry = opts.registry.scoped({
-            connectorIds: authz.connectorIds,
-            ...(authz.subjectKey ? { subjectKey: authz.subjectKey } : {}),
-            ...(authz.principalKey ? { principalKey: authz.principalKey } : {}),
-        });
-    }
-    catch (error) {
-        return privateJson({ error: msg(error) }, { status: 403 });
-    }
-    const connector = registry.getConnector(connectorId);
-    if (!connector?.disconnectAuth || !connector.startAuth) {
-        return privateJson({ error: "unknown OAuth connector" }, { status: 404 });
-    }
-    if (connector.authScope === "personal" && !authz.principalKey) {
-        return privateJson({ error: "forbidden" }, { status: 403 });
-    }
-    if (request.method !== "DELETE" && request.method !== "POST") {
-        return privateJson({ error: "method not allowed" }, { status: 405 });
-    }
-    const requestScope = {};
-    const ctx = registry.contextFor(connectorId, baseUrl, requestScope);
-    try {
-        let result;
-        let operationError;
-        try {
-            if (request.method === "DELETE") {
-                await connector.disconnectAuth(ctx);
-            }
-            else {
-                result = await connector.startAuth(ctx, { force: true });
-                if (result.authorizationUrl) {
-                    await registry.bindOAuthHandoff(connectorId, result.authorizationUrl);
-                }
-            }
-        }
-        catch (error) {
-            operationError = error;
-        }
-        // The old grant and its cached catalog are invalid after either operation,
-        // including a partially failed physical cleanup whose epoch fence succeeded.
-        try {
-            await registry.invalidateStored(connectorId);
-        }
-        catch (error) {
-            operationError ??= error;
-        }
-        if (operationError) {
-            return privateJson({ error: msg(operationError) }, { status: 400 });
-        }
-        if (request.method === "DELETE") {
-            return new Response(null, {
-                status: 204,
-                headers: {
-                    "Cache-Control": "no-store",
-                    "Referrer-Policy": "no-referrer",
-                },
-            });
-        }
-        const authorizationUrl = isSafeHttpUrl(result.authorizationUrl)
-            ? result.authorizationUrl
-            : undefined;
-        if (result.state === "error") {
-            return privateJson({ error: result.message || "OAuth authorization could not start" }, { status: 502 });
-        }
-        if (result.state === "auth_required" && !authorizationUrl) {
-            return privateJson({
-                error: result.message ||
-                    "OAuth authorization requires consent but no safe URL is available",
-            }, { status: 502 });
-        }
-        return privateJson({
-            state: result.state,
-            ...(result.message ? { message: result.message } : {}),
-            ...(authorizationUrl ? { authorizationUrl } : {}),
-        });
-    }
-    finally {
-        await closeConnectorScope(connector, ctx, defer);
-    }
-}
-export async function routeOAuthManagement(context) {
-    const match = /^\/ui\/oauth\/([a-z0-9_-]+)$/.exec(context.path);
-    if (!match)
-        return null;
-    const connectorId = match[1];
-    if (!connectorId)
-        return null;
-    if (context.request.method === "OPTIONS") {
-        return privateJson({ error: "method not allowed" }, { status: 405 });
-    }
-    return handleOAuthManagementRequest(context, connectorId);
-}
+import { resolveBranding } from "../branding.js";
+import { authorizeUiIdentity, mayManageConnector, validateAuthPermissions, loggableValue, msg, } from "./shared.js";
 function escapeHtml(value) {
     return value
         .replaceAll("&", "&")
@@ -112,7 +9,7 @@ function escapeHtml(value) {
         .replaceAll('"', """);
 }
 /** `body` is escaped — callback params and error messages are attacker-influenced. */
-function html(body, status = 200, branding) {
+function html(body, status = 200, branding, hasUi = false) {
     const brand = resolveBranding(branding);
     const title = brand.pageTitle;
     const owner = brand.ownerName
@@ -173,7 +70,7 @@ function html(body, status = 200, branding) {
     <h1>Connection status</h1>
     <div class="copy">
       <p>${escapeHtml(body)}</p>
-      <p><a href="/">Return to ${escapeHtml(brand.productName)}</a></p>
+      ${hasUi ? `<p><a href="/">Return to ${escapeHtml(brand.productName)}</a></p>` : ""}
     </div>
   </main>
 </body>
@@ -216,10 +113,10 @@ export async function routeOAuthCallback(context) {
         return null;
     const error = url.searchParams.get("error");
     if (error)
-        return html(`Authorization denied: ${error}`, 400, opts.branding);
+        return html(`Authorization denied: ${error}`, 400, opts.branding, Boolean(opts.ui));
     const code = url.searchParams.get("code");
     if (!code)
-        return html("Missing authorization code.", 400, opts.branding);
+        return html("Missing authorization code.", 400, opts.branding, Boolean(opts.ui));
     const id = path.slice("/oauth/callback/".length);
     const state = url.searchParams.get("state");
     const callbackTarget = await opts.registry.oauthCallbackView(id, state);
@@ -234,22 +131,25 @@ export async function routeOAuthCallback(context) {
         ? callbackRegistry.contextFor(id, baseUrl)
         : opts.registry.contextFor(id, baseUrl);
     const refused = () => html("Authorization could not be completed. Re-run authorization from " +
-        "connecta and try again.", 400, opts.branding);
+        "connecta and try again.", 400, opts.branding, Boolean(opts.ui));
     if (!connector || !connector.finishAuth) {
         await equalizeRefusalCost(connectorContext);
         return refused();
     }
     const expectedPrincipalKey = callbackTarget?.principalKey;
-    if (expectedPrincipalKey) {
-        const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.auth, "OAuth callback", context.runtimeContext, opts.identity);
-        if (browserIdentity.ok &&
-            browserIdentity.principalKey !== expectedPrincipalKey) {
-            opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
-                `${loggableValue(id)} with 400: the authenticated browser identity ` +
-                "did not start this personal authorization flow. No authorization " +
-                "code was exchanged.");
+    const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.auth, "OAuth callback", context.runtimeContext, opts.identity);
+    if (browserIdentity.ok) {
+        try {
+            validateAuthPermissions(browserIdentity, opts.registry);
+        }
+        catch {
             return refused();
         }
+        if (!mayManageConnector(browserIdentity, connector) || (expectedPrincipalKey && browserIdentity.principalKey !== expectedPrincipalKey))
+            return refused();
+    }
+    else if (browserIdentity.response.status === 403 && opts.auth.some(provider => provider.interactiveOperator)) {
+        return refused();
     }
     // CSRF / login-fixation guard: this route is intentionally public, so verify
     // the `state` matches the flow connecta started BEFORE exchanging the code.
@@ -292,15 +192,15 @@ export async function routeOAuthCallback(context) {
             opts.logger.warn(`[connecta] refused an OAuth callback for connector ` +
                 `${loggableValue(id)} with 500: its principal handoff could not be ` +
                 `consumed (${loggableValue(msg(err))}). No authorization code was exchanged.`);
-            return html("Authorization could not be completed.", 500, opts.branding);
+            return html("Authorization could not be completed.", 500, opts.branding, Boolean(opts.ui));
         }
     }
     try {
         await connector.finishAuth(code, connectorContext, url.searchParams);
         await callbackRegistry.invalidateStored(id);
-        return html(`Connected "${id}". You can close this window.`, 200, opts.branding);
+        return html(`Connected "${id}". You can close this window.`, 200, opts.branding, Boolean(opts.ui));
     }
     catch (err) {
-        return html(`Authorization failed: ${msg(err)}`, 500, opts.branding);
+        return html(`Authorization failed: ${msg(err)}`, 500, opts.branding, Boolean(opts.ui));
     }
 }