@zackbart/connecta 0.23.0 → 0.24.0

package/AGENTS.md

@@ -82,6 +82,11 @@ Two boundaries CI enforces that are not obvious from reading a file:
   unreachable from the root entry. `test/purity.test.ts` walks the import graph
   and fails otherwise. Need a Node API? It goes behind an explicit Node-only
   subpath (`/node` or `/quickjs`), never the root.
+- **Optional modules.** Core owns catalog discovery, execution, invocation, and
+  enforcement. UI, activity history, encrypted credentials, and bearer auth
+  implementations stay behind explicit subpaths and outside the root import
+  graph. Use the typed `ui`, `activity`, and `vault` slots; do not add a generic
+  plugin registry or runtime installation.
 - **The published surface.** Platform-specific storage adapters live in
   `examples/worker/`, never in `src/` and never in the `exports` map. That
   example does ship in the tarball, Cloudflare KV and D1 adapters included —

package/CHANGELOG.md

@@ -2,6 +2,46 @@
 
 All notable changes to this package are documented here.
 
+## 0.24.0 — 2026-09-07
+
+Deployments now select UI, encrypted credentials, activity history, and inbound
+auth through explicit module imports. Core keeps discovery, execution,
+invocation, and enforcement together. This breaks configuration and removes
+Connecta-issued client tokens; migrate those clients before upgrading. Shared
+and personal auth management now require explicit permissions. Existing vault
+and OAuth state need no format migration. See the
+[detailed migration guide](./documentation/upgrading.md#0240-optional-modules)
+for before-and-after configuration, team and personal deployment examples,
+client migration, and verification.
+
+### Added
+
+- Optional `operatorUi`, `encryptedCredentialVault`, and `activityHistory`
+  factories behind `/ui`, `/credentials`, and `/activity`, with contracts in core.
+- Separate config-derived `credentialAdministration` and `personalConnection`
+  permissions, both denied by default; `activityAccess` controls history reads.
+- Explicit `logger: "silent"`, independent of activity recording.
+
+### Changed
+
+- Move configured bearer authentication to `/auth/bearer`. Remove Connecta-issued
+  tokens and their management routes; old records remain inert in storage.
+- Move root branding into UI options, replace `credentials` with `vault`, and
+  construct activity through its factory. Removed configuration fails at startup.
+- Put credential and OAuth controls inside Connections; remove separate
+  Credentials and Tokens tabs. Show the current user's effective permissions.
+- Keep optional implementations outside the root import graph. Omitted modules
+  contribute no runtime work or UI routes; OAuth callbacks remain in core.
+
+### Fixed
+
+- Return the configured connection list without awaiting provider checks, then
+  load bounded connection details independently. Auth action feedback no longer
+  waits for an unrelated catalog reload.
+- Start OAuth only through explicit authorized actions, never status reads.
+- Return unavailable credential recovery when no UI or vault is mounted, and
+  complete UI-free OAuth without a dead return link.
+
 ## 0.23.0 — 2026-09-07
 
 This release removes server-owned program views, connector HTTP routes, and

package/README.md

@@ -78,18 +78,26 @@ Fifty issues in, one small object out. Your context window notices.
 - **Run it where you like.** Node, a Docker container, or a Cloudflare Worker,
   from the same small deployment file.
 
-There is also an operator surface, off until you turn it on: sign-in, an
-encrypted credential vault with rotation, revocable per-client tokens, and a
-payload-free activity log. Worker deployments can use Cloudflare Access for
-both MCP and operator identity; Node deployments and existing Workers can use
-Clerk.
+Deployments explicitly compose optional features: `operatorUi()` from
+`@zackbart/connecta/ui`, `encryptedCredentialVault()` from `/credentials`,
+`activityHistory()` from `/activity`, and inbound authentication adapters from
+`/auth/*`. Omit a module and its implementation does no runtime work. Core
+keeps connector discovery, execution, invocation, and enforcement together.
+
+The optional UI shows each person's connections and effective permissions.
+Authentication controls live inside each connection, with optional activity
+history. The configured connection list loads before downstream checks finish;
+a slow provider does not hold up the page. Connector selection and access rules
+remain in deployment code.
 
 One deployment may serve several authenticated people inside the same tenant.
-Configuration can derive connector visibility from the admitted identity, and
-each connector may keep one shared downstream grant or a separate encrypted
-grant per human. Connecta does not own accounts or groups; Clerk or Cloudflare
-Access remains the identity provider. See [inbound auth](./documentation/auth.md#principals-visibility-and-operators)
-and [shared and personal auth](./documentation/storage-and-credentials.md#shared-and-personal-auth).
+Cloudflare Access supplies Worker identity; Node can use Clerk or the optional
+configured bearer adapter. Connecta owns no accounts or groups and issues no
+client access tokens. Shared-credential administration and personal connection
+setup require separate explicit permissions, both denied by default. See
+[inbound auth](./documentation/auth.md#principals-visibility-and-operators),
+[shared and personal auth](./documentation/storage-and-credentials.md#shared-and-personal-auth),
+and the [module migration guide](./documentation/upgrading.md#0240-optional-modules).
 
 Connecta is not a platform, a marketplace, a policy engine, or a multi-tenant
 service. Those are decisions, and the [ethos](./ethos.md) records each one

package/dist/activity-friction.d.ts

@@ -0,0 +1,3 @@
+import type { AgentFriction } from "./activity.js";
+/** Coarse recovery class derived without inspecting payloads or error prose. */
+export declare function agentFrictionForCode(code: string | undefined): AgentFriction | undefined;

package/dist/activity-friction.js

@@ -0,0 +1,19 @@
+/** Coarse recovery class derived without inspecting payloads or error prose. */
+export function agentFrictionForCode(code) {
+    switch (code) {
+        case "unknown_address":
+        case "unknown_tool":
+        case "ambiguous_tool_alias":
+            return "tool_not_found";
+        case "invalid_args":
+            return "schema_retry";
+        case "destructive_tool_requires_approval":
+            return "destructive_reroute";
+        case "auth_required":
+            return "auth_required";
+        case "result_too_large":
+            return "result_too_large";
+        default:
+            return undefined;
+    }
+}

package/dist/activity.d.ts

@@ -1,9 +1,9 @@
+import type { ActivityModule } from "./module-contracts.js";
 import type { CatalogDriftCounts, Logger } from "./types.js";
 export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code";
 export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled";
 export type AgentFriction = "tool_not_found" | "schema_retry" | "destructive_reroute" | "auth_required" | "result_too_large";
-/** Coarse recovery class derived without inspecting payloads or error prose. */
-export declare function agentFrictionForCode(code: string | undefined): AgentFriction | undefined;
+export { agentFrictionForCode } from "./activity-friction.js";
 /**
  * Authenticated identity attached to an activity event. `id` is intentionally
  * optional: open deployments and shared bearer tokens cannot honestly identify
@@ -119,6 +119,7 @@ export type ActivityReadGate = (actor: ActivityActor) => boolean | Promise<boole
  * did, so it carries no actor and no request id to attribute it to one.
  */
 export interface CatalogDriftActivityContext {
+    recordDrift?: typeof recordCatalogDriftActivity;
     sink: ActivitySink;
     serverInfo: {
         name: string;
@@ -129,6 +130,7 @@ export interface CatalogDriftActivityContext {
 }
 /** Request-scoped context shared by direct, batch, and code-mode call paths. */
 export interface ActivityRequestContext {
+    recordTool?: typeof recordToolActivity | undefined;
     sink: ActivitySink;
     actor: ActivityActor;
     requestId: string;
@@ -155,3 +157,10 @@ export declare function recordToolActivity(context: ActivityRequestContext | und
 export declare function recordCatalogDriftActivity(context: CatalogDriftActivityContext | undefined, input: {
     connectorId: string;
 } & CatalogDriftCounts): void;
+export interface ActivityHistoryOptions {
+    store: ActivityStore;
+    deploymentId?: string;
+    readGate?: ActivityReadGate;
+}
+/** Attach payload-free history without changing tool results on store failure. */
+export declare function activityHistory(options: ActivityHistoryOptions): ActivityModule;

package/dist/activity.js

@@ -1,3 +1,4 @@
+import { routeActivity } from "./routes/activity.js";
 import { boundedEchoText } from "./errors.js";
 /**
  * How long an identity field may be before the store stops believing it.
@@ -16,25 +17,8 @@ import { boundedEchoText } from "./errors.js";
 const MAX_ACTIVITY_NAME_BYTES = 128;
 /** Two names and the dot between them. */
 const MAX_ACTIVITY_ADDRESS_BYTES = MAX_ACTIVITY_NAME_BYTES * 2 + 1;
-/** Coarse recovery class derived without inspecting payloads or error prose. */
-export function agentFrictionForCode(code) {
-    switch (code) {
-        case "unknown_address":
-        case "unknown_tool":
-        case "ambiguous_tool_alias":
-            return "tool_not_found";
-        case "invalid_args":
-            return "schema_retry";
-        case "destructive_tool_requires_approval":
-            return "destructive_reroute";
-        case "auth_required":
-            return "auth_required";
-        case "result_too_large":
-            return "result_too_large";
-        default:
-            return undefined;
-    }
-}
+import { agentFrictionForCode } from "./activity-friction.js";
+export { agentFrictionForCode } from "./activity-friction.js";
 /** Reader implementations throw this for an opaque cursor they cannot decode. */
 export class InvalidActivityCursorError extends Error {
     name = "InvalidActivityCursorError";
@@ -123,3 +107,15 @@ export function recordCatalogDriftActivity(context, input) {
         context.logger.warn("[connecta] catalog drift record failed", error);
     }
 }
+/** Attach payload-free history without changing tool results on store failure. */
+export function activityHistory(options) {
+    if (!options || typeof options.store?.record !== "function") {
+        throw new Error("activityHistory.store must implement record(event)");
+    }
+    return {
+        ...options,
+        handle: routeActivity,
+        recordTool: recordToolActivity,
+        recordDrift: recordCatalogDriftActivity,
+    };
+}

package/dist/auth/downstream-oauth.d.ts

@@ -71,6 +71,7 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     private readonly storage;
     private readonly redirectUri;
     private readonly refreshCoordinator?;
+    private readonly allowAuthorization;
     /**
      * The reset generation this provider's flow started under. Every OAuth value
      * it writes carries this epoch, so a late write can land after a reset without
@@ -80,7 +81,7 @@ export declare class KvOAuthProvider implements OAuthClientProvider {
     private refreshFlight;
     /** Tokens this request's issuer-aware auth flow decided to refresh. */
     private refreshBasis;
-    constructor(connectorId: string, storage: KVStorage, redirectUri: string, refreshCoordinator?: OAuthRefreshCoordinator | undefined);
+    constructor(connectorId: string, storage: KVStorage, redirectUri: string, refreshCoordinator?: OAuthRefreshCoordinator | undefined, allowAuthorization?: boolean);
     /**
      * Stamp the force-reauth generation the current connect flow started under.
      * Called by the connector once per connect, before c.connect(). The callback

package/dist/auth/downstream-oauth.js

@@ -1,3 +1,4 @@
+import { UnauthorizedError } from "@modelcontextprotocol/client";
 /** A 256-bit random opaque value, hex-encoded — used for the OAuth `state`. */
 function randomState() {
     const bytes = new Uint8Array(32);
@@ -383,6 +384,7 @@ export class KvOAuthProvider {
     storage;
     redirectUri;
     refreshCoordinator;
+    allowAuthorization;
     /**
      * The reset generation this provider's flow started under. Every OAuth value
      * it writes carries this epoch, so a late write can land after a reset without
@@ -392,11 +394,12 @@ export class KvOAuthProvider {
     refreshFlight;
     /** Tokens this request's issuer-aware auth flow decided to refresh. */
     refreshBasis;
-    constructor(connectorId, storage, redirectUri, refreshCoordinator) {
+    constructor(connectorId, storage, redirectUri, refreshCoordinator, allowAuthorization = true) {
         this.connectorId = connectorId;
         this.storage = storage;
         this.redirectUri = redirectUri;
         this.refreshCoordinator = refreshCoordinator;
+        this.allowAuthorization = allowAuthorization;
     }
     /**
      * Stamp the force-reauth generation the current connect flow started under.
@@ -666,6 +669,8 @@ export class KvOAuthProvider {
      * clearPending() once the flow completes.
      */
     async state() {
+        if (!this.allowAuthorization)
+            throw new UnauthorizedError("Authorization required. Use authorize_connector or Connect to start consent.");
         const value = randomState();
         await this.writeValue("oauth:state", value, (raw) => raw);
         return value;
@@ -684,6 +689,8 @@ export class KvOAuthProvider {
         return matches;
     }
     async saveCodeVerifier(verifier) {
+        if (!this.allowAuthorization)
+            throw new UnauthorizedError("Authorization required. Use authorize_connector or Connect to start consent.");
         await this.writeValue("oauth:verifier", verifier, (raw) => raw);
     }
     async codeVerifier() {
@@ -694,6 +701,8 @@ export class KvOAuthProvider {
         return stored.value;
     }
     async redirectToAuthorization(authorizationUrl) {
+        if (!this.allowAuthorization)
+            throw new UnauthorizedError("Authorization required. Use authorize_connector or Connect to start consent.");
         try {
             await this.writeValue("oauth:pending", authorizationUrl.toString(), (raw) => raw);
             this.failRefreshFlight(new Error("OAuth refresh required reauthorization before tokens were saved."));

package/dist/branding.d.ts

@@ -0,0 +1,67 @@
+import type { ConnectaBranding, UiAuthConfig } from "./types.js";
+/** Connecta's default monochrome "C" mark. */
+export declare const CONNECTA_FAVICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 32 32\">\n  <style>\n    .fg { fill: #000 }\n    @media (prefers-color-scheme: dark) { .fg { fill: #fff } }\n  </style>\n  <path class=\"fg\" d=\"M27 9.4A13 13 0 1 0 27 22.6l-4.4-2.5a8 8 0 1 1 0-8.2z\"/>\n</svg>";
+interface ResolvedBranding {
+    productName: string;
+    productUrl?: string;
+    ownerName?: string;
+    ownerUrl?: string;
+    description: string;
+    /** Browser tab title and page meta name. */
+    pageTitle: string;
+    /** href for the page's icon link. */
+    faviconHref: string;
+    themeColor: string;
+}
+export declare function resolveBranding(branding?: ConnectaBranding): ResolvedBranding;
+/**
+ * Names of the branding URLs the operator set that failed their gate and were
+ * replaced by a default. Lives beside the gates so the startup warning cannot
+ * drift from them, and takes `unknown` fields for the same reason
+ * `resolveBranding` does — a warning helper must never throw.
+ */
+export declare function droppedBrandingUrls(branding?: ConnectaBranding): string[];
+export declare function isSafeHttpUrl(url: unknown): boolean;
+/**
+ * True for values allowed in the page's `<link rel="icon" href>`: an absolute
+ * `http(s)` URL (an icon the operator hosts elsewhere) or a path rooted at this
+ * origin. The relative carve-out is deliberate rather than accidental — the
+ * default href is the relative `/favicon.svg`, which `isSafeHttpUrl` alone would
+ * reject — and it is kept narrow on both ends.
+ *
+ * Root-relative only, because operator and OAuth callback pages sit at
+ * different depths and a document-relative path would resolve differently.
+ *
+ * "Root-relative" is enforced structurally: exactly one leading `/` followed by
+ * a character that is neither `/` nor `\`. Both of those would make the value an
+ * authority (`//host`, and `/\host` because the URL parser folds `\` to `/` in
+ * special schemes), pointing at an origin this server does not control. The test
+ * runs on a copy with tab/newline/CR removed, since the parser strips those
+ * anywhere and `/\t/host` would otherwise slip through as single-slash. The
+ * origin comparison that follows is defense in depth, not the authority check —
+ * on its own it would accept an authority that happened to equal the probe host.
+ */
+export declare function isSafeIconHref(href: unknown): boolean;
+/** Absolute HTTPS gate for the `UiAuthConfig` URL fields documented in types.ts. */
+export declare function isSafeHttpsUrl(url: unknown): boolean;
+/**
+ * Names of the `uiAuth` URLs an inbound-auth provider supplied that failed their
+ * gate. Lives beside the gate for the same reason `droppedBrandingUrls` does: the
+ * startup warning cannot then drift from what rendering actually drops. Every
+ * field is read defensively rather than trusted, because a custom `InboundAuth`
+ * is untyped at a JS call site — `isSafeHttpsUrl` takes `unknown`, and a
+ * `uiAuth` that is not the clerk shape is reported as nothing to warn about.
+ *
+ * `frontendApiUrl` is required, so anything that fails its gate is a drop.
+ * `signInUrl` and `signUpUrl` are optional, so only a value the operator
+ * *supplied* and the gate then rejected is worth a warning — an unset field
+ * took no default away from anyone. `isSetUrlValue` decides that, the same way
+ * and for the same reasons it decides it for the branding URLs: a warning that
+ * fires for one and not the other would be reporting on the field rather than
+ * on the operator's intent. Rendering is not consulted for this: it drops on
+ * the gate alone, and a blank string fails that gate too — it is simply not
+ * *reported*, because a blank is indistinguishable from leaving the field
+ * alone.
+ */
+export declare function droppedUiAuthUrls(uiAuth?: UiAuthConfig): string[];
+export {};

package/dist/branding.js

@@ -0,0 +1,176 @@
+/** Connecta's default monochrome "C" mark. */
+export const CONNECTA_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
+  <style>
+    .fg { fill: #000 }
+    @media (prefers-color-scheme: dark) { .fg { fill: #fff } }
+  </style>
+  <path class="fg" d="M27 9.4A13 13 0 1 0 27 22.6l-4.4-2.5a8 8 0 1 1 0-8.2z"/>
+</svg>`;
+const DEFAULT_FAVICON_HREF = "/favicon.svg";
+/**
+ * Branding arrives from operator config, which is untyped at a JS call site, so
+ * every field is treated as `unknown`: a non-string is read as unset rather than
+ * throwing on `.trim()`. Rendering must degrade to defaults for a malformed
+ * value, never fail — `createConnecta` calls this during construction.
+ */
+function trimmedString(value) {
+    return typeof value === "string" ? value.trim() || undefined : undefined;
+}
+export function resolveBranding(branding) {
+    const productName = trimmedString(branding?.productName) ?? "Connecta";
+    const ownerName = trimmedString(branding?.ownerName);
+    // Operator branding URLs become masthead/callback hrefs, so a non-http(s)
+    // scheme (javascript:, data:) is dropped the same as an unset URL — the
+    // callers already render a <span> instead of an <a> when it is absent.
+    const productUrl = trimmedString(branding?.productUrl);
+    const ownerUrl = trimmedString(branding?.ownerUrl);
+    const faviconHref = trimmedString(branding?.favicon?.href);
+    return {
+        productName,
+        ...(productUrl && isSafeHttpUrl(productUrl) ? { productUrl } : {}),
+        ...(ownerName ? { ownerName } : {}),
+        ...(ownerUrl && isSafeHttpUrl(ownerUrl) ? { ownerUrl } : {}),
+        description: trimmedString(branding?.description) ??
+            `Manage the services this ${productName} instance makes available to agents.`,
+        pageTitle: trimmedString(branding?.pageTitle) ??
+            (ownerName ? `${productName} — ${ownerName}` : productName),
+        faviconHref: faviconHref && isSafeIconHref(faviconHref)
+            ? faviconHref
+            : DEFAULT_FAVICON_HREF,
+        themeColor: trimmedString(branding?.themeColor) ?? "#ffffff",
+    };
+}
+/**
+ * Whether the operator meant to supply a value here — the question every
+ * dropped-URL warning asks before naming a field, and one definition so the
+ * branding and `uiAuth` warnings cannot answer it differently. A non-string
+ * counts as set: the intent was there and is exactly what the warning reports
+ * on. A blank or whitespace-only string does not; that is indistinguishable
+ * from leaving the field alone, and both take the default silently.
+ */
+function isSetUrlValue(value) {
+    return typeof value === "string"
+        ? trimmedString(value) !== undefined
+        : value !== undefined && value !== null;
+}
+/**
+ * Names of the branding URLs the operator set that failed their gate and were
+ * replaced by a default. Lives beside the gates so the startup warning cannot
+ * drift from them, and takes `unknown` fields for the same reason
+ * `resolveBranding` does — a warning helper must never throw.
+ */
+export function droppedBrandingUrls(branding) {
+    if (!branding)
+        return [];
+    const resolved = resolveBranding(branding);
+    const faviconHref = branding.favicon?.href;
+    return [
+        ...(isSetUrlValue(branding.productUrl) && !resolved.productUrl
+            ? ["productUrl"]
+            : []),
+        ...(isSetUrlValue(branding.ownerUrl) && !resolved.ownerUrl
+            ? ["ownerUrl"]
+            : []),
+        ...(isSetUrlValue(faviconHref) &&
+            trimmedString(faviconHref) !== resolved.faviconHref
+            ? ["favicon.href"]
+            : []),
+    ];
+}
+/**
+ * True only for absolute `http:`/`https:` URLs. Downstream connectors control
+ * their `authorizationUrl`, so a hostile/misconfigured one could hand back a
+ * `javascript:` (or other) scheme; gate it before it can become an href.
+ */
+function safeUrl(url, schemes) {
+    if (typeof url !== "string")
+        return false;
+    try {
+        return schemes.includes(new URL(url).protocol);
+    }
+    catch {
+        return false;
+    }
+}
+export function isSafeHttpUrl(url) {
+    return safeUrl(url, ["http:", "https:"]);
+}
+/**
+ * Only the second check's base; any origin works because the check is whether
+ * the href stays on whatever origin it is resolved against. It is deliberately
+ * never the sole gate: a value whose own authority equals this host (say
+ * `//connecta.invalid/x`) would resolve to this exact origin and pass, so the
+ * structural check below runs first and is what actually rejects `//host`.
+ */
+const SAME_ORIGIN_PROBE = "https://connecta.invalid";
+/** Removed anywhere in a URL by the parser, so a gate must ignore them too. */
+const URL_STRIPPED_CHARS = /[\t\n\r]/g;
+/**
+ * True for values allowed in the page's `<link rel="icon" href>`: an absolute
+ * `http(s)` URL (an icon the operator hosts elsewhere) or a path rooted at this
+ * origin. The relative carve-out is deliberate rather than accidental — the
+ * default href is the relative `/favicon.svg`, which `isSafeHttpUrl` alone would
+ * reject — and it is kept narrow on both ends.
+ *
+ * Root-relative only, because operator and OAuth callback pages sit at
+ * different depths and a document-relative path would resolve differently.
+ *
+ * "Root-relative" is enforced structurally: exactly one leading `/` followed by
+ * a character that is neither `/` nor `\`. Both of those would make the value an
+ * authority (`//host`, and `/\host` because the URL parser folds `\` to `/` in
+ * special schemes), pointing at an origin this server does not control. The test
+ * runs on a copy with tab/newline/CR removed, since the parser strips those
+ * anywhere and `/\t/host` would otherwise slip through as single-slash. The
+ * origin comparison that follows is defense in depth, not the authority check —
+ * on its own it would accept an authority that happened to equal the probe host.
+ */
+export function isSafeIconHref(href) {
+    if (typeof href !== "string")
+        return false;
+    if (isSafeHttpUrl(href))
+        return true;
+    if (!/^\/(?![/\\])/.test(href.replace(URL_STRIPPED_CHARS, "")))
+        return false;
+    try {
+        return new URL(href, SAME_ORIGIN_PROBE).origin === SAME_ORIGIN_PROBE;
+    }
+    catch {
+        return false;
+    }
+}
+/** Absolute HTTPS gate for the `UiAuthConfig` URL fields documented in types.ts. */
+export function isSafeHttpsUrl(url) {
+    return safeUrl(url, ["https:"]);
+}
+/**
+ * Names of the `uiAuth` URLs an inbound-auth provider supplied that failed their
+ * gate. Lives beside the gate for the same reason `droppedBrandingUrls` does: the
+ * startup warning cannot then drift from what rendering actually drops. Every
+ * field is read defensively rather than trusted, because a custom `InboundAuth`
+ * is untyped at a JS call site — `isSafeHttpsUrl` takes `unknown`, and a
+ * `uiAuth` that is not the clerk shape is reported as nothing to warn about.
+ *
+ * `frontendApiUrl` is required, so anything that fails its gate is a drop.
+ * `signInUrl` and `signUpUrl` are optional, so only a value the operator
+ * *supplied* and the gate then rejected is worth a warning — an unset field
+ * took no default away from anyone. `isSetUrlValue` decides that, the same way
+ * and for the same reasons it decides it for the branding URLs: a warning that
+ * fires for one and not the other would be reporting on the field rather than
+ * on the operator's intent. Rendering is not consulted for this: it drops on
+ * the gate alone, and a blank string fails that gate too — it is simply not
+ * *reported*, because a blank is indistinguishable from leaving the field
+ * alone.
+ */
+export function droppedUiAuthUrls(uiAuth) {
+    if (!uiAuth || uiAuth.kind !== "clerk")
+        return [];
+    return [
+        ...(isSafeHttpsUrl(uiAuth.frontendApiUrl) ? [] : ["uiAuth.frontendApiUrl"]),
+        ...(isSetUrlValue(uiAuth.signInUrl) && !isSafeHttpsUrl(uiAuth.signInUrl)
+            ? ["uiAuth.signInUrl"]
+            : []),
+        ...(isSetUrlValue(uiAuth.signUpUrl) && !isSafeHttpsUrl(uiAuth.signUpUrl)
+            ? ["uiAuth.signUpUrl"]
+            : []),
+    ];
+}

package/dist/connectors/remote-mcp.js

@@ -505,7 +505,7 @@ export function remoteMcp(id, opts) {
     const newProvider = (ctx, state) => {
         if (state?.provider)
             return state.provider;
-        const provider = new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`, refreshCoordinator);
+        const provider = new KvOAuthProvider(id, ctx.storage, `${ctx.baseUrl}/oauth/callback/${id}`, refreshCoordinator, ctx.allowAuthorization === true);
         if (state)
             state.provider = provider;
         return provider;
@@ -1025,12 +1025,8 @@ export function remoteMcp(id, opts) {
                     // Only an OAuth connector has a pending consent URL to offer. A
                     // credential connector's downstream 401 is repaired on /credentials,
                     // so do not reach into OAuth storage to look for one.
-                    const url = isOauth
-                        ? await newProvider(ctx, state).pendingAuthorizationUrl()
-                        : undefined;
                     return {
                         state: "auth_required",
-                        ...(url !== undefined ? { authorizationUrl: url } : {}),
                         message: credentialAuth
                             ? "Authorization required — the downstream rejected this connector's stored credential."
                             : "Authorization required — open the URL to connect.",
@@ -1070,7 +1066,9 @@ export function remoteMcp(id, opts) {
             await disconnectAuthorization(ctx, stateFor(ctx), true);
         };
         connector.startAuth = async (ctx, startOpts) => {
+            ctx = { ...ctx, requestScope: ctx.requestScope ?? ctx, allowAuthorization: true };
             const state = stateFor(ctx);
+            state.provider = null;
             const p = newProvider(ctx, state);
             if (startOpts?.force || (await p.operatorDisconnected())) {
                 await disconnectAuthorization(ctx, state);

package/dist/credential-contract.d.ts

@@ -0,0 +1,24 @@
+import type { ConnectorCredentialValues } from "./types.js";
+interface CredentialFieldMetadata {
+    configured: true;
+    /** Only emitted when the value is long enough that four chars don't leak much. */
+    lastFour?: string;
+    updatedAt: string;
+}
+export interface CredentialMetadata {
+    configured: true;
+    /** Backward-compatible metadata for the reserved single credential field. */
+    lastFour?: string;
+    updatedAt: string;
+    /** Per-field masked metadata for named multi-value credentials. */
+    fields?: Record<string, CredentialFieldMetadata>;
+}
+export interface CredentialVault {
+    get(connectorId: string, field?: string, owner?: string): Promise<string | null>;
+    getAll(connectorId: string, owner?: string): Promise<ConnectorCredentialValues | null>;
+    metadata(connectorId: string, owner?: string): Promise<CredentialMetadata | null>;
+    set(connectorId: string, value: string, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
+    setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
+    delete(connectorId: string, owner?: string): Promise<void>;
+}
+export {};

package/dist/credential-contract.js

@@ -0,0 +1 @@
+export {};