@zackbart/connecta 0.23.0 → 0.24.0

package/dist/credential-rules.d.ts

@@ -0,0 +1,85 @@
+import type { Connector, ConnectorCredentialConfig } from "./types.js";
+/** Which hook a testable credential is checked with. */
+type CredentialTestMode = "single" | "multiple";
+/** Operator-safe explanation shared by every surface that detects shape drift. */
+export declare const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
+export type StoredCredentialShape = {
+    state: "missing";
+} | {
+    state: "valid";
+    mode: CredentialTestMode;
+    /**
+     * Stored keys the connector no longer declares, sorted. Harmless — the
+     * credential works — but worth telling an operator about, since nothing
+     * else in `/ui` can show a field the declaration has stopped naming.
+     */
+    undeclared: string[];
+} | {
+    state: "mismatch";
+    mode: CredentialTestMode;
+    message: typeof STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR;
+};
+/**
+ * Compare a connector's current declaration with the keys in its stored
+ * credential. Values are deliberately ignored: callers may pass decrypted
+ * values or `/credentials`' masked field metadata and get the same answer.
+ *
+ * The test is CONTAINMENT, not equality: the stored key set is compatible when
+ * it holds every field currently declared — the reserved `value` key for a
+ * single-value declaration, every declared name for a named one. Anything the
+ * declaration asks for and the vault does not have is `mismatch`, which is
+ * precisely what a renamed field, a newly added field, or a swap between the
+ * two shapes produces. The swap needs no special case: `value` is never one of
+ * the declared names, so single→named and named→single each leave the declared
+ * side unsatisfied. An empty stored map (reachable through a hand-written
+ * plaintext) satisfies nothing and is a mismatch too.
+ *
+ * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
+ * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
+ * `getAll().apiKey` — keeps returning the right secret across that redeploy.
+ * Calling it drift would order an operator to re-enter a working secret that
+ * many providers will not reissue in readable form. The leftovers come back as
+ * `undeclared` instead, for a surface to mention without blocking anything.
+ */
+export declare function storedCredentialShape(config: ConnectorCredentialConfig, stored: Readonly<Record<string, unknown>> | null): StoredCredentialShape;
+/**
+ * The one sentence describing leftover stored fields, so every surface words it
+ * the same way. Names only — the values stay in the vault, and a field name from
+ * a previous declaration is not a secret. Deliberately reassuring: nothing is
+ * broken, and the only thing an operator gains by acting is that a connector
+ * iterating `getAll()` stops seeing a field its code no longer knows about.
+ */
+export declare function describeUndeclaredCredentialFields(fields: string[]): string;
+/** A declared credential shape whose only test hook cannot test it. */
+export interface CredentialTestMismatch {
+    /** The shape the connector declared. */
+    shape: CredentialTestMode;
+    /** The hook it implements, which that shape cannot use. */
+    hook: "testCredential" | "testCredentials";
+}
+export interface CredentialTestRule {
+    /** The hook to call, or null when this credential cannot be tested at all. */
+    mode: CredentialTestMode | null;
+    /** Set only when the sole implemented hook is the one the shape cannot use. */
+    mismatch?: CredentialTestMismatch;
+}
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export declare function credentialTestRule(connector: Pick<Connector, "credential" | "testCredential" | "testCredentials">): CredentialTestRule;
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export declare function describeCredentialTestMismatch(mismatch: CredentialTestMismatch): string;
+export {};

package/dist/credential-rules.js

@@ -0,0 +1,107 @@
+/** Operator-safe explanation shared by every surface that detects shape drift. */
+export const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
+/**
+ * Compare a connector's current declaration with the keys in its stored
+ * credential. Values are deliberately ignored: callers may pass decrypted
+ * values or `/credentials`' masked field metadata and get the same answer.
+ *
+ * The test is CONTAINMENT, not equality: the stored key set is compatible when
+ * it holds every field currently declared — the reserved `value` key for a
+ * single-value declaration, every declared name for a named one. Anything the
+ * declaration asks for and the vault does not have is `mismatch`, which is
+ * precisely what a renamed field, a newly added field, or a swap between the
+ * two shapes produces. The swap needs no special case: `value` is never one of
+ * the declared names, so single→named and named→single each leave the declared
+ * side unsatisfied. An empty stored map (reachable through a hand-written
+ * plaintext) satisfies nothing and is a mismatch too.
+ *
+ * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
+ * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
+ * `getAll().apiKey` — keeps returning the right secret across that redeploy.
+ * Calling it drift would order an operator to re-enter a working secret that
+ * many providers will not reissue in readable form. The leftovers come back as
+ * `undeclared` instead, for a surface to mention without blocking anything.
+ */
+export function storedCredentialShape(config, stored) {
+    if (!stored)
+        return { state: "missing" };
+    const mode = config.fields?.length
+        ? "multiple"
+        : "single";
+    const declared = new Set(mode === "multiple" ? config.fields.map((field) => field.name) : ["value"]);
+    const actual = Object.keys(stored);
+    const present = new Set(actual);
+    for (const field of declared) {
+        if (!present.has(field)) {
+            return {
+                state: "mismatch",
+                mode,
+                message: STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR,
+            };
+        }
+    }
+    return {
+        state: "valid",
+        mode,
+        undeclared: actual.filter((field) => !declared.has(field)).sort(),
+    };
+}
+/** How many leftover field names an advisory names before it summarizes. */
+const UNDECLARED_SAMPLE = 5;
+/**
+ * The one sentence describing leftover stored fields, so every surface words it
+ * the same way. Names only — the values stay in the vault, and a field name from
+ * a previous declaration is not a secret. Deliberately reassuring: nothing is
+ * broken, and the only thing an operator gains by acting is that a connector
+ * iterating `getAll()` stops seeing a field its code no longer knows about.
+ */
+export function describeUndeclaredCredentialFields(fields) {
+    const shown = fields.slice(0, UNDECLARED_SAMPLE);
+    const rest = fields.length - shown.length;
+    const named = shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
+    return fields.length === 1
+        ? `Stored credential also holds a field this connector no longer declares (${named}). It keeps working; replace the credential to drop it.`
+        : `Stored credential also holds fields this connector no longer declares (${named}). It keeps working; replace the credential to drop them.`;
+}
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export function credentialTestRule(connector) {
+    if (!connector.credential)
+        return { mode: null };
+    if (connector.credential.fields?.length) {
+        if (connector.testCredentials)
+            return { mode: "multiple" };
+        return connector.testCredential
+            ? { mode: null, mismatch: { shape: "multiple", hook: "testCredential" } }
+            : { mode: null };
+    }
+    if (connector.testCredential)
+        return { mode: "single" };
+    return connector.testCredentials
+        ? { mode: null, mismatch: { shape: "single", hook: "testCredentials" } }
+        : { mode: null };
+}
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export function describeCredentialTestMismatch(mismatch) {
+    return mismatch.shape === "multiple"
+        ? "it declares named credential fields, which only " +
+            "`testCredentials(values, ctx)` can test, but implements " +
+            "`testCredential`"
+        : "it declares a single-value credential, which only " +
+            "`testCredential(value, ctx)` can test, but implements " +
+            "`testCredentials`";
+}

package/dist/credentials.d.ts

@@ -1,107 +1,11 @@
-import type { Connector, ConnectorCredentialConfig, ConnectorCredentialValues, KVStorage } from "./types.js";
-interface CredentialFieldMetadata {
-    configured: true;
-    /** Only emitted when the value is long enough that four chars don't leak much. */
-    lastFour?: string;
-    updatedAt: string;
-}
-export interface CredentialMetadata {
-    configured: true;
-    /** Backward-compatible metadata for the reserved single credential field. */
-    lastFour?: string;
-    updatedAt: string;
-    /** Per-field masked metadata for named multi-value credentials. */
-    fields?: Record<string, CredentialFieldMetadata>;
-}
-/** Which hook a testable credential is checked with. */
-type CredentialTestMode = "single" | "multiple";
-/** Operator-safe explanation shared by every surface that detects shape drift. */
-export declare const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
-export type StoredCredentialShape = {
-    state: "missing";
-} | {
-    state: "valid";
-    mode: CredentialTestMode;
-    /**
-     * Stored keys the connector no longer declares, sorted. Harmless — the
-     * credential works — but worth telling an operator about, since nothing
-     * else in `/ui` can show a field the declaration has stopped naming.
-     */
-    undeclared: string[];
-} | {
-    state: "mismatch";
-    mode: CredentialTestMode;
-    message: typeof STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR;
-};
-/**
- * Compare a connector's current declaration with the keys in its stored
- * credential. Values are deliberately ignored: callers may pass decrypted
- * values or `/credentials`' masked field metadata and get the same answer.
- *
- * The test is CONTAINMENT, not equality: the stored key set is compatible when
- * it holds every field currently declared — the reserved `value` key for a
- * single-value declaration, every declared name for a named one. Anything the
- * declaration asks for and the vault does not have is `mismatch`, which is
- * precisely what a renamed field, a newly added field, or a swap between the
- * two shapes produces. The swap needs no special case: `value` is never one of
- * the declared names, so single→named and named→single each leave the declared
- * side unsatisfied. An empty stored map (reachable through a hand-written
- * plaintext) satisfies nothing and is a mismatch too.
- *
- * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
- * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
- * `getAll().apiKey` — keeps returning the right secret across that redeploy.
- * Calling it drift would order an operator to re-enter a working secret that
- * many providers will not reissue in readable form. The leftovers come back as
- * `undeclared` instead, for a surface to mention without blocking anything.
- */
-export declare function storedCredentialShape(config: ConnectorCredentialConfig, stored: Readonly<Record<string, unknown>> | null): StoredCredentialShape;
-/**
- * The one sentence describing leftover stored fields, so every surface words it
- * the same way. Names only — the values stay in the vault, and a field name from
- * a previous declaration is not a secret. Deliberately reassuring: nothing is
- * broken, and the only thing an operator gains by acting is that a connector
- * iterating `getAll()` stops seeing a field its code no longer knows about.
- */
-export declare function describeUndeclaredCredentialFields(fields: string[]): string;
-/** A declared credential shape whose only test hook cannot test it. */
-export interface CredentialTestMismatch {
-    /** The shape the connector declared. */
-    shape: CredentialTestMode;
-    /** The hook it implements, which that shape cannot use. */
-    hook: "testCredential" | "testCredentials";
-}
-export interface CredentialTestRule {
-    /** The hook to call, or null when this credential cannot be tested at all. */
-    mode: CredentialTestMode | null;
-    /** Set only when the sole implemented hook is the one the shape cannot use. */
-    mismatch?: CredentialTestMismatch;
-}
-/**
- * The one rule deciding whether a connector's credential can be tested — read
- * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
- * it picks a hook, and by the construction-time mismatch warning, so those
- * three cannot drift apart.
- *
- * The declared credential *shape* selects the hook: named `credential.fields`
- * are tested as a set by `testCredentials`, a single-value `credential` by
- * `testCredential` on the vault's reserved `value` field. The other hook is
- * never substituted — it would be handed a shape the connector never declared —
- * so a connector implementing only the mismatched hook is not testable, and
- * says so at construction rather than under an operator's click.
- */
-export declare function credentialTestRule(connector: Pick<Connector, "credential" | "testCredential" | "testCredentials">): CredentialTestRule;
-/**
- * One clause naming a mismatch, shared by the startup warning and the test
- * route's 400 so an operator reads the same explanation in both places.
- */
-export declare function describeCredentialTestMismatch(mismatch: CredentialTestMismatch): string;
+import type { CredentialMetadata, CredentialVault as Vault } from "./credential-contract.js";
+import type { ConnectorCredentialValues, KVStorage } from "./types.js";
 /**
  * Encrypted, connector-scoped credential vault over the deployment's existing
  * KVStorage. Only ciphertext enters KV; the AES-GCM key remains an environment
  * secret outside the store.
  */
-export declare class CredentialVault {
+export declare class CredentialVault implements Vault {
     private readonly storage;
     private readonly key;
     constructor(storage: KVStorage, encryptionKey: string);
@@ -114,4 +18,4 @@ export declare class CredentialVault {
     setAll(connectorId: string, values: ConnectorCredentialValues, updatedBy: string, owner?: string): Promise<CredentialMetadata>;
     delete(connectorId: string, owner?: string): Promise<void>;
 }
-export {};
+export declare function encryptedCredentialVault(storage: KVStorage, encryptionKey: string): Vault;

package/dist/credentials.js

@@ -3,113 +3,6 @@ const IV_BYTES = 12;
 const MAX_CREDENTIAL_BYTES = 16_384;
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
-/** Operator-safe explanation shared by every surface that detects shape drift. */
-export const STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR = "Stored credential fields do not match this connector's current declaration. Replace the credential before using or testing this connector.";
-/**
- * Compare a connector's current declaration with the keys in its stored
- * credential. Values are deliberately ignored: callers may pass decrypted
- * values or `/credentials`' masked field metadata and get the same answer.
- *
- * The test is CONTAINMENT, not equality: the stored key set is compatible when
- * it holds every field currently declared — the reserved `value` key for a
- * single-value declaration, every declared name for a named one. Anything the
- * declaration asks for and the vault does not have is `mismatch`, which is
- * precisely what a renamed field, a newly added field, or a swap between the
- * two shapes produces. The swap needs no special case: `value` is never one of
- * the declared names, so single→named and named→single each leave the declared
- * side unsatisfied. An empty stored map (reachable through a hand-written
- * plaintext) satisfies nothing and is a mismatch too.
- *
- * Extra keys are NOT drift. They are what *dropping* a field leaves behind, and
- * every accessor a connector actually uses — `ctx.credential.get("apiKey")`,
- * `getAll().apiKey` — keeps returning the right secret across that redeploy.
- * Calling it drift would order an operator to re-enter a working secret that
- * many providers will not reissue in readable form. The leftovers come back as
- * `undeclared` instead, for a surface to mention without blocking anything.
- */
-export function storedCredentialShape(config, stored) {
-    if (!stored)
-        return { state: "missing" };
-    const mode = config.fields?.length
-        ? "multiple"
-        : "single";
-    const declared = new Set(mode === "multiple" ? config.fields.map((field) => field.name) : ["value"]);
-    const actual = Object.keys(stored);
-    const present = new Set(actual);
-    for (const field of declared) {
-        if (!present.has(field)) {
-            return {
-                state: "mismatch",
-                mode,
-                message: STORED_CREDENTIAL_SHAPE_MISMATCH_ERROR,
-            };
-        }
-    }
-    return {
-        state: "valid",
-        mode,
-        undeclared: actual.filter((field) => !declared.has(field)).sort(),
-    };
-}
-/** How many leftover field names an advisory names before it summarizes. */
-const UNDECLARED_SAMPLE = 5;
-/**
- * The one sentence describing leftover stored fields, so every surface words it
- * the same way. Names only — the values stay in the vault, and a field name from
- * a previous declaration is not a secret. Deliberately reassuring: nothing is
- * broken, and the only thing an operator gains by acting is that a connector
- * iterating `getAll()` stops seeing a field its code no longer knows about.
- */
-export function describeUndeclaredCredentialFields(fields) {
-    const shown = fields.slice(0, UNDECLARED_SAMPLE);
-    const rest = fields.length - shown.length;
-    const named = shown.join(", ") + (rest > 0 ? `, and ${rest} more` : "");
-    return fields.length === 1
-        ? `Stored credential also holds a field this connector no longer declares (${named}). It keeps working; replace the credential to drop it.`
-        : `Stored credential also holds fields this connector no longer declares (${named}). It keeps working; replace the credential to drop them.`;
-}
-/**
- * The one rule deciding whether a connector's credential can be tested — read
- * by /credentials' `testable` flag, by `POST /ui/credentials/<id>/test` when
- * it picks a hook, and by the construction-time mismatch warning, so those
- * three cannot drift apart.
- *
- * The declared credential *shape* selects the hook: named `credential.fields`
- * are tested as a set by `testCredentials`, a single-value `credential` by
- * `testCredential` on the vault's reserved `value` field. The other hook is
- * never substituted — it would be handed a shape the connector never declared —
- * so a connector implementing only the mismatched hook is not testable, and
- * says so at construction rather than under an operator's click.
- */
-export function credentialTestRule(connector) {
-    if (!connector.credential)
-        return { mode: null };
-    if (connector.credential.fields?.length) {
-        if (connector.testCredentials)
-            return { mode: "multiple" };
-        return connector.testCredential
-            ? { mode: null, mismatch: { shape: "multiple", hook: "testCredential" } }
-            : { mode: null };
-    }
-    if (connector.testCredential)
-        return { mode: "single" };
-    return connector.testCredentials
-        ? { mode: null, mismatch: { shape: "single", hook: "testCredentials" } }
-        : { mode: null };
-}
-/**
- * One clause naming a mismatch, shared by the startup warning and the test
- * route's 400 so an operator reads the same explanation in both places.
- */
-export function describeCredentialTestMismatch(mismatch) {
-    return mismatch.shape === "multiple"
-        ? "it declares named credential fields, which only " +
-            "`testCredentials(values, ctx)` can test, but implements " +
-            "`testCredential`"
-        : "it declares a single-value credential, which only " +
-            "`testCredential(value, ctx)` can test, but implements " +
-            "`testCredentials`";
-}
 function storageKey(connectorId, owner) {
     return owner
         ? `principal:${owner}:conn:${connectorId}:credential:v1`
@@ -290,3 +183,6 @@ export class CredentialVault {
         await this.storage.delete(storageKey(connectorId, owner));
     }
 }
+export function encryptedCredentialVault(storage, encryptionKey) {
+    return new CredentialVault(storage, encryptionKey);
+}

package/dist/index.d.ts

@@ -1,34 +1,9 @@
+import type { CredentialVault } from "./credential-contract.js";
 import { Registry } from "./registry.js";
-import type { ActivityReadGate, ActivityStore } from "./activity.js";
-import type { AuthenticatedIdentity, Connector, ConnectaBranding, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
-/** Payload-free activity storage and operator-read policy. */
-export interface ConnectaActivityConfig {
-    /**
-     * Privacy-minimal downstream tool activity storage. Writes are best-effort
-     * and never change tool results. Implement `list` to enable the Activity UI.
-     */
-    store: ActivityStore;
-    /**
-     * Optional authorization gate for the Activity read API. MCP authentication
-     * is still required first. Omit to admit every authenticated actor.
-     */
-    readGate?: ActivityReadGate;
-    /** Stable deployment label included in activity events, e.g. "production". */
-    deploymentId?: string;
-}
-/** Operator-vault encryption. */
-export interface ConnectaCredentialsConfig {
-    /**
-     * Base64-encoded 32-byte AES key for credentials managed on /credentials.
-     * Keep this in the runtime's secret store, never in KV or source control.
-     */
-    encryptionKey?: string;
-}
-/** Operator-issued credentials for clients connecting to this deployment. */
-export interface ConnectaAccessTokensConfig {
-    /** Maximum simultaneously active access tokens. Defaults to 100. */
-    maxActive?: number;
-}
+import type { ActivityModule, OperatorSurface } from "./module-contracts.js";
+export type { ActivityModule, OperatorSurface } from "./module-contracts.js";
+export type { CredentialVault, CredentialMetadata } from "./credential-contract.js";
+import type { AuthenticatedIdentity, Connector, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
 /** Tool-catalog caching, persistence, stale fallback, and probe deadlines. */
 export interface ConnectaDiscoveryConfig {
     /**
@@ -116,22 +91,22 @@ export interface ConnectaAdmissionConfig {
     code?: AdmissionPoolConfig;
 }
 /** Config-owned identity rules for one deployment and tenant. */
+export type ConnectorPermission = "all" | "none" | readonly string[];
 export interface ConnectaIdentityConfig {
     /** Connector ids this admitted identity may discover and call. */
     connectorAccess?(identity: Readonly<AuthenticatedIdentity>): "all" | readonly string[] | Promise<"all" | readonly string[]>;
-    /**
-     * Whether a human may manage deployment access tokens and global activity.
-     * Connector access already permits that human to manage the visible
-     * connector's shared or personal auth. Omit to preserve the existing
-     * all-interactive-humans operator rule.
-     */
-    operatorAccess?(principal: Readonly<IdentityReference>): boolean | Promise<boolean>;
+    /** Global payload-free activity reads. Defaults to interactive humans. */
+    activityAccess?(principal: Readonly<IdentityReference>): boolean | Promise<boolean>;
+    /** Shared credential and OAuth administration. Defaults to none. */
+    credentialAdministration?(identity: Readonly<AuthenticatedIdentity>): ConnectorPermission | Promise<ConnectorPermission>;
+    /** Connecting or changing the caller's personal account. Defaults to none. */
+    personalConnection?(identity: Readonly<AuthenticatedIdentity>): ConnectorPermission | Promise<ConnectorPermission>;
 }
 export interface ConnectaConfig {
     connectors: Connector[];
     /** Inbound auth adapters. Includes bearerToken(...); omit for open (dev). */
     auth?: InboundAuth | InboundAuth[];
-    /** Identity-derived connector visibility and deployment operator membership. */
+    /** Code-derived connection visibility and independent management permissions. */
     identity?: ConnectaIdentityConfig;
     /** KVStorage impl. Defaults to memoryStorage(). */
     storage?: KVStorage;
@@ -140,15 +115,12 @@ export interface ConnectaConfig {
      * HTTPS URL also redirects matching inbound HTTP requests to HTTPS.
      */
     publicUrl?: string;
-    /** Payload-free tool activity storage and operator-read policy. */
-    activity?: ConnectaActivityConfig;
-    /** Operator credential vault settings. */
-    credentials?: ConnectaCredentialsConfig;
-    /**
-     * Named, revocable Bearer tokens for MCP clients. Creation and mutation
-     * require an eligible interactive operator; token secrets are returned once.
-     */
-    accessTokens?: ConnectaAccessTokensConfig;
+    /** Optional recorder and reader, created by activityHistory() from /activity. */
+    activity?: ActivityModule;
+    /** Replaceable owner-partitioned credential storage. Omit for config-owned secrets. */
+    vault?: CredentialVault;
+    /** Optional connection UI, created by operatorUi() from /ui. */
+    ui?: OperatorSurface;
     /** Tool-catalog caching, persistence, stale fallback, and probe deadlines. */
     discovery?: ConnectaDiscoveryConfig;
     /** Deployment-wide call deadlines and result paging threshold. */
@@ -157,9 +129,8 @@ export interface ConnectaConfig {
     execute?: ConnectaExecuteConfig;
     /** Bounded MCP and fallback code-mode admission. */
     admission?: ConnectaAdmissionConfig;
-    /** Optional browser UI and OAuth result-page labels. */
-    branding?: ConnectaBranding;
-    logger?: Logger;
+    /** Diagnostic output. Use "silent" to disable all diagnostic logging. */
+    logger?: Logger | "silent";
     serverInfo?: {
         name?: string;
         version?: string;
@@ -198,14 +169,10 @@ export { ConnectorCallError } from "./errors.js";
 export type { ConnectorCallErrorCode, CallErrorDetails } from "./errors.js";
 export { validateToolInput } from "./validate.js";
 export type { ValidateToolInputOptions } from "./validate.js";
-export { bearerToken } from "./auth/bearer.js";
-export type { BearerTokenOptions } from "./auth/bearer.js";
-export type { AccessTokenMetadata, CreatedAccessToken, } from "./access-tokens.js";
 export { memoryStorage } from "./storage/memory.js";
 export { CONNECTA_VERSION } from "./version.js";
 export type { Registry } from "./registry.js";
 export type { RemoteMcpOptions, RemoteMcpAuth, RemoteMcpRedirectPolicy, } from "./connectors/remote-mcp.js";
 export type { ApiOptions, ApiTool } from "./connectors/api.js";
-export type { CatalogDriftCounts, CatalogDriftReport, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectaBranding, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
+export type { CatalogDriftCounts, CatalogDriftReport, ConnectaBranding, Connector, ConnectorCallAdmissionInput, ConnectorCallAdmissionPolicy, ConnectorCallAdmissionRule, ConnectorRollingWindowBudget, ConnectorCredentialAccess, ConnectorCredentialConfig, ConnectorCredentialFieldConfig, ConnectorCredentialValues, ConnectorContext, ConnectorUsageGuide, ConnectorStatus, CredentialTestResult, AdmittingExecutor, AdmissionSnapshot, ExecuteResult, Executor, ExecutorLease, ExecutorProvider, InboundAuth, InboundAuthRuntimeContext, UiAuthConfig, AuthResult, AuthenticatedIdentity, IdentityReference, JsonSchema, KVStorage, Logger, ToolDef, ToolAnnotations, } from "./types.js";
 export type { ActivityActor, ActivityCallSource, ActivityOutcome, ActivityPage, ActivityReadActor, ActivityReadEvent, ActivityReader, ActivityReadGate, ActivityReadPage, ActivitySink, ActivityStore, AgentFriction, CatalogDriftActivityEvent, ToolCallActivityEvent, } from "./activity.js";
-export { InvalidActivityCursorError } from "./activity.js";