@zackbart/connecta 0.23.0 → 0.24.0

package/dist/index.js

@@ -1,8 +1,7 @@
-import { CredentialVault, credentialTestRule, describeCredentialTestMismatch, } from "./credentials.js";
-import { AccessTokenManager } from "./access-tokens.js";
+import { credentialTestRule, describeCredentialTestMismatch, } from "./credential-rules.js";
 import { Registry } from "./registry.js";
 import { createFetchHandler } from "./server.js";
-import { droppedBrandingUrls, droppedUiAuthUrls } from "./ui.js";
+import { droppedBrandingUrls, droppedUiAuthUrls } from "./branding.js";
 import { memoryStorage } from "./storage/memory.js";
 import { CONNECTA_VERSION } from "./version.js";
 import { AdmissionController, executorName, isAdmittingExecutor, withExecutorAdmission, } from "./executor-admission.js";
@@ -53,21 +52,15 @@ const CONFIG_SCHEMA = {
     auth: null,
     identity: {
         connectorAccess: null,
-        operatorAccess: null,
+        activityAccess: null,
+        credentialAdministration: null,
+        personalConnection: null,
     },
     storage: null,
     publicUrl: null,
-    activity: {
-        store: null,
-        readGate: null,
-        deploymentId: null,
-    },
-    credentials: {
-        encryptionKey: null,
-    },
-    accessTokens: {
-        maxActive: null,
-    },
+    activity: null,
+    vault: null,
+    ui: null,
     discovery: {
         concurrency: null,
         catalogTtlSeconds: null,
@@ -87,20 +80,6 @@ const CONFIG_SCHEMA = {
         requests: admissionPoolSchema,
         code: admissionPoolSchema,
     },
-    branding: {
-        productName: null,
-        productUrl: null,
-        ownerName: null,
-        ownerUrl: null,
-        description: null,
-        pageTitle: null,
-        favicon: {
-            svg: null,
-            ico: null,
-            href: null,
-        },
-        themeColor: null,
-    },
     logger: null,
     serverInfo: {
         name: null,
@@ -144,17 +123,24 @@ function rejectUnknownOptions(paths) {
     if (paths.length === 0)
         return;
     throw new Error(`Unknown Connecta configuration option${paths.length === 1 ? "" : "s"}:\n` +
-        paths.map((path) => `- ${path}`).join("\n"));
+        paths.map((path) => `- ${path}`).join("\n") +
+        (paths.includes("ConnectaConfig.credentials") ? "\nUse vault: encryptedCredentialVault(storage, key) from @zackbart/connecta/credentials." : "") +
+        (paths.includes("ConnectaConfig.accessTokens") ? "\nConnecta-issued tokens were removed. Configure an inbound auth adapter instead." : "") +
+        (paths.includes("ConnectaConfig.branding") ? "\nMove branding into ui: operatorUi({ branding }) from @zackbart/connecta/ui." : ""));
 }
 /** Reject JavaScript typos and removed options before construction does work. */
 function assertKnownConfig(config) {
     rejectUnknownOptions(unknownOptionPaths(config, "ConnectaConfig", CONFIG_SCHEMA));
+    if (config.vault && ["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function"))
+        throw new Error("ConnectaConfig.vault must implement CredentialVault");
+    if (config.ui && (typeof config.ui.handle !== "function" || typeof config.ui.credentialHandoffUrl !== "function" || !Array.isArray(config.ui.reservedPaths)))
+        throw new Error("ConnectaConfig.ui must be created with operatorUi(...)");
     const activity = config.activity;
     if (activity !== undefined &&
         (typeof activity !== "object" ||
             activity === null ||
-            typeof activity.store?.record !== "function")) {
-        throw new Error("ConnectaConfig.activity.store must implement record(event)");
+            typeof activity.recordTool !== "function")) {
+        throw new Error("ConnectaConfig.activity must be created with activityHistory(...)");
     }
 }
 /**
@@ -171,7 +157,7 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     if (inboundAuth.length === 0 &&
         (hasCredentialConnector || oauthConnectors.length > 0)) {
         logger.warn("[connecta] running with no inbound authentication: any caller can " +
-            "invoke every connector and read or overwrite stored credentials. " +
+            "invoke every shared connector. " +
             "Configure `auth` (for example bearerToken(...) or Clerk) to gate access.");
     }
     // Unset publicUrl with OAuth connectors: the downstream redirect_uri is
@@ -186,7 +172,7 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     // Branding URLs that failed their scheme gate. Rendering silently falls back
     // (a bad URL must not take the page down), so this warning is the only way an
     // operator learns their value never reached the page.
-    const dropped = droppedBrandingUrls(config.branding);
+    const dropped = droppedBrandingUrls(config.ui?.branding);
     if (dropped.length > 0) {
         logger.warn(`[connecta] branding ${dropped.join(", ")} dropped: a branding URL is ` +
             "used as an href, so it must be an absolute http(s) URL (favicon.href " +
@@ -250,26 +236,11 @@ export function createConnecta(config) {
             '"@cloudflare/codemode" on Workers.');
     }
     const storage = config.storage ?? memoryStorage();
-    const logger = config.logger ?? defaultLogger();
-    const credentialConnectors = config.connectors.filter((c) => c.credential);
-    const encryptionKey = config.credentials?.encryptionKey;
-    if (credentialConnectors.length > 0 && !encryptionKey) {
-        logger.warn("Human-managed credentials are unavailable because " +
-            "credentials.encryptionKey is not configured for connectors: " +
-            credentialConnectors.map((c) => c.id).join(", "));
-    }
-    const credentialVault = encryptionKey
-        ? new CredentialVault(storage, encryptionKey)
-        : undefined;
+    const logger = config.logger === "silent"
+        ? { debug() { }, info() { }, warn() { }, error() { } }
+        : config.logger ?? defaultLogger();
+    const credentialVault = config.vault;
     const configuredAuth = normalizeAuth(config.auth);
-    const accessTokens = config.accessTokens
-        ? new AccessTokenManager(storage, config.accessTokens)
-        : undefined;
-    if (accessTokens &&
-        !configuredAuth.some((provider) => provider.interactiveOperator)) {
-        throw new Error("accessTokens requires an interactive operator auth provider: only an eligible " +
-            "operator may create, rename, or revoke deployment access tokens");
-    }
     const serverInfo = {
         ...config.serverInfo,
         name: config.serverInfo?.name ?? "connecta",
@@ -279,9 +250,11 @@ export function createConnecta(config) {
         storage,
         logger,
         credentialVault,
+        credentialUi: Boolean(config.ui),
         catalogDriftActivity: config.activity?.store
             ? {
                 sink: config.activity.store,
+                recordDrift: config.activity.recordDrift,
                 serverInfo,
                 ...(config.activity.deploymentId !== undefined
                     ? { deploymentId: config.activity.deploymentId }
@@ -293,7 +266,7 @@ export function createConnecta(config) {
         toolCatalogStaleSeconds: config.discovery?.staleCatalogSeconds,
         maxResultBytes: config.calls?.maxResultBytes,
     });
-    const inboundAuth = normalizeAuth(accessTokens ? [accessTokens.auth, ...configuredAuth] : configuredAuth);
+    const inboundAuth = configuredAuth;
     warnInsecureConfig(config, inboundAuth, logger);
     const requestAdmission = admissionController(config.admission?.requests, REQUEST_ADMISSION_DEFAULTS);
     const configuredCodeAdmission = admissionController(config.admission?.code, CODE_ADMISSION_DEFAULTS);
@@ -319,6 +292,7 @@ export function createConnecta(config) {
         serverInfo,
         logger,
         activity: config.activity?.store,
+        activityModule: config.activity,
         activityReadGate: config.activity?.readGate,
         activityDeploymentId: config.activity?.deploymentId,
         executor,
@@ -330,9 +304,9 @@ export function createConnecta(config) {
         maxEmittedBytes: config.execute?.maxEmittedBytes,
         maxEmittedBlocks: config.execute?.maxEmittedBlocks,
         credentialVault,
-        accessTokens,
+        ui: config.ui,
         deploymentInfo: config.deploymentInfo,
-        branding: config.branding,
+        branding: config.ui?.branding,
     });
     let closePromise;
     return {
@@ -358,7 +332,5 @@ export { ConnectorCallError } from "./errors.js";
 // implement the Connector interface directly. Returns the error rather than
 // throwing so the caller decides what to do with it.
 export { validateToolInput } from "./validate.js";
-export { bearerToken } from "./auth/bearer.js";
 export { memoryStorage } from "./storage/memory.js";
 export { CONNECTA_VERSION } from "./version.js";
-export { InvalidActivityCursorError } from "./activity.js";

package/dist/invocation.js

@@ -1,4 +1,3 @@
-import { recordToolActivity, } from "./activity.js";
 import { isCallAdmissionError } from "./call-admission.js";
 import { classifyCallError, ConnectorCallError, echoedCallArgs, framingError, } from "./errors.js";
 import { unwrapMcpResult } from "./mcp-result.js";
@@ -28,7 +27,7 @@ function callerCancelledDetails() {
 function recoveryMode(registry, connector, baseUrl) {
     if (connector.startAuth)
         return "oauth";
-    if (connector.credential &&
+    if (registry.credentialUiAvailable() && connector.credential &&
         registry.contextFor(connector.id, baseUrl).credential) {
         return "operator_config";
     }
@@ -116,7 +115,7 @@ export class InvocationService {
                 : attempted;
             if (!identity)
                 return;
-            recordToolActivity(this.activity, {
+            this.activity?.recordTool?.(this.activity, {
                 connectorId: identity.connectorId,
                 toolName: identity.toolName,
                 address: `${identity.connectorId}.${identity.toolName}`,

package/dist/meta-tools.d.ts

@@ -94,6 +94,8 @@ export declare function createMetaTools(registry: RegistryView, baseUrl: string,
     /** Maximum simultaneous connector discovery operations. Default 4. */
     discoveryConcurrency?: number | undefined;
     activity?: ActivityRequestContext | undefined;
+    canManageAuth?: ((id: string) => boolean) | undefined;
+    credentialHandoffUrl?: string | undefined;
     /** Inbound request cancellation shared by every call this request makes. */
     requestSignal?: AbortSignal | undefined;
     /** Runtime-owned tail for stale catalog refreshes. */
@@ -120,6 +122,8 @@ export declare function registerMetaTools(server: McpServer, registry: RegistryV
     probeTimeoutMs?: number | undefined;
     discoveryConcurrency?: number | undefined;
     activity?: ActivityRequestContext | undefined;
+    canManageAuth?: ((id: string) => boolean) | undefined;
+    credentialHandoffUrl?: string | undefined;
     requestSignal?: AbortSignal | undefined;
     defer?: DeferredWork | undefined;
 }): void;

package/dist/meta-tools.js

@@ -448,12 +448,12 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                     });
                 }
                 const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
-                if (!ctx.credential) {
+                if (!ctx.credential || !opts.credentialHandoffUrl) {
                     return jsonResult({
                         connector: connector.id,
                         recovery: "unavailable",
-                        message: "Credential storage is not configured. Configure " +
-                            "credentials.encryptionKey, redeploy, then call " +
+                        message: "Credential recovery needs both a vault and the optional UI. Configure " +
+                            "vault and ui in deployment code, then call " +
                             "authorize_connector again.",
                     });
                 }
@@ -474,7 +474,7 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                         label: connector.credential.label,
                         fields,
                     },
-                    operatorUrl: new URL("/credentials", baseUrl).toString(),
+                    operatorUrl: opts.credentialHandoffUrl,
                     instructions: "Have the operator open operatorUrl, set and test the credential, " +
                         "then retry the original call. No redeploy is needed. " +
                         (connector.authScope === "personal"
@@ -482,6 +482,8 @@ export function createMetaTools(registry, baseUrl, opts = {}) {
                             : "Shared credential mutation requires a signed-in human with access to this connector."),
                 });
             }
+            if (!opts.canManageAuth?.(connector.id))
+                return jsonResult({ connector: connector.id, recovery: "unavailable", message: "Your identity is not permitted to manage authentication for this connection." });
             const ctx = registry.contextFor(connector.id, baseUrl, requestScope);
             try {
                 const status = await connector.startAuth(ctx, args.force !== undefined ? { force: args.force } : {});
@@ -581,6 +583,8 @@ export function registerMetaTools(server, registry, ctx) {
         probeTimeoutMs: ctx.probeTimeoutMs,
         discoveryConcurrency: ctx.discoveryConcurrency,
         activity: ctx.activity,
+        canManageAuth: ctx.canManageAuth,
+        credentialHandoffUrl: ctx.credentialHandoffUrl,
         requestSignal: ctx.requestSignal,
         defer: ctx.defer,
     });

package/dist/module-contracts.d.ts

@@ -0,0 +1,19 @@
+import type { ConnectaBranding } from "./types.js";
+import type { ActivityStore, ActivityReadGate, recordToolActivity, recordCatalogDriftActivity } from "./activity.js";
+import type { RouteContext } from "./routes/shared.js";
+/** Construction-time UI contract. Core never imports the implementation. */
+export interface OperatorSurface {
+    readonly branding?: ConnectaBranding;
+    readonly reservedPaths: readonly string[];
+    credentialHandoffUrl(baseUrl: string): string;
+    handle(context: RouteContext): Promise<Response | null>;
+}
+/** Optional recording and reading callbacks supplied by /activity. */
+export interface ActivityModule {
+    readonly store: ActivityStore;
+    readonly deploymentId?: string;
+    readonly readGate?: ActivityReadGate;
+    handle(context: RouteContext): Promise<Response | null>;
+    readonly recordTool: typeof recordToolActivity;
+    readonly recordDrift: typeof recordCatalogDriftActivity;
+}

package/dist/module-contracts.js

@@ -0,0 +1 @@
+export {};