@zackbart/connecta 0.24.2 → 0.24.4

package/dist/providers/revenuecat.js

@@ -3,7 +3,12 @@ import { vettedCatalog, withVettedCatalog } from "../catalog-drift.js";
 import { defined } from "../connectors/api.js";
 /** RevenueCat publishes one hosted MCP endpoint, streamable HTTP. */
 export const REVENUECAT_MCP_ENDPOINT = "https://mcp.revenuecat.ai/mcp";
-/** Reviewed reads; see `documentation/revenuecat.md` and convention P5. */
+/**
+ * Reviewed reads, every `Read` row of RevenueCat's tool reference as read on
+ * 2026-08-30 (P5). The list is a superset: plan, platform, and beta enrollment
+ * gate parts of the catalog, so a name this account never returns costs
+ * nothing while an unlisted new one fails closed.
+ */
 const READ_ONLY_TOOLS = new Set([
     // Projects and apps
     "get-account-billing",
@@ -70,26 +75,48 @@ const READ_ONLY_TOOLS = new Set([
     // *start* one are writes and sit below.
     "get-paywall-ai-task",
 ]);
-/** Reviewed writes and verb exceptions: `documentation/revenuecat.md`. */
+/**
+ * Reviewed writes with their destructive verdict. Most follow the verb, and
+ * additive writes stay additive because `readOnlyHint: false` already routes
+ * them through the approval path — asserting a destruction that does not happen
+ * only inflates the copy a human reads. The verdicts the verb does not decide
+ * carry their reason on the row.
+ *
+ * `render-paywall-screenshot` is deliberately in neither map: RevenueCat's
+ * reference gives it no access column, so the live annotation stands and a
+ * catalog that omits one fails closed. Guessing from a harmless-sounding name
+ * is what P5 exists to prevent.
+ */
 const WRITE_TOOLS = new Map([
     // Projects and apps
     ["create-app", "additive"],
     ["create-project", "additive"],
     ["update-app", "destructive"],
     ["update-project-ui-config", "destructive"],
+    // Filed `Write` by RevenueCat, so it cannot take the read path, but it leaves
+    // the saved credentials alone and only records a check's outcome.
     ["validate-app-credentials", "additive"],
     // Products and prices
     ["archive-product", "destructive"],
     ["create-product", "additive"],
+    // Named `create-`, but "Configure prices for a product": the price set
+    // already exists, so this overwrites it, and it is money-facing.
     ["create-product-prices", "destructive"],
+    // "Fills *missing* App Store subscription territory prices" — by
+    // RevenueCat's own word it writes only where nothing is set.
     ["equalize-subscription-prices", "additive"],
+    // An upsert.
     ["set-product-store-state", "destructive"],
+    // Sends products to Apple for review.
     ["submit-products-to-store", "destructive"],
     ["unarchive-product", "destructive"],
     ["update-product", "destructive"],
+    // Reserves a new App Store Connect review screenshot slot; replaces nothing.
     ["upload-product-store-state-screenshot", "additive"],
     // Entitlements
     ["archive-entitlement", "destructive"],
+    // Attach adds membership and removes nothing; detach is the destructive half.
+    // Filing both destructive would make the pair read identically to a human.
     ["attach-products-to-entitlement", "additive"],
     ["create-entitlement", "additive"],
     ["detach-products-from-entitlement", "destructive"],
@@ -97,6 +124,7 @@ const WRITE_TOOLS = new Map([
     ["update-entitlement", "destructive"],
     // Offerings and packages
     ["archive-offering", "destructive"],
+    // The attach/detach argument again, one level down.
     ["attach-products-to-package", "additive"],
     ["create-offering", "additive"],
     ["create-packages", "additive"],
@@ -110,6 +138,7 @@ const WRITE_TOOLS = new Map([
     // Paywalls
     ["attach-offering-to-paywall", "destructive"],
     ["detach-offering-from-paywall", "destructive"],
+    // Copies an existing paywall's current draft; the original is untouched.
     ["duplicate-paywall", "additive"],
     ["publish-paywall", "destructive"],
     ["unpublish-paywall", "destructive"],
@@ -130,14 +159,23 @@ const WRITE_TOOLS = new Map([
     ["unarchive-virtual-currency", "destructive"],
     ["update-virtual-currency", "destructive"],
     // Integrations and webhooks
+    // Destructive on consequence, not on the verb: no existing integration
+    // changes, but with filters omitted the new one starts delivering every
+    // customer event in the project to a URL the caller typed.
     ["create-webhook-integration", "destructive"],
     ["delete-webhook-integration", "destructive"],
     ["update-webhook-integration", "destructive"],
-    // Paywall editing
+    // Paywall editing. Both start an async task; the difference is what the task
+    // touches — a new paywall, or a draft that already exists.
     ["create-paywall-ai", "additive"],
     ["edit-paywall-ai", "destructive"],
 ]);
-/** Release-reviewed manifest; see provider conventions P5 and P13. */
+/**
+ * One release-reviewed manifest, used both to classify a live tool and as the
+ * baseline the drift check compares against, so the annotation a caller gets
+ * and the verdict a check reads can never disagree. Names and verdicts only —
+ * no schemas are vendored; the live `tools/list` response stays authoritative.
+ */
 export const REVENUECAT_VETTED_CATALOG = vettedCatalog({
     reads: READ_ONLY_TOOLS,
     writes: WRITE_TOOLS,

package/dist/providers/stripe.d.ts

@@ -40,7 +40,13 @@ export interface StripeHeaderOptions extends StripeCommonOptions {
     connectedAccount?: string;
 }
 export type StripeOptions = StripeOAuthOptions | StripeHeaderOptions;
-/** Release-reviewed manifest; see provider conventions P5 and P13. */
+/**
+ * One release-reviewed manifest, used both to classify a live tool and as the
+ * baseline the drift check compares against, so the annotation a caller gets and
+ * the verdict a check reads can never disagree. Stripe publishes no stability or
+ * deprecation policy for this tool set, so treat it as unversioned: an
+ * unclassified, unannotated name fails closed onto the approval path (P5).
+ */
 export declare const STRIPE_VETTED_CATALOG: import("../catalog-drift.js").VettedCatalog;
 /** A maintained Stripe hosted-MCP connection. */
 export declare function stripe(id: string, options: StripeOptions): Connector;

package/dist/providers/stripe.js

@@ -3,7 +3,14 @@ import { vettedCatalog, withVettedCatalog } from "../catalog-drift.js";
 import { defined } from "../connectors/api.js";
 /** Stripe publishes one hosted MCP endpoint for every account and mode. */
 export const STRIPE_MCP_ENDPOINT = "https://mcp.stripe.com/";
-/** Account limits and local concurrency rationale: `documentation/stripe.md`. */
+/**
+ * Stripe documents no MCP-specific limit, so these transcribe the account limit
+ * MCP traffic spends: 100 requests per second live, 25 in a sandbox. OAuth takes
+ * the sandbox rule (`mode ?? "sandbox"` below) because one session can reach
+ * either mode and the policy is fixed before the account-scoped call begins.
+ * The `maxConcurrency` figures are Connecta's own choice — Stripe says
+ * per-account and per-endpoint concurrency limits exist but publishes no number.
+ */
 const STRIPE_ADMISSION = {
     production: {
         rules: [
@@ -47,16 +54,30 @@ const READ_ONLY_TOOLS = new Set([
     "manage_stripe_accounts",
     "search_stripe_documentation",
 ]);
-/** Reviewed writes, including mixed read/create tools: `documentation/stripe.md`. */
+/**
+ * Reviewed writes with their destructive verdict. `stripe_api_write` is the
+ * sibling of `stripe_api_read` and carries every `POST`, `PATCH`, `PUT`, and
+ * `DELETE`. Additive writes leave `destructiveHint` unset: `readOnlyHint: false`
+ * already routes them through the approval path, and asserting destruction they
+ * do not perform would misstate their effect.
+ */
 const WRITE_TOOLS = new Map([
     ["stripe_api_write", "destructive"],
     ["create_refund", "destructive"],
+    // Creates and continues provider-side guide state; destroys nothing.
     ["stripe_implementation_planner", "additive"],
+    // Retrieval mixed with query-run creation behind one tool.
     ["stripe_analytics", "additive"],
     ["stripe_report", "additive"],
     ["send_stripe_mcp_feedback", "additive"],
 ]);
-/** Release-reviewed manifest; see provider conventions P5 and P13. */
+/**
+ * One release-reviewed manifest, used both to classify a live tool and as the
+ * baseline the drift check compares against, so the annotation a caller gets and
+ * the verdict a check reads can never disagree. Stripe publishes no stability or
+ * deprecation policy for this tool set, so treat it as unversioned: an
+ * unclassified, unannotated name fails closed onto the approval path (P5).
+ */
 export const STRIPE_VETTED_CATALOG = vettedCatalog({
     reads: READ_ONLY_TOOLS,
     writes: WRITE_TOOLS,
@@ -64,7 +85,12 @@ export const STRIPE_VETTED_CATALOG = vettedCatalog({
 /** Stripe key prefixes carry their own mode; only a clear reading counts. */
 const LIVE_KEY = /\b(?:sk|rk|pk)_live_/;
 const TEST_KEY = /\b(?:sk|rk|pk)_test_/;
-/** Refuse a recognizable key/mode mismatch; see `documentation/stripe.md`. */
+/**
+ * Refuse a recognizable key/mode mismatch. This is the only mode guard Connecta
+ * can offer, and it needs the key as a literal header to read the prefix: an
+ * operator-managed key is not in the deployment file, so its declared mode
+ * stands alone and a key pointed at the other environment fails at Stripe.
+ */
 function assertModeMatchesKey(id, mode, auth) {
     if (auth.type !== "headers")
         return;

package/dist/providers/vercel.js

@@ -1,4 +1,14 @@
-/** See documentation/vercel.md#no-sdk-on-purpose. */
+/**
+ * No `@vercel/sdk` on purpose — not a dependency and not an optional peer.
+ * Direct fetch keeps the root Workers-safe, avoids shipping the SDK's generated
+ * model graph, and lets the reviewed named operations and the REST hatches share
+ * one guarded transport. The trade is API drift, handled explicitly rather than
+ * by the SDK's version bumps: `scripts/drift/vercel-endpoints.json` records the
+ * method, versioned path, spec revision, and request/response digest for every
+ * fixed endpoint, and `npm run providers:check -- --provider vercel` compares
+ * those rows with Vercel's published OpenAPI document at
+ * https://openapi.vercel.sh/ without needing a credential.
+ */
 import { api, defined } from "../connectors/api.js";
 import { remoteMcp } from "../connectors/remote-mcp.js";
 import { vettedCatalog, withVettedCatalog } from "../catalog-drift.js";

package/dist/registry.d.ts

@@ -61,6 +61,10 @@ export interface RegistryOptions {
      * to the default 50_000.
      */
     maxResultBytes?: number | undefined;
+    results?: {
+        maxStashBytes?: number;
+        maxStashEntries?: number;
+    } | undefined;
     /**
      * Where payload-free catalog-drift observations go. Present only when the
      * deployment configured an activity store; drift is reported through
@@ -103,6 +107,8 @@ export interface RegistryView {
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
     resultsStorage(): KVStorage;
+    /** Reserve runtime-wide capacity before writing a paging envelope's chunks. */
+    stashResult(key: string, chunks: readonly string[], ttlSeconds: number): Promise<boolean>;
     /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
     credentialDriftFor(id: string): Promise<string | undefined>;
     /** Value-free shape learned from successful calls, never a provider declaration. */
@@ -156,9 +162,13 @@ export declare class Registry implements RegistryView {
     private readonly persistToolCatalog;
     /** Result-size guard cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
+    /** Only keys, byte counts, and expiry survive requests; never write promises. */
+    private readonly resultStash;
+    private resultStashBytes;
     private readonly configuredConnectors;
     private readonly personalRegistries;
-    /** `connector.tool` grants that matched nothing, warned once per isolate. */
+    private callAdmissionClosed;
+    /** Bounded FIFO of absent grants already warned about. */
     private readonly warnedAbsentGrants;
     constructor(connectors: Connector[], opts: RegistryOptions);
     personalRegistry(principalKey: string): Registry;
@@ -202,7 +212,7 @@ export declare class Registry implements RegistryView {
         args: unknown;
         signal?: AbortSignal;
     }): Promise<CallAdmissionPermit>;
-    /** Payload-free aggregate state for the open health endpoint. */
+    /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
     /**
      * Payload-free drift counts for the open health endpoint, so `connecta
@@ -230,6 +240,16 @@ export declare class Registry implements RegistryView {
     private observeCatalogDrift;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
+    /**
+     * Reserve capacity and write one ASCII paging envelope in this runtime.
+     *
+     * `chunks[0]` lands on `<prefix><key>` and `chunks[n]` on `<prefix><key>#<n>`
+     * — the layout get_result reads back, so a page fetches only the chunks it
+     * covers instead of the whole stored result (issue #540). Chunking is a
+     * read-cost decision, not a capacity one: however many keys an envelope
+     * occupies, it is one stash entry charged its total ASCII length.
+     */
+    stashResult(key: string, chunks: readonly string[], ttlSeconds: number, prefix?: string): Promise<boolean>;
     /**
      * Storage namespaced to the meta-tool result store (`results:` prefix), kept
      * separate from any connector's `conn:<id>:` namespace. Backs get_result.

package/dist/registry.js

@@ -1,7 +1,7 @@
 import { closeConnectorScope, } from "./connector-scope.js";
 import { storedCredentialShape, } from "./credential-rules.js";
 import { ConnectorCallError, msg } from "./errors.js";
-import { ConnectorCallAdmissionController, } from "./call-admission.js";
+import { ConnectorCallAdmissionController, aggregateCallAdmissionSnapshots, } from "./call-admission.js";
 import { boundedCatalogDrift } from "./catalog-drift.js";
 import { fingerprintSerializedCatalog, snapshotCatalog, } from "./catalog-fingerprint.js";
 import { MAX_CATALOG_CHUNK_BYTES, MAX_CATALOG_TOOLS, MAX_SERIALIZED_CATALOG_BYTES, } from "./catalog-limits.js";
@@ -80,6 +80,7 @@ function namespaced(storage, prefix) {
     };
 }
 const MAX_PERSONAL_REGISTRIES = 1_024;
+const MAX_ABSENT_GRANT_WARNINGS = 1_024;
 const OAUTH_HANDOFF_TTL_SECONDS = 15 * 60;
 async function sha256Hex(value) {
     const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
@@ -117,9 +118,13 @@ export class Registry {
     persistToolCatalog;
     /** Result-size guard cap threaded to the meta-tools. */
     maxResultBytes;
+    /** Only keys, byte counts, and expiry survive requests; never write promises. */
+    resultStash = new Map();
+    resultStashBytes = 0;
     configuredConnectors;
     personalRegistries = new Map();
-    /** `connector.tool` grants that matched nothing, warned once per isolate. */
+    callAdmissionClosed = false;
+    /** Bounded FIFO of absent grants already warned about. */
     warnedAbsentGrants = new Set();
     constructor(connectors, opts) {
         this.opts = opts;
@@ -174,18 +179,24 @@ export class Registry {
             this.personalRegistries.set(principalKey, existing);
             return existing;
         }
+        if (this.personalRegistries.size >= MAX_PERSONAL_REGISTRIES) {
+            // Eviction must not reset a live rolling budget or orphan queued calls.
+            const idle = [...this.personalRegistries].find(([, candidate]) => [...candidate.callAdmission.values()].every(admission => admission.isIdle()));
+            if (!idle) {
+                throw new Error("Personal connector capacity is exhausted; retry after calls and rolling budgets drain.");
+            }
+            idle[1].closeCallAdmission();
+            this.personalRegistries.delete(idle[0]);
+        }
         const registry = new Registry(this.configuredConnectors.filter((connector) => connector.authScope === "personal"), {
             ...this.opts,
             storage: namespaced(this.opts.storage, `principal:${principalKey}:`),
             credentialOwner: principalKey,
             constructionChecks: false,
         });
+        if (this.callAdmissionClosed)
+            registry.closeCallAdmission();
         this.personalRegistries.set(principalKey, registry);
-        const oldest = this.personalRegistries.keys().next().value;
-        if (this.personalRegistries.size > MAX_PERSONAL_REGISTRIES &&
-            typeof oldest === "string") {
-            this.personalRegistries.delete(oldest);
-        }
         return registry;
     }
     /** Build the only connector view an authenticated request receives. */
@@ -214,6 +225,11 @@ export class Registry {
         if (this.warnedAbsentGrants.has(key))
             return;
         this.warnedAbsentGrants.add(key);
+        if (this.warnedAbsentGrants.size > MAX_ABSENT_GRANT_WARNINGS) {
+            const oldest = this.warnedAbsentGrants.values().next().value;
+            if (oldest !== undefined)
+                this.warnedAbsentGrants.delete(oldest);
+        }
         // Grant names are operator data but may carry any non-control character;
         // quote them so a line terminator a log reader honours cannot forge a line.
         const quoted = JSON.stringify(key).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
@@ -345,11 +361,19 @@ export class Registry {
             return admission.acquire(input);
         return Promise.resolve({ waitMs: 0, release() { } });
     }
-    /** Payload-free aggregate state for the open health endpoint. */
+    /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot() {
-        return Object.fromEntries([...this.callAdmission].map(([id, admission]) => [
-            id,
-            admission.snapshot(),
+        const snapshots = new Map();
+        for (const [id, admission] of this.callAdmission) {
+            snapshots.set(id, [admission.snapshot()]);
+        }
+        for (const registry of this.personalRegistries.values()) {
+            for (const [id, admission] of registry.callAdmission) {
+                snapshots.get(id)?.push(admission.snapshot());
+            }
+        }
+        return Object.fromEntries([...snapshots].map(([id, values]) => [
+            id, aggregateCallAdmissionSnapshots(values),
         ]));
     }
     /**
@@ -416,8 +440,68 @@ export class Registry {
     }
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission() {
+        this.callAdmissionClosed = true;
         for (const admission of this.callAdmission.values())
             admission.close();
+        for (const registry of this.personalRegistries.values())
+            registry.closeCallAdmission();
+    }
+    /**
+     * Reserve capacity and write one ASCII paging envelope in this runtime.
+     *
+     * `chunks[0]` lands on `<prefix><key>` and `chunks[n]` on `<prefix><key>#<n>`
+     * — the layout get_result reads back, so a page fetches only the chunks it
+     * covers instead of the whole stored result (issue #540). Chunking is a
+     * read-cost decision, not a capacity one: however many keys an envelope
+     * occupies, it is one stash entry charged its total ASCII length.
+     */
+    async stashResult(key, chunks, ttlSeconds, prefix = "results:") {
+        const maxBytes = this.opts.results?.maxStashBytes ?? 8 * 1024 * 1024;
+        const maxEntries = this.opts.results?.maxStashEntries ?? 64;
+        // The paging envelope is ASCII, so its string length is its stored byte count.
+        const bytes = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+        if (bytes > maxBytes || maxEntries === 0)
+            return false;
+        const now = Date.now();
+        for (const [oldKey, entry] of this.resultStash) {
+            if (entry.busy || entry.expiresAt > now)
+                continue;
+            entry.busy = true;
+            try {
+                // TTL alone cannot reclaim a lazy backend. Keep the charge until deletion
+                // succeeds, including writes which persisted before throwing.
+                for (const staleKey of entry.keys)
+                    await this.opts.storage.delete(staleKey);
+                this.resultStash.delete(oldKey);
+                this.resultStashBytes -= entry.bytes;
+            }
+            finally {
+                entry.busy = false;
+            }
+        }
+        if (this.resultStash.size >= maxEntries || this.resultStashBytes + bytes > maxBytes)
+            return false;
+        const fullKey = prefix + key;
+        const keys = chunks.map((_, index) => index === 0 ? fullKey : `${fullKey}#${index}`);
+        const entry = { keys, bytes, expiresAt: Infinity, busy: true };
+        this.resultStash.set(fullKey, entry);
+        this.resultStashBytes += bytes;
+        try {
+            // Trailing chunks first: the header chunk is what makes an id readable, so
+            // a write that fails midway leaves no envelope pointing at absent chunks.
+            for (let index = keys.length - 1; index >= 0; index--) {
+                await this.opts.storage.set(keys[index], chunks[index], { ttlSeconds });
+            }
+            entry.expiresAt = Date.now() + ttlSeconds * 1000;
+            return true;
+        }
+        catch (error) {
+            entry.expiresAt = 0;
+            throw error;
+        }
+        finally {
+            entry.busy = false;
+        }
     }
     /**
      * Storage namespaced to the meta-tool result store (`results:` prefix), kept
@@ -1125,10 +1209,14 @@ class ScopedRegistryView {
         return registry.contextFor(...args);
     }
     admitCall(...args) {
-        if (!this.registryFor(args[0])) {
+        const registry = this.registryFor(args[0]);
+        if (!registry) {
             return Promise.reject(new Error(`Unknown connector "${args[0]}"`));
         }
-        return this.root.admitCall(...args);
+        return registry.admitCall(...args);
+    }
+    stashResult(key, chunks, ttlSeconds) {
+        return this.root.stashResult(key, chunks, ttlSeconds, this.scope.subjectKey ? `subject:${this.scope.subjectKey}:` : "results:");
     }
     resultsStorage() {
         return this.scope.subjectKey

package/dist/routes/mcp.d.ts

@@ -4,4 +4,7 @@ export declare const MCP_CORS_HEADERS: {
     "Access-Control-Allow-Methods": string;
     "Access-Control-Allow-Headers": string;
 };
-export declare function createMcpRoute(opts: ServerOptions): (context: RouteContext) => Promise<Response | null>;
+export declare function createMcpRoute(opts: ServerOptions): {
+    handle(context: RouteContext): Promise<Response | null>;
+    rejectOrigin(request: Request): Response | null;
+};

package/dist/routes/mcp.js

@@ -14,11 +14,26 @@ export const MCP_CORS_HEADERS = {
 // Browser-based MCP clients call /mcp cross-origin. Without CORS on every
 // response — errors included — the browser hides the 401, the client cannot
 // read WWW-Authenticate, and OAuth discovery silently never starts.
-function withMcpCors(response) {
+function withMcpCors(response, request, allowedOrigin) {
     const headers = new Headers(response.headers);
     for (const [name, value] of Object.entries(MCP_CORS_HEADERS)) {
         headers.set(name, value);
     }
+    headers.delete("Access-Control-Allow-Origin");
+    if (allowedOrigin !== null)
+        headers.set("Access-Control-Allow-Origin", allowedOrigin);
+    headers.append("Vary", "Origin");
+    if (request.method === "OPTIONS") {
+        // Browsers do not interpret a prefix wildcard in Allow-Headers. Echo only
+        // valid SEP-2243 field names; unrelated requested headers stay disallowed.
+        const paramHeaders = (request.headers.get("Access-Control-Request-Headers") ?? "")
+            .toLowerCase().split(",").map(name => name.trim())
+            .filter(name => /^mcp-param-[!#$%&'*+.^_`|~0-9a-z-]+$/.test(name));
+        if (paramHeaders.length) {
+            headers.append("Access-Control-Allow-Headers", [...new Set(paramHeaders)].join(", "));
+        }
+        headers.append("Vary", "Access-Control-Request-Headers");
+    }
     headers.set("Access-Control-Expose-Headers", "WWW-Authenticate, Retry-After, mcp-session-id, mcp-protocol-version");
     return new Response(response.body, {
         status: response.status,
@@ -46,7 +61,10 @@ function requestAdmissionFailure(error) {
         jsonrpc: "2.0",
         id: null,
         error: {
-            code: overloaded ? -32001 : -32002,
+            // MCP 2026-07-28 basic#error-codes forbids new allocations in the
+            // legacy -32000..-32019 range. Use application codes outside the
+            // JSON-RPC reserved range, avoiding retired protocol meanings.
+            code: overloaded ? -31001 : -31002,
             message: overloaded
                 ? "Server capacity is exhausted. Retry later."
                 : "Server is shutting down.",
@@ -244,6 +262,49 @@ async function serveMcp(request, opts, baseUrl, actor, registry, canManageAuth,
     return transport.handleRequest(request);
 }
 export function createMcpRoute(opts) {
+    const configuredOrigins = opts.allowedOrigins;
+    const isExactOrigin = (value) => {
+        if (typeof value !== "string")
+            return false;
+        try {
+            const url = new URL(value);
+            return (url.protocol === "http:" || url.protocol === "https:") && url.origin === value;
+        }
+        catch {
+            return false;
+        }
+    };
+    if (configuredOrigins !== undefined && configuredOrigins !== "*" &&
+        (!Array.isArray(configuredOrigins) || !configuredOrigins.every(isExactOrigin))) {
+        throw new TypeError('ConnectaConfig.allowedOrigins must be an array of exact HTTP(S) origins or "*".');
+    }
+    const origins = new Set(configuredOrigins === undefined
+        ? opts.publicUrl ? [new URL(opts.publicUrl).origin] : []
+        : configuredOrigins === "*" ? [] : configuredOrigins);
+    const allowsOrigin = (origin) => {
+        if (configuredOrigins === "*")
+            return true;
+        if (!isExactOrigin(origin))
+            return false;
+        if (origins.has(origin))
+            return true;
+        if (configuredOrigins !== undefined)
+            return false;
+        const hostname = new URL(origin).hostname;
+        return hostname === "localhost" || hostname === "[::1]" || /^127\.\d+\.\d+\.\d+$/.test(hostname);
+    };
+    const rejectOrigin = (request) => {
+        const path = new URL(request.url).pathname;
+        if (path !== "/mcp" && !path.startsWith("/mcp/"))
+            return null;
+        const origin = request.headers.get("Origin");
+        if (origin === null || allowsOrigin(origin))
+            return null;
+        return withMcpCors(new Response('{"error":"origin not allowed"}', {
+            status: 403,
+            headers: { "Content-Type": "application/json", "Cache-Control": "no-store" },
+        }), request, null);
+    };
     let lastAdmissionWarningAt = 0;
     let suppressedAdmissionWarnings = 0;
     const warnAdmissionRejected = (error) => {
@@ -261,12 +322,21 @@ export function createMcpRoute(opts) {
         lastAdmissionWarningAt = now;
         suppressedAdmissionWarnings = 0;
     };
-    return async function routeMcp(context) {
+    async function routeMcp(context) {
         const { path, request, baseUrl, runtimeContext, } = context;
-        const poolPath = /^\/mcp\/([a-z0-9_-]+)$/.exec(path);
-        if (path !== "/mcp" && !poolPath)
+        if (path !== "/mcp" && !path.startsWith("/mcp/"))
             return null;
-        const poolName = poolPath?.[1];
+        const poolName = path === "/mcp" ? undefined : path.slice("/mcp/".length);
+        const origin = request.headers.get("Origin");
+        const allowed = origin === null || allowsOrigin(origin);
+        const cors = (response) => withMcpCors(response, request, configuredOrigins === "*" ? "*" : allowed ? origin : null);
+        // DNS-rebinding refusals cost neither a permit nor an auth lookup. This
+        // local header check also guards OPTIONS before any provider metadata.
+        const refusal = rejectOrigin(request);
+        if (refusal)
+            return refusal;
+        if (request.method === "OPTIONS")
+            return cors(new Response(null, { status: 204 }));
         let admission;
         try {
             admission = await opts.requestAdmission.acquire({
@@ -289,14 +359,14 @@ export function createMcpRoute(opts) {
                 if (error.code === "executor_overloaded") {
                     warnAdmissionRejected(error);
                 }
-                return withMcpCors(requestAdmissionFailure(error));
+                return cors(requestAdmissionFailure(error));
             }
             throw error;
         }
         try {
             const authz = await authorize(request, baseUrl, opts.auth, runtimeContext, opts.identity);
             if (!authz.ok) {
-                return releaseAdmissionWithResponse(withMcpCors(authz.response), admission, request.signal);
+                return releaseAdmissionWithResponse(cors(authz.response), admission, request.signal);
             }
             // A pool endpoint narrows the identity's own view and nothing else. An
             // undeclared name, a grant that refuses, and a grant that throws are
@@ -319,7 +389,7 @@ export function createMcpRoute(opts) {
                 if (!pool || !granted) {
                     opts.logger.warn(`[connecta] refused /mcp/${poolName} with 404: pool ${reason}` +
                         (authz.actor.id ? ` for ${loggableValue(authz.actor.id)}` : ""));
-                    return releaseAdmissionWithResponse(withMcpCors(new Response("Not Found", { status: 404 })), admission, request.signal);
+                    return releaseAdmissionWithResponse(cors(new Response("Not Found", { status: 404 })), admission, request.signal);
                 }
                 access = intersectAccess(authz, pool.access);
             }
@@ -334,19 +404,20 @@ export function createMcpRoute(opts) {
                 });
             }
             catch (error) {
-                return releaseAdmissionWithResponse(withMcpCors(new Response(JSON.stringify({ error: msg(error) }), {
+                return releaseAdmissionWithResponse(cors(new Response(JSON.stringify({ error: msg(error) }), {
                     status: 403,
                     headers: { "Content-Type": "application/json" },
                 })), admission, request.signal);
             }
             if (new URL(request.url).searchParams.has("toolkit")) {
-                return releaseAdmissionWithResponse(withMcpCors(toolkitRetired(opts.logger)), admission, request.signal);
+                return releaseAdmissionWithResponse(cors(toolkitRetired(opts.logger)), admission, request.signal);
             }
-            return releaseAdmissionWithResponse(withMcpCors(await serveMcp(request, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext)), admission, request.signal);
+            return releaseAdmissionWithResponse(cors(await serveMcp(request, opts, baseUrl, authz.actor, scopedRegistry, id => { const connector = scopedRegistry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); }, runtimeContext)), admission, request.signal);
         }
         catch (error) {
             admission.release();
             throw error;
         }
-    };
+    }
+    return { handle: routeMcp, rejectOrigin };
 }

package/dist/routes/oauth.js

@@ -137,6 +137,10 @@ export async function routeOAuthCallback(context) {
         return refused();
     }
     const expectedPrincipalKey = callbackTarget?.principalKey;
+    // A browser returning from consent normally has no MCP Authorization
+    // header. An interactive bearer provider therefore answers 401 here; state
+    // and the saved state-to-principal handoff still prove ownership below.
+    // Rejecting 401 would break that callback. A 403 is an explicit denial.
     const browserIdentity = await authorizeUiIdentity(context.request, baseUrl, opts.auth, "OAuth callback", context.runtimeContext, opts.identity);
     if (browserIdentity.ok) {
         try {

package/dist/routes/shared.d.ts

@@ -16,6 +16,7 @@ export interface ServerOptions {
     /** Validated named pools served at `/mcp/<name>`; empty when none declared. */
     pools?: ReadonlyMap<string, ResolvedPool> | undefined;
     publicUrl?: string | undefined;
+    allowedOrigins?: readonly string[] | "*" | undefined;
     serverInfo: Implementation;
     logger: Logger;
     activity?: ActivityStore | undefined;