@zackbart/connecta 0.24.4 → 0.26.0

package/dist/fix-prompt.js

@@ -0,0 +1,37 @@
+/**
+ * The frame every copyable fix prompt shares: the operator page's failure
+ * notices and the OAuth callback page both hand an operator text to paste into
+ * a coding agent working in the deployment's repository.
+ *
+ * A prompt is assembled from fixed catalogue text and, at most, a configured
+ * connector id. It has no parameter an error message, a downstream body, a
+ * token, or a URL could arrive through — which is the whole guarantee: the
+ * text leaves the page on a clipboard, into a tool the deployment does not
+ * control, so it must be something the deployment would be content to publish.
+ * The agent finds the underlying cause where it belongs, in the deployment's
+ * own logs and a local reproduction.
+ */
+const CONNECTOR_ID_RE = /^[a-z0-9_-]+$/;
+/**
+ * Render one prompt. A connector id is the only variable part, and only when
+ * it has the shape configuration enforces; anything else is dropped rather
+ * than escaped, since a value that is not a connector id is not config.
+ */
+export function renderFixPrompt(spec, connectorId) {
+    const id = connectorId !== undefined && CONNECTOR_ID_RE.test(connectorId)
+        ? connectorId
+        : undefined;
+    return [
+        "Diagnose and fix a problem in this connecta deployment (the @zackbart/connecta package). " +
+            "It is configured as code: connectors, credential slots, OAuth clients, pools, and inbound auth " +
+            "are declared in the deployment's source and environment, so the fix belongs there and not in the operator page.",
+        `Problem: ${spec.problem}` + (id ? `\nConnector id: ${id}` : ""),
+        `Where to look:\n${spec.steps.map((step) => `- ${step}`).join("\n")}`,
+        "This prompt deliberately carries no error text, tokens, or URLs. Find the underlying cause in the deployment's " +
+            "own logs (lines prefixed [connecta]) or by reproducing the failure locally. Never put a secret in source, " +
+            "a log line, or your reply: secrets belong in the deployment's environment or its credential vault.",
+        "Make the smallest change that fixes it, then verify it by redeploying and refreshing the connection on the " +
+            "operator Connections page. If the fix needs something you cannot do yourself — a provider console setting, " +
+            "a secret only the operator holds — name that exact step instead.",
+    ].join("\n\n");
+}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import type { CredentialVault } from "./credential-contract.js";
 import { Registry } from "./registry.js";
-import type { ActivityModule, OperatorSurface } from "./module-contracts.js";
-export type { ActivityModule, OperatorSurface } from "./module-contracts.js";
+import type { ConnectorGrant } from "./connector-access.js";
+import type { ActivityModule, ArtifactsModule, OperatorSurface } from "./module-contracts.js";
+export type { ActivityModule, ArtifactsModule, OperatorSurface, } from "./module-contracts.js";
 export type { CredentialVault, CredentialMetadata } from "./credential-contract.js";
 import type { AuthenticatedIdentity, Connector, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
 /** Tool-catalog caching, persistence, stale fallback, and probe deadlines. */
@@ -47,7 +48,7 @@ export interface ConnectaCallsConfig {
     /**
      * Max inline result size (bytes) before truncation and `get_result` paging.
      * Must be a finite whole number >= 1; invalid values warn and fall back to
-     * 50_000. Connectors may override it individually.
+     * 24_000. Connectors may override it individually.
      */
     maxResultBytes?: number;
 }
@@ -81,6 +82,55 @@ export interface ConnectaExecuteConfig {
      * values fall back to the default.
      */
     hostCallTimeoutMs?: number;
+    /**
+     * Hard ceiling on one execution, in milliseconds, enforced outside the
+     * sandbox. Default 120_000, above both executors' own deadlines (QuickJS
+     * 30_000, the Dynamic Worker 60_000), so it only ends a run whose executor
+     * never settled; that run fails as unresponsive and its admission slot is
+     * released. Keep it above any raised executor deadline. Invalid values
+     * fall back to the default.
+     */
+    watchdogMs?: number;
+    /**
+     * Let programs write. A call to a tool that is not explicitly read-only
+     * pauses the run before anything is sent and returns the exact write with
+     * a token; `resume_execution` repeating it is the approval, and the
+     * program replays from a journal to send it and continue. Needs `storage`
+     * with `compareAndSet`, because two resumes of one pause must send its
+     * writes at most once. Omitted, it is on exactly when the storage has one
+     * (a single startup warning says when it is not); `true` over storage
+     * without one refuses to construct; `false` keeps E4's refusal.
+     * `resume_execution` is listed either way.
+     */
+    resumableWrites?: boolean;
+    /**
+     * Consequential calls one run may send, on top of the host-call budget
+     * every call already spends. Default 10. A replayed write spends it again,
+     * so it bounds the run, not each play. Invalid values fall back to the
+     * default.
+     */
+    maxWrites?: number;
+    /**
+     * How long a paused run can be resumed, in seconds from its first pause.
+     * Default 1_800. A later pause in the same run keeps the first deadline, so
+     * a run never replays reads older than this. Invalid values fall back to
+     * the default.
+     */
+    pausedRunTtlSeconds?: number;
+    /**
+     * Which writes a program may make without pausing for approval. Keys are
+     * connector ids (all of that connector's tools) or `connector.tool`
+     * addresses (that tool); values are `"never"` (never ask) or `"ask"`. The
+     * most specific key wins, and `"ask"` switches off a connector's own
+     * default. An exempt write still spends the write budget, is recorded in
+     * activity, and is journaled like any other; it is never read-only
+     * anywhere else — discovery still lists it as approval-required and
+     * `call_tool` still refuses it. Works with resumable writes off too. An
+     * unknown connector id, or an `api()` address its tools do not include,
+     * refuses to construct; a remote connector's tool names load later, so an
+     * address naming one it never serves simply never matches.
+     */
+    approval?: Readonly<Record<string, "never" | "ask">>;
 }
 export interface AdmissionPoolConfig {
     /** Simultaneous work admitted to this pool. */
@@ -92,6 +142,10 @@ export interface AdmissionPoolConfig {
     /** Retry hint returned with overload failures, in milliseconds. */
     retryAfterMs?: number;
 }
+export interface RequestAdmissionConfig extends AdmissionPoolConfig {
+    /** Hard lifetime of an admitted /mcp request. Default 300,000 ms. */
+    maxDurationMs?: number;
+}
 /**
  * Runtime-portable server-memory boundaries. `/health` and operator routes do
  * not consume these permits, so they remain responsive during MCP saturation.
@@ -101,7 +155,7 @@ export interface ConnectaAdmissionConfig {
      * The `/mcp` request boundary. Defaults to 16 active, 32 queued, and a
      * 5-second maximum wait.
      */
-    requests?: AdmissionPoolConfig;
+    requests?: RequestAdmissionConfig;
     /**
      * Fallback pool for an `executor` that does not implement its own `acquire`.
      * Defaults to 2 active, 8 queued, and a 5-second maximum wait. Bounded
@@ -115,10 +169,13 @@ export interface ConnectaIdentityConfig {
     /**
      * What this admitted identity may discover and call: `"all"`, or a list
      * whose entries are connector ids (the whole connector) and `connector.tool`
-     * addresses (that tool only). Grants are additive. An address naming a tool
-     * the catalog lacks is unreachable and warned once, never widened.
+     * addresses (that tool only), or `{ tool: "connector.tool",
+     * requireReadOnly: true }` for an exact tool only while its loaded catalog
+     * explicitly classifies it read-only. Grants are additive: an unrestricted
+     * connector or address grant wins over the guarded form. An address naming
+     * a tool the catalog lacks is unreachable and warned once, never widened.
      */
-    connectorAccess?(identity: Readonly<AuthenticatedIdentity>): "all" | readonly string[] | Promise<"all" | readonly string[]>;
+    connectorAccess?(identity: Readonly<AuthenticatedIdentity>): "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>;
     /** Global payload-free activity reads. Defaults to interactive humans. */
     activityAccess?(principal: Readonly<IdentityReference>): boolean | Promise<boolean>;
     /** Shared credential and OAuth administration. Defaults to none. */
@@ -167,6 +224,14 @@ export interface ConnectaConfig {
     vault?: CredentialVault;
     /** Optional connection UI, created by operatorUi() from /ui. */
     ui?: OperatorSurface;
+    /**
+     * Optional team pages over stored data, created by artifacts() from
+     * /artifacts. Adds the built-in `artifacts` connector; needs `publicUrl`,
+     * because the links it hands out are shared.
+     */
+    artifacts?: ArtifactsModule;
+    /** Optional dedicated HTTPS origin that serves only artifact pages and their library. */
+    artifactOrigin?: string;
     /** Tool-catalog caching, persistence, stale fallback, and probe deadlines. */
     discovery?: ConnectaDiscoveryConfig;
     /** Deployment-wide call deadlines and result paging threshold. */

package/dist/index.js

@@ -1,39 +1,38 @@
 import { credentialTestRule, describeCredentialTestMismatch, } from "./credential-rules.js";
 import { Registry } from "./registry.js";
-import { parseConnectorAccess, POOL_NAME_RE } from "./connector-access.js";
+import { intersectAccess, parseConnectorAccess, POOL_NAME_RE } from "./connector-access.js";
 import { createFetchHandler } from "./server.js";
+import { createProgramRunner } from "./execute.js";
 import { droppedBrandingUrls, droppedThemeTokens, droppedUiAuthUrls, } from "./branding.js";
 import { memoryStorage } from "./storage/memory.js";
 import { CONNECTA_VERSION } from "./version.js";
 import { AdmissionController, executorName, isAdmittingExecutor, withExecutorAdmission, } from "./executor-admission.js";
+import { DEFAULT_MAX_WRITES, DEFAULT_PAUSED_RUN_TTL_SECONDS, } from "./resumable.js";
+import { disposeEdgeRuntime } from "./runtime/run.js";
+import { NO_EXEMPTIONS } from "./tool-safety.js";
+import { createCoreRuntime, resolveLogger } from "./runtime/services.js";
 const REQUEST_ADMISSION_DEFAULTS = {
     concurrency: 16,
     maxQueueSize: 32,
     queueTimeoutMs: 5_000,
     retryAfterMs: 1_000,
 };
+const DEFAULT_REQUEST_MAX_DURATION_MS = 300_000;
 const CODE_ADMISSION_DEFAULTS = {
     concurrency: 2,
     maxQueueSize: 8,
     queueTimeoutMs: 5_000,
     retryAfterMs: 1_000,
 };
-function admissionController(options, defaults) {
+function admissionController(options, defaults, maxDurationMs) {
     return new AdmissionController({
         concurrency: options?.concurrency ?? defaults.concurrency,
         maxQueueSize: options?.maxQueueSize ?? defaults.maxQueueSize,
         queueTimeoutMs: options?.queueTimeoutMs ?? defaults.queueTimeoutMs,
         retryAfterMs: options?.retryAfterMs ?? defaults.retryAfterMs,
+        ...(maxDurationMs !== undefined ? { maxDurationMs } : {}),
     });
 }
-function defaultLogger() {
-    return {
-        debug: (...a) => console.debug("[connecta]", ...a),
-        info: (...a) => console.info("[connecta]", ...a),
-        warn: (...a) => console.warn("[connecta]", ...a),
-        error: (...a) => console.error("[connecta]", ...a),
-    };
-}
 /** Bearer providers are checked before Clerk (per spec). */
 function normalizeAuth(auth) {
     const list = auth ? (Array.isArray(auth) ? auth : [auth]) : [];
@@ -48,6 +47,10 @@ const admissionPoolSchema = {
     queueTimeoutMs: null,
     retryAfterMs: null,
 };
+const requestAdmissionSchema = {
+    ...admissionPoolSchema,
+    maxDurationMs: null,
+};
 const CONFIG_SCHEMA = {
     connectors: null,
     auth: null,
@@ -64,6 +67,8 @@ const CONFIG_SCHEMA = {
     activity: null,
     vault: null,
     ui: null,
+    artifacts: null,
+    artifactOrigin: null,
     discovery: {
         concurrency: null,
         catalogTtlSeconds: null,
@@ -84,9 +89,14 @@ const CONFIG_SCHEMA = {
         maxEmittedBlocks: null,
         maxHostCalls: null,
         hostCallTimeoutMs: null,
+        watchdogMs: null,
+        resumableWrites: null,
+        maxWrites: null,
+        pausedRunTtlSeconds: null,
+        approval: null,
     },
     admission: {
-        requests: admissionPoolSchema,
+        requests: requestAdmissionSchema,
         code: admissionPoolSchema,
     },
     logger: null,
@@ -151,7 +161,7 @@ function assertKnownConfig(config) {
             }
         }
     }
-    if (config.vault && ["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function"))
+    if (config.vault && (["get", "getAll", "set", "setAll", "metadata", "delete"].some(key => typeof config.vault[key] !== "function") || ["seal", "open"].some(key => !["undefined", "function"].includes(typeof config.vault[key]))))
         throw new Error("ConnectaConfig.vault must implement CredentialVault");
     if (config.ui && (typeof config.ui.handle !== "function" || typeof config.ui.credentialHandoffUrl !== "function" || !Array.isArray(config.ui.reservedPaths)))
         throw new Error("ConnectaConfig.ui must be created with operatorUi(...)");
@@ -162,6 +172,47 @@ function assertKnownConfig(config) {
             typeof activity.recordTool !== "function")) {
         throw new Error("ConnectaConfig.activity must be created with activityHistory(...)");
     }
+    const artifacts = config.artifacts;
+    if (artifacts !== undefined) {
+        const connector = artifacts?.connector;
+        if (typeof artifacts !== "object" ||
+            artifacts === null ||
+            !connector ||
+            connector.id !== "artifacts" ||
+            typeof connector.callTool !== "function" ||
+            typeof artifacts.handle !== "function") {
+            throw new Error("ConnectaConfig.artifacts must be created with artifacts(...) from @zackbart/connecta/artifacts");
+        }
+        if (config.connectors?.some((candidate) => candidate?.id === "artifacts")) {
+            throw new Error('Connector id "artifacts" is reserved by the artifacts module; rename ' +
+                "your connector or drop the artifacts option");
+        }
+        if (!config.publicUrl) {
+            throw new Error("ConnectaConfig.artifacts needs publicUrl: artifact links are shared " +
+                "with teammates, so they must name the deployment's own origin, never " +
+                "one taken from a request's Host header");
+        }
+    }
+    if (config.artifactOrigin !== undefined) {
+        if (!config.artifacts || !config.ui || !config.publicUrl) {
+            throw new Error("ConnectaConfig.artifactOrigin needs artifacts, ui, and publicUrl");
+        }
+        if (typeof config.artifactOrigin !== "string") {
+            throw new Error("ConnectaConfig.artifactOrigin must be an HTTPS origin");
+        }
+        let origin;
+        try {
+            origin = new URL(config.artifactOrigin);
+        }
+        catch {
+            throw new Error("ConnectaConfig.artifactOrigin must be an HTTPS origin");
+        }
+        if (origin.protocol !== "https:" ||
+            origin.toString() !== `${origin.origin}/` ||
+            origin.origin === new URL(config.publicUrl).origin) {
+            throw new Error("ConnectaConfig.artifactOrigin must be a distinct HTTPS origin");
+        }
+    }
 }
 /**
  * Validate declared pools against the connector set. Everything checkable at
@@ -224,6 +275,92 @@ function resolvePools(pools, registry) {
     }
     return resolved;
 }
+/**
+ * Validate `execute.approval` against the connector set, like the pools: a
+ * malformed key or value, an unknown connector, and an `api()` address its
+ * tools do not include all throw. Remote catalogs load lazily, so an address
+ * on one is kept and simply never matches a tool it does not serve.
+ */
+function resolveApprovalPolicy(approval, registry) {
+    for (const connector of registry.listConnectors()) {
+        if (connector.approval !== undefined && connector.approval !== "never") {
+            throw new Error(`Connector "${connector.id}": approval must be "never" or omitted`);
+        }
+    }
+    if (approval === undefined)
+        return NO_EXEMPTIONS;
+    if (!approval || typeof approval !== "object" || Array.isArray(approval)) {
+        throw new Error("ConnectaConfig.execute.approval must be an object keyed by connector ids and connector.tool addresses");
+    }
+    const connectors = new Map();
+    const tools = new Map();
+    for (const [key, value] of Object.entries(approval)) {
+        const where = `ConnectaConfig.execute.approval[${JSON.stringify(key)}]`;
+        if (value !== "never" && value !== "ask") {
+            throw new Error(`${where} must be "never" or "ask"`);
+        }
+        const dot = key.indexOf(".");
+        const id = dot === -1 ? key : key.slice(0, dot);
+        const tool = dot === -1 ? undefined : key.slice(dot + 1);
+        if (!id || tool === "") {
+            throw new Error(`${where}: keys are connector ids or connector.tool addresses`);
+        }
+        const connector = registry.getConnector(id);
+        if (!connector)
+            throw new Error(`${where}: unknown connector "${id}"`);
+        if (tool === undefined) {
+            connectors.set(id, value);
+            continue;
+        }
+        if (connector.staticTools &&
+            !connector.staticTools.some((candidate) => candidate.name === tool)) {
+            throw new Error(`${where}: connector "${id}" has no tool "${tool}"`);
+        }
+        tools.set(key, value);
+    }
+    return { connectors, tools };
+}
+/** A positive whole number, or the default when the value is unusable. */
+function positiveWhole(value, fallback) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 1
+        ? Math.trunc(value)
+        : fallback;
+}
+/**
+ * Resumable writes' deployment settings, or undefined when they are off.
+ * Omitted, they are on exactly when the storage can claim atomically, and a
+ * deployment left without them hears so once. Asked for over storage that
+ * cannot claim, they throw: at-most-once delivery of an approved write rests
+ * on exactly one resume winning the claim, and a read-then-write stand-in
+ * would let two win.
+ */
+function resolveResumableWrites(execute, storage, logger) {
+    const enabled = execute?.resumableWrites;
+    if (enabled !== undefined && typeof enabled !== "boolean") {
+        throw new Error("ConnectaConfig.execute.resumableWrites must be a boolean");
+    }
+    if (enabled === false)
+        return undefined;
+    if (enabled === undefined && typeof storage.compareAndSet !== "function") {
+        logger.warn("[connecta] resumable writes are off: the configured storage has no " +
+            "compareAndSet, so programs refuse writes (E4) and resume_execution " +
+            "answers resumable_writes_unavailable. Use storage with an atomic " +
+            "compareAndSet (the Worker example's D1 store, fileStorage, " +
+            "memoryStorage) to let programs pause for approval, or set " +
+            "execute.resumableWrites: false to keep this and silence the warning.");
+        return undefined;
+    }
+    if (typeof storage.compareAndSet !== "function") {
+        throw new Error("ConnectaConfig.execute.resumableWrites needs storage with compareAndSet: " +
+            "two resumes of one paused run must send its writes at most once, which " +
+            "takes an atomic claim. memoryStorage() and fileStorage() provide it, as " +
+            "does the Worker example's D1 store; Cloudflare KV cannot.");
+    }
+    return {
+        maxWrites: positiveWhole(execute?.maxWrites, DEFAULT_MAX_WRITES),
+        ttlSeconds: positiveWhole(execute?.pausedRunTtlSeconds, DEFAULT_PAUSED_RUN_TTL_SECONDS),
+    };
+}
 /**
  * One-time construction warnings for deployment shapes that run fine but are
  * usually unintended. Warning-only — never throws and never changes behavior;
@@ -236,7 +373,7 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     // Static API headers can carry secrets without declaring credential hooks.
     // Any configured connector warrants the open-deployment warning.
     if (inboundAuth.length === 0 &&
-        config.connectors.length > 0) {
+        (config.connectors.length > 0 || config.artifacts)) {
         logger.warn("[connecta] running with no inbound authentication: any caller can " +
             "invoke every shared connector. " +
             (hasCredentialConnector || oauthConnectors.length > 0
@@ -244,6 +381,18 @@ function warnInsecureConfig(config, inboundAuth, logger) {
                 : "") +
             "Configure `auth` (for example bearerToken(...) or Clerk) to gate access.");
     }
+    // Artifact pages mount inside the operator UI and open only for an
+    // authenticated viewer; either missing leaves the connector with no page.
+    if (config.artifacts && !config.ui) {
+        logger.warn("[connecta] artifacts is configured without ui: agents can publish and " +
+            "read artifacts, but there is no viewer, so their links answer 404. " +
+            "Add ui: operatorUi() to serve artifact pages.");
+    }
+    else if (config.artifacts && inboundAuth.length === 0) {
+        logger.warn("[connecta] artifacts is configured with no inbound authentication: " +
+            "artifact pages refuse every request, because there is no team to " +
+            "show them to. Configure `auth` to open them.");
+    }
     // Unset publicUrl with OAuth connectors: the downstream redirect_uri is
     // derived per-request from the attacker-influenced inbound Host header.
     if (oauthConnectors.length > 0 && !config.publicUrl) {
@@ -296,18 +445,31 @@ function warnInsecureConfig(config, inboundAuth, logger) {
     }
     // A credential test hook that cannot test the declared credential shape.
     // The shape picks the hook (see `credentialTestRule`) and the other one is
-    // never substituted, so the connector is simply not testable: /credentials offers no
-    // Test action and the route answers 400. Without this line the only way to
-    // discover the mistake is to click a button that isn't there.
+    // never substituted, so the connection offers no Test action in the operator
+    // UI and the route answers 400. Without this line the only way to discover
+    // the mistake is to click a button that isn't there.
     for (const connector of config.connectors) {
         const { mismatch } = credentialTestRule(connector);
         if (!mismatch)
             continue;
         logger.warn(`[connecta] connector "${connector.id}" cannot test its credential: ` +
-            `${describeCredentialTestMismatch(mismatch)}. /credentials offers no Test ` +
+            `${describeCredentialTestMismatch(mismatch)}. The connection in the operator UI offers no Test ` +
             `action and POST /ui/credentials/${connector.id}/test answers 400 ` +
             "until the matching hook is implemented.");
     }
+    // A vault written before seal/open existed encrypts credentials but cannot
+    // seal downstream OAuth state, so tokens stay plaintext at rest beside them.
+    const vault = config.vault;
+    if (vault && (typeof vault.seal !== "function" || typeof vault.open !== "function")) {
+        for (const connector of config.connectors) {
+            if (!connector.startAuth)
+                continue;
+            logger.warn(`[connecta] connector "${connector.id}" stores its downstream OAuth ` +
+                "tokens, client registration, and PKCE verifier as plaintext: the " +
+                "configured vault implements no `seal`/`open`. Use " +
+                "encryptedCredentialVault(...) or add both methods to seal them.");
+        }
+    }
     // OAuth connectors whose callback cannot perform a state/CSRF check. The
     // public route refuses every callback for these connectors rather than hand
     // an unverified code to finishAuth, so this warning explains why auth cannot
@@ -331,9 +493,7 @@ export function createConnecta(config) {
             '"@cloudflare/codemode" on Workers.');
     }
     const storage = config.storage ?? memoryStorage();
-    const logger = config.logger === "silent"
-        ? { debug() { }, info() { }, warn() { }, error() { } }
-        : config.logger ?? defaultLogger();
+    const logger = resolveLogger(config.logger);
     const credentialVault = config.vault;
     const configuredAuth = normalizeAuth(config.auth);
     const serverInfo = {
@@ -341,7 +501,12 @@ export function createConnecta(config) {
         name: config.serverInfo?.name ?? "connecta",
         version: config.serverInfo?.version ?? CONNECTA_VERSION,
     };
-    const registry = new Registry(config.connectors, {
+    // The artifacts module contributes one prebuilt connector, appended like any
+    // configured one: same catalog, invocation, admission, and activity.
+    const connectors = config.artifacts
+        ? [...config.connectors, config.artifacts.connector]
+        : config.connectors;
+    const registry = new Registry(connectors, {
         storage,
         logger,
         credentialVault,
@@ -364,8 +529,12 @@ export function createConnecta(config) {
     });
     const inboundAuth = configuredAuth;
     const pools = resolvePools(config.pools, registry);
+    const resumable = resolveResumableWrites(config.execute, storage, logger);
+    const approval = resolveApprovalPolicy(config.execute?.approval, registry);
+    // Exempt writes need a budget whether or not programs can pause.
+    const maxWrites = positiveWhole(config.execute?.maxWrites, DEFAULT_MAX_WRITES);
     warnInsecureConfig(config, inboundAuth, logger);
-    const requestAdmission = admissionController(config.admission?.requests, REQUEST_ADMISSION_DEFAULTS);
+    const requestAdmission = admissionController(config.admission?.requests, REQUEST_ADMISSION_DEFAULTS, config.admission?.requests?.maxDurationMs ?? DEFAULT_REQUEST_MAX_DURATION_MS);
     const configuredCodeAdmission = admissionController(config.admission?.code, CODE_ADMISSION_DEFAULTS);
     let codeAdmission;
     let executor = config.executor;
@@ -381,17 +550,91 @@ export function createConnecta(config) {
             "implements acquire() and owns its admission pool; configure that " +
             "executor's concurrency and queue options instead.");
     }
+    if (config.artifacts?.bindRefresh) {
+        const sharedIds = registry.listConnectors()
+            .filter((connector) => connector.id !== "artifacts" && connector.authScope !== "personal")
+            .map((connector) => connector.id);
+        const refreshConfig = {
+            discoveryConcurrency: config.discovery?.concurrency,
+            probeTimeoutMs: config.discovery?.probeTimeoutMs,
+            maxEmittedBytes: config.execute?.maxEmittedBytes,
+            maxEmittedBlocks: config.execute?.maxEmittedBlocks,
+            maxHostCalls: config.execute?.maxHostCalls,
+            hostCallTimeoutMs: config.execute?.hostCallTimeoutMs,
+            watchdogMs: config.execute?.watchdogMs,
+            failOnInvocationFailure: true,
+            // A connector's own `approval: "never"` still applies when policy maps
+            // are empty. Override every shared connector explicitly for refresh.
+            approval: {
+                connectors: new Map(sharedIds.map((id) => [id, "ask"])),
+                tools: new Map(),
+            },
+        };
+        const refreshRunner = createProgramRunner(registry.scoped({ connectorIds: [] }), config.publicUrl, executor, logger, undefined, refreshConfig);
+        config.artifacts.bindRefresh({
+            claimMs: refreshRunner.claimMs,
+            execute: async (program, owner, signal) => {
+                if (!owner)
+                    throw new Error("Refresh owner is missing; reconfigure this program.");
+                let access = parseConnectorAccess(config.identity?.connectorAccess
+                    ? await config.identity.connectorAccess(owner.identity) : "all", { allowReadOnly: true });
+                if (owner.pool) {
+                    const pool = pools.get(owner.pool);
+                    if (!pool || await pool.grant(owner.identity) !== true) {
+                        throw new Error("Refresh owner's pool grant is no longer available.");
+                    }
+                    access = intersectAccess(access, pool.access);
+                }
+                if (access.connectorIds !== "all" && !access.connectorIds.includes("artifacts")) {
+                    throw new Error("Refresh owner no longer has artifact publishing access.");
+                }
+                if (access.toolAccess?.get("artifacts") &&
+                    !access.toolAccess.get("artifacts").has("set_refresh")) {
+                    throw new Error("Refresh owner no longer has refresh configuration access.");
+                }
+                if (access.guardedToolAccess?.get("artifacts")?.has("set_refresh")) {
+                    throw new Error("A read-only guarded grant cannot configure refresh.");
+                }
+                access = intersectAccess(access, { connectorIds: sharedIds });
+                if (signal.aborted)
+                    throw new Error("Refresh deadline expired before execution.");
+                const view = registry.scoped({ connectorIds: access.connectorIds,
+                    ...(access.toolAccess ? { toolAccess: access.toolAccess } : {}),
+                    ...(access.guardedToolAccess ? { guardedToolAccess: access.guardedToolAccess } : {}) });
+                const runner = createProgramRunner(view, config.publicUrl, executor, logger, undefined, refreshConfig);
+                return runner.execute({ code: program }, { signal });
+            },
+        });
+    }
+    // Every structural check has passed, so this is the configuration the
+    // deployment runs with. Creating the runtime builds nothing — a Worker may
+    // construct its Connecta at global scope, where no fiber may start.
+    const runtime = createCoreRuntime(registry, {
+        storage,
+        logger,
+        vault: credentialVault,
+        activity: config.activity,
+        config: {
+            config,
+            serverInfo,
+            auth: inboundAuth,
+            pools,
+            executorName: configuredExecutorName,
+        },
+    });
     const handler = createFetchHandler({
         registry,
         auth: inboundAuth,
         identity: config.identity,
         pools,
         publicUrl: config.publicUrl,
+        artifactOrigin: config.artifactOrigin,
         allowedOrigins: config.allowedOrigins,
         serverInfo,
         logger,
         activity: config.activity?.store,
         activityModule: config.activity,
+        artifactsModule: config.artifacts,
         activityReadGate: config.activity?.readGate,
         activityDeploymentId: config.activity?.deploymentId,
         executor,
@@ -404,6 +647,10 @@ export function createConnecta(config) {
         maxEmittedBlocks: config.execute?.maxEmittedBlocks,
         maxHostCalls: config.execute?.maxHostCalls,
         hostCallTimeoutMs: config.execute?.hostCallTimeoutMs,
+        watchdogMs: config.execute?.watchdogMs,
+        resumable,
+        approval,
+        maxWrites,
         credentialVault,
         ui: config.ui,
         deploymentInfo: config.deploymentInfo,
@@ -417,10 +664,18 @@ export function createConnecta(config) {
         registry,
         close: async () => {
             closePromise ??= Promise.resolve().then(async () => {
-                requestAdmission.close();
-                codeAdmission?.close();
-                registry.closeCallAdmission();
-                await config.executor?.close?.();
+                try {
+                    requestAdmission.close();
+                    codeAdmission?.close();
+                    registry.closeCallAdmission();
+                    await config.executor?.close?.();
+                }
+                finally {
+                    // Last, and whether or not the executor closed cleanly. A fiber
+                    // already running keeps the services it was given; only a run
+                    // started after this is refused.
+                    await disposeEdgeRuntime(runtime);
+                }
             });
             await closePromise;
         },