@zackbart/connecta 0.25.0 → 0.26.0

package/dist/server.js

@@ -5,6 +5,7 @@ import { createMcpRoute, MCP_CORS_HEADERS } from "./routes/mcp.js";
 import { routeOAuthCallback, } from "./routes/oauth.js";
 import { runEdge } from "./runtime/run.js";
 import { withSecurityHeaders, } from "./routes/shared.js";
+const isArtifactPath = (path) => path === "/artifacts" || path.startsWith("/artifacts/");
 /**
  * Build the Web-standard fetch handler.
  *
@@ -50,6 +51,10 @@ export function createFetchHandler(opts) {
             ...(opts.executorName !== undefined
                 ? { executor: { name: opts.executorName } }
                 : {}),
+            // Whether a program's write pauses for resume_execution or fails E4.
+            // The tool is listed either way; this is the only place an operator
+            // can see which answer it gives (#565).
+            resumableWrites: opts.resumable !== undefined,
             // Counts only, from refreshes that already happened — the endpoint
             // asks no downstream anything, and `connecta doctor` reads it to
             // report a stale allowlist without a probe of its own (#343).
@@ -71,6 +76,7 @@ export function createFetchHandler(opts) {
                     "/health",
                     ...(opts.ui?.reservedPaths ?? []),
                     ...(opts.ui && opts.activity?.list ? ["/activity"] : []),
+                    ...(opts.ui && opts.artifactsModule ? ["/artifacts", "/artifacts/*"] : []),
                 ],
             },
             ...(opts.deploymentInfo ? { deployment: opts.deploymentInfo } : {}),
@@ -120,6 +126,26 @@ export function createFetchHandler(opts) {
         const defer = runtimeContext
             ? runtimeContext.waitUntil.bind(runtimeContext)
             : undefined;
+        // The artifact hostname has no MCP, health, OAuth, or operator routes.
+        // Dispatch before MCP origin checks so even a hostile /mcp is a plain 404.
+        if (opts.artifactOrigin && url.origin === new URL(opts.artifactOrigin).origin) {
+            if (!isArtifactPath(path) || !opts.ui || !opts.artifactsModule) {
+                return Effect.succeed(withSecurityHeaders(new Response("Not Found", { status: 404 }), url, path));
+            }
+            const context = {
+                request, url, path, baseUrl: opts.artifactOrigin, opts, defer, runtimeContext,
+            };
+            return Effect.map(Effect.promise(() => opts.ui.handle(context)), response => withSecurityHeaders(response ?? new Response("Not Found", { status: 404 }), url, path));
+        }
+        if (opts.artifactOrigin && isArtifactPath(path) && opts.ui && opts.artifactsModule) {
+            const target = new URL(opts.artifactOrigin);
+            target.pathname = path;
+            target.search = url.search;
+            return Effect.succeed(withSecurityHeaders(new Response(null, {
+                status: 308,
+                headers: { Location: target.toString() },
+            }), url, path));
+        }
         const originRefusal = routeMcp.rejectOrigin(request);
         if (originRefusal) {
             return Effect.succeed(withSecurityHeaders(originRefusal, url, path));

package/dist/skills.js

@@ -1,10 +1,24 @@
 import { boundedEchoText } from "./errors.js";
-export const CONNECTA_INSTRUCTIONS = 'Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Inspect unfamiliar result shapes with a small sample before proceeding. Only readOnlyHint: true tools run there. Keep catalog inspection and unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. After auth_required use authorize_connector. After a truncated direct result use get_result. Guidance is on demand: fetch skills({ name: "usage" }) only when these instructions and the tool description are insufficient or a run needs repair.';
+const ROUTE = "Choose a route before discovery. A known-address read needs only call_tool. Unknown-address read-only work starts with execute_code to discover, call, and return the answer; use the same route for reduction, multiple or dependent calls, loops, joins, or branches. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Inspect unfamiliar result shapes with a small sample before proceeding.";
+const RECOVERY = 'After auth_required use authorize_connector. After a truncated direct result use get_result. Guidance is on demand: fetch skills({ name: "usage" }) only when these instructions and the tool description are insufficient or a run needs repair.';
+/**
+ * The MCP instructions of a deployment whose programs pause at writes. The
+ * route sentence is its own, not ROUTE's: with writes in programs, "one known
+ * write" is the only work left for call_destructive_tool, and an agent told
+ * only that programs *may* write reads each write after a lookup as a known
+ * one and sends them one prompt at a time.
+ */
+export const CONNECTA_INSTRUCTIONS = `Choose a route before discovery. A known-address read needs only call_tool; one known write, call_destructive_tool. Everything else starts with execute_code to discover, call, and return the answer: unknown addresses, reduction, multiple or dependent calls, loops, joins, branches, and writes that follow reads. Keep discovery and calls together when schemas suffice; do not return catalog matches alone. Inspect unfamiliar result shapes with a small sample before proceeding. A program's call to a tool not annotated readOnlyHint: true pauses unsent; resume_execution with the returned token, address, and args approves it and continues the program (approval "tool" covers that tool for the run). Keep catalog inspection top level with search_tools. ${RECOVERY}`;
+/**
+ * The instructions of a deployment without resumable writes, whose programs
+ * refuse every write: the routing it always had.
+ */
+export const READ_ONLY_PROGRAM_INSTRUCTIONS = `${ROUTE} Only readOnlyHint: true tools run there. Keep catalog inspection and unannotated, write-capable, or destructive work top level: search_tools then call_destructive_tool when a call is needed. ${RECOVERY}`;
 const USAGE_SKILL_BASE = `# Connecta usage
 
 ## The surface
 
-Seven tools: \`execute_code\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Read-only discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
+Eight tools: \`execute_code\`, \`resume_execution\`, \`search_tools\`, \`call_tool\`, \`call_destructive_tool\`, \`authorize_connector\`, \`get_result\`, \`skills\`. Discovery and multi-call work live in a program. Top-level search remains for catalog inspection and approval-required work.
 
 Follow the MCP instructions for routing. Read at most once for syntax or repair.
 
@@ -25,7 +39,7 @@ Search and call in one run when schemas suffice. For unfamiliar result formats,
 
 For top-level catalog inspection or approval-required discovery, omit \`limit\` initially (the default is 8), then page with a limit up to 50 if needed. Empty or whitespace-only queries browse all tools. A non-empty query with no ASCII terms returns no matches; mixed input searches with its ASCII terms. \`includeSchemas: "compact"\` adds bounded input and available output shapes. An \`outputSchemaSource: "observed"\` shape is a hint, not a contract. Plain objects expose \`inputKeys\`, \`requiredInputKeys\`, and \`outputKeys\`; truncation flags mark incomplete shapes; matches also carry declared annotations.
 
-- \`connecta.search({})\` loads all catalogs. Pass \`connector: "<id>"\` when the integration is obvious. Use \`safety: "readOnly"\` for program calls. These inputs filter discovery; they grant no authority.
+- \`connecta.search({})\` loads all catalogs. Pass \`connector: "<id>"\` when the integration is obvious. Use \`safety: "readOnly"\` for reads. These inputs filter discovery; they grant no authority.
 - Use \`includeSchemas: "json"\` for programmatic schema inspection; compact schemas are text, not objects with \`.properties\`. Check connectorTitle for the account/environment, then address, purpose, annotations, inputs, and outputs. Never select only because a result ranks first or has fewer required inputs.
 - Supply every \`requiredInputKey\` from the task or a prior result. For dependencies, match the earlier \`outputKey\` to the later required key. An empty required-key list does not permit invented arguments. Missing \`outputKeys\` means inspect \`outputSchema\`.
 - Use \`connecta.describe({ address })\` or \`{ addresses }\` when a compact schema is truncated or insufficient. Use \`format: "json"\` only for exact constraints. Write the property names the schema displays; never guess positions or aliases.
@@ -34,13 +48,16 @@ For top-level catalog inspection or approval-required discovery, omit \`limit\`
 - Preserve the schema's JSON types exactly: a numeric id is a number, not a numeric-looking string.
 - Validate tabular headers, row arrays, and row widths before mapping them. Never let a header or partial row become data.
 
-Only tools explicitly annotated \`readOnlyHint: true\` are reachable. The catalog, credential, admission, and read-only gates run below the sandbox; code cannot widen its authority.
+Only tools explicitly annotated \`readOnlyHint: true\` are reachable unasked. Where the MCP instructions say programs pause, any other call pauses unsent and \`execute_code\` returns \`paused\` with the write and a token; repeat all three unchanged in top-level \`resume_execution\` to approve (\`approval: "tool"\` covers that tool for the run). Replay reruns the program against a journal: make the same calls in the same order. The catalog, credential, admission, and approval gates run below the sandbox; code cannot widen its authority.
 
 ## Errors and repair
 
 Caught Connecta errors expose \`message\`, \`code\`, \`retryable\`, and \`details\`. Promise rejections retain these fields. Branch on fields, never prose. After a shared argument failure, repair one call before repeating it across other records. Do not retry \`retryable: false\`, and do not retry \`rate_limited\` immediately because portable code has no timer.
 
-- \`destructive_tool_requires_approval\`: stop the program and use the returned canonical address with top-level \`call_destructive_tool\`.
+- \`destructive_tool_requires_approval\`: stop and send the returned address through top-level \`call_destructive_tool\`.
+- \`execution_paused\`: the run already stopped at a write; let it end.
+- \`write_outcome_unknown\`: sent but unanswered, never re-sent; check the target.
+- \`execution_expired\`, \`_diverged\`, \`_interrupted\`: check \`writes\`, then rerun.
 - \`auth_required\`: let the failure reach the model, then use top-level \`authorize_connector\`, give its handoff to the operator, and retry after recovery.
 - A truncated direct-call result: follow its \`get_result\` action. A truncated program result has no page handle; filter, map, or slice inside a new program.
 - Unknown addresses and tools carry scoped search recovery. Use it inside the current run. Do not invent an address.
@@ -49,12 +66,14 @@ For a direct call, \`resultMode: "value"\` unwraps the result. \`timeoutMs\` set
 
 \`get_result({ id, offset?, maxBytes? })\` returns a one-line JSON header \`{ resultId, offset, bytes, totalBytes, hasMore, nextAction? }\`, a newline, and then the page as raw text, for a direct-call result. Both sizes are byte counts: \`maxBytes\` must be a whole number at least 1, defaults to the result's cap, and is clamped to it; \`offset\` must be a whole number at least 0 and defaults to 0. An offset inside a multi-byte character moves back to its first byte, and the header reports the served offset. Follow \`nextAction\` until \`hasMore\` is false to reassemble pages. An unknown or expired id is an error.
 
-Limits: 20 host calls per run and a 15-second deadline per host call.
+The \`execute_code\` description states this deployment's host-call and write budgets and per-call deadline.
 
 ## Runtime portability
 
 Portable code uses standard JavaScript builtins, \`connecta\`, and \`console.*\`. QuickJS blocks imports and lacks fetch, process, timers, crypto, and WebSocket. Dynamic Workers must use only \`{ loader }\`; bindings, modules, or globalOutbound grant ambient authority. With loader only, environment maps are empty; node:fs/http/https are absent; outbound fetch, WebSocket, node:net, and node:tls are denied; DNS is unresolved. Runtime builtins remain through \`import()\` and \`process.getBuiltinModule()\`, including node:path and cloudflare:workers; this set can drift. Timers, process, crypto, WebSocket, and data: fetch remain. Avoid every runtime-only capability because QuickJS fails.
 
+\`Date.now()\` is the run's start and does not advance; \`Math.random()\` is seeded per run.
+
 ## Examples
 
 One read-only call at a known address:
@@ -95,8 +114,8 @@ Connector guides appear in \`skills({})\` and discovery with an exact \`guide\`
 /** Shared Connecta routing guidance, byte-identical across deployments. */
 export const USAGE_SKILL = USAGE_SKILL_BASE + CONNECTOR_GUIDES_SECTION;
 /** The always-loaded MCP `instructions` string. */
-export function instructionsFor() {
-    return CONNECTA_INSTRUCTIONS;
+export function instructionsFor(resumableWrites) {
+    return resumableWrites ? CONNECTA_INSTRUCTIONS : READ_ONLY_PROGRAM_INSTRUCTIONS;
 }
 /** True when at least one of `connectors` carries a usage guide. */
 export function hasConnectorGuides(connectors) {

package/dist/timeout.js

@@ -31,6 +31,32 @@ export function withDeadline(operation, options) {
         catch: (error) => error,
     }), options));
 }
+/**
+ * Run `operation` under one signal that aborts when any of `signals` does —
+ * the MCP call's own and the inbound request's, for the program tools — and
+ * detach every listener afterwards, however it ends.
+ */
+export async function underAnySignal(signals, operation) {
+    const controller = new AbortController();
+    const forwarders = signals
+        .filter((signal) => signal !== undefined)
+        .map((signal) => {
+        const forward = () => controller.abort(signal.reason);
+        if (signal.aborted)
+            forward();
+        else
+            signal.addEventListener("abort", forward, { once: true });
+        return { signal, forward };
+    });
+    try {
+        return await operation(controller.signal);
+    }
+    finally {
+        for (const { signal, forward } of forwarders) {
+            signal.removeEventListener("abort", forward);
+        }
+    }
+}
 /**
  * Give one operation a caller-facing deadline and the matching cancellation
  * signal. The timeout rejects with the stable, labelled error while aborting

package/dist/tool-safety.d.ts

@@ -0,0 +1,35 @@
+import type { Connector, ToolDef } from "./types.js";
+/**
+ * The one fail-closed classification shared by discovery and invocation.
+ *
+ * A tool is read-only only when it says so without also saying it is
+ * destructive. Missing, false, and contradictory annotations all require the
+ * approval-visible call path.
+ */
+export declare function isExplicitlyReadOnly(definition: ToolDef): boolean;
+/**
+ * A deployment's approval exemptions, resolved once at construction from
+ * `execute.approval` (#566). Config is the only source: nothing an agent, the
+ * operator UI, or a downstream catalog says can add an entry.
+ */
+export interface ApprovalPolicy {
+    /** Connector id → the default for that connector's tools. */
+    readonly connectors: ReadonlyMap<string, "never" | "ask">;
+    /** Canonical `connector.tool` address → that tool's own setting. */
+    readonly tools: ReadonlyMap<string, "never" | "ask">;
+}
+export declare const NO_EXEMPTIONS: ApprovalPolicy;
+/**
+ * Whether a program may call this tool without pausing for approval.
+ *
+ * Only a tool that is *not* explicitly read-only can be exempt — a read-only
+ * tool needs no exemption, and reporting one would blur the two classes an
+ * exemption must never merge. The most specific setting wins: the tool's
+ * address, then its connector's entry, then the connector's own default,
+ * then `"ask"`. Annotations play no part beyond that first test: a downstream
+ * that could annotate its way out of approval would be granting itself the
+ * capability this exists to keep in config. Exempt never means read-only:
+ * discovery keeps it in the approval-required class, and `call_tool` still
+ * refuses it.
+ */
+export declare function isApprovalExempt(policy: ApprovalPolicy, connector: Pick<Connector, "id" | "approval">, toolName: string, definition: ToolDef): boolean;

package/dist/tool-safety.js

@@ -9,3 +9,34 @@ export function isExplicitlyReadOnly(definition) {
     return (definition.annotations?.readOnlyHint === true &&
         definition.annotations?.destructiveHint !== true);
 }
+export const NO_EXEMPTIONS = {
+    connectors: new Map(),
+    tools: new Map(),
+};
+/**
+ * Whether a program may call this tool without pausing for approval.
+ *
+ * Only a tool that is *not* explicitly read-only can be exempt — a read-only
+ * tool needs no exemption, and reporting one would blur the two classes an
+ * exemption must never merge. The most specific setting wins: the tool's
+ * address, then its connector's entry, then the connector's own default,
+ * then `"ask"`. Annotations play no part beyond that first test: a downstream
+ * that could annotate its way out of approval would be granting itself the
+ * capability this exists to keep in config. Exempt never means read-only:
+ * discovery keeps it in the approval-required class, and `call_tool` still
+ * refuses it.
+ */
+export function isApprovalExempt(policy, connector, toolName, definition) {
+    if (isExplicitlyReadOnly(definition))
+        return false;
+    // This tool starts another program. Letting a program call it while holding
+    // the only executor permit would deadlock; manual refresh is a top-level
+    // action, even though other artifact writes are exempt inside programs.
+    if (connector.id === "artifacts" && toolName === "run_refresh")
+        return false;
+    const setting = policy.tools.get(`${connector.id}.${toolName}`) ??
+        policy.connectors.get(connector.id) ??
+        connector.approval ??
+        "ask";
+    return setting === "never";
+}

package/dist/types.d.ts

@@ -149,6 +149,11 @@ export interface ConnectorCredentialConfig {
 }
 export interface CredentialTestResult {
     ok: boolean;
+    /**
+     * Detail for the deployment's log. The operator page shows fixed copy for
+     * `ok` and never this text, since a downstream's reply quoted here can
+     * quote the credential it rejected.
+     */
     message?: string;
 }
 export interface ConnectorContext {
@@ -240,6 +245,17 @@ export interface Connector {
     title?: string;
     /** How call_tool wraps results. "mcp" passes the content array through; anything else is JSON-wrapped. */
     kind?: "mcp" | "api";
+    /**
+     * This connector's own default for its tools that are not explicitly
+     * read-only, inside `execute_code`: `"never"` lets a program call them
+     * without pausing for approval. Reserved for connectors connecta ships
+     * whose writes are cheap to undo (the planned artifacts connector, whose
+     * every write is a new immutable version); a deployment's own connectors
+     * leave it unset and exempt through `execute.approval`, which overrides
+     * this either way. Never read from a downstream catalog — a server cannot
+     * exempt its own tools — and never makes a tool read-only anywhere else.
+     */
+    approval?: "never";
     description?: string;
     /**
      * Max inline result size (bytes) for this connector's tools before
@@ -394,6 +410,8 @@ export interface AdmissionSnapshot {
     maxQueueSize: number;
     queueTimeoutMs: number;
     retryAfterMs: number;
+    /** Hard admitted-request lifetime, present only on the /mcp pool. */
+    maxDurationMs?: number;
     active: number;
     queued: number;
     closed: boolean;

package/dist/ui.d.ts

@@ -2,18 +2,21 @@ import type { OperatorSurface } from "./module-contracts.js";
 import type { CredentialVault } from "./credential-contract.js";
 import { type DeferredWork } from "./connector-scope.js";
 import { type CredentialManagementCapability, type UiData, type UiProblem, type UiToolSafety } from "./operator-ui/model.js";
+import { type ApprovalPolicy } from "./tool-safety.js";
 import type { RegistryView } from "./registry.js";
 import type { ConnectaBranding, Connector, ConnectorStatus, ToolDef, UiAuthConfig } from "./types.js";
 export { filterUiConnectors, type CredentialManagementCapability, type UiConnector, type UiData, } from "./operator-ui/model.js";
 export { CONNECTA_FAVICON_SVG, resolveBranding, isSafeHttpUrl, isSafeHttpsUrl, isSafeIconHref } from "./branding.js";
-export type OperatorPage = "connections" | "activity";
+export type OperatorPage = "connections" | "activity" | "artifacts" | "artifact";
 export declare function operatorPageForPath(path: string): OperatorPage | undefined;
 export declare function operatorPageTitle(page: OperatorPage, configuredTitle: string): string;
 /**
- * The badge a tool earns, from the one predicate core enforces with. Computed
- * here so the page reports the rule rather than restating it.
+ * The badge a tool earns, from the predicates core enforces with. Computed
+ * here so the page reports the rule rather than restating it. `exempt` is the
+ * config exemption (#566), which `isApprovalExempt` already refuses to grant
+ * a read-only tool.
  */
-export declare function uiToolSafety(definition: ToolDef): UiToolSafety;
+export declare function uiToolSafety(definition: ToolDef, exempt?: boolean): UiToolSafety;
 /**
  * The fix-prompt key for a connector that is not usable. Chosen from the
  * status state and the connector's declared auth shape — configuration, never
@@ -40,12 +43,16 @@ export declare function buildUiData(registry: RegistryView, baseUrl: string, ser
     mayManage?: (id: string) => boolean;
     timeoutMs?: number;
     signal?: AbortSignal;
+    approval?: ApprovalPolicy;
 }): Promise<UiData>;
 /**
  * Every operator page serves this same data-free shell. Connector, credential,
  * and activity data arrives only through the authenticated `/ui/*` APIs.
  */
-export declare function renderUiHtml(uiAuth?: UiAuthConfig, mcpUrl?: string, branding?: ConnectaBranding, nonce?: string, page?: OperatorPage): string;
+export declare function renderUiHtml(uiAuth?: UiAuthConfig, mcpUrl?: string, branding?: ConnectaBranding, nonce?: string, page?: OperatorPage, options?: {
+    /** Where the Connections page lives, when this shell is on another origin. */
+    homeUrl?: string;
+}): string;
 /** Mount the connection UI without enabling any storage or activity module. */
 export declare function operatorUi(options?: {
     branding?: ConnectaBranding;

package/dist/ui.js

@@ -18,23 +18,39 @@ function stringForInlineScript(value) {
 const OPERATOR_PAGE_LABELS = {
     connections: "Connections",
     activity: "Activity",
+    artifacts: "Artifacts",
+    artifact: "Artifact",
 };
+/** `/artifacts/<id>` and its snapshots, `/artifacts/<id>/v/<version>`. */
+const ARTIFACT_PAGE = /^\/artifacts\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?(?:\/v\/\d{1,9})?$/;
 export function operatorPageForPath(path) {
     if (path === "/")
         return "connections";
     if (path === "/activity")
         return "activity";
+    if (path === "/artifacts")
+        return "artifacts";
+    if (ARTIFACT_PAGE.test(path))
+        return "artifact";
     return undefined;
 }
+/** Everything artifact pages own: shells, their API, and the frame. */
+function isArtifactPath(path) {
+    return path === "/artifacts" || path.startsWith("/artifacts/");
+}
 export function operatorPageTitle(page, configuredTitle) {
     return `${OPERATOR_PAGE_LABELS[page]} — ${configuredTitle}`;
 }
 /**
- * The badge a tool earns, from the one predicate core enforces with. Computed
- * here so the page reports the rule rather than restating it.
+ * The badge a tool earns, from the predicates core enforces with. Computed
+ * here so the page reports the rule rather than restating it. `exempt` is the
+ * config exemption (#566), which `isApprovalExempt` already refuses to grant
+ * a read-only tool.
  */
-export function uiToolSafety(definition) {
-    return isExplicitlyReadOnly(definition) ? "runs_in_programs" : "needs_approval";
+export function uiToolSafety(definition, exempt = false) {
+    if (isExplicitlyReadOnly(definition))
+        return "runs_in_programs";
+    return exempt ? "exempt" : "needs_approval";
 }
 /**
  * The fix-prompt key for a connector that is not usable. Chosen from the
@@ -99,7 +115,7 @@ function jsonForInlineScript(value) {
  * Every operator page serves this same data-free shell. Connector, credential,
  * and activity data arrives only through the authenticated `/ui/*` APIs.
  */
-export function renderUiHtml(uiAuth, mcpUrl = "/mcp", branding, nonce, page = "connections") {
+export function renderUiHtml(uiAuth, mcpUrl = "/mcp", branding, nonce, page = "connections", options = {}) {
     const clerk = uiAuth?.kind === "clerk" ? uiAuth : undefined;
     // The Clerk loader's origin. A value that fails the gate is dropped rather
     // than escaped into the page: the loader tag is simply not emitted, the gate
@@ -197,6 +213,7 @@ ${clerkScript}
 const AUTH = ${jsonForInlineScript(auth)};
 const MCP_URL = ${jsonForInlineScript(mcpUrl)};
 const INITIAL_PAGE = ${jsonForInlineScript(page)};
+const HOME_URL = ${jsonForInlineScript(options.homeUrl ?? "/")};
 const TITLE_SUFFIX = ${jsonForInlineScript(brand.pageTitle)};
 const PRODUCT_NAME = ${stringForInlineScript(brand.productName)};
 const PRODUCT_DESCRIPTION = ${stringForInlineScript(brand.description)};
@@ -226,8 +243,17 @@ export function operatorUi(options = {}) {
             // route here, and no activity module, runs for a path this surface does
             // not own. The Activity page is the one addition; the server reserves
             // it only when history is readable, and routeUi checks the same thing.
-            if (!ownsOperatorPath(reservedPaths, context.path))
+            // Artifact pages are the other: they exist only beside the module.
+            const artifacts = context.opts.artifactsModule;
+            const artifactPath = Boolean(artifacts) && isArtifactPath(context.path);
+            if (!artifactPath && !ownsOperatorPath(reservedPaths, context.path))
                 return null;
+            if (artifactPath && !operatorPageForPath(context.path)) {
+                // The pages' JSON API and the sandboxed frame; the module owns both,
+                // and this bundle imports none of it.
+                return (await artifacts?.handle(context)) ??
+                    new Response("Not Found", { status: 404 });
+            }
             const routes = [
                 ...(context.opts.credentialVault ? [routeCredentials] : []),
                 routeOAuthManagement,

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.25.0";
+export declare const CONNECTA_VERSION = "0.26.0";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.25.0";
+export const CONNECTA_VERSION = "0.26.0";