@zackbart/connecta 0.26.0 → 0.26.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/CHANGELOG.md +141 -0
  2. package/README.md +11 -0
  3. package/dist/access-tokens.d.ts +38 -0
  4. package/dist/access-tokens.js +294 -0
  5. package/dist/artifacts/document.js +6 -2
  6. package/dist/artifacts/markdown.js +43 -14
  7. package/dist/artifacts/routes.js +27 -4
  8. package/dist/artifacts/validate.js +1 -0
  9. package/dist/auth/downstream-oauth.js +397 -48
  10. package/dist/auth/oauth-start-reset.js +20 -0
  11. package/dist/branding.d.ts +87 -0
  12. package/dist/branding.js +170 -1
  13. package/dist/connectors/remote-mcp.js +32 -7
  14. package/dist/execute.js +7 -8
  15. package/dist/identity.js +2 -0
  16. package/dist/index.d.ts +6 -2
  17. package/dist/index.js +13 -2
  18. package/dist/module-contracts.d.ts +5 -0
  19. package/dist/oauth-callback-outcome.js +43 -18
  20. package/dist/operator-ui/generated.js +2 -2
  21. package/dist/operator-ui/model.d.ts +1 -0
  22. package/dist/operator-ui/view.js +304 -33
  23. package/dist/page-styles.js +7 -0
  24. package/dist/registry.js +16 -13
  25. package/dist/routes/access-tokens.js +110 -0
  26. package/dist/routes/mcp.js +5 -1
  27. package/dist/routes/oauth-management.js +66 -12
  28. package/dist/routes/oauth.js +54 -87
  29. package/dist/routes/shared.d.ts +3 -1
  30. package/dist/routes/shared.js +6 -1
  31. package/dist/routes/ui.js +9 -1
  32. package/dist/server.js +8 -5
  33. package/dist/skills.js +6 -6
  34. package/dist/types.d.ts +5 -0
  35. package/dist/ui.d.ts +6 -1
  36. package/dist/ui.js +27 -64
  37. package/dist/version.d.ts +1 -1
  38. package/dist/version.js +1 -1
  39. package/documentation/architecture.md +19 -9
  40. package/documentation/auth.md +166 -2
  41. package/documentation/code-mode.md +15 -15
  42. package/documentation/meta-tools.md +12 -5
  43. package/ethos.md +1 -1
  44. package/package.json +5 -1
  45. package/templates/node/README.md +11 -0
  46. package/templates/node/package.json +1 -1
  47. package/templates/node/src/index.ts +5 -1
package/templates/node/README.md CHANGED
@@ -179,3 +179,14 @@ Doctor verifies the MCP contract. Verify UI behavior separately: sign in at `/`,
179
179
  confirm the visible connections and their permitted auth controls, and check
180
180
  Activity only when you enabled a readable history store. A missing optional
181
181
  feature should not leave a tab behind.
182
+
183
+ ### Existing client tokens
184
+
185
+ Upgrading from v0.23 does not require rotating managed `cta_…` tokens. Import
186
+ `accessTokens` from `@zackbart/connecta/auth/access-tokens`, replace the old
187
+ `accessTokens: true` with `accessTokens: accessTokens(storage)`, and keep the
188
+ same persistent storage namespace and identity/tool/pool grant rules. Enable
189
+ `identity.accessTokenManagement` only for the interactive operators who should
190
+ manage tokens. New issuance needs storage with atomic `compareAndSet`; older
191
+ storage adapters can still verify existing tokens. See the package's
192
+ `documentation/auth.md` for the migration and storage requirements.
package/templates/node/package.json CHANGED
@@ -15,7 +15,7 @@
15
15
  "typecheck": "tsc --noEmit"
16
16
  },
17
17
  "dependencies": {
18
- "@zackbart/connecta": "0.26.0",
18
+ "@zackbart/connecta": "0.26.2",
19
19
  "quickjs-emscripten": "0.32.0"
20
20
  },
21
21
  "devDependencies": {
package/templates/node/src/index.ts CHANGED
@@ -27,6 +27,7 @@ import { operatorUi } from "@zackbart/connecta/ui";
27
27
  import { api, createConnecta } from "@zackbart/connecta";
28
28
  import { fileStorage, listen } from "@zackbart/connecta/node";
29
29
  import { quickJsExecutor } from "@zackbart/connecta/quickjs";
30
+ // import { accessTokens } from "@zackbart/connecta/auth/access-tokens";
30
31
  // import { artifacts, kvArtifactStore } from "@zackbart/connecta/artifacts";
31
32
  // Operator sign-in. Needs `npm install @clerk/backend` — it is an optional
32
33
  // peer, so it does not install with Connecta.
@@ -63,6 +64,8 @@ const storage = fileStorage(stateFile);
63
64
 
64
65
  const connecta = createConnecta({
65
66
  storage,
67
+ // Reuse this storage to keep v0.23 client tokens without rotating secrets.
68
+ // accessTokens: accessTokens(storage),
66
69
  auth: [
67
70
  bearerToken(token, { subjectId: "operator" }),
68
71
  // clerkAuth({
@@ -74,7 +77,7 @@ const connecta = createConnecta({
74
77
  // // allowedDomains: ["acme.com"],
75
78
  // }),
76
79
  ],
77
- // Code-owned identity resolvers. The two management permissions default to
80
+ // Code-owned identity resolvers. Connection management permissions default to
78
81
  // none, so the template grants them. The commented pair is the optional
79
82
  // member/operator split for Clerk-backed deployments: connector access is
80
83
  // derived from the authenticated identity and cannot be selected by an MCP
@@ -86,6 +89,7 @@ const connecta = createConnecta({
86
89
  // connectorAccess: ({ principal }) =>
87
90
  // principal?.id === "user_admin" ? "all" : ["time"],
88
91
  // activityAccess: ({ id }) => id === "user_admin",
92
+ // accessTokenManagement: ({ principal }) => principal?.id === "user_admin",
89
93
  },
90
94
  publicUrl,
91
95
  // Required: model-written programs run in a bounded QuickJS child.