@zackbart/connecta 0.26.1 → 0.26.3

package/dist/operator-ui/model.d.ts

@@ -108,6 +108,7 @@ export interface UiConnector {
 }
 export type CredentialManagementCapability = "available" | "requires_operator" | "vault_not_configured" | "no_slots";
 export interface UiData {
+    accessTokenManagement?: "available" | "requires_operator";
     serverInfo: {
         name: string;
         version: string;

package/dist/operator-ui/view.js

@@ -1,10 +1,12 @@
 /** Pages the nav lists. A single artifact is reached from the library, not the nav. */
 export const OPERATOR_PAGES = [
     "connections",
+    "tokens",
     "activity",
     "artifacts",
 ];
 export const PAGE_META = {
+    tokens: { path: "/tokens", label: "Access tokens" },
     connections: { path: "/", label: "Connections" },
     activity: { path: "/activity", label: "Activity" },
     artifacts: { path: "/artifacts", label: "Artifacts" },
@@ -198,6 +200,11 @@ export function confirmCopy(action, name) {
         confirm: "Remove",
     };
 }
+export function accessTokenUnavailableCopy(capability) {
+    return capability === undefined
+        ? "Access tokens are not configured for this deployment."
+        : "Token management requires an interactive sign-in and explicit permission.";
+}
 export function initialState(page) {
     return {
         page,
@@ -230,6 +237,12 @@ function identityScopedState() {
         credentialNoticeFor: null,
         credentialEditing: null,
         credentialBusy: null,
+        tokenPhase: "idle",
+        tokenNotice: null,
+        tokens: [],
+        createdToken: null,
+        tokenRenaming: null,
+        tokenBusy: false,
         activityPhase: "idle",
         activityNotice: null,
         activityEvents: [],
@@ -270,6 +283,9 @@ export function withPage(state, page) {
     return {
         ...state,
         page,
+        createdToken: null,
+        tokenRenaming: null,
+        tokenNotice: null,
         credentialEditing: null,
         credentialNotice: null,
         credentialNoticeFor: null,

package/dist/routes/access-tokens.js

@@ -0,0 +1,110 @@
+import { authorizeUiIdentity, isSameOrigin, privateJson, } from "./shared.js";
+async function readName(request) {
+    if (!request.headers
+        .get("content-type")
+        ?.toLowerCase()
+        .startsWith("application/json")) {
+        return {
+            ok: false,
+            response: privateJson({ error: "Content-Type must be application/json" }, { status: 415 }),
+        };
+    }
+    const reader = request.body?.getReader();
+    const chunks = [];
+    let size = 0;
+    if (reader) {
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                size += value.byteLength;
+                if (size > 1_000) {
+                    reader.cancel().catch(() => { });
+                    return { ok: false, response: privateJson({ error: "request body is too large" }, { status: 413 }) };
+                }
+                chunks.push(value);
+            }
+        }
+        finally {
+            reader.releaseLock();
+        }
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    const raw = new TextDecoder().decode(bytes);
+    if (raw.length > 1_000) {
+        return {
+            ok: false,
+            response: privateJson({ error: "request body is too large" }, { status: 413 }),
+        };
+    }
+    try {
+        const body = JSON.parse(raw);
+        return { ok: true, name: body.name };
+    }
+    catch {
+        return {
+            ok: false,
+            response: privateJson({ error: "invalid JSON body" }, { status: 400 }),
+        };
+    }
+}
+/**
+ * Interactive-operator lifecycle for deployment access tokens. The token itself
+ * is deliberately never an administrator credential and cannot reach here.
+ */
+export async function routeAccessTokens(context, manager) {
+    const match = /^\/ui\/access-tokens(?:\/([0-9a-f-]{36}))?$/.exec(context.path);
+    if (!match)
+        return null;
+    const { request, baseUrl, opts } = context;
+    if (request.method === "OPTIONS") {
+        return privateJson({ error: "CORS is not allowed" }, { status: 403 });
+    }
+    const mutating = request.method !== "GET";
+    if (mutating && !isSameOrigin(request, baseUrl)) {
+        return privateJson({ error: "same-origin request required" }, { status: 403 });
+    }
+    const admin = await authorizeUiIdentity(request, baseUrl, opts.auth, "access token management", context.runtimeContext, opts.identity);
+    if (!admin.ok)
+        return admin.response;
+    if (!admin.accessTokenManagement || !admin.identity.principal) {
+        return privateJson({ error: "access token management permission required" }, { status: 403 });
+    }
+    const id = match[1];
+    try {
+        if (!id && request.method === "GET") {
+            return privateJson({ accessTokens: await manager.list() });
+        }
+        if (!id && request.method === "POST") {
+            const input = await readName(request);
+            if (!input.ok)
+                return input.response;
+            return privateJson(await manager.create(input.name, admin.identity.principal), { status: 201 });
+        }
+        if (id && request.method === "PUT") {
+            const input = await readName(request);
+            if (!input.ok)
+                return input.response;
+            const accessToken = await manager.rename(id, input.name);
+            return accessToken
+                ? privateJson({ accessToken })
+                : privateJson({ error: "unknown access token" }, { status: 404 });
+        }
+        if (id && request.method === "DELETE") {
+            const accessToken = await manager.revoke(id, `${admin.identity.principal.namespace}:${admin.identity.principal.id}`);
+            return accessToken
+                ? privateJson({ accessToken })
+                : privateJson({ error: "unknown access token" }, { status: 404 });
+        }
+        return privateJson({ error: "method not allowed" }, { status: 405 });
+    }
+    catch {
+        return privateJson({ error: "Access token operation failed; check the name, capacity, and storage" }, { status: 400 });
+    }
+}

package/dist/routes/shared.d.ts

@@ -1,5 +1,5 @@
 import type { Implementation } from "@modelcontextprotocol/server";
-import type { ActivityModule, ArtifactsModule, OperatorSurface } from "../module-contracts.js";
+import type { AccessTokensModule, ActivityModule, ArtifactsModule, OperatorSurface } from "../module-contracts.js";
 import type { ActivityActor, ActivityReadGate, ActivityStore } from "../activity.js";
 import type { CredentialVault } from "../credential-contract.js";
 import type { DeferredWork } from "../connector-scope.js";
@@ -63,6 +63,7 @@ export interface ServerOptions {
     activityModule?: ActivityModule | undefined;
     /** Optional team pages; their routes mount only beside `ui`. */
     artifactsModule?: ArtifactsModule | undefined;
+    accessTokens?: AccessTokensModule | undefined;
     /** Optional browser UI and OAuth result-page labels. */
     branding?: ConnectaBranding | undefined;
 }
@@ -102,6 +103,7 @@ export declare function authorize(request: Request, baseUrl: string, auth: Inbou
     /** Granted addresses that still require the catalog's read-only hint. */
     guardedToolAccess?: ToolAccess;
     operator: boolean;
+    accessTokenManagement: boolean;
     credentialAdministration: ConnectorPermission;
     personalConnection: ConnectorPermission;
     /** Backward-compatible name used by operator views. */

package/dist/routes/shared.js

@@ -45,7 +45,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
                 response: privateJson({ error: "identity access resolution failed" }, { status: 403 }),
             };
         }
-        return { ok: true, actor, identity, ...access, operator: false, credentialAdministration: "none", personalConnection: "none" };
+        return { ok: true, actor, identity, ...access, operator: false, accessTokenManagement: false, credentialAdministration: "none", personalConnection: "none" };
     }
     let lastResponse = null;
     for (const provider of auth) {
@@ -75,6 +75,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
                 interactive,
             };
             let operator = interactive;
+            let accessTokenManagement = false;
             let credentialAdministration = "none";
             let personalConnection = "none";
             let access;
@@ -86,6 +87,9 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
                 }
                 access = parseConnectorAccess(identityConfig?.connectorAccess ? await identityConfig.connectorAccess(identity) : "all", { allowReadOnly: true });
                 if (interactive) {
+                    accessTokenManagement = identityConfig?.accessTokenManagement ? await identityConfig.accessTokenManagement(identity) : false;
+                    if (typeof accessTokenManagement !== "boolean")
+                        throw new Error("invalid token management permission");
                     credentialAdministration = identityConfig?.credentialAdministration ? await identityConfig.credentialAdministration(identity) : "none";
                     personalConnection = principal && identityConfig?.personalConnection ? await identityConfig.personalConnection(identity) : "none";
                 }
@@ -113,6 +117,7 @@ export async function authorize(request, baseUrl, auth, runtimeContext, identity
                     ? { principalKey: await identityStorageKey(principal) }
                     : {}),
                 ...access,
+                accessTokenManagement,
                 credentialAdministration,
                 personalConnection,
                 operator,

package/dist/routes/ui.js

@@ -74,6 +74,7 @@ export async function routeUi(context) {
     const artifactPage = operatorPage === "artifacts" || operatorPage === "artifact";
     if (operatorPage &&
         (operatorPage !== "activity" || opts.activity?.list) &&
+        (operatorPage !== "tokens" || opts.accessTokens) &&
         (!artifactPage || opts.artifactsModule)) {
         if (request.method !== "GET" && request.method !== "HEAD") {
             return privateJson({ error: "method not allowed" }, { status: 405 });
@@ -187,6 +188,7 @@ function summary(context) {
             serverInfo: opts.serverInfo,
             connectaVersion: CONNECTA_VERSION,
             activityEnabled,
+            ...(opts.accessTokens ? { accessTokenManagement: authz.accessTokenManagement && authz.identity.principal ? "available" : "requires_operator" } : {}),
             ...(opts.artifactsModule && mayViewArtifacts(authz, opts.registry) ? { artifactsEnabled: true } : {}),
             credentialManagement,
             oauthManagement: visible.some(c => mayManage(c.id)),

package/dist/server.js

@@ -77,6 +77,7 @@ export function createFetchHandler(opts) {
                     "/health",
                     ...(opts.ui?.reservedPaths ?? []),
                     ...(opts.ui && opts.activity?.list ? ["/activity"] : []),
+                    ...(opts.ui && opts.accessTokens ? ["/tokens"] : []),
                     ...(opts.ui && opts.artifactsModule ? ["/artifacts", "/artifacts/*"] : []),
                 ],
             },

package/dist/ui.d.ts

@@ -7,7 +7,7 @@ import type { RegistryView } from "./registry.js";
 import type { ConnectaBranding, Connector, ConnectorStatus, ToolDef, UiAuthConfig } from "./types.js";
 export { filterUiConnectors, type CredentialManagementCapability, type UiConnector, type UiData, } from "./operator-ui/model.js";
 export { CONNECTA_FAVICON_SVG, resolveBranding, isSafeHttpUrl, isSafeHttpsUrl, isSafeIconHref } from "./branding.js";
-export type OperatorPage = "connections" | "activity" | "artifacts" | "artifact";
+export type OperatorPage = "tokens" | "connections" | "activity" | "artifacts" | "artifact";
 export declare function operatorPageForPath(path: string): OperatorPage | undefined;
 export declare function operatorPageTitle(page: OperatorPage, configuredTitle: string): string;
 /**

package/dist/ui.js

@@ -17,6 +17,7 @@ function stringForInlineScript(value) {
 }
 const OPERATOR_PAGE_LABELS = {
     connections: "Connections",
+    tokens: "Access tokens",
     activity: "Activity",
     artifacts: "Artifacts",
     artifact: "Artifact",
@@ -24,6 +25,8 @@ const OPERATOR_PAGE_LABELS = {
 /** `/artifacts/<id>` and its snapshots, `/artifacts/<id>/v/<version>`. */
 const ARTIFACT_PAGE = /^\/artifacts\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?(?:\/v\/\d{1,9})?$/;
 export function operatorPageForPath(path) {
+    if (path === "/tokens")
+        return "tokens";
     if (path === "/")
         return "connections";
     if (path === "/activity")
@@ -180,7 +183,7 @@ ${OPERATOR_UI_SCRIPT}</script>`,
     });
 }
 function ownsOperatorPath(reserved, path) {
-    if (path === "/activity")
+    if (path === "/activity" || path === "/tokens")
         return true;
     return reserved.some((pattern) => pattern.endsWith("/*")
         ? path.startsWith(pattern.slice(0, -1))
@@ -211,6 +214,9 @@ export function operatorUi(options = {}) {
                 return (await artifacts?.handle(context)) ??
                     notFoundResponse(context.request, context.opts);
             }
+            const tokenResponse = await context.opts.accessTokens?.handle(context);
+            if (tokenResponse)
+                return tokenResponse;
             const routes = [
                 ...(context.opts.credentialVault ? [routeCredentials] : []),
                 routeOAuthManagement,

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.26.1";
+export declare const CONNECTA_VERSION = "0.26.3";

package/dist/version.js

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.26.1";
+export const CONNECTA_VERSION = "0.26.3";

package/documentation/architecture.md

@@ -614,6 +614,6 @@ compiling and configuring the real thing.
   connector limiters, then the executor, then the Connecta's runtime; Node's `listen()` calls it on
   SIGTERM/SIGINT.
 - **Structural mistakes throw at construction.** A duplicate connector id, an
-  invalid admission rule, the removed `accessTokens` option, a missing executor:
+  invalid admission rule, the old boolean `accessTokens` option, a missing executor:
   all refuse to boot (`test/config.test.ts`, `test/registry.test.ts`). Starting
   in the wrong shape is worse than not starting.

package/documentation/auth.md

@@ -7,7 +7,7 @@ static bearers are checked first, then other providers in configuration order.
 An `InboundAuth` provider's `authorize(request, baseUrl, runtimeContext)`
 returns either `{ ok: true, userId?, subjectId?, principal? }` or a refusal
 carrying its own `Response`, so the provider owns its challenge. Connecta
-issues no tokens of its own and serves no token-management routes.
+issues managed client tokens only when the optional `accessTokens` module is configured.
 
 The bearer adapter challenges with `WWW-Authenticate: Bearer` and deliberately
 omits `resource_metadata`: its credential is configured out of band, so it has no
@@ -16,6 +16,67 @@ or the edge own OAuth discovery. An open deployment with any connector warns at
 construction — including API connectors carrying static auth headers, and with
 sharper wording for credential and OAuth connectors.
 
+## Managed client tokens and upgrading from v0.23
+
+Import `accessTokens` from `@zackbart/connecta/auth/access-tokens` and pass its
+module to `createConnecta`. It installs its inbound adapter and, beside `ui`,
+the Access tokens page and `/ui/access-tokens` lifecycle routes. Omitting the
+module loads none of its implementation and serves none of those routes.
+
+```ts
+import { accessTokens } from "@zackbart/connecta/auth/access-tokens";
+
+createConnecta({
+  storage,
+  accessTokens: accessTokens(storage),
+  auth: clerkAuth({ publishableKey, secretKey }),
+  ui: operatorUi(),
+  identity: {
+    connectorAccess, // Keep the existing principal and token-id grant rules.
+    accessTokenManagement: ({ principal }) =>
+      principal?.namespace === "clerk:your-existing-namespace" &&
+      principal.id === "your-operator-id",
+  },
+  connectors,
+  executor,
+});
+```
+
+For a v0.23 deployment, replace the old `accessTokens: true` or options object
+with `accessTokens: accessTokens(storage)`, using **the same storage and key
+namespace**. Keep the existing `access-token:v1:record:*` and
+`access-token:v1:lookup:*` records. Their unrevoked `cta_…` secrets keep working;
+no secret recovery, rewrite, or client rotation is needed. Preserve the existing
+identity namespaces and connector/pool grant callbacks too. Storage compatibility
+does not translate deployment configuration or invent replacement grants.
+
+The adapter preserves `access_token` actor ids, the
+`connecta:access-tokens:v1` activity namespace, friendly names, and any stored
+principal. A token without a principal stays unbound. Every request evaluates
+current identity/tool/pool grants; a token never becomes an interactive operator.
+Names are labels, never permissions. New UI-issued tokens belong to the issuing
+human's principal, and any explicitly permitted token manager can list, rename,
+or revoke deployment tokens. Static and managed bearers cannot manage tokens or
+connection credentials. Operators need an interactive auth provider.
+
+Storage must implement `list`. Existing-token verification, rename, and revoke
+also work on older adapters without `compareAndSet`; **new issuance requires
+atomic `compareAndSet`**, because counting records before writing admits too many
+concurrent creates. Active capacity defaults to 100, configurable with
+`accessTokens(storage, { maxActive: 200 })`, up to 1,000. A durable reservation
+counts before a secret is written. An interrupted create can consume capacity
+without returning a token; it is never automatically retried or released after
+an uncertain write. Avoid creating new tokens through old-version instances once
+new-version issuance has started, since those instances do not honor reservations.
+
+Secrets contain 256 random bits and only their SHA-256 digests persist. Creation
+returns the secret once; list and rename never return it. Revocation removes its
+lookup before updating metadata, and authorization has no token cache. A strongly
+consistent store makes revocation effective on the next authorization; an
+eventually consistent backend retains its own propagation delay. Requests already
+admitted are not recalled. Management writes require an exact same-origin Origin,
+and responses are private and non-cacheable.
+
 ## Origins
 
 `allowedOrigins?: readonly string[] | "*"` bounds which browsers may speak to
@@ -409,7 +470,7 @@ from caller input.
 interactive human, the one default here that is open, because a single-operator
 deployment would otherwise be locked out of its own event stream. Team
 deployments should set it. There is no general administrator role and no
-token-management authority.
+implicit token-management authority. `identity.accessTokenManagement` is a separate boolean permission, false by default, evaluated only for interactive humans. Lifecycle routes also require a stable principal.
 
 ```ts
 createConnecta({
@@ -554,3 +615,26 @@ present, must match that owner and may then manage the connector, while an
 interactive provider's explicit 403 still refuses the flow. See
 [meta-tools](./meta-tools.md#authorization-recovery) for the recovery shapes a
 caller actually receives.
+
+## URL-based downstream OAuth clients
+
+`remoteMcp` accepts `auth: { type: "oauth", clientMetadataUrl, scope }`.
+`clientMetadataUrl` names a public HTTPS OAuth client metadata document with a
+non-root path. It must not contain credentials or a fragment. The document
+must include its own URL as `client_id`, the deployment's exact
+`/oauth/callback/<connector-id>` in `redirect_uris`, authorization-code and
+refresh-token grants, and `token_endpoint_auth_method: "none"`. Hosting that
+public document belongs to the deployment; Connecta does not expose a public
+route through inbound authentication.
+
+The SDK uses the URL as the client ID only when the authorization server
+advertises `client_id_metadata_document_supported`. Otherwise it keeps the
+existing dynamic registration flow. State validation, PKCE, issuer binding,
+encrypted token storage, refresh, and disconnect follow the same code paths.
+The metadata URL and scopes participate in the saved-client configuration
+binding, so restarting after either changes cannot reuse an old registration.
+
+`scope` supplies space-separated default OAuth scopes through client metadata.
+A downstream challenge or protected-resource scope declaration takes precedence,
+and the SDK adds `offline_access` when advertised for refresh-token grants.
+Omitting both settings preserves the existing discovery and registration flow.

package/ethos.md

@@ -40,7 +40,7 @@ carries them.
 | Optional deployment modules | accepted | typed slots select UI, activity, vault, and inbound auth; core keeps discovery, execution, invocation, and enforcement |
 | Artifacts module | accepted | a built-in connector for team-only sandboxed pages over stored JSON; immutable versions let writes skip approval. Supersedes [#287](https://github.com/zackbart/connecta/issues/287) |
 | Plugin lifecycle, provider registry, or marketplace | refused | modules are deployment code, not runtime installs; prebuilt connections are imports, discovered in docs ([#297](https://github.com/zackbart/connecta/issues/297)) |
-| Connecta-issued access tokens | removed | inbound providers authenticate clients; bearer auth stays an optional adapter |
+| Connecta-issued access tokens | accepted | optional /auth/access-tokens preserves v0.23 secrets; config owns grants, interactive management needs explicit permission ([#619](https://github.com/zackbart/connecta/issues/619)) |
 | Expanded Notion page create/update options | refused | different workflows, not missing fields; use `api()` ([#408](https://github.com/zackbart/connecta/issues/408)) |
 | Resources, prompts, and downstream MCP Apps templates | refused | tools only; clients own presentation ([#266](https://github.com/zackbart/connecta/issues/266)) |
 | Protocol sessions, server push, elicitation passthrough | refused | stateless per request; elicitation has no route |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.26.1",
+  "version": "0.26.3",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of eight meta-tools.",
@@ -114,6 +114,10 @@
     "./artifacts": {
       "types": "./dist/artifacts.d.ts",
       "import": "./dist/artifacts.js"
+    },
+    "./auth/access-tokens": {
+      "types": "./dist/access-tokens.d.ts",
+      "import": "./dist/access-tokens.js"
     }
   },
   "scripts": {

package/templates/node/README.md

@@ -179,3 +179,14 @@ Doctor verifies the MCP contract. Verify UI behavior separately: sign in at `/`,
 confirm the visible connections and their permitted auth controls, and check
 Activity only when you enabled a readable history store. A missing optional
 feature should not leave a tab behind.
+
+### Existing client tokens
+
+Upgrading from v0.23 does not require rotating managed `cta_…` tokens. Import
+`accessTokens` from `@zackbart/connecta/auth/access-tokens`, replace the old
+`accessTokens: true` with `accessTokens: accessTokens(storage)`, and keep the
+same persistent storage namespace and identity/tool/pool grant rules. Enable
+`identity.accessTokenManagement` only for the interactive operators who should
+manage tokens. New issuance needs storage with atomic `compareAndSet`; older
+storage adapters can still verify existing tokens. See the package's
+`documentation/auth.md` for the migration and storage requirements.

package/templates/node/package.json

@@ -15,7 +15,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.26.1",
+    "@zackbart/connecta": "0.26.3",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {

package/templates/node/src/index.ts

@@ -27,6 +27,7 @@ import { operatorUi } from "@zackbart/connecta/ui";
 import { api, createConnecta } from "@zackbart/connecta";
 import { fileStorage, listen } from "@zackbart/connecta/node";
 import { quickJsExecutor } from "@zackbart/connecta/quickjs";
+// import { accessTokens } from "@zackbart/connecta/auth/access-tokens";
 // import { artifacts, kvArtifactStore } from "@zackbart/connecta/artifacts";
 // Operator sign-in. Needs `npm install @clerk/backend` — it is an optional
 // peer, so it does not install with Connecta.
@@ -63,6 +64,8 @@ const storage = fileStorage(stateFile);
 
 const connecta = createConnecta({
   storage,
+  // Reuse this storage to keep v0.23 client tokens without rotating secrets.
+  // accessTokens: accessTokens(storage),
   auth: [
     bearerToken(token, { subjectId: "operator" }),
     // clerkAuth({
@@ -74,7 +77,7 @@ const connecta = createConnecta({
     //   // allowedDomains: ["acme.com"],
     // }),
   ],
-  // Code-owned identity resolvers. The two management permissions default to
+  // Code-owned identity resolvers. Connection management permissions default to
   // none, so the template grants them. The commented pair is the optional
   // member/operator split for Clerk-backed deployments: connector access is
   // derived from the authenticated identity and cannot be selected by an MCP
@@ -86,6 +89,7 @@ const connecta = createConnecta({
     // connectorAccess: ({ principal }) =>
     //   principal?.id === "user_admin" ? "all" : ["time"],
     // activityAccess: ({ id }) => id === "user_admin",
+    // accessTokenManagement: ({ principal }) => principal?.id === "user_admin",
   },
   publicUrl,
   // Required: model-written programs run in a bounded QuickJS child.