@zackbart/connecta 0.27.0 → 0.28.1

package/AGENTS.md

@@ -4,13 +4,13 @@ This is the canonical instruction file for coding agents. `CLAUDE.md` is a
 symlink to this file so every agent works from the same conventions.
 
 A single MCP endpoint aggregating downstream connectors (remote MCP servers and
-plain HTTP APIs) behind eight meta-tools, `execute_code` among them. Every
+plain HTTP APIs) behind seven meta-tools, `execute_code` among them. Every
 deployment configures an executor, and agents reach connectors by writing
 JavaScript against it. One fetch-native core on Effect behind a Promise API,
-running on both Node and Cloudflare Workers. A program's write pauses until
-`resume_execution` repeats it. One `planned` decision changes that picture — an
-artifacts module — and until it ships, the code and the guides describe what
-exists.
+running on both Node and Cloudflare Workers. A program runs read-only and
+config-exempt tools; every other write is its own `call_destructive_tool` call,
+so the host's permission prompt is the only approval. The code and the guides
+describe what exists.
 
 - **[`ethos.md`](./ethos.md) is the constitution.** It states what connecta is
   and isn't, and its decisions table carries a verdict for every shape already
@@ -74,7 +74,7 @@ pins the generated deployment to the CLI package's exact version, restores the
 template `.gitignore` and the `CLAUDE.md` symlink, and refuses to merge into an
 existing path.
 `connecta doctor` verifies a running deployment's health, executor, and exact
-eight-tool surface. The template carries its own `Dockerfile` and
+seven-tool surface. The template carries its own `Dockerfile` and
 `docker-compose.yml`, so the generated project is the container: setup changes
 must keep the root README, the template (source, container files, and README),
 and the `scripts/check-package.mjs` smoke — which builds and runs that

package/CHANGELOG.md

@@ -2,6 +2,235 @@
 
 All notable changes to this package are documented here.
 
+## 0.28.1 — 2026-10-05
+
+This patch adds six maintained connections for church operations and the
+downstream OAuth they needed. Planning Center, Overflow, Tithe.ly, Breeze ChMS,
+and Church Community Builder (Pushpay ChMS) are hand-written `api()` surfaces
+over their whole APIs, with every money-moving write behind approval; Basecamp
+proxies 37signals' hosted MCP server. Church Community Builder accepts only
+OAuth, so `api()` connectors can now declare a static OAuth 2.0
+authorization-code grant that reuses the `remoteMcp()` machinery. Each
+connection is a new opt-in provider subpath and the OAuth grant is opt-in per
+connector: existing imports, connector declarations, credentials, and
+deployment behavior do not change. Two fixes a deployment may notice: a forced
+OAuth restart no longer reuses a client registration the provider has deleted
+([#611](https://github.com/zackbart/connecta/issues/611)), and a failed OAuth
+code exchange is now logged as fixed text rather than the provider's message.
+Internally, the guarded transport can repeat a query key for an array value,
+and `api()`'s builder moved into its own module so OAuth stays out of bundles
+that never use it.
+
+### Added
+
+- **Downstream OAuth on `api()` connectors.** A hand-written connector can
+  declare `oauth: { authorizationEndpoint, tokenEndpoint, clientId,
+  clientSecret?, tokenEndpointAuthMethod?, scope?, pkce?, authorizationParams?,
+  tokenRequestHeaders?, apiOrigins }` for a REST API that accepts only the authorization code grant,
+  such as Church Community Builder. Nothing is discovered or registered: the
+  endpoints and the provider-issued client are configuration, and the client
+  secret comes from the deployment's environment and is never stored. Handlers
+  call `ctx.oauth.fetch(url, init)`, which sends the calling owner's token as a
+  bearer to a declared origin only, answers a 401 with one coordinated refresh
+  and one replay, and otherwise fails `auth_required`. The grant is the
+  `remoteMcp()` grant underneath — the same sealed epochs, shared and personal
+  ownership, rotating-refresh coordination, dead-versus-outage verdicts,
+  `/oauth/callback/<id>`, `authorize_connector`, and operator Connect,
+  Restart, and Disconnect. `oauth` and `credential` are exclusive on one
+  connector. See [downstream OAuth on `api()`](./documentation/auth.md#downstream-oauth-on-api).
+- **Church Community Builder (Pushpay ChMS) connection.**
+  `@zackbart/connecta/providers/ccb` exports `ccb(id, { purpose, environment,
+  mode, clientId, clientSecret, access?, scopes?, subdomain? })`, a
+  hand-written v2 REST connection over `api()`'s OAuth grant. `environment`
+  (`production` or `sandbox`) and `mode` (`system`, one church-wide grant an
+  administrator approves; `identity`, each person signing in as themselves
+  with a personal grant) are required, because CCB credentials do not cross
+  environments and the two modes reach different data. Twenty-four named reads
+  cover people and families, groups and participants, events and attendance,
+  forms and responses, processes and queues, scheduling, notes, and giving
+  metrics and pledges, with projections that drop allergies, giving
+  identifiers, and prayer requests unless `raw: true`. `ccb_api_get` and
+  `ccb_api_search` reach every GET and advanced search read-only, and
+  `ccb_api_mutate` ships only when a write scope is requested. A default
+  60-per-minute admission window per endpoint transcribes CCB's documented
+  limit, and `npm run providers:check -- --provider ccb` compares the 41
+  touched endpoints with Pushpay's published OpenAPI document. Clients are
+  issued by hand through Pushpay's API access request form.
+- **Maintained Planning Center connection.**
+  `@zackbart/connecta/providers/planning-center` exports `planningCenter(id,
+  options)`, a hand-written `api()` surface over Planning Center Online's REST
+  API with no SDK and no new dependency. Named tools cover the jobs church
+  staff run — People search, profiles, contact records, lists, workflows and
+  card actions, notes, custom fields, and form submissions; Services plans,
+  teams, schedules, songs, and scheduling; Groups memberships and events;
+  Check-Ins attendance; Calendar occurrences; Registrations signups; and Giving
+  donations, funds, batches, pledges, and recurring gifts as reads only — with
+  JSON:API flattened into lean records and `raw: true` beside them.
+  `pco_api_get` (read-only) and `pco_api_mutate` (always approval-gated) reach
+  every other endpoint, including every write that moves money. The credential
+  is a personal access token as two labeled fields, and the Test action names
+  the person and organization it acts as. Every request sends a reviewed
+  `X-PCO-API-Version` per product and a configurable `User-Agent`, and the
+  default call budget transcribes Planning Center's 100 requests per 20
+  seconds. `npm run providers:check -- --provider planning-center` compares
+  the touched endpoints with Planning Center's per-product OpenAPI documents
+  and reports a newly published version of any pinned product. Planning
+  Center's own hosted MCP server was considered and is not wrapped: its writes
+  stop at People.
+- **Maintained Overflow connection.** `@zackbart/connecta/providers/overflow`
+  ships 16 projected reads over contributions, deposits and their line items
+  and totals, refunds, chargebacks, donors, recurring gifts, payment methods,
+  campaigns, locations, Tap events, and webhook delivery logs, plus a
+  read-only GET hatch and a destructive JSON-mutation hatch that carries every
+  Overflow write — charges, payment authorization, refunds, recurring-gift
+  changes, and donor edits — to the host's approval prompt. `environment`
+  (`"production"` or `"staging"`) is required with no default, the credential
+  is one operator slot with `clientId` and `apiKey` fields, list rows keep
+  donor contact details and webhook payloads out unless `raw: true`, and the
+  default admission budget transcribes Overflow's 120 requests per minute per
+  client. `npm run providers:check -- --provider overflow` compares all 38
+  operations with the OpenAPI document Overflow publishes on staging.
+- A maintained Tithe.ly giving connection, `tithely(id, { purpose, environment })`
+  from `@zackbart/connecta/providers/tithely`: a hand-written `api()` surface
+  over Tithe.ly's v1 REST API. `environment` (`"live"` for tithe.ly, `"test"`
+  for tithelydev.com) is required with no default, because Tithe.ly's key pairs
+  are environment-specific and carry nothing that says which. The credential
+  slot takes the public and private keys as two fields, refuses an obviously
+  swapped pair without a request, and its Test action reports the organization
+  the keys reach; API access is by request through support@tithe.ly. Named
+  read-only tools cover organizations and their funds, donor accounts, charges
+  by organization or donor and created-date range, recurring gifts, and
+  payment-method metadata, with amounts as integer cents, dates as ISO 8601,
+  `hasMore` paging, and organization projections that omit payout bank and
+  legal-contact details. Every write moves money or donor payment state and is
+  reached only through the always-destructive, form-encoded
+  `tithely_api_mutate`; `tithely_api_get` reaches every v1 read. No call budget
+  is declared, since Tithe.ly publishes no rate limit.
+  `npm run providers:check -- --provider tithely` digests the OpenAPI snippet
+  each reference page embeds, for every documented v1 operation.
+- A maintained Breeze ChMS connection (Tithely Church Management since
+  2025-11-11) at `@zackbart/connecta/providers/breeze`:
+  `breeze(id, { subdomain, purpose })` binds one church's
+  `<subdomain>.breezechms.com` — validated as a single hostname label at
+  construction, so no argument can steer the API key elsewhere — with an
+  operator `Api-Key` slot tested against the account summary. Named reads cover
+  people, profile fields, tags, events, calendars, attendance, forms,
+  volunteers, the account log, and giving (`list_contributions`, `list_funds`,
+  which call endpoints Breeze stopped documenting in 2023 and still serves);
+  named writes add and update people, assign and unassign tags, and record a
+  check-in. Because Breeze sends writes as GET too, the escape hatches split by
+  endpoint rather than method: `breeze_api_get` admits only a reviewed
+  allowlist of read endpoints and their documented parameters, and the
+  destructive `breeze_api_mutate` reaches everything else. No admission budget
+  is declared, since Breeze documents no rate limit; drift is review-only,
+  since it publishes no machine-readable specification.
+- **`basecamp()` — a maintained Basecamp hosted-MCP connection** at
+  `@zackbart/connecta/providers/basecamp`, proxying
+  `https://mcp.basecamp.com/mcp` — a server 37signals runs but has not
+  documented or announced. OAuth only, and `clientMetadataUrl` is required:
+  Basecamp restricts dynamic client registration for HTTPS callbacks, so a
+  deployment hosts a Client ID Metadata Document listing
+  `<publicUrl>/oauth/callback/<id>`, and construction throws without one. A
+  grant reaches exactly one Basecamp account, chosen at consent, so the guide
+  leads with that, names `get_me` to confirm it, and a second account is a
+  second connector. All 227 tools in the live catalog are classified (105
+  read-only, 34 additive, 88 destructive); the four verdicts that part from the
+  server's own annotations, and `create_stream_ticket`'s agreement with its
+  read-only claim, are argued beside their rows. No access mode ships: the MCP
+  client requests the scope Basecamp's challenge names, so a `read` option
+  would be a label rather than a limit. Personal access tokens are not offered,
+  because nothing shows this endpoint accepts one. No default `callAdmission`:
+  Basecamp's limits are dynamic, multi-tier, and metered at its own server's
+  IP. With no public setup page or inventory, `npm run providers:check` reads
+  the server's OAuth discovery instead — the resource names the endpoint and
+  the authorization server still accepts metadata-document clients — and
+  catalog drift is runtime-only.
+
+### Fixed
+
+- **A forced OAuth restart can no longer wedge on a purged client
+  registration** ([#611](https://github.com/zackbart/connecta/issues/611)).
+  Restart already carried an issuer-bound dynamic registration into the new
+  epoch; it carried it unconditionally, and a provider that had forgotten the
+  client refuses it at consent without ever redirecting back, so every later
+  Restart reused the same dead client and only Disconnect escaped. A carried
+  client is now carried again only once a grant in its epoch proves the
+  provider still knows it, so two restarts in a row with no consent between
+  them register at most once more. A URL-based client (`clientMetadataUrl`)
+  and a client whose secret has expired are never carried. Continue no longer
+  hands back a pending consent URL whose client a callback's `invalid_client`
+  has dropped; it starts a flow that registers instead. Static `api()` OAuth
+  clients are configuration and unaffected.
+- **A refresh rotation saved after its request was cancelled keeps its
+  issuer.** When the token endpoint answered after the owning request left,
+  connecta persisted the rotated tokens itself but unbound, and the next
+  issuer-aware read adopted them for whichever authorization server the
+  connector named by then — so a connector repointed at another server would
+  send the rotated refresh token there. The recovery save now stamps the issuer
+  the refresh answered to, as the SDK's own save does, and a repointed connector
+  fences the grant instead.
+- **A failed OAuth code exchange no longer writes the provider's message to the
+  operator log.** The SDK quotes a token endpoint's `error_description` or raw
+  body, and a provider that echoes a `client_secret_post` request put the client
+  secret, code, and verifier in the log. The callback now logs fixed text and,
+  when the error carries one, a standard OAuth error code from an allowlist.
+
+## 0.28.0 — 2026-10-04
+
+This minor release removes program pauses ([#672](https://github.com/zackbart/connecta/issues/672)).
+`execute_code` programs run explicitly read-only tools and the writes
+`execute.approval` exempts, and every other write is its own
+`call_destructive_tool` call, so the host's permission prompt on that call is
+the only approval there is. Hosts approve one tool call at a time, and under
+always-allow or bypass modes the agent called `resume_execution` itself: each
+pause cost a round trip and a full replay and protected nothing. What breaks:
+`resume_execution` is gone, so the surface is seven tools again, and a host
+allow-list or cached tool list naming it should drop it.
+`execute.resumableWrites` and `execute.pausedRunTtlSeconds` now refuse to
+construct with an error naming
+the removal — delete them, including the Worker example's
+`execute: { resumableWrites: false }` line. A program's non-exempt write now
+fails `destructive_tool_requires_approval` with a `nextAction` for
+`call_destructive_tool`, exactly as it did on deployments without resumable
+writes, and a run never returns `{ paused: … }`. `Date.now()` and
+`Math.random()` inside a program are the runtime's own again rather than pinned
+per run. A deployment that sets neither option and whose programs only read
+can ignore all of this: approval exemptions, `execute.maxWrites`, storage
+contracts, and the D1 activity schema are unchanged, and any paused runs left
+in storage expire on their own TTL. The Node template now pins 0.28.0.
+
+### Removed
+
+- `resume_execution`, the run journal, deterministic replay, compare-and-set
+  run claims, and the pinned clock and randomness (code-mode `P6`) that
+  existed only so a replay could match. `W1`–`W8`, `W11`, `P6`, and `X12` are
+  retired clause ids.
+- The pause-only error codes: `execution_paused`, `pending_write_too_large`,
+  `journal_too_large`, `execution_interrupted`, `execution_diverged`,
+  `execution_claim_lost`, `approval_mismatch`, `execution_token_stale`,
+  `execution_in_progress`, `execution_expired`, `execution_not_found`, and
+  `resumable_writes_unavailable`. `write_outcome_unknown` stays, for an exempt
+  write that was sent and never answered.
+- `resumableWrites` from `/health`, and the "resumable writes off" note from
+  `connecta doctor`, which now verifies the exact seven-tool surface.
+- The pause and resume agent eval tasks.
+
+### Changed
+
+- The MCP instructions, the `execute_code` description, and the `usage` skill
+  describe the read-only program route: reads and config-exempt writes in a
+  program, every other write through `call_destructive_tool`. The description
+  states the exempt-write budget.
+- `execute.maxWrites` now bounds only config-exempt writes, the one kind a
+  program can still send. Its default stays 10.
+- Activity no longer emits `paused` or `approved` outcomes, the
+  `resume_execution` source, or an `approval` scope. The types keep them as
+  read-only history, the operator UI still renders older rows (a historical
+  pause now reads "Paused for approval"), and the D1 example still stores and
+  reads the `approval` column.
+- QuickJS still runs its child with `TZ=UTC`, now for parity with a Dynamic
+  Worker's local time rather than for replay.
+
 ## 0.27.0 — 2026-10-01
 
 This minor release moves the runtime to stable Effect v4 and fixes execution,

package/README.md

@@ -10,19 +10,18 @@ writing code instead of loading a thousand tool definitions.
 You ask your agent a question that touches a service — Linear, Stripe, an
 internal API, anything you have connected. Here is what happens:
 
-1. The agent talks to one endpoint, yours, and sees eight tools. Always eight,
+1. The agent talks to one endpoint, yours, and sees seven tools. Always seven,
    no matter how many services sit behind it.
 2. It writes a short JavaScript program. Connecta runs it in a sandbox next to
    your integrations. The program can search for tools, call them, chain the
    calls, and shape the result.
 3. Only the answer comes back into the agent's context — not raw pages of
    API output.
-4. If the program wants to change something — create, update, delete — it
-   stops right there, before anything is sent, and hands the agent the exact
-   write. The agent repeats it through `resume_execution`, which your MCP
-   client can put in front of you first. Approve it and the program picks up
-   where it stopped, without re-reading what it already read. A single write
-   can also go straight through `call_destructive_tool`.
+4. If the agent wants to change something — create, update, delete — it
+   cannot do that from a program, unless your config exempts that tool. The
+   program refuses the write before anything is sent and hands back the exact
+   call; the agent makes it through `call_destructive_tool`, one visible call
+   your MCP client can put in front of you first.
 
 Credentials never leave the server. The program never sees them, and neither
 does the agent.
@@ -31,9 +30,9 @@ does the agent.
 flowchart TB
     Client["Your MCP client<br/>Claude, Cursor, …"]
 
-    subgraph Connecta["Connecta — one endpoint, eight tools, your credentials"]
-        Sandbox["execute_code<br/>the agent's program runs here<br/>reads run, writes pause"]
-        Explicit["resume_execution · call_destructive_tool<br/>the exact write, visible<br/>your client can ask you first"]
+    subgraph Connecta["Connecta — one endpoint, seven tools, your credentials"]
+        Sandbox["execute_code<br/>the agent's program runs here<br/>read-only tools, plus writes<br/>your config exempts"]
+        Explicit["call_destructive_tool<br/>one visible call per write<br/>your client can ask you first"]
     end
 
     Integrations["The integrations you chose<br/>Linear · Stripe · Notion · Vercel · your HTTP API · any MCP server"]
@@ -41,7 +40,6 @@ flowchart TB
     Client -->|"one connection"| Sandbox
     Client --> Explicit
     Sandbox -->|"reads"| Integrations
-    Sandbox -.->|"paused write"| Explicit
     Explicit -->|"writes"| Integrations
 ```
 
@@ -66,11 +64,14 @@ Fifty issues in, one small object out. Your context window notices.
   services in a config file; your client never changes.
 - **Wrap any HTTP API by hand.** A few lines per tool. No OpenAPI conversion —
   generated tool sprawl is the problem, not the fix.
-- **Use maintained connections** for Cloudflare, Linear, Mixpanel, Notion,
-  RevenueCat, Stripe, and Vercel: known endpoints, auth defaults, and vetted
-  read/write classifications, imported one at a time. Cloudflare, Notion, and
-  Vercel each let the deployment choose their hand-written API interface or
-  official hosted MCP.
+- **Use maintained connections** for Basecamp, Breeze ChMS, Church Community
+  Builder, Cloudflare, Linear, Mixpanel, Notion, Overflow, Planning Center,
+  RevenueCat, Stripe, Tithe.ly, and Vercel: known endpoints, auth defaults, and
+  vetted read/write classifications, imported one at a time. Cloudflare,
+  Notion, and Vercel each let the deployment choose their hand-written API
+  interface or official hosted MCP. Planning Center, Overflow, Tithe.ly,
+  Breeze, and Church Community Builder are hand-written over their whole APIs,
+  with every money-moving write behind approval.
 - **Let the agent work in code.** Search, chain, filter, join, and reduce
   inside the sandbox instead of round-tripping every call through the model.
 - **Teach undeclared result shapes by using them.** Successful read-only calls
@@ -82,13 +83,11 @@ Fifty issues in, one small object out. Your context window notices.
   notice also points the agent to reduce or search the result inside a
   program. Discovery can show compact schemas, exact JSON Schema, or a
   TypeScript signature to read while writing JavaScript.
-- **Keep writes deliberate.** Only tools marked read-only run in a program
-  unasked. Any other call pauses the program with the exact write, and it
-  runs only once `resume_execution` repeats it — a visible call your client
-  can gate. A paused run is a journal in storage, not a held program, so it
-  survives a restart; it expires, and a write whose outcome is unknown is
-  never sent twice. Config — and only config — can exempt a cheap,
-  reversible write from asking, per tool or per connector.
+- **Keep writes deliberate.** Only tools marked read-only run in a program.
+  Every other write is a separate, visible `call_destructive_tool` call your
+  client can gate, so the host's permission prompt is the one approval there
+  is. Config — and only config — can exempt a cheap, reversible write from
+  asking, per tool or per connector, and then a program may make it.
 - **Run it on Node or Cloudflare Workers.** The core is shared; each deployment
   supplies its platform's executor and storage. The Node template also runs
   unchanged in Docker.
@@ -122,7 +121,7 @@ and why.
 
 Setup is written for an agent. Point yours at [`AGENTS.md`](./AGENTS.md) and
 ask it to set up a Connecta deployment; the
-[documentation](./documentation/) covers the architecture, the eight tools,
+[documentation](./documentation/) covers the architecture, the seven tools,
 code mode, and inbound auth if you want to go deeper. When upgrading an
 existing deployment, each [changelog](./CHANGELOG.md) release opens with what
 breaks and what a deployment can ignore.

package/bin/connecta.mjs

@@ -257,7 +257,6 @@ async function doctor() {
     "call_tool",
     "execute_code",
     "get_result",
-    "resume_execution",
     "search_tools",
     "skills",
   ];
@@ -310,10 +309,7 @@ async function doctor() {
   console.log(
     `Connecta doctor passed: ${health.connectors} connector(s), ` +
       `${executorName ? `${executorName} executed` : "code executed"}, ` +
-      "prescribed eight-tool surface" +
-      // resume_execution is listed either way; whether programs can write is
-      // what an operator cannot tell from the tool list, so say when not.
-      (health.resumableWrites === false ? ", resumable writes off" : "") +
+      "prescribed seven-tool surface" +
       (drifted.length > 0
         ? `, catalog drift on ${drifted.length} connector(s).`
         : "."),

package/dist/activity.d.ts

@@ -2,7 +2,7 @@ import type { ActivityModule } from "./module-contracts.js";
 import type { CatalogDriftCounts, Logger } from "./types.js";
 export type ActivityCallSource = "call_tool" | "call_destructive_tool" | "batch_call" | "execute_code" | "resume_execution";
 export type ActivityOutcome = "success" | "error" | "timeout" | "cancelled" | "paused" | "approved";
-/** How much one `resume_execution` approved: this call, or this tool for the run. */
+/** Read-only history: how much one `resume_execution` approved (#672). */
 export type ActivityApproval = "call" | "tool";
 export type AgentFriction = "tool_not_found" | "schema_retry" | "destructive_reroute" | "auth_required" | "result_too_large";
 export { agentFrictionForCode } from "./activity-friction.js";
@@ -50,8 +50,9 @@ export interface ToolCallActivityEvent {
      */
     friction?: AgentFriction;
     /**
-     * Set only on an `approved` event: the scope the approval covered. An enum,
-     * like everything else here — the approved arguments are never recorded.
+     * Read-only history: set only on an `approved` event written before issue
+     * #672, the scope the approval covered. An enum, like everything else
+     * here — the approved arguments were never recorded.
      */
     approval?: ActivityApproval;
     serverName: string;
@@ -149,7 +150,7 @@ export interface ActivityRequestContext {
     defer?: (promise: Promise<unknown>) => void;
     logger: Logger;
 }
-export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "errorCode" | "friction" | "approval">;
+export type ActivityEventInput = Pick<ToolCallActivityEvent, "connectorId" | "toolName" | "address" | "source" | "outcome" | "durationMs" | "attempts" | "errorCode" | "friction">;
 /**
  * Best-effort by design: activity storage can never change a tool result.
  * Workers attach async sinks to waitUntil; synchronous sinks such as Analytics

package/dist/activity.js

@@ -49,18 +49,9 @@ export function recordToolActivity(context, input) {
         source: input.source,
         outcome: input.outcome,
         durationMs: Math.max(0, Math.trunc(input.durationMs)),
-        // A pause and an approval reach nothing downstream, so they are the two
-        // events that honestly carry zero attempts. Every other outcome keeps its
-        // floor of one, as it always has.
-        attempts: input.outcome === "paused" || input.outcome === "approved"
-            ? 0
-            : Math.max(1, Math.trunc(input.attempts)),
+        attempts: Math.max(1, Math.trunc(input.attempts)),
         ...(input.errorCode ? { errorCode: input.errorCode } : {}),
         ...(friction ? { friction } : {}),
-        ...(input.outcome === "approved" &&
-            (input.approval === "call" || input.approval === "tool")
-            ? { approval: input.approval }
-            : {}),
         serverName: context.serverInfo.name,
         serverVersion: context.serverInfo.version,
         ...(context.deploymentId

package/dist/artifacts/connector.js

@@ -6,7 +6,7 @@
 //
 // Who made each version comes from the caller core attached to the context,
 // never from arguments.
-import { api } from "../connectors/api.js";
+import { apiConnector as api } from "../connectors/api-connector.js";
 import { callerOf } from "../connector-caller.js";
 import { ConnectorCallError } from "../errors.js";
 import { resolveTheme } from "../branding.js";

package/dist/artifacts/json.js

@@ -66,3 +66,13 @@ export function jsonProblem(value, maxDepth) {
     }
     return undefined;
 }
+const encoder = new TextEncoder();
+/** A string's size in UTF-8 bytes: what every artifact limit counts. */
+export function utf8Bytes(text) {
+    return encoder.encode(text).byteLength;
+}
+/** SHA-256 as lowercase hex: the content address of a stored body. */
+export async function sha256Hex(text) {
+    const digest = await crypto.subtle.digest("SHA-256", encoder.encode(text));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/dist/artifacts/operations.js

@@ -14,8 +14,8 @@
 // Nothing here throws for a caller's mistake. Operations answer
 // `{ ok: false, code, message }`, and the connector turns that into its typed
 // error; a throw means storage failed.
-import { sha256Hex, utf8Bytes } from "../run-journal.js";
 import { buildFrameDocument, FRAME_OVERHEAD_BYTES } from "./document.js";
+import { sha256Hex, utf8Bytes } from "./json.js";
 import { markdownPage, MarkdownNestingError } from "./markdown.js";
 import { ARTIFACT_ID, checkDocument, checkDocumentTotals, checkView, finish, validDocumentName, } from "./validate.js";
 /** Physical head moves a write absorbs before giving up as busy. */

package/dist/artifacts/validate.js

@@ -7,9 +7,8 @@
 // finding names a line where there is one, quotes the source only through the
 // shared echo bound, and says what to do instead.
 import { boundedEchoText } from "../errors.js";
-import { utf8Bytes } from "../run-journal.js";
 import { lineLocator, scanHtml } from "./html-scan.js";
-import { jsonProblem, scriptSafeJson } from "./json.js";
+import { jsonProblem, scriptSafeJson, utf8Bytes } from "./json.js";
 import { FRAME_OVERHEAD_BYTES } from "./document.js";
 import { markdownPage, MarkdownNestingError } from "./markdown.js";
 import { DEFAULT_ARTIFACT_ALLOWLIST, DEFAULT_ARTIFACT_LIMITS, } from "./types.js";