@zackbart/connecta 0.28.1 → 0.29.0

package/dist/server.js

@@ -3,10 +3,11 @@ import { notFoundResponse } from "./branding.js";
 import { aggregateCallAdmissionSnapshots } from "./call-admission.js";
 import { isAdmittingExecutor } from "./executor-admission.js";
 import { createMcpRoute, MCP_CORS_HEADERS } from "./routes/mcp.js";
-import { routeOAuthCallback, } from "./routes/oauth.js";
+import { routeOAuthCallback } from "./routes/oauth.js";
+import { routeOAuthClientMetadata } from "./routes/oauth-client-metadata.js";
+import { routeConnect } from "./routes/connect.js";
 import { runEdge } from "./runtime/run.js";
-import { withSecurityHeaders, } from "./routes/shared.js";
-const isArtifactPath = (path) => path === "/artifacts" || path.startsWith("/artifacts/");
+import { authMetadata, withSecurityHeaders, } from "./routes/shared.js";
 /**
  * Build the Web-standard fetch handler.
  *
@@ -20,47 +21,24 @@ const isArtifactPath = (path) => path === "/artifacts" || path.startsWith("/arti
  * `close()` has disposed that runtime.
  */
 export function createFetchHandler(opts) {
-    const { auth, publicUrl, registry } = opts;
+    const { registry } = opts;
+    const { auth, publicUrl } = opts.config;
     const routeMcp = createMcpRoute(opts);
-    // The first provider's metadata answer for this request, if any has one.
-    const metadata = (request, baseUrl) => Effect.gen(function* () {
-        for (const provider of auth) {
-            const handleMetadata = provider.handleMetadata?.bind(provider);
-            if (handleMetadata) {
-                const response = yield* Effect.promise(async () => handleMetadata(request, baseUrl));
-                if (response)
-                    return response;
-            }
-        }
-        return null;
-    });
+    const metadata = (request, baseUrl) => Effect.promise(async () => (await authMetadata(request, baseUrl, auth))?.response ?? null);
     const health = async () => {
         // The executor is required, so code admission always has a shape to
         // report: either the executor's own pool or the fallback controller
         // wrapped around it at construction.
-        const codeAdmission = isAdmittingExecutor(opts.executor)
-            ? opts.executor.admissionSnapshot?.()
-            : undefined;
+        const codeAdmission = isAdmittingExecutor(opts.executor) ? opts.executor.admissionSnapshot?.() : undefined;
         return Response.json({
             status: "ok",
             connectors: registry.listConnectors().length,
-            server: opts.serverInfo,
+            server: opts.config.serverInfo,
             // Which sandbox, not how it is tuned: `connecta doctor` reports the
             // executor it just exercised rather than assuming one, and a
             // deployment whose executor identifies as nothing omits the key
             // instead of inviting a guess (#368).
-            ...(opts.executorName !== undefined
-                ? { executor: { name: opts.executorName } }
-                : {}),
-            // Counts only, from refreshes that already happened — the endpoint
-            // asks no downstream anything, and `connecta doctor` reads it to
-            // report a stale allowlist without a probe of its own (#343).
-            // Stable 64-bit hashes preserve that shape without publishing ids.
-            catalogDrift: Object.fromEntries(await Promise.all(Object.entries(registry.catalogDriftSnapshot()).map(async ([id, report]) => {
-                const hash = new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(id)));
-                const key = Array.from(hash.subarray(0, 8), byte => byte.toString(16).padStart(2, "0")).join("");
-                return [key, report];
-            }))),
+            ...(opts.executorName !== undefined ? { executor: { name: opts.executorName } } : {}),
             admission: {
                 policy: "global-fifo",
                 requests: opts.requestAdmission.snapshot(),
@@ -71,24 +49,32 @@ export function createFetchHandler(opts) {
                 },
                 reservedRoutes: [
                     "/health",
-                    ...(opts.ui?.reservedPaths ?? []),
-                    ...(opts.ui && opts.activity?.list ? ["/activity"] : []),
-                    ...(opts.ui && opts.accessTokens ? ["/tokens"] : []),
-                    ...(opts.ui && opts.artifactsModule ? ["/artifacts", "/artifacts/*"] : []),
+                    ...(opts.config.ui?.reservedPaths ?? []),
+                    ...(opts.config.ui && opts.config.activity?.store.list ? ["/activity"] : []),
+                    ...(opts.config.ui && opts.config.accessTokens ? ["/tokens"] : []),
                 ],
             },
-            ...(opts.deploymentInfo ? { deployment: opts.deploymentInfo } : {}),
+            ...(opts.config.deploymentInfo ? { deployment: opts.config.deploymentInfo } : {}),
         });
     };
     const route = (context) => Effect.gen(function* () {
         const { request, path, baseUrl } = context;
+        const clientMetadata = routeOAuthClientMetadata(context);
+        if (clientMetadata)
+            return clientMetadata;
         // Private mutations own OPTIONS so they never inherit wildcard CORS.
-        const ui = opts.ui;
+        const ui = opts.config.ui;
         if (ui) {
             const uiResponse = yield* Effect.promise(() => ui.handle(context));
             if (uiResponse)
                 return uiResponse;
         }
+        const connect = yield* routeConnect(context);
+        if (connect)
+            return connect;
+        const oauthCallback = yield* routeOAuthCallback(context);
+        if (oauthCallback)
+            return oauthCallback;
         if (request.method === "OPTIONS") {
             const preflight = yield* routeMcp.handle(context);
             if (preflight)
@@ -105,46 +91,20 @@ export function createFetchHandler(opts) {
             const response = yield* metadata(request, baseUrl);
             if (response)
                 return response;
-            return notFoundResponse(request, opts);
+            return notFoundResponse(request, opts.config);
         }
         if (path === "/health")
             return yield* Effect.promise(health);
-        const oauthCallback = yield* routeOAuthCallback(context);
-        if (oauthCallback)
-            return oauthCallback;
         const mcp = yield* routeMcp.handle(context);
         if (mcp)
             return mcp;
-        return notFoundResponse(request, opts);
+        return notFoundResponse(request, opts.config);
     });
     const serve = (request, runtimeContext) => Effect.suspend(() => {
         const url = new URL(request.url);
         const baseUrl = publicUrl ?? url.origin;
         const path = url.pathname;
-        const defer = runtimeContext
-            ? runtimeContext.waitUntil.bind(runtimeContext)
-            : undefined;
-        // The artifact hostname has no MCP, health, OAuth, or operator routes.
-        // Dispatch before MCP origin checks so even a hostile /mcp gets the same
-        // 404 as any other unserved path.
-        if (opts.artifactOrigin && url.origin === new URL(opts.artifactOrigin).origin) {
-            if (!isArtifactPath(path) || !opts.ui || !opts.artifactsModule) {
-                return Effect.succeed(withSecurityHeaders(notFoundResponse(request, opts), url, path));
-            }
-            const context = {
-                request, url, path, baseUrl: opts.artifactOrigin, opts, defer, runtimeContext,
-            };
-            return Effect.map(Effect.promise(() => opts.ui.handle(context)), response => withSecurityHeaders(response ?? notFoundResponse(request, opts), url, path));
-        }
-        if (opts.artifactOrigin && isArtifactPath(path) && opts.ui && opts.artifactsModule) {
-            const target = new URL(opts.artifactOrigin);
-            target.pathname = path;
-            target.search = url.search;
-            return Effect.succeed(withSecurityHeaders(new Response(null, {
-                status: 308,
-                headers: { Location: target.toString() },
-            }), url, path));
-        }
+        const defer = runtimeContext ? runtimeContext.waitUntil.bind(runtimeContext) : undefined;
         const originRefusal = routeMcp.rejectOrigin(request);
         if (originRefusal) {
             return Effect.succeed(withSecurityHeaders(originRefusal, url, path));
@@ -155,10 +115,7 @@ export function createFetchHandler(opts) {
         // external DNS, TLS, and the tunnel in front of connecta — so /health is
         // exempt. It is unauthenticated, returns no user data, and sets no
         // cookies, so forcing HTTPS on it protects nothing.
-        if (publicUrl &&
-            path !== "/health" &&
-            new URL(publicUrl).protocol === "https:" &&
-            url.protocol === "http:") {
+        if (publicUrl && path !== "/health" && new URL(publicUrl).protocol === "https:" && url.protocol === "http:") {
             // Assign the path and query onto the configured URL instead of resolving
             // attacker-controlled text against it. A pathname beginning with `//`
             // (including a backslash form normalized by URL parsing) is an authority