@zackbart/connecta 0.28.1 → 0.30.0

package/bin/connecta.mjs

@@ -1,18 +1,10 @@
 #!/usr/bin/env node
 
-import {
-  copyFile,
-  cp,
-  lstat,
-  mkdtemp,
-  readFile,
-  rename,
-  rm,
-  symlink,
-  writeFile,
-} from "node:fs/promises";
+import { copyFile, cp, lstat, mkdtemp, readFile, rename, rm, symlink, writeFile } from "node:fs/promises";
+import { CONNECTA_VERSION } from "./version.mjs";
+import { META_TOOL_NAMES } from "./meta-tool-names.mjs";
 import { basename, dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { fileURLToPath, pathToFileURL } from "node:url";
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const [command, ...args] = process.argv.slice(2);
@@ -27,7 +19,8 @@ function shellCd(path) {
 function usage() {
   console.log(`Usage:
   connecta init [directory]
-  CONNECTA_TOKEN=<bearer> connecta doctor [--url http://localhost:8787]
+  connecta migrate-state <state.json> <connecta.sqlite>
+  CONNECTA_TOKEN=<bearer> connecta doctor [--config] [--url http://localhost:8787]
   CF_ACCESS_CLIENT_ID=<id> CF_ACCESS_CLIENT_SECRET=<secret> connecta doctor --url https://worker.example`);
 }
 
@@ -44,18 +37,13 @@ async function init() {
     await lstat(target);
     throw new Error(`Refusing to overwrite existing path: ${target}`);
   } catch (error) {
-    const code =
-      error && typeof error === "object" && "code" in error
-        ? String(error.code)
-        : "";
+    const code = error && typeof error === "object" && "code" in error ? String(error.code) : "";
     if (code !== "ENOENT") throw error;
   }
 
   // Build beside the destination, then rename once complete. A failed copy or
   // rewrite leaves no partial destination that blocks a clean retry.
-  let stage = await mkdtemp(
-    join(parent, `.${basename(target)}.connecta-init-`),
-  );
+  let stage = await mkdtemp(join(parent, `.${basename(target)}.connecta-init-`));
   try {
     await cp(join(packageRoot, "templates", "node"), stage, {
       recursive: true,
@@ -63,10 +51,7 @@ async function init() {
 
     // npm excludes .gitignore files and symlinks from packed dependencies.
     // Restore both conventions explicitly in the generated project.
-    await writeFile(
-      join(stage, ".gitignore"),
-      ".connecta-state.json\n.connecta-activity.jsonl\n.env\nnode_modules/\n",
-    );
+    await writeFile(join(stage, ".gitignore"), ".connecta.sqlite*\n.env\nnode_modules/\n");
     await rm(join(stage, "CLAUDE.md"), { force: true });
     try {
       await symlink("AGENTS.md", join(stage, "CLAUDE.md"));
@@ -76,18 +61,11 @@ async function init() {
       await copyFile(join(stage, "AGENTS.md"), join(stage, "CLAUDE.md"));
     }
 
-    const rootPackage = JSON.parse(
-      await readFile(join(packageRoot, "package.json"), "utf8"),
-    );
+    const rootPackage = JSON.parse(await readFile(join(packageRoot, "package.json"), "utf8"));
     const deploymentPath = join(stage, "package.json");
-    const deploymentPackage = JSON.parse(
-      await readFile(deploymentPath, "utf8"),
-    );
+    const deploymentPackage = JSON.parse(await readFile(deploymentPath, "utf8"));
     deploymentPackage.dependencies["@zackbart/connecta"] = rootPackage.version;
-    await writeFile(
-      deploymentPath,
-      JSON.stringify(deploymentPackage, null, 2) + "\n",
-    );
+    await writeFile(deploymentPath, JSON.stringify(deploymentPackage, null, 2) + "\n");
 
     await rename(stage, target);
     stage = "";
@@ -99,7 +77,10 @@ async function init() {
   console.log("Next:");
   console.log(`  ${shellCd(target)}`);
   console.log("  npm install");
-  console.log("  CONNECTA_TOKEN=dev-token npm start");
+  console.log('  npm run --silent provision-token -- "local-machine"');
+  console.log("  # Save the returned cta_ token privately for your MCP client and doctor.");
+  console.log("  npm start");
+  console.log("  # README.md covers database paths and Docker provisioning.");
 }
 
 function option(name, fallback) {
@@ -135,7 +116,7 @@ async function doctorFetch(url, init = {}) {
     const response = await fetch(url, {
       ...init,
       redirect: "manual",
-      signal: AbortSignal.timeout(DOCTOR_TIMEOUT_MS),
+      signal: AbortSignal.any([AbortSignal.timeout(DOCTOR_TIMEOUT_MS), ...(init.signal ? [init.signal] : [])]),
     });
     if ([301, 302, 303, 307, 308].includes(response.status)) {
       await response.body?.cancel().catch(() => {});
@@ -145,10 +126,7 @@ async function doctorFetch(url, init = {}) {
     }
     return response;
   } catch (error) {
-    if (
-      error instanceof Error &&
-      (error.name === "TimeoutError" || error.name === "AbortError")
-    ) {
+    if (error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError")) {
       throw new Error(`Timed out after ${DOCTOR_TIMEOUT_MS}ms contacting ${url}`);
     }
     throw error;
@@ -156,9 +134,9 @@ async function doctorFetch(url, init = {}) {
 }
 
 async function doctor() {
-  const known = new Set(["--url"]);
-  for (let index = 0; index < args.length; index += 2) {
-    if (!known.has(args[index]) || !args[index + 1]) {
+  for (let index = 0; index < args.length; index++) {
+    if (args[index] === "--config") continue;
+    if (args[index] !== "--url" || !args[++index] || args[index].startsWith("--")) {
       usage();
       process.exitCode = 1;
       return;
@@ -173,22 +151,15 @@ async function doctor() {
     throw new Error("Doctor URL must use http or https.");
   }
   const loopbackHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
-  if (
-    parsedUrl.protocol === "http:" &&
-    !loopbackHosts.has(parsedUrl.hostname)
-  ) {
-    throw new Error(
-      "Refusing to send authentication credentials over remote plaintext HTTP. Use HTTPS.",
-    );
+  if (parsedUrl.protocol === "http:" && !loopbackHosts.has(parsedUrl.hostname)) {
+    throw new Error("Refusing to send authentication credentials over remote plaintext HTTP. Use HTTPS.");
   }
   const baseUrl = requestedUrl.replace(/\/+$/, "");
   const token = process.env.CONNECTA_TOKEN;
   const accessClientId = process.env.CF_ACCESS_CLIENT_ID;
   const accessClientSecret = process.env.CF_ACCESS_CLIENT_SECRET;
   if (Boolean(accessClientId) !== Boolean(accessClientSecret)) {
-    throw new Error(
-      "Set both CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET.",
-    );
+    throw new Error("Set both CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET.");
   }
   if (!token && !accessClientId) {
     throw new Error(
@@ -205,9 +176,28 @@ async function doctor() {
       : {}),
   };
 
-  const health = await jsonResponse(
-    await doctorFetch(`${baseUrl}/health`, { headers: authHeaders }),
-  );
+  if (args.includes("--config")) {
+    const response = await doctorFetch(`${baseUrl}/ui/api/config`, { headers: authHeaders });
+    if (!response.ok) {
+      await response.body?.cancel().catch(() => {});
+      throw new Error(`HTTP ${response.status}: config snapshot unavailable.`);
+    }
+    let contract;
+    try {
+      contract = await response.json();
+    } catch {
+      throw new Error("Deployment returned an invalid config contract.");
+    }
+    if (contract?.schemaVersion !== 1 || contract.config?.schemaVersion !== 1) {
+      throw new Error("Deployment returned an unsupported config contract.");
+    }
+    // The server builds this with describeConfig's allowlist; do not print
+    // the overlay, identity, health deploymentInfo, or a raw error body.
+    console.log(JSON.stringify(contract.config, null, 2));
+    return;
+  }
+
+  const health = await jsonResponse(await doctorFetch(`${baseUrl}/health`, { headers: authHeaders }));
   if (health.status !== "ok") {
     throw new Error(`Unexpected health status: ${String(health.status)}`);
   }
@@ -225,107 +215,99 @@ async function doctor() {
           .slice(0, 40)
           .trim()
       : "";
-  let requestId = 0;
-  const mcp = async (method, params) =>
-    jsonResponse(
-      await doctorFetch(`${baseUrl}/mcp`, {
-      method: "POST",
-      headers: {
-        ...authHeaders,
-        "Content-Type": "application/json",
-        Accept: "application/json, text/event-stream",
-      },
-      body: JSON.stringify({
-        jsonrpc: "2.0",
-          id: ++requestId,
-          method,
-          params,
-      }),
-      }),
-    );
-
-  const listed = await mcp("tools/list", {});
-  if (listed.error) {
-    throw new Error(`tools/list failed: ${JSON.stringify(listed.error)}`);
-  }
-  const actual = listed.result?.tools
-    ?.map((tool) => tool.name)
-    .sort();
-  const expected = [
-    "authorize_connector",
-    "call_destructive_tool",
-    "call_tool",
-    "execute_code",
-    "get_result",
-    "search_tools",
-    "skills",
-  ];
-  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
-    throw new Error(
-      `Unexpected MCP surface. Expected ${expected.join(", ")}; received ` +
-      `${Array.isArray(actual) ? actual.join(", ") : "no tool list"}.`,
-    );
-  }
-
-  const executed = await mcp("tools/call", {
-    name: "execute_code",
-    arguments: { code: "async () => 42" },
+  const { Client, StreamableHTTPClientTransport } = await import("@modelcontextprotocol/client");
+  const client = new Client(
+    { name: "connecta-doctor", version: CONNECTA_VERSION },
+    { versionNegotiation: { mode: "auto", probe: { timeoutMs: DOCTOR_TIMEOUT_MS } } },
+  );
+  const transport = new StreamableHTTPClientTransport(new URL(`${baseUrl}/mcp`), {
+    requestInit: { headers: authHeaders },
+    fetch: doctorFetch,
   });
-  if (executed.error) {
-    throw new Error(`execute_code failed: ${JSON.stringify(executed.error)}`);
-  }
-  const executionResult =
-    executed.result?.structuredContent ??
-    JSON.parse(executed.result?.content?.[0]?.text ?? "null");
-  if (executed.result?.isError || executionResult?.result !== 42) {
-    throw new Error(
-      `${executorName ? `${executorName} execution` : "execute_code"} check ` +
-        `failed: ${JSON.stringify(executed.result)}`,
-    );
-  }
+  let negotiatedVersion;
+  try {
+    await client.connect(transport);
+    negotiatedVersion = client.getNegotiatedProtocolVersion();
+    const listed = await client.listTools({}, { timeout: DOCTOR_TIMEOUT_MS });
+    const actual = listed.tools.map((tool) => tool.name).sort();
+    const expected = [...META_TOOL_NAMES].sort();
+    if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+      throw new Error(
+        `Unexpected MCP surface. Expected ${expected.join(", ")}; received ` +
+          `${Array.isArray(actual) ? actual.join(", ") : "no tool list"}.`,
+      );
+    }
 
-  // Drift is reported, never failed on. A downstream that grew a tool nobody
-  // has classified is a maintainer's next task, not a broken deployment: the
-  // unclassified tool already fails closed onto call_destructive_tool. These
-  // counts come from refreshes the deployment already served, so a deployment
-  // that has answered no catalog request yet reports nothing here (#343).
-  const drifted = Object.entries(health.catalogDrift ?? {}).filter(
-    ([, report]) =>
-      report.unclassifiedTools ||
-      report.unservedTools ||
-      report.annotationConflicts ||
-      report.schemaChanges,
-  );
-  for (const [connectorId, report] of drifted) {
-    console.warn(
-      `[connecta] catalog drift on "${connectorId}" (observed ` +
-        `${report.observedAt}): ${report.unclassifiedTools} unclassified, ` +
-        `${report.unservedTools} no longer served, ` +
-        `${report.annotationConflicts} annotation conflict(s), ` +
-        `${report.schemaChanges} schema change(s).`,
+    const executed = await client.callTool(
+      {
+        name: "execute_code",
+        arguments: { code: "async () => 42" },
+      },
+      undefined,
+      { timeout: DOCTOR_TIMEOUT_MS },
     );
+    const executionResult = executed.structuredContent ?? JSON.parse(executed.content?.[0]?.text ?? "null");
+    if (executed.isError || executionResult?.result !== 42) {
+      throw new Error(
+        `${executorName ? `${executorName} execution` : "execute_code"} check ` + `failed: ${JSON.stringify(executed)}`,
+      );
+    }
+  } finally {
+    await client.close();
   }
 
   console.log(
     `Connecta doctor passed: ${health.connectors} connector(s), ` +
       `${executorName ? `${executorName} executed` : "code executed"}, ` +
-      "prescribed seven-tool surface" +
-      (drifted.length > 0
-        ? `, catalog drift on ${drifted.length} connector(s).`
-        : "."),
+      `prescribed ${META_TOOL_NAMES.length}-tool surface, MCP ${negotiatedVersion}, package ${CONNECTA_VERSION}.`,
   );
 }
 
+/**
+ * One-shot copy of a 0.28 `fileStorage` JSON state file into the SQLite
+ * database 0.29 stores everything in. Stop the old deployment first; the file
+ * is read, never changed.
+ */
+async function migrateState() {
+  if (args.length !== 2 || args.some((arg) => arg.startsWith("--"))) {
+    usage();
+    process.exitCode = 1;
+    return;
+  }
+  const [statePath, databasePath] = args.map((arg) => resolve(process.cwd(), arg));
+  const { importStateFile, openSqlite } = await import(pathToFileURL(join(packageRoot, "dist", "sqlite.js")).href);
+  let database;
+  try {
+    database = openSqlite(databasePath);
+  } catch {
+    throw new Error("State migration failed: could not open the SQLite database");
+  }
+  let closeFailed = false;
+  try {
+    const result = importStateFile(database, statePath);
+    console.log(
+      `Imported ${result.imported} entries from ${statePath} into ${databasePath}` +
+        ` (${result.kept} already present, ${result.expired} expired).`,
+    );
+  } finally {
+    try {
+      database.close();
+    } catch {
+      closeFailed = true;
+    }
+  }
+  if (closeFailed) throw new Error("State migration failed: could not close the SQLite database");
+}
+
 try {
   if (command === "init") await init();
   else if (command === "doctor") await doctor();
+  else if (command === "migrate-state") await migrateState();
   else {
     usage();
     process.exitCode = command === "--help" || command === "-h" ? 0 : 1;
   }
 } catch (error) {
-  console.error(
-    `[connecta] ${error instanceof Error ? error.message : String(error)}`,
-  );
+  console.error(`[connecta] ${error instanceof Error ? error.message : String(error)}`);
   process.exitCode = 1;
 }

package/bin/meta-tool-names.d.mts

@@ -0,0 +1,2 @@
+/** The complete upward meta-tool set, shared by discovery checks and doctor. */
+export declare const META_TOOL_NAMES: readonly string[];

package/bin/meta-tool-names.mjs

@@ -0,0 +1,9 @@
+/** The complete upward meta-tool set, shared by discovery checks and doctor. */
+export const META_TOOL_NAMES = Object.freeze([
+  "authorize_connector",
+  "call_destructive_tool",
+  "call_tool",
+  "execute_code",
+  "search_tools",
+  "skills",
+]);

package/bin/version.mjs

@@ -0,0 +1,3 @@
+// Generated from package.json by scripts/generate-version.mjs.
+// Workers-safe: no runtime filesystem read or deployment override.
+export const CONNECTA_VERSION = "0.30.0";

package/dist/access-tokens.js

@@ -1,35 +1,27 @@
+import { authorizationCredential, isMachineCredential } from "./inbound-credential.js";
+import { assertKnownOptions, keys, optionsOf } from "./config-schema.js";
 import { routeAccessTokens } from "./routes/access-tokens.js";
 import { validIdentityReference } from "./identity.js";
+import { accessTokenKeys } from "./storage/keys.js";
 const TOKEN_PREFIX = "cta_";
 const TOKEN_BYTES = 32;
 const TOKEN_VALUE_RE = /^cta_[A-Za-z0-9_-]{43}$/;
-const RECORD_PREFIX = "access-token:v1:record:";
-const LOOKUP_PREFIX = "access-token:v1:lookup:";
 const MAX_NAME_CHARACTERS = 80;
 const DEFAULT_MAX_ACTIVE = 100;
 const MAX_CONFIGURED_ACTIVE = 1_000;
-const ACTIVE_KEY = "access-token:v1:active";
 const ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/u;
 const encoder = new TextEncoder();
-function recordKey(id) {
-    return `${RECORD_PREFIX}${id}`;
-}
-function lookupKey(hash) {
-    return `${LOOKUP_PREFIX}${hash}`;
-}
+const recordKey = accessTokenKeys.record;
+const lookupKey = accessTokenKeys.lookup;
+const ACTIVE_KEY = accessTokenKeys.active;
 function bytesToBase64Url(bytes) {
     let binary = "";
     for (const byte of bytes)
         binary += String.fromCharCode(byte);
-    return btoa(binary)
-        .replaceAll("+", "-")
-        .replaceAll("/", "_")
-        .replace(/=+$/u, "");
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
 }
 function bytesToHex(bytes) {
-    return [...bytes]
-        .map((byte) => byte.toString(16).padStart(2, "0"))
-        .join("");
+    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 async function hashToken(token) {
     return bytesToHex(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(token))));
@@ -62,12 +54,10 @@ function parseRecord(raw) {
             typeof value.createdAt !== "string" ||
             !Number.isFinite(Date.parse(value.createdAt)) ||
             typeof value.createdBy !== "string" ||
-            (value.principal !== undefined &&
-                !validIdentityReference(value.principal)) ||
+            (value.principal !== undefined && !validIdentityReference(value.principal)) ||
             (value.revokedAt !== undefined &&
                 (typeof value.revokedAt !== "string" || !value.revokedAt || !Number.isFinite(Date.parse(value.revokedAt)))) ||
-            (value.revokedBy !== undefined &&
-                typeof value.revokedBy !== "string")) {
+            (value.revokedBy !== undefined && typeof value.revokedBy !== "string")) {
             throw new Error("invalid token record");
         }
         return value;
@@ -119,18 +109,20 @@ export class AccessTokenManager {
     maxActive;
     constructor(storage, options = {}) {
         this.storage = storage;
-        if (!storage.list) {
-            throw new Error("accessTokens requires a storage adapter that implements list(prefix)");
+        // Issuance claims capacity by compare-and-set and listing enumerates
+        // records; refuse a store without either here, not at the first create.
+        if (typeof storage?.list !== "function" || typeof storage.compareAndSet !== "function") {
+            throw new Error("accessTokens requires storage that implements list and compareAndSet " +
+                "(d1Storage, sqliteStorage, or memoryStorage)");
         }
         const maxActive = options.maxActive ?? DEFAULT_MAX_ACTIVE;
-        if (!Number.isInteger(maxActive) ||
-            maxActive < 1 ||
-            maxActive > MAX_CONFIGURED_ACTIVE) {
+        if (!Number.isInteger(maxActive) || maxActive < 1 || maxActive > MAX_CONFIGURED_ACTIVE) {
             throw new Error(`accessTokens.maxActive must be a whole number from 1 to ${MAX_CONFIGURED_ACTIVE}`);
         }
         this.maxActive = maxActive;
         this.auth = {
             kind: "access_token",
+            recognizesCredential: isMachineCredential,
             activityActorNamespace: "connecta:access-tokens:v1",
             activityActorLabel: async (id) => {
                 try {
@@ -153,7 +145,7 @@ export class AccessTokenManager {
         return record;
     }
     async list() {
-        const keys = await this.storage.list(RECORD_PREFIX);
+        const keys = await this.storage.list(accessTokenKeys.recordPrefix);
         const records = await Promise.all(keys.map(async (key) => {
             const raw = await this.storage.get(key);
             return raw ? parseRecord(raw) : null;
@@ -165,9 +157,6 @@ export class AccessTokenManager {
     }
     async create(name, createdBy) {
         const normalizedName = normalizeName(name);
-        if (!this.storage.compareAndSet) {
-            throw new Error("Creating access tokens requires atomic compareAndSet storage");
-        }
         if (typeof createdBy !== "string" && !validIdentityReference(createdBy)) {
             throw new Error("Invalid token owner");
         }
@@ -184,12 +173,8 @@ export class AccessTokenManager {
             tokenHash: hash,
             tokenPrefix: token.slice(0, 12),
             createdAt: new Date().toISOString(),
-            createdBy: typeof createdBy === "string"
-                ? createdBy
-                : `${createdBy.namespace}:${createdBy.id}`,
-            ...(typeof createdBy === "string"
-                ? {}
-                : { principal: { ...createdBy } }),
+            createdBy: typeof createdBy === "string" ? createdBy : `${createdBy.namespace}:${createdBy.id}`,
+            ...(typeof createdBy === "string" ? {} : { principal: { ...createdBy } }),
         };
         try {
             await this.updateActive(record.id, true);
@@ -211,7 +196,7 @@ export class AccessTokenManager {
     }
     async rename(id, name) {
         const normalized = normalizeName(name);
-        const record = await this.updateRecord(id, current => ({ ...current, name: normalized }));
+        const record = await this.updateRecord(id, (current) => ({ ...current, name: normalized }));
         return record ? metadata(record) : null;
     }
     async revoke(id, revokedBy) {
@@ -221,11 +206,14 @@ export class AccessTokenManager {
         // Remove admission first. A metadata failure cannot leave a successful
         // revocation's lookup alive. Retry deletion even if already marked revoked.
         await this.storage.delete(lookupKey(record.tokenHash));
-        const updated = await this.updateRecord(id, current => current.revokedAt ? current : {
-            ...current, revokedAt: new Date().toISOString(), revokedBy,
-        });
-        if (this.storage.compareAndSet)
-            await this.updateActive(id, false);
+        const updated = await this.updateRecord(id, (current) => current.revokedAt
+            ? current
+            : {
+                ...current,
+                revokedAt: new Date().toISOString(),
+                revokedBy,
+            });
+        await this.updateActive(id, false);
         return updated ? metadata(updated) : null;
     }
     async updateRecord(id, update) {
@@ -239,45 +227,36 @@ export class AccessTokenManager {
             if (record.id !== id)
                 throw new Error("Stored access token id mismatch");
             const next = update(record);
-            if (this.storage.compareAndSet) {
-                // A rename racing revocation must retain revokedAt, including when
-                // an in-flight create has not yet published its lookup.
-                if (!await this.storage.compareAndSet(recordKey(id), raw, JSON.stringify(next)))
-                    continue;
-            }
-            else {
-                // Legacy adapters cannot create, so no late lookup writer exists.
-                // Revocation's deleted lookup still refuses a stale metadata write.
-                await this.storage.set(recordKey(id), JSON.stringify(next));
-            }
+            // A rename racing revocation must retain revokedAt, including when
+            // an in-flight create has not yet published its lookup.
+            if (!(await this.storage.compareAndSet(recordKey(id), raw, JSON.stringify(next))))
+                continue;
             return next;
         }
         throw new Error("Access token metadata is busy; retry the operation");
     }
     async updateActive(id, adding) {
-        const cas = this.storage.compareAndSet;
-        if (!cas)
-            throw new Error("Creating access tokens requires atomic compareAndSet storage");
         for (let attempt = 0; attempt < 32; attempt++) {
             const raw = await this.storage.get(ACTIVE_KEY);
             const ids = raw === null
-                ? (await this.list()).filter(token => !token.revokedAt).map(token => token.id)
+                ? (await this.list()).filter((token) => !token.revokedAt).map((token) => token.id)
                 : JSON.parse(raw);
-            if (!Array.isArray(ids) || !ids.every(value => typeof value === "string" && ID_RE.test(value)) || new Set(ids).size !== ids.length) {
+            if (!Array.isArray(ids) ||
+                !ids.every((value) => typeof value === "string" && ID_RE.test(value)) ||
+                new Set(ids).size !== ids.length) {
                 throw new Error("Stored access token capacity is invalid");
             }
             if (adding && ids.length >= this.maxActive)
                 throw new Error(`This deployment already has the maximum of ${this.maxActive} active access tokens`);
-            const next = adding ? [...ids, id] : ids.filter(value => value !== id);
-            if (await cas.call(this.storage, ACTIVE_KEY, raw, JSON.stringify(next)))
+            const next = adding ? [...ids, id] : ids.filter((value) => value !== id);
+            if (await this.storage.compareAndSet(ACTIVE_KEY, raw, JSON.stringify(next)))
                 return;
         }
         throw new Error("Access token capacity is busy; retry the operation");
     }
     async authorize(request) {
-        const header = request.headers.get("authorization") ?? "";
-        const match = /^Bearer\s+(.+)$/iu.exec(header);
-        const token = match?.[1];
+        const credential = authorizationCredential(request);
+        const token = credential.kind === "bearer" ? credential.token : undefined;
         if (!token || !TOKEN_VALUE_RE.test(token))
             return unauthorized();
         const hash = await hashToken(token);
@@ -298,8 +277,19 @@ export class AccessTokenManager {
         };
     }
 }
+/** The closed options accessTokens() accepts; see `assertKnownOptions`. */
+const ACCESS_TOKENS_OPTIONS = optionsOf()(keys("maxActive"));
 /** Opt in using the same storage namespace that held the v0.23 records. */
 export function accessTokens(storage, options = {}) {
+    options = assertKnownOptions(options, "accessTokens()", ACCESS_TOKENS_OPTIONS);
     const manager = new AccessTokenManager(storage, options);
-    return { auth: manager.auth, handle: context => routeAccessTokens(context, manager) };
+    const maxActive = options.maxActive ?? DEFAULT_MAX_ACTIVE;
+    const optionSources = Object.freeze({
+        maxActive: options.maxActive === undefined ? "default" : "config",
+    });
+    return {
+        auth: manager.auth,
+        handle: (context) => routeAccessTokens(context, manager),
+        describe: () => ({ maxActive, optionSources }),
+    };
 }

package/dist/activity-request.js

@@ -0,0 +1,8 @@
+// Weak ownership keeps the grouping context within the request's lifetime.
+const requests = new WeakMap();
+export function bindActivityRequest(scope, context) {
+    requests.set(scope, context);
+}
+export function activityRequest(scope) {
+    return scope ? requests.get(scope) : undefined;
+}