@zackbart/connecta 0.28.1 → 0.30.0

package/dist/routes/ui-data.js

@@ -6,11 +6,12 @@
 // than the payload's, and its connector scope closes as the slot ends,
 // however it ends.
 import { Effect } from "effect";
+import { bindActivityRequest } from "../activity-request.js";
 import { resolveDiscoveryConcurrency } from "../concurrency.js";
-import { credentialTestRule, describeUndeclaredCredentialFields, storedCredentialShape, } from "../credential-rules.js";
+import { credentialTestRule, describeUndeclaredCredentialFields, storedCredentialShape } from "../credential-rules.js";
+import { failureRecord, failureStatus, logFailure, recordedToolName, statusFailure } from "../operator-record.js";
 import { closeScope } from "../runtime/connector-scope.js";
 import { withDeadlineEffect } from "../runtime/run.js";
-import { isApprovalExempt, NO_EXEMPTIONS, } from "../tool-safety.js";
 import { uiProblemFor, uiToolSafety } from "../ui.js";
 import { CONNECTA_VERSION } from "../version.js";
 const DETAIL_TIMEOUT_MS = 30_000;
@@ -21,24 +22,23 @@ function attempt(operation) {
 export function uiData(registry, baseUrl, options) {
     return Effect.suspend(() => {
         const requestScope = {};
+        if (options.activityContext)
+            bindActivityRequest(requestScope, options.activityContext);
         const vault = options.credentialVault;
         const owner = options.personalCredentialOwner;
         /**
-         * A connector's status message stops here. It can quote a downstream error
-         * body — and a downstream error body can quote the secret it just rejected —
-         * so the payload carries only the classified `problem` and the raw text goes
-         * to the deployment's log, where an operator debugging the failure already
-         * looks. An `ok` status's message is informational and simply dropped.
+         * A connector's status message stops here: the payload carries only the
+         * classified `problem`, and the log a record of the state and, when
+         * connecta described the failure itself, that failure's typed facts. The
+         * message is never logged, whatever it looks like: a connector's own
+         * `status()` can quote a downstream error body, which can quote the
+         * secret it just rejected (INV-6). An `ok` status is simply dropped.
          */
-        const logStatus = (id, state, message) => {
-            if (!message || state === "ok")
+        const logStatus = (id, state, failure) => {
+            if (state === "ok")
                 return;
             const logger = registry.contextFor(id, baseUrl, requestScope).logger;
-            const line = `[connecta] connector "${id}" operator status ${state}: ${message}`;
-            if (state === "auth_required")
-                logger.info(line);
-            else
-                logger.warn(line);
+            logFailure(logger, "operator status", failureRecord({ connector: id, state }, failure), state === "auth_required" ? "info" : "warn");
         };
         // Status first, then the catalog only when status is ok. A failed status
         // read is an error status, not a failed row: the row still reports the
@@ -52,26 +52,31 @@ export function uiData(registry, baseUrl, options) {
                 });
             }
             return Effect.gen(function* () {
-                const status = yield* attempt(() => registry.statusFor(c.id, baseUrl, requestScope, { signal }));
+                const status = yield* attempt(() => registry.statusFor(c.id, baseUrl, requestScope, {
+                    signal,
+                    ...(options.defer ? { defer: options.defer } : {}),
+                }));
                 if (status.state !== "ok" || signal.aborted) {
                     return { status, tools: [], catalogFailed: false };
                 }
-                return yield* attempt(async () => (await registry.getTools(c.id, baseUrl, requestScope, { signal })).map((t) => ({
-                    name: t.name,
-                    address: `${c.id}.${t.name}`,
+                // A catalog is configuration the operator chose to load, and its
+                // descriptions are the agent's too, so the page shows them as text.
+                // A name outside MCP's tool-name grammar is withheld here as in every
+                // record (INV-6), and so is the address built from it.
+                return yield* attempt(async () => (await registry.getTools(c.id, baseUrl, requestScope, {
+                    signal,
+                    ...(options.defer ? { defer: options.defer } : {}),
+                })).map((t) => ({
+                    name: recordedToolName(t),
+                    address: `${c.id}.${recordedToolName(t)}`,
                     ...(t.description ? { description: t.description } : {}),
-                    safety: uiToolSafety(t, isApprovalExempt(options.approval ?? NO_EXEMPTIONS, c, t.name, t)),
+                    safety: uiToolSafety(t),
                 }))).pipe(Effect.map((tools) => ({ status, tools, catalogFailed: false })), 
                 // The registry owns the failed catalog observation; the page only
                 // needs to know there was one.
                 Effect.catch(() => Effect.succeed({ status, tools: [], catalogFailed: !signal.aborted })));
             }).pipe(Effect.catch((error) => Effect.succeed({
-                status: {
-                    state: "error",
-                    message: error instanceof Error
-                        ? error.message
-                        : "Connection details unavailable",
-                },
+                status: failureStatus(c.id, error),
                 tools: [],
                 catalogFailed: false,
             })));
@@ -79,8 +84,7 @@ export function uiData(registry, baseUrl, options) {
         // The credential card, for someone who may manage this connector's auth.
         // Never fails: a vault that cannot be read is the card's own error.
         const credentialFor = (c) => {
-            const mayManageAuth = options.mayManage?.(c.id) ??
-                (c.authScope === "personal" ? Boolean(owner) : options.oauthManagement);
+            const mayManageAuth = options.mayManage?.(c.id) ?? (c.authScope === "personal" ? Boolean(owner) : options.oauthManagement);
             const declared = c.credential;
             if (!declared || !vault || !mayManageAuth)
                 return Effect.succeed(undefined);
@@ -119,13 +123,9 @@ export function uiData(registry, baseUrl, options) {
                     ...(fields?.length ? { fields } : {}),
                     configured: shape.state === "valid",
                     removable: Boolean(metadata),
-                    ...(metadata
-                        ? { lastFour: metadata.lastFour, updatedAt: metadata.updatedAt }
-                        : {}),
+                    ...(metadata ? { lastFour: metadata.lastFour, updatedAt: metadata.updatedAt } : {}),
                     testable: testRule.mode !== null && shape.state !== "mismatch",
-                    ...(shape.state === "mismatch"
-                        ? { error: shape.message, problem: "credential_mismatch" }
-                        : {}),
+                    ...(shape.state === "mismatch" ? { error: shape.message, problem: "credential_mismatch" } : {}),
                     // A dropped field leaves its secret in the vault, and the field
                     // list below only renders fields the connector still declares —
                     // so without this line there is nowhere an operator could see it.
@@ -153,7 +153,7 @@ export function uiData(registry, baseUrl, options) {
             // after this one had already ended the row.
             const { status, tools, catalogFailed } = yield* observe(c, drift, signal);
             const credential = yield* credentialFor(c);
-            logStatus(c.id, status.state, status.message);
+            logStatus(c.id, status.state, statusFailure(status));
             const problem = uiProblemFor(c, status.state, {
                 credentialDrift: Boolean(drift),
                 catalogFailed,
@@ -173,12 +173,17 @@ export function uiData(registry, baseUrl, options) {
                 // schema even if the plugin seam returned one.
                 ...(status.catalogDrift ? { catalogDrift: status.catalogDrift } : {}),
                 ...(status.catalogAccess ? { catalogAccess: status.catalogAccess } : {}),
+                ...(status.resourceTemplateRefusals ? { resourceTemplateRefusals: status.resourceTemplateRefusals } : {}),
+                ...(status.state === "auth_required" && c.startAuth && options.mayManage?.(c.id) && options.oauthConnectUrl
+                    ? { authorizationUrl: yield* attempt(() => options.oauthConnectUrl(c.id)) }
+                    : {}),
                 oauth: Boolean(c.startAuth && c.disconnectAuth),
+                ...(status.registrationPath ? { registrationPath: status.registrationPath } : {}),
                 ...(credential ? { credential } : {}),
             };
         });
         const unavailable = (c, error) => Effect.sync(() => {
-            logStatus(c.id, "failed", error instanceof Error ? error.message : String(error));
+            logStatus(c.id, "failed", error);
             return {
                 id: c.id,
                 ...(c.title ? { title: c.title } : {}),

package/dist/routes/ui.js

@@ -1,9 +1,16 @@
+import { operatorAsset } from "../operator-ui/assets.js";
+import { operatorActivityContext } from "./activity-context.js";
+import { isSafeHttpsUrl } from "../branding.js";
+import { htmlSecurityHeaders } from "../html-security.js";
+import { oauthConnectUrl, oauthConnectUnavailable } from "../oauth-handoff.js";
+import { authorizationCredential } from "../inbound-credential.js";
 import { Effect } from "effect";
 import { CONNECTA_VERSION } from "../version.js";
 import { CONNECTA_FAVICON_ICO } from "../favicon.js";
-import { CONNECTA_FAVICON_SVG, operatorPageForPath, renderUiHtml, } from "../ui.js";
+import { CONNECTA_FAVICON_SVG, operatorPageForPath, renderUiHtml } from "../ui.js";
 import { authorized, refuse, scopeFor, serveOperator, visibleRegistry, } from "./operator.js";
-import { mayManageConnector, mayViewArtifacts, privateJson, } from "./shared.js";
+import { mayManageConnector, privateJson } from "./shared.js";
+import { routeUiConfig } from "./ui-config.js";
 import { uiData } from "./ui-data.js";
 /**
  * Headers that make an operator-supplied favicon body inert on this origin.
@@ -32,18 +39,12 @@ const INERT_ICON_HEADERS = {
     "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
     "X-Content-Type-Options": "nosniff",
 };
-/** Per-request base64 nonce for an operator shell's scripts (Node 22+ and Workers). */
-function uiScriptNonce() {
-    const bytes = crypto.getRandomValues(new Uint8Array(16));
-    let binary = "";
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary);
-}
 export async function routeUi(context) {
     const { request, url, path, baseUrl, opts, runtimeContext } = context;
+    if (path.startsWith("/ui/assets/"))
+        return operatorAsset(request, path);
     if (request.method === "GET" && path === "/favicon.svg") {
-        return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
+        return new Response(opts.config.ui?.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
             headers: {
                 "Content-Type": "image/svg+xml",
                 "Cache-Control": "public, max-age=86400",
@@ -52,7 +53,7 @@ export async function routeUi(context) {
         });
     }
     if (request.method === "GET" && path === "/favicon.ico") {
-        return new Response(opts.branding?.favicon?.ico ?? CONNECTA_FAVICON_ICO, {
+        return new Response(opts.config.ui?.branding?.favicon?.ico ?? CONNECTA_FAVICON_ICO, {
             headers: {
                 "Content-Type": "image/x-icon",
                 "Cache-Control": "public, max-age=86400",
@@ -71,50 +72,36 @@ export async function routeUi(context) {
         });
     }
     const operatorPage = operatorPageForPath(path);
-    const artifactPage = operatorPage === "artifacts" || operatorPage === "artifact";
     if (operatorPage &&
-        (operatorPage !== "activity" || opts.activity?.list) &&
-        (operatorPage !== "tokens" || opts.accessTokens) &&
-        (!artifactPage || opts.artifactsModule)) {
+        (operatorPage !== "activity" || opts.config.activity?.store.list) &&
+        (operatorPage !== "tokens" || opts.config.accessTokens)) {
         if (request.method !== "GET" && request.method !== "HEAD") {
             return privateJson({ error: "method not allowed" }, { status: 405 });
         }
         // Open shell — carries no operator data; everything comes from the
         // authenticated /ui/* APIs after the browser establishes a session.
-        const ambient = runtimeContext?.access
-            ? opts.auth.find((provider) => provider.uiAuth?.kind === "cloudflare-access")?.uiAuth
+        const ambient = authorizationCredential(request).kind === "absent" && runtimeContext?.access
+            ? opts.config.auth.find((provider) => provider.uiAuth?.kind === "cloudflare-access")?.uiAuth
             : undefined;
-        const uiAuth = ambient ?? opts.auth.find((provider) => provider.uiAuth && provider.uiAuth.kind !== "cloudflare-access")?.uiAuth;
+        const uiAuth = ambient ??
+            opts.config.auth.find((provider) => provider.uiAuth && provider.uiAuth.kind !== "cloudflare-access")?.uiAuth;
         const mcpUrl = new URL("/mcp", baseUrl).toString();
-        // Nonce the page's inline script (and the Clerk loader). 'strict-dynamic'
-        // lets scripts the nonced Clerk loader injects at runtime execute; the
-        // https:/'unsafe-inline' fallbacks are ignored by CSP3 browsers that
-        // honour the nonce and only cover legacy ones. No default-src, so Clerk's
-        // style/font/network needs and the page's inline <style> stay unrestricted
-        // — only script execution, the XSS sink, is gated.
-        const nonce = uiScriptNonce();
-        // An artifact shell frames the sandboxed page from its own origin and
-        // nothing else; Connections stays on the deployment's public origin.
-        const homeUrl = opts.publicUrl ? new URL("/", opts.publicUrl).toString() : "/";
-        // The artifact host serves no favicon, so a shell there takes its icons
-        // from the public origin, as the 404 does; on the main host they stay
-        // root-relative.
-        const onArtifactHost = Boolean(opts.artifactOrigin) &&
-            url.origin === new URL(opts.artifactOrigin).origin;
-        const iconOrigin = onArtifactHost ? opts.publicUrl : undefined;
+        const clerkOrigin = uiAuth?.kind === "clerk" && isSafeHttpsUrl(uiAuth.frontendApiUrl)
+            ? new URL(uiAuth.frontendApiUrl).origin
+            : undefined;
         return new Response(request.method === "HEAD"
             ? null
-            : renderUiHtml(uiAuth, mcpUrl, opts.branding, nonce, operatorPage, { homeUrl, iconOrigin }), {
+            : renderUiHtml(uiAuth, mcpUrl, opts.config.ui?.branding, undefined, operatorPage), {
             status: 200,
-            headers: {
+            headers: htmlSecurityHeaders({
                 "Content-Type": "text/html; charset=utf-8",
-                "Content-Security-Policy": `script-src 'nonce-${nonce}' 'strict-dynamic' https: 'unsafe-inline'; ` +
-                    "object-src 'none'; base-uri 'none'; frame-ancestors 'none'" +
-                    (artifactPage ? "; frame-src 'self'" : ""),
-                "X-Content-Type-Options": "nosniff",
-            },
+                "Cache-Control": "no-store",
+            }, clerkOrigin ? { clerkOrigin } : {}),
         });
     }
+    const configResponse = await routeUiConfig(context);
+    if (configResponse)
+        return configResponse;
     const detail = /^\/ui\/connectors\/([a-z0-9_-]+)$/.exec(path);
     if (path !== "/ui/data" && !detail)
         return null;
@@ -126,16 +113,23 @@ export async function routeUi(context) {
 /** What this identity may see and do, for the summary and a detail alike. */
 function operatorView({ opts }, authz, registry) {
     const visible = registry.listConnectors();
-    const mayManage = (id) => { const connector = registry.getConnector(id); return Boolean(connector && mayManageConnector(authz, connector)); };
+    const mayManage = (id) => {
+        const connector = registry.getConnector(id);
+        return Boolean(connector && mayManageConnector(authz, connector));
+    };
     const permissions = (connector) => ({
         use: true,
         manageSharedAuth: connector.authScope !== "personal" && mayManage(connector.id),
         connectPersonal: connector.authScope === "personal" && mayManage(connector.id),
     });
-    const activityEnabled = Boolean(opts.activity?.list) && authz.operator;
-    const credentialManagement = visible.some(c => c.credential && mayManage(c.id))
-        ? opts.credentialVault ? "available" : "vault_not_configured"
-        : authz.identity.interactive && !visible.some(c => c.credential) ? "no_slots" : "requires_operator";
+    const activityEnabled = Boolean(opts.config.activity?.store.list) && authz.operator;
+    const credentialManagement = visible.some((c) => c.credential && mayManage(c.id))
+        ? opts.config.vault
+            ? "available"
+            : "vault_not_configured"
+        : authz.identity.interactive && !visible.some((c) => c.credential)
+            ? "no_slots"
+            : "requires_operator";
     return { visible, mayManage, permissions, activityEnabled, credentialManagement };
 }
 /** One connector's probed row, the page's second request per card. */
@@ -149,18 +143,21 @@ function connectorDetail(context, id) {
         if (!connector)
             return yield* refuse("unknown connector", 404);
         const data = yield* uiData(opts.registry.scoped(scopeFor(authz, [connector.id])), baseUrl, {
-            serverInfo: opts.serverInfo,
-            credentialVault: opts.credentialVault,
+            serverInfo: opts.config.serverInfo,
+            activityContext: operatorActivityContext(context, authz),
+            credentialVault: opts.config.vault,
             activityEnabled,
             credentialManagement,
             defer,
             oauthManagement: false,
+            ...(!oauthConnectUnavailable(opts)
+                ? { oauthConnectUrl: (id) => oauthConnectUrl(opts, baseUrl, id, authz.principalKey) }
+                : {}),
             discoveryConcurrency: 1,
             personalCredentialOwner: authz.principalKey,
             mayManage,
-            timeoutMs: opts.probeTimeoutMs ?? 30_000,
+            timeoutMs: opts.config.discovery.probeTimeoutMs,
             signal: request.signal,
-            approval: opts.approval,
         });
         return privateJson({ ...data.connectors[0], permissions: permissions(connector) });
     });
@@ -185,14 +182,27 @@ function summary(context) {
         }
         return privateJson({
             ...(pools.length ? { pools } : {}),
-            serverInfo: opts.serverInfo,
+            serverInfo: opts.config.serverInfo,
             connectaVersion: CONNECTA_VERSION,
             activityEnabled,
-            ...(opts.accessTokens ? { accessTokenManagement: authz.accessTokenManagement && authz.identity.principal ? "available" : "requires_operator" } : {}),
-            ...(opts.artifactsModule && mayViewArtifacts(authz, opts.registry) ? { artifactsEnabled: true } : {}),
+            ...(opts.config.accessTokens
+                ? {
+                    accessTokenManagement: authz.accessTokenManagement && authz.identity.principal ? "available" : "requires_operator",
+                }
+                : {}),
             credentialManagement,
-            oauthManagement: visible.some(c => mayManage(c.id)),
-            connectors: visible.map(c => ({ id: c.id, ...(c.title ? { title: c.title } : {}), ...(c.description ? { description: c.description } : {}), authScope: c.authScope ?? "shared", status: "loading", toolCount: 0, tools: [], oauth: Boolean(c.startAuth && c.disconnectAuth), permissions: permissions(c) })),
+            oauthManagement: visible.some((c) => mayManage(c.id)),
+            connectors: visible.map((c) => ({
+                id: c.id,
+                ...(c.title ? { title: c.title } : {}),
+                ...(c.description ? { description: c.description } : {}),
+                authScope: c.authScope ?? "shared",
+                status: "loading",
+                toolCount: 0,
+                tools: [],
+                oauth: Boolean(c.startAuth && c.disconnectAuth),
+                permissions: permissions(c),
+            })),
         });
     });
 }

package/dist/runtime/admission.js

@@ -30,7 +30,7 @@ export function admit(controller, options = {}) {
     if (!program) {
         throw new Error("AdmissionController's admission program was never installed.");
     }
-    return program(controller, options.signal);
+    return program(controller, options.signal, options.wait !== false);
 }
 /**
  * A lease owned by the enclosing Scope: released when the scope closes, on
@@ -39,5 +39,7 @@ export function admit(controller, options = {}) {
  * in line until the queue timeout.
  */
 export function acquireScoped(controller, options = {}) {
-    return Effect.acquireRelease(admit(controller, options), (lease) => Effect.sync(() => lease.release()), { interruptible: true });
+    return Effect.acquireRelease(admit(controller, options), (lease) => Effect.sync(() => lease.release()), {
+        interruptible: true,
+    });
 }

package/dist/runtime/call-admission.js

@@ -63,5 +63,7 @@ export function admitCall(controller, request) {
  * the queue timeout.
  */
 export function acquireCallScoped(controller, request) {
-    return Effect.acquireRelease(admitCall(controller, request), (permit) => Effect.sync(() => permit.release()), { interruptible: true });
+    return Effect.acquireRelease(admitCall(controller, request), (permit) => Effect.sync(() => permit.release()), {
+        interruptible: true,
+    });
 }

package/dist/runtime/connector-scope.js

@@ -23,10 +23,7 @@ const CONNECTOR_SCOPE_DEFER_BUDGET_MS = 2_000;
  * cancel a connector's close, only stop waiting for it.
  */
 function waitAtMost(work, budgetMs) {
-    return Effect.raceAllFirst([
-        Effect.promise(() => work),
-        Effect.sleep(Duration.millis(budgetMs)),
-    ]);
+    return Effect.raceAllFirst([Effect.promise(() => work), Effect.sleep(Duration.millis(budgetMs))]);
 }
 /**
  * Tell a connector that a scope owned by the core has ended, with the contract

package/dist/runtime/run.js

@@ -3,7 +3,7 @@
 // Connecta's published surface is Promise-shaped and stays that way; Effect is
 // an implementation detail behind it. Every edge where a fiber starts runs
 // through this module, so the rules for that crossing live in one file instead
-// of being re-derived at each call site — and test/purity.test.ts fails if any
+// of being re-derived at each call site — and test/purity.node.test.ts fails if any
 // other file under src/ calls Effect.run*, runFork, forkDaemon, or
 // ManagedRuntime.make.
 //
@@ -18,7 +18,7 @@
 // - Effect.runPromise rejects an interrupted fiber with a generic "All fibers
 //   interrupted without error". Callers of withDeadline today see the abort
 //   reason the caller chose, and runEdge keeps it that way.
-import { Cause, Context, Duration, Effect, Exit, ManagedRuntime, Scheduler, } from "effect";
+import { Cause, Context, Duration, Effect, Exit, Scheduler } from "effect";
 /** Yield to the scheduler through the microtask queue, never a timer. */
 function setMicrotask(task) {
     let cancelled = false;
@@ -34,9 +34,7 @@ function setMicrotask(task) {
 export const microtaskScheduler = new Scheduler.MixedScheduler("async", setMicrotask);
 const runExit = Effect.runPromiseExitWith(Context.make(Scheduler.Scheduler, microtaskScheduler));
 function abortReason(signal) {
-    return signal && signal.reason !== undefined
-        ? signal.reason
-        : new DOMException("aborted", "AbortError");
+    return signal && signal.reason !== undefined ? signal.reason : new DOMException("aborted", "AbortError");
 }
 /**
  * Turn a failed Exit back into the value a Promise caller would have seen.
@@ -59,43 +57,16 @@ function rethrow(cause, signal) {
         throw defect.defect;
     throw abortReason(signal);
 }
-const disposedRuntimes = new WeakSet();
-/** Wrap a layer as an EdgeRuntime without building it. */
-export function makeEdgeRuntime(layer) {
-    return ManagedRuntime.make(layer);
-}
-/**
- * Release a runtime's layer resources. Idempotent, and never rejects: a
- * finalizer that fails has nobody left to report to.
- */
-export async function disposeEdgeRuntime(runtime) {
-    if (disposedRuntimes.has(runtime))
-        return;
-    disposedRuntimes.add(runtime);
-    // Through runExit rather than runtime.dispose(), whose runner yields on
-    // Effect's default scheduler — the one vitest's fake timers freeze.
-    await runExit(runtime.disposeEffect);
-}
 /**
- * The effect with the runtime's services provided, building them first when
- * no run has yet. The build runs on the calling fiber's scheduler, so it is
- * the microtask scheduler here, as everything else is.
+ * Run an effect at a Promise boundary.
+ *
+ * Resolves with the success value. Rejects with the original Fail error or Die
+ * defect, and with `signal.reason` (or an AbortError) when interrupted. The
+ * effect requires no services: a caller that needs some provides them first
+ * (src/runtime/storage.ts).
  */
-function provideRuntime(effect, runtime) {
-    if (disposedRuntimes.has(runtime)) {
-        return Effect.die(new Error("This Connecta has been closed."));
-    }
-    const built = runtime.cachedContext;
-    if (built)
-        return Effect.provideContext(effect, built);
-    return Effect.flatMap(runtime.contextEffect, (context) => Effect.provideContext(effect, context));
-}
 export async function runEdge(effect, options = {}) {
-    const exit = await runExit(options.runtime
-        ? provideRuntime(effect, options.runtime)
-        // Without a runtime the overloads admit only an effect that requires
-        // nothing, so there is nothing to provide.
-        : effect, options.signal ? { signal: options.signal } : undefined);
+    const exit = await runExit(effect, options.signal ? { signal: options.signal } : undefined);
     if (Exit.isSuccess(exit))
         return exit.value;
     return rethrow(exit.cause, options.signal);

package/dist/runtime/services.js

@@ -1,130 +1,25 @@
 // The core's services, as Effect code sees them.
 //
-// createConnecta resolves storage, the vault, activity history, logging, and
-// the rest of its configuration once, at construction. This module gives each
-// of those a service key and assembles them into the layer behind that
-// Connecta's runtime (an EdgeRuntime, src/runtime/run.ts), so an Effect
-// program reads them from its context rather than from arguments threaded
-// through every call. The shells — Registry, CatalogService, and the rest —
-// stay constructible from plain arguments, as the tests construct them. The
-// registry's storage programs read Storage and Logger too, but from their own
-// partition rather than this runtime (see src/runtime/storage.ts for why).
-//
-// Every import from an optional module is type-only. An omitted activity
-// module is a no-op recorder that builds no event and calls nothing, and the
-// UI, vault, and activity implementations stay out of the root import graph
-// (test/purity.test.ts).
-import { Context, Effect, Layer } from "effect";
-import { makeEdgeRuntime } from "./run.js";
+// A registry's storage programs read the deployment's KVStorage and Logger
+// from their context rather than from arguments threaded through every call.
+// Each Registry provides its own pair (`runOnPartition` in
+// src/runtime/storage.ts), because a personal registry's storage is the
+// root's namespaced to its principal. There is no per-Connecta runtime:
+// createConnecta resolves its configuration into plain values once
+// (src/config.ts), and the request pipeline runs on no runtime so `/health`
+// and a closed deployment's 503 keep answering after `close()`.
+import { Context } from "effect";
 /**
- * The deployment's KVStorage: `config.storage`, or the memoryStorage() that
- * stands in for it. `compareAndSet` is present exactly when the adapter
- * implements it, so a caller that needs atomicity checks for it here.
+ * A registry's KVStorage partition. Every adapter implements `list` and
+ * `compareAndSet`.
  */
 export class Storage extends Context.Service()("connecta/Storage") {
 }
-/**
- * The credential vault, or undefined when the deployment configures none —
- * a required service whose value may be absent, not a default, so a program
- * run without it provided fails to typecheck instead of finding no vault.
- */
-export class Vault extends Context.Service()("connecta/Vault") {
-}
 /**
  * Connecta's diagnostic logger, already resolved: the configured Logger, a
  * no-op for `"silent"`, or console output prefixed `[connecta]`. Effect's
- * own logger is never used (test/purity.test.ts), because it honors neither
+ * own logger is never used (test/purity.node.test.ts), because it honors neither
  * `"silent"` nor the line format a deployment greps for.
  */
 export class Logger extends Context.Service()("connecta/Logger") {
 }
-/** Payload-free activity history, or a recorder that records nothing. */
-export class ActivityRecorder extends Context.Service()("connecta/ActivityRecorder") {
-}
-/** What createConnecta resolved at construction. */
-export class ResolvedConfig extends Context.Service()("connecta/ResolvedConfig") {
-}
-/**
- * The request's hook for work that may outlive its response (a Worker's
- * `ctx.waitUntil`). Per request, not per Connecta, so it is never part of the
- * runtime: a request provides it with `Effect.provideService`, and a program
- * outside any request sees undefined and keeps its work in the foreground.
- */
-export const DeferredWork = Context.Reference("connecta/DeferredWork", { defaultValue: () => undefined });
-/**
- * Resolve `ConnectaConfig.logger`. `"silent"` discards every line; an omitted
- * logger writes to the console with the `[connecta]` prefix.
- */
-export function resolveLogger(logger) {
-    if (logger === "silent") {
-        return { debug() { }, info() { }, warn() { }, error() { } };
-    }
-    return logger ?? {
-        debug: (...a) => console.debug("[connecta]", ...a),
-        info: (...a) => console.info("[connecta]", ...a),
-        warn: (...a) => console.warn("[connecta]", ...a),
-        error: (...a) => console.error("[connecta]", ...a),
-    };
-}
-const NO_ACTIVITY = {
-    enabled: false,
-    recordTool: () => Effect.void,
-    recordDrift: () => Effect.void,
-};
-function activityRecorder(module, serverInfo, logger) {
-    const deployment = module.deploymentId !== undefined
-        ? { deploymentId: module.deploymentId }
-        : {};
-    // A custom module's recorder that throws is logged like a store that
-    // throws: activity never changes the outcome of the work it describes.
-    const bestEffort = (record) => Effect.sync(() => {
-        try {
-            record();
-        }
-        catch (error) {
-            logger.warn("[connecta] activity record failed", error);
-        }
-    });
-    return {
-        enabled: true,
-        recordTool: (request, input) => DeferredWork.use((defer) => bestEffort(() => module.recordTool({
-            sink: module.store,
-            recordTool: module.recordTool,
-            actor: request.actor,
-            requestId: request.requestId,
-            serverInfo,
-            ...deployment,
-            ...(defer ? { defer } : {}),
-            logger,
-        }, input))),
-        recordDrift: (input) => bestEffort(() => module.recordDrift({ sink: module.store, serverInfo, ...deployment, logger }, input)),
-    };
-}
-/**
- * The layer behind a Connecta's runtime. Every service is a value resolved
- * before this is called, so building the layer only assembles a context: it
- * starts no fiber and touches no storage.
- */
-function coreServices(options) {
-    const activity = options.activity
-        ? activityRecorder(options.activity, options.config.serverInfo, options.logger)
-        : NO_ACTIVITY;
-    return Layer.succeedContext(Context.make(Storage, options.storage).pipe(Context.add(Vault, options.vault), Context.add(Logger, options.logger), Context.add(ActivityRecorder, activity), Context.add(ResolvedConfig, options.config)));
-}
-// Keyed by the root Registry: it is the per-Connecta object every internal
-// caller already holds, and a Registry built directly (as the tests build
-// them) simply has no runtime.
-const runtimes = new WeakMap();
-/**
- * Create the runtime for the Connecta that owns `registry`. Runs nothing:
- * the layer is built by the first run that needs it (see EdgeRuntime).
- */
-export function createCoreRuntime(registry, options) {
-    const runtime = makeEdgeRuntime(coreServices(options));
-    runtimes.set(registry, runtime);
-    return runtime;
-}
-/** The runtime createConnecta made for this root registry, if it made one. */
-export function coreRuntime(registry) {
-    return runtimes.get(registry);
-}

package/dist/runtime/shared-read.js

@@ -75,9 +75,7 @@ export class SharedRead {
                     this.cancel(signal?.reason);
             });
             const answer = Deferred.await(this.outcome);
-            const own = signal
-                ? Effect.raceFirst(answer, this.leftBy(signal))
-                : answer;
+            const own = signal ? Effect.raceFirst(answer, this.leftBy(signal)) : answer;
             return Effect.ensuring(own, leave);
         });
     }