@zackbart/connecta 0.29.0 → 0.31.0

package/examples/worker/README.md

@@ -1,5 +1,12 @@
 # connecta — Cloudflare Worker example
 
+Agent setup guide for the Worker deployment.
+For deployment choices and upgrades, use [Deploying Connecta](https://github.com/zackbart/connecta/blob/main/documentation/deploying.md).
+For connector changes, use [Integrating services](https://github.com/zackbart/connecta/blob/main/documentation/integrating.md).
+The [agent index](https://github.com/zackbart/connecta/blob/main/documentation/README.md) routes endpoint use and package
+maintenance. This README and [local agent instructions](./AGENTS.md) own the
+runnable Worker steps.
+
 A deployable Worker that aggregates a downstream remote MCP and an in-code HTTP
 API connector, guarded by Cloudflare Access. It uses three Cloudflare resources
 and nothing else: one D1 database (`CONNECTA_DB`) for every piece of state, the
@@ -309,8 +316,8 @@ Rolling back to 0.24.x then requires reauthorizing those OAuth connectors.
 
 The shipped Notion connector uses a deployment-owned static header and echo
 needs no secret. To exercise vault controls, declare a `credential` slot on an
-`api()` connector or use Notion's explicit `surface: "api"` integration
-interface, which declares its own slot.
+`api()` connector or use a Notion connector with `auth: { type: "token" }`,
+which declares its own slot.
 Authorized users manage that slot inside the connection. Configuring a vault
 does not create credentials or permissions by itself.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.29.0",
+  "version": "0.31.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -109,6 +109,10 @@
       "types": "./dist/providers/gmail/index.d.ts",
       "import": "./dist/providers/gmail/index.js"
     },
+    "./providers/infisical": {
+      "types": "./dist/providers/infisical/index.d.ts",
+      "import": "./dist/providers/infisical/index.js"
+    },
     "./providers/linear": {
       "types": "./dist/providers/linear/index.d.ts",
       "import": "./dist/providers/linear/index.js"
@@ -221,8 +225,10 @@
     "precheck:bundle": "npm run build:operator-ui",
     "precheck:fast": "npm run check:operator-ui",
     "eval:regrade": "tsx eval/regrade.ts",
+    "eval:compare": "tsx eval/compare.ts",
     "format": "oxfmt --write .",
-    "format:check": "oxfmt --check ."
+    "format:check": "oxfmt --check .",
+    "providers:spec": "tsx scripts/generate-openapi.mjs"
   },
   "dependencies": {
     "@cfworker/json-schema": "^4.1.1",
@@ -267,6 +273,7 @@
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "cmdk": "^1.1.1",
+    "commonmark": "^0.31.2",
     "esbuild": "^0.28.0",
     "knip": "^6.29.0",
     "oxfmt": "0.72.0",

package/templates/node/README.md

@@ -1,5 +1,12 @@
 # Connecta deployment
 
+Agent setup guide for the Node deployment and its Docker packaging.
+For cross-platform setup and upgrades, use [Deploying Connecta](https://github.com/zackbart/connecta/blob/main/documentation/deploying.md).
+For connector changes, use [Integrating services](https://github.com/zackbart/connecta/blob/main/documentation/integrating.md).
+The [agent index](https://github.com/zackbart/connecta/blob/main/documentation/README.md) routes endpoint use and package
+maintenance. This README and [local agent instructions](./AGENTS.md) own the
+runnable steps for a copied Node deployment.
+
 This is the prescribed Node deployment. It runs locally from source and as
 a container. Install, provision a machine token, then start it:
 
@@ -181,8 +188,8 @@ node -e "console.log(crypto.randomBytes(32).toString('base64'))"
 Keep this key outside the database. Losing it makes saved values unreadable;
 upgrades must reuse it. The shipped `time` connector declares no credential
 slot. Add `credential: { label: "API token" }` to an `api()` connector and read
-it through `await ctx.credential?.get()`, or use Notion's explicit
-`surface: "api"` integration interface, which declares its own slot. Authorized humans manage the slot inside that
+it through `await ctx.credential?.get()`, or use a Notion
+connector with `auth: { type: "token" }`, which declares its own slot. Authorized humans manage the slot inside that
 connection on `/`; there is no separate Credentials tab.
 
 In 0.25.0, this vault also seals downstream OAuth tokens on their first read.

package/templates/node/package.json

@@ -17,7 +17,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.29.0",
+    "@zackbart/connecta": "0.31.0",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {

package/dist/providers/vercel/mcp-ownership.js

@@ -1,212 +0,0 @@
-// Reviewed 2026-10-08 against the 28 published MCP categories (213 names)
-// linked from https://vercel.com/docs/agent-resources/vercel-mcp/tools and
-// https://openapi.vercel.sh/ (SHA-256: 2d5dd6a91e9df8280bb1c4ef2b1ec045498e28667b7e9a164bedd01a92093028).
-// These are routing ownership facts, not schemas or annotation baselines.
-// Exact operationId matches plus reviewed list/get aliases establish the
-// published hosted counterpart. The four value-unsafe project-env MCP tools
-// are excluded: the authored API owns those operations. Tools outside the
-// reviewed classifier still receive the registry's fail-closed classification.
-export const HOSTED_REST_OPERATIONS = [
-    ["GET", "/v1/query/web-analytics/events/aggregate", "aggregate_events"],
-    ["GET", "/v1/query/web-analytics/visits/aggregate", "aggregate_pageviews"],
-    ["POST", "/v1/edge-cache/invalidate-by-src-images", "invalidate_by_src_images"],
-    ["GET", "/v1/query/web-analytics/events/count", "count_events"],
-    ["GET", "/v1/query/web-analytics/visits/count", "count_pageviews"],
-    ["GET", "/v1/security/firewall/attack-status", "get_active_attack_status"],
-    ["POST", "/v1/registrar/domains/availability", "get_bulk_availability"],
-    ["GET", "/ai-gateway/virtual-model-configs", "get_ai_gateway_virtual_model_config"],
-    ["POST", "/v1/edge-cache/invalidate-by-tags", "invalidate_by_tags"],
-    ["GET", "/v1/billing/contract-commitments", "list_contract_commitments"],
-    ["GET", "/v1/integrations/configurations", "list_integration_configurations"],
-    ["GET", "/v1/integrations/search-repo", "search_repo"],
-    ["GET", "/v1/registrar/tlds/supported", "list_supported_tlds"],
-    ["GET", "/v1/security/firewall/bypass", "get_bypass_ip"],
-    ["PATCH", "/v1/security/firewall/config", "update_firewall_config"],
-    ["PUT", "/v1/security/firewall/config", "put_firewall_config"],
-    ["GET", "/v1/bulk-redirects/versions", "list_bulk_redirect_versions"],
-    ["POST", "/v1/bulk-redirects/versions", "update_version"],
-    ["POST", "/v1/integrations/sso/token", "exchange_sso_token"],
-    ["POST", "/v1/registrar/domains/buy", "buy_domains"],
-    ["GET", "/v2/observability/schema", "get_observability_schema"],
-    ["POST", "/v1/security/attack-mode", "update_attack_challenge_mode"],
-    ["GET", "/v2/sandboxes/snapshots", "list_session_snapshots"],
-    ["POST", "/v2/observability/query", "create_observability_query"],
-    ["GET", "/v2/sandboxes/sessions", "list_sessions"],
-    ["POST", "/v1/connect/connectors", "create_connector"],
-    ["GET", "/v8/artifacts/status", "status"],
-    ["POST", "/storage/stores/blob", "create_storage_stores_blob"],
-    ["POST", "/v8/artifacts/events", "record_events"],
-    ["GET", "/v1/billing/charges", "list_billing_charges"],
-    ["GET", "/v1/projects/traces", "get_project_trace"],
-    ["GET", "/v1/bulk-redirects", "list_bulk_redirects"],
-    ["PUT", "/v1/bulk-redirects", "stage_redirects"],
-    ["GET", "/v1/events/types", "list_event_types"],
-    ["POST", "/v13/deployments", "create_deployment"],
-    ["GET", "/v7/deployments", "list_deployments"],
-    ["POST", "/v1/billing/buy", "buy_credits"],
-    ["POST", "/v1/drains/test", "test_drain"],
-    ["GET", "/v10/projects", "list_projects"],
-    ["GET", "/v2/sandboxes", "list_sandboxes"],
-    ["POST", "/v11/projects", "create_project"],
-    ["POST", "/v2/sandboxes", "create_sandboxes_v2"],
-    ["POST", "/v3/sandboxes", "create_sandboxes_v3"],
-    ["POST", "/v4/sandboxes", "create_sandboxes_v4"],
-    ["POST", "/v8/artifacts", "artifact_query"],
-    ["GET", "/v4/aliases", "list_aliases"],
-    ["GET", "/v5/domains", "list_domains"],
-    ["POST", "/v7/domains", "create_or_transfer_domain"],
-    ["GET", "/v1/drains", "list_drains"],
-    ["GET", "/v3/events", "list_user_events"],
-    ["POST", "/v1/drains", "create_drain"],
-    ["GET", "/v2/teams", "list_teams"],
-    ["GET", "/v8/certs", "list_certs"],
-    ["POST", "/api-keys", "create_api_keys"],
-    ["POST", "/v2/files", "upload_file"],
-    ["POST", "/v8/certs", "issue_cert"],
-    ["PUT", "/v8/certs", "upload_cert"],
-    ["GET", "/v2/user", "get_auth_user"],
-    ["PATCH", "/v1/env", "update_shared_env_variable"],
-    [
-        "GET",
-        "/v1/microfrontends/projects/{projectIdOrName}/production-mfe-config",
-        "get_microfrontends_config_for_project",
-    ],
-    ["GET", "/v1/projects/{projectIdOrName}/feature-flags/sdk-keys", "list_feature_flag_sdk_keys"],
-    ["GET", "/v1/projects/{projectIdOrName}/feature-flags/settings", "get_flag_settings"],
-    ["PATCH", "/v1/projects/{projectIdOrName}/feature-flags/settings", "update_flag_settings"],
-    ["POST", "/v1/projects/{idOrName}/rolling-release/approve-stage", "approve_rolling_release_stage"],
-    ["PUT", "/v1/projects/{projectIdOrName}/feature-flags/sdk-keys", "create_sdk_key"],
-    ["GET", "/v1/registrar/domains/{domain}/contact-verification", "get_domain_contact_verification"],
-    ["GET", "/v1/projects/{projectIdOrName}/feature-flags/flags", "list_flags"],
-    ["GET", "/v1/registrar/domains/{domain}/contact-info/schema", "get_contact_info_schema"],
-    ["GET", "/v2/projects/{projectIdOrName}/feature-flags/flags", "list_flags_v2"],
-    ["PUT", "/v1/projects/{projectIdOrName}/feature-flags/flags", "create_flag"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/extend-timeout", "extend_session_timeout"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/network-policy", "update_session_network_policy"],
-    ["POST", "/v1/projects/{idOrName}/rolling-release/complete", "complete_rolling_release"],
-    ["GET", "/v1/projects/{idOrName}/rolling-release/billing", "get_rolling_release_billing_status"],
-    ["GET", "/v1/projects/{idOrName}/rolling-release/config", "get_rolling_release_config"],
-    ["PATCH", "/v1/projects/{idOrName}/rolling-release/config", "update_rolling_release_config"],
-    ["POST", "/v1/projects/{idOrName}/rolling-release/start", "start_rolling_release"],
-    ["GET", "/v1/integrations/configuration/{id}/products", "list_integration_configuration_products"],
-    ["GET", "/v1/microfrontends/groups/{groupId}/projects", "list_microfrontends_group_projects"],
-    ["GET", "/v1/security/firewall/config/{configVersion}", "get_firewall_config"],
-    ["GET", "/v1/registrar/domains/{domain}/availability", "get_domain_availability"],
-    ["GET", "/v9/projects/{idOrName}/custom-environments", "list_project_custom_environments"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/fs/mkdir", "create_session_directory"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/fs/write", "write_session_files"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/snapshot", "create_sandboxes_sessions_by_session_id_snapshot_v2"],
-    ["POST", "/v3/sandboxes/sessions/{sessionId}/snapshot", "create_sandboxes_sessions_by_session_id_snapshot_v3"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/fs/read", "read_session_file"],
-    ["PATCH", "/v1/projects/{idOrName}/protection-bypass", "update_project_protection_bypass"],
-    ["POST", "/v2/deployments/{deploymentId}/check-runs", "create_deployment_check_run"],
-    ["GET", "/v1/microfrontends/{deploymentId}/config", "get_microfrontends_config"],
-    ["GET", "/v1/projects/{projectId}/promote/aliases", "list_promote_aliases"],
-    ["GET", "/v1/projects/{projectId}/routes/versions", "list_project_route_versions"],
-    ["POST", "/v1/projects/{projectId}/routes/generate", "generate_route"],
-    ["POST", "/v1/projects/{projectId}/routes/versions", "update_route_versions"],
-    ["GET", "/v1/projects/{idOrName}/rolling-release", "get_rolling_release"],
-    ["POST", "/v1/global-config/{edgeConfigId}/schema", "patch_edge_config_schema"],
-    ["POST", "/v1/kms/issuers/{issuerId}/sign/message", "sign_kms_message"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/stop", "stop_session"],
-    ["GET", "/v2/sandboxes/sessions/{sessionId}/cmd", "list_session_commands"],
-    ["PATCH", "/v1/global-config/{edgeConfigId}/items", "patch_edge_config_items"],
-    ["POST", "/v1/global-config/{edgeConfigId}/token", "create_edge_config_token"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/cmd", "run_session_command"],
-    ["GET", "/v1/access-groups/{idOrName}/projects", "list_access_group_projects"],
-    ["POST", "/v1/deployments/{deploymentId}/checks", "create_check"],
-    ["POST", "/v1/kms/issuers/{issuerId}/sign/token", "sign_kms_token"],
-    ["POST", "/v1/teams/{teamId}/members/teams/join", "join_team"],
-    ["GET", "/v1/access-groups/{idOrName}/members", "list_access_group_members"],
-    ["GET", "/v1/registrar/domains/{domain}/price", "get_domain_price"],
-    ["GET", "/v2/sandboxes/snapshots/{snapshotId}", "get_session_snapshot"],
-    ["GET", "/v1/integrations/configuration/{id}", "get_configuration"],
-    ["POST", "/v1/kms/issuers/{issuerId}/policies", "create_kms_issuer_policy"],
-    ["GET", "/v2/sandboxes/sessions/{sessionId}", "get_session"],
-    ["POST", "/v1/registrar/domains/{domain}/buy", "buy_single_domain"],
-    ["PUT", "/projects/transfer-request/{code}", "accept_project_transfer_request"],
-    ["GET", "/v1/connect/networks/{networkId}", "read_network"],
-    ["GET", "/v3/deployments/{idOrUrl}/events", "list_deployment_events"],
-    ["PATCH", "/v1/connect/networks/{networkId}", "update_network"],
-    ["POST", "/v1/projects/{projectId}/unpause", "unpause_project"],
-    ["POST", "/v10/projects/{idOrName}/domains", "add_project_domain"],
-    ["PUT", "/v1/global-config/{edgeConfigId}", "update_edge_config"],
-    ["GET", "/v1/projects/{projectId}/routes", "list_project_routes"],
-    ["GET", "/v9/projects/{idOrName}/domains", "list_project_domains"],
-    ["PATCH", "/aliases/{id}/protection-bypass", "patch_url_protection_bypass"],
-    ["POST", "/v1/kms/issuers/{issuerId}/keys", "create_kms_signing_key"],
-    ["POST", "/v1/projects/{projectId}/routes", "add_route"],
-    ["PUT", "/v1/projects/{projectId}/routes", "stage_routes"],
-    ["GET", "/v1/registrar/orders/{orderId}", "get_order"],
-    ["GET", "/v1/registrar/tlds/{tld}/price", "get_tld_price"],
-    ["PATCH", "/v1/domains/records/{recordId}", "update_record"],
-    ["POST", "/v1/projects/{projectId}/pause", "pause_project"],
-    ["POST", "/v1/projects/{idOrName}/token", "get_project_token"],
-    ["GET", "/v1/access-groups/{idOrName}", "read_access_group"],
-    ["GET", "/v2/deployments/{id}/aliases", "list_deployment_aliases"],
-    ["PATCH", "/v12/deployments/{id}/cancel", "cancel_deployment"],
-    ["POST", "/v2/deployments/{id}/aliases", "assign_alias"],
-    ["GET", "/domains/records/{recordId}", "get_domains_records_by_record_id"],
-    ["GET", "/v1/kms/issuers/{issuerId}", "get_kms_issuer"],
-    ["GET", "/v13/deployments/{idOrUrl}", "get_deployment"],
-    ["GET", "/v3/teams/{teamId}/members", "list_team_members"],
-    ["GET", "/v6/deployments/{id}/files", "list_deployment_files"],
-    ["PATCH", "/v1/kms/issuers/{issuerId}", "update_kms_issuer"],
-    ["GET", "/v5/user/tokens/{tokenId}", "get_auth_token"],
-    ["PUT", "/domains/{domain}/records", "replace_domains_by_domain_records"],
-    ["GET", "/v1/registrar/tlds/{tld}", "get_tld"],
-    ["GET", "/v9/projects/{idOrName}", "get_project"],
-    ["PATCH", "/v9/projects/{idOrName}", "update_project"],
-    ["GET", "/storage/stores/{id}", "get_storage_stores_by_id"],
-    ["GET", "/v2/sandboxes/{name}", "get_named_sandbox"],
-    ["PATCH", "/v2/sandboxes/{name}", "update_sandbox"],
-    ["PUT", "/v8/artifacts/{hash}", "upload_artifact"],
-    ["GET", "/v2/teams/{teamId}", "get_team"],
-    ["GET", "/v1/webhooks/{id}", "get_webhook"],
-    ["GET", "/v1/drains/{id}", "get_drain"],
-    ["PATCH", "/v1/drains/{id}", "update_drain"],
-    ["GET", "/v1/env/{id}", "get_shared_env_var"],
-    [
-        "GET",
-        "/v1/integrations/integration/{integrationIdOrSlug}/products/{productIdOrSlug}/plans",
-        "list_integration_billing_plans",
-    ],
-    [
-        "POST",
-        "/v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}/restore",
-        "restore_edge_config_backup",
-    ],
-    ["GET", "/v1/projects/{projectIdOrName}/feature-flags/segments/{segmentIdOrSlug}", "get_flag_segment"],
-    ["PATCH", "/v1/projects/{projectIdOrName}/feature-flags/segments/{segmentIdOrSlug}", "update_flag_segment"],
-    ["GET", "/v1/global-config/{edgeConfigId}/backups/{edgeConfigBackupVersionId}", "get_edge_config_backup"],
-    ["GET", "/v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}", "get_flag"],
-    ["GET", "/v9/projects/{idOrName}/custom-environments/{environmentSlugOrId}", "get_custom_environment"],
-    ["PATCH", "/v1/projects/{projectIdOrName}/feature-flags/flags/{flagIdOrSlug}", "update_flag"],
-    ["GET", "/v1/projects/{projectId}/deployments/{deploymentId}/runtime-logs", "get_runtime_logs"],
-    ["GET", "/v1/access-groups/{accessGroupIdOrName}/projects/{projectId}", "read_access_group_project"],
-    ["POST", "/v1/deployments/{deploymentId}/checks/{checkId}/rerequest", "rerequest_check"],
-    ["GET", "/v2/deployments/{deploymentId}/check-runs/{checkRunId}", "get_deployment_check_run"],
-    ["PATCH", "/v2/deployments/{deploymentId}/check-runs/{checkRunId}", "update_deployment_check_run"],
-    ["GET", "/v2/projects/{projectIdOrName}/checks/{checkId}/runs", "list_check_runs"],
-    ["GET", "/v2/sandboxes/sessions/{sessionId}/cmd/{cmdId}/logs", "get_session_command_logs"],
-    ["POST", "/v2/sandboxes/sessions/{sessionId}/cmd/{cmdId}/kill", "kill_session_command"],
-    ["POST", "/v1/kms/issuers/{issuerId}/keys/{keyId}/activate", "activate_kms_signing_key"],
-    ["POST", "/v1/projects/{projectId}/rollback/{deploymentId}", "request_rollback"],
-    ["POST", "/v10/projects/{projectId}/promote/{deploymentId}", "request_promote"],
-    ["GET", "/v1/deployments/{deploymentId}/checks/{checkId}", "get_check"],
-    ["GET", "/v2/projects/{projectIdOrName}/checks/{checkId}", "get_project_check"],
-    ["PATCH", "/v1/deployments/{deploymentId}/checks/{checkId}", "update_check"],
-    ["PATCH", "/v2/projects/{projectIdOrName}/checks/{checkId}", "update_project_check"],
-    ["GET", "/v1/global-config/{edgeConfigId}/token/{token}", "get_edge_config_token"],
-    ["GET", "/v2/sandboxes/sessions/{sessionId}/cmd/{cmdId}", "get_session_command"],
-    ["POST", "/v1/kms/issuers/{issuerId}/keys/{keyId}/revoke", "revoke_kms_signing_key"],
-    ["PATCH", "/v1/projects/{projectId}/routes/{routeId}", "edit_route"],
-    ["GET", "/v1/teams/{teamId}/request/{userId}", "get_team_access_request"],
-    ["GET", "/v8/deployments/{id}/files/{fileId}", "get_deployment_file_contents"],
-    ["PATCH", "/v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}", "update_kms_issuer_policy"],
-];
-// OpenAPI listDrives is not in the published MCP categories. This concrete
-// route must resolve before get_named_sandbox's wildcard name parameter.
-export const UNCOVERED_REST_OPERATIONS = [
-    ["GET", "/v2/sandboxes/drives"],
-];