@zackbart/connecta 0.30.0 → 0.32.0

package/CHANGELOG.md

@@ -2,6 +2,72 @@
 
 All notable changes to this package are documented here.
 
+## 0.32.0 — 2026-10-14
+
+Connecta 0.32.0 makes each endpoint simply writable or read-only, and lets a deployment keep chosen callers, such as an agent's token, off plain `/mcp` (#820, #821). A deployment can then give an agent one token and per-person pools, and the agent sees only the pool its client picks for each turn.
+
+Every deployment must now choose `readOnly`, and this breaks existing configurations (#822). `readOnly` replaces the pool `trust` setting. The deployment's value applies to `/mcp`, and each pool inherits it unless it sets its own. A deployment that sets neither `readOnly` nor `trust` fails at startup and asks the operator to choose. One that still sets `trust` anywhere fails with a message naming `readOnly`. Replace `trust: "trusted"` with `readOnly: false`, and `trust: "read-only"` with `readOnly: true`. On a read-only endpoint, write tools are left out of search and describe, and every write is refused with `read_only_endpoint` before validation or dispatch, whether it comes from `call_tool`, `call_destructive_tool` or a program. That includes `call_destructive_tool`, which a read-only pool used to allow with host approval. On a writable endpoint, `call_destructive_tool` and programs write, and the MCP client owns approval. Guides are documentation and are not filtered, so a guide may name a tool the endpoint refuses. A deployment that set no `trust` used to let programs read only and allow host-approved direct writes. Choose `readOnly: true` to stop all writes, or `readOnly: false` to let programs write too. A pool that relied on the old read-only default now inherits the deployment's value, so set `readOnly: true` on every pool that must stay read-only. The Node template and Worker example set `readOnly: false`.
+
+A new top-level `grant(identity)` admits callers to plain `/mcp` the way pool grants admit callers to pools (#824). Without it, everyone admitted today is still admitted. Only a literal `true` admits. A refused caller gets the same 404 as a refused or undeclared pool, and can still open any pool whose own grant admits it. Result paging and the operator UI's catalog and config reads apply the same grant, so a refused token cannot read the full catalog through `/ui`. OAuth protected-resource metadata stays public, so MCP clients can still discover where to sign in. Deployments that don't set `grant` need no changes.
+
+`mixpanel()` gains a REST implementation, `via: "api"`, for what the hosted MCP server cannot answer (#825). It covers raw event export with a size bound, one user's activity stream, profile queries, saved Insights and Funnels reports, retention queries and event import. It authenticates with an operator-managed service account, takes `project_id` per call (with optional `defaultProjectId`) and lists the projects the account can reach. Profile updates are left out because Mixpanel's profile endpoint requires the project token, which service-account credentials alone don't provide. The hosted MCP implementation stays the default, so existing Mixpanel configurations are unchanged. A deployment that wants both declares two connections.
+
+The release also adds `excludeApps` to `planningCenter()`, Gmail `get_attachment` and a maintained Wispr Flow provider, and updates the Notion connector to Notion's current limits and errors. CI now runs its checks in parallel, and the redaction tests no longer depend on wall-clock time.
+
+### Added
+
+- Let deployments configure a grant for plain `/mcp`, independently of named pools. Refusals use the same 404 as refused pools, result paging and operator catalog reads respect the grant while OAuth metadata discovery stays public, and the operator UI and configuration snapshot report whether it is configured.
+- Read Gmail attachment text and small binary files with `get_attachment`. Attachment listings now expose immutable `partId` identifiers for reads across rotated download ids and for inline attachments. Binary content uses standard base64 for Drive uploads; downloads and whole results have explicit size limits.
+  
+  Parsed forwarded attachments include their headers and readable body after checking descendant sizes. MIME charset parameters accept whitespace and quoted values, unsupported charsets are reported, and inconsistent attachment byte counts are refused.
+- Let `mixpanel()` use service-account REST APIs with `via: "api"` for reachable projects, bounded raw event export, profile activity and queries, Insights and Funnels reports, retention queries and event import. Existing hosted MCP configurations remain the default. Retention queries cap intervals at 90 only for day units, as Mixpanel documents.
+- `planningCenter()` accepts `excludeApps`, a list of Planning Center products the connection never reaches, such as `["giving"]` for a deployment that keeps agents away from donor and financial data. An excluded product's named tools leave the catalog; the description, usage guide, and version pins stop naming it; and `pco_api_get` and `pco_api_mutate` refuse its paths with `provider_permission_denied` before sending, checked against the exact URL the transport would fetch. While any product is excluded, a hatch path must be literal (no dot segments, empty segments, backslashes, whitespace, or percent-encoded delimiters), and the connection also removes the People list tools and refuses People lists, list results, rules, and conditions by path or `include`, since a list's conditions can draw on any product; refuses webhook event and delivery payloads and any change to an existing webhook subscription; and accepts a new subscription only to a reachable product's event. Any product except People can be excluded; an unknown name or People throws at construction. The default excludes nothing and is unchanged. Exclusion does not hide records copied into a reachable product by the church's automations or staff, such as People workflow cards a Giving automation creates for first-time donors, notes, or custom fields; for a hard boundary, use a personal access token from a user with No Access in the excluded product, since Planning Center sets permissions per product for each user, and treat `excludeApps` as defense in depth.
+- Add a maintained Wispr Flow hosted-MCP provider for OAuth access to Notetaker meetings, Scratchpad notes, calendar events and tasks, with reviewed tool classification and account-specific usage guidance.
+
+### Changed
+
+- Run CI checks in parallel, cancel superseded PR runs, and request snapshot updates explicitly while preserving the full check gate.
+- **Breaking:** Each endpoint is now writable or read-only, set by a plain `readOnly` boolean that replaces pool `trust`. The deployment's `readOnly` sets `/mcp` and is required for this release: a deployment that sets neither `readOnly` nor the removed `trust` fails at startup with a configuration error asking the operator to choose `readOnly: true` or `readOnly: false`. Each pool inherits the deployment value unless it sets its own, in either direction. The client owns approval. A writable endpoint (`false`) behaves as a `trusted` pool did: `call_destructive_tool` and `execute_code` programs write (program writes stay capped by `execute.maxWrites`), `call_tool` still refuses writes, and `execute_code` is annotated `readOnlyHint: false, destructiveHint: true`. On a read-only endpoint (`true`), write tools are absent from `search_tools` results, `connecta.search`, and `connecta.describe`, and every write call through `call_tool`, `call_destructive_tool`, or a program is refused before validation or dispatch with the new code `read_only_endpoint` (`retryable: false`, no `nextAction`); reads still run, and `execute_code` is annotated `readOnlyHint: true, destructiveHint: false`. Guides are documentation and are not filtered: provider `SKILL.md` and usage guides, surfaced through `queryAnalysis.guideSummary`, `skills`, `connecta.skill`, and skill `resources/read`, may still name tools a read-only endpoint refuses. `tools/list` stays six tools on both. Resource reads, grants, `connectorAccess` (including guarded `requireReadOnly` grants), classification, and `execute.maxWrites` are unchanged. `describeConfig()` and the operator UI report `readOnly` instead of `trust`, and programs no longer receive `destructive_tool_requires_approval`, which remains `call_tool`'s refusal of a write on a writable endpoint.
+  
+  To migrate, set `readOnly` explicitly in deployment code and remove every `trust`; a config that still sets `trust`, on the deployment or a pool, fails at construction with a message naming `readOnly`, and one that sets no `readOnly` fails too. Replace `trust: "trusted"` with `readOnly: false`. Replace `trust: "read-only"` with `readOnly: true`, and note that a read-only endpoint now also refuses writes through `call_destructive_tool`; a pool that should still allow host-approved direct writes but no program writes has no equivalent and must choose. A deployment that set no `trust` was read-only for programs and allowed host-approved direct writes; choose `readOnly: true` to keep it from writing at all, or `readOnly: false` to let programs write too. Pools that relied on the old read-only default inherit the deployment value, so set `readOnly: true` on each pool that must stay read-only under a writable deployment. The Node template and Worker example now set `readOnly: false`, and `connecta init` asks operators to choose.
+
+### Fixed
+
+- Make redaction regression tests robust under machine load with CPU scaling, exact output and low-heap checks, without adding production instrumentation.
+- `notion()` over an integration token now splits text longer than Notion's 2,000-character rich-text run limit into consecutive runs in `integration_create_page` and `integration_append_blocks`, instead of sending a request Notion rejects, and refuses text no single value can carry. Failures follow Notion's current contract: a 429 whose reason is `public_api_request_blocked` is no longer retryable, the retry window falls back to the body's `additional_data.retry_after`, a 403 names the workspace block limit, a 5xx on a write that Notion reports as committed names the created object or appended blocks so the caller reads them instead of repeating the write, and a 5xx on a write that carries Notion's `retry_guidance` relays it, unless the operation withholds Notion's error text, and is not retryable. A data source query stopped at Notion's 10,000-result cap reports `incomplete: true` from `integration_query_data_source` and `page.hasMore` without `page.next` from the generic read. Projections name native Notion icons and custom emoji and read an `unsupported` formula or rollup value as `null`. The OAuth connector classifies `notion-ai-search`, `notion-get-self`, `notion-get-tool-access`, and `notion-download-skill` as reads. The guide routes whole-page reads and Markdown writes through the page Markdown endpoints.
+
+## 0.31.0 — 2026-10-09
+
+Connecta 0.31.0 lets the auth mode choose how Stripe, Notion, Cloudflare and Vercel connect (#801). `auth: { type: "oauth" }` connects the vendor's hosted MCP server, OAuth only. A key connects Connecta's own REST connector with an operator-managed credential: Stripe `apiKey`, Notion `token`, Cloudflare `apiToken` or `globalApiKey`, and Vercel `token`. Each implementation is now complete on its own. This replaces the 0.29 split, in which the hosted server owned writes and the REST surface refused them, so a Cloudflare API token could not change a DNS record. Decision record 0005 explains the choice. Deployments that use none of these four providers need no changes.
+
+The timing comes from Stripe. Its hosted MCP server stops accepting `sk_` secret keys and untagged `rk_` restricted keys on 2026-10-31, so a deployment that sends one of those keys to `mcp.stripe.com` loses Stripe on that date. Upgrade before then. Stripe still documents agent-tagged restricted keys for its MCP server, but Connecta's hosted Stripe connection is now OAuth only, and every Stripe key, tagged or not, uses the REST connector. For these four providers, Connecta no longer sends a bearer key, literal header or operator credential to the hosted MCP server. Other hosted providers, such as RevenueCat, Mixpanel and GitHub, are unchanged.
+
+Every key connector serves the same four tools. `<vendor>_api_search` and `<vendor>_api_details` read an operation index compiled from the vendor's pinned OpenAPI document. `<vendor>_api_read` and `<vendor>_api_write` check each call's path and parameters against that index before sending it, and return `{ status, data, page? }`. The read tool admits GET plus reviewed read-only POSTs such as Stripe's invoice preview, Cloudflare analytics and Vercel observability queries. Each vendor keeps a few named tools. Stripe POST writes send the caller's `idempotencyKey`, or a generated one, as `Idempotency-Key` and return it; DELETE writes send none. When a deadline interrupts one of those POST writes, or its outcome is otherwise unknown, `uncertainCall.recovery` carries the generated key, or a caller-supplied key of at most 128 characters. A longer caller key is still sent to Stripe but not echoed there, since the caller already has it. Every Stripe request, v1 and v2, sends `Stripe-Version: 2026-09-30.endive`, the pinned index's version, whatever the account's default API version. Response shapes and accepted parameters follow that version, so check the fields programs rely on with `stripe_api_details`. Stripe's `connectedAccount` now works with an operator-managed key. `npm run providers:check` reports when a pinned index falls behind the vendor's live document.
+
+Most existing configurations of these providers need edits. `auth` is now required, with no default, and omitting it throws an error that lists the valid types. `surface` is removed from Notion, Vercel and Cloudflare, along with Cloudflare `authentication` and its `credential` override. Stripe loses literal `headers` auth and hosted `credential` auth. Cloudflare bearer-token auth to `mcp.cloudflare.com` is removed, so those deployments move to `apiToken` and its REST tools. A credential stored under the same connector id carries over; run its Test action after upgrading.
+
+Tool names change on the key paths. Cloudflare's `cloudflare_api_get` and `cloudflare_api_mutate` become `cloudflare_api_read` and `cloudflare_api_write`. `verify_api_token` and `verify_global_api_key` become `verify_credential`. Cloudflare's 23 hand-written reads give way to `cloudflare_api_read`, which returns unprojected results. Vercel's `vercel_api_get` and `vercel_api_mutate` become `vercel_api_read` and `vercel_api_write`, and `verify_project_domain`, `remove_project_domain` and `delete_deployment` are removed. Notion's token connector drops eight `integration_*` tools in favor of the generic ones. Stripe keeps its tool names with Connecta's contracts, but natural-language Sigma, metrics, docs search, the planner, reports and feedback exist only on the OAuth connection.
+
+Several exports are removed. Cloudflare loses `CloudflareApiOptions`, `CloudflareMcpOptions`, `CloudflareConnectionOptions` and `CloudflareAuthentication`, plus `CLOUDFLARE_DNS_RECORD_TYPES` and `CLOUDFLARE_CONTENT_DNS_RECORD_TYPES`. Notion and Vercel lose their `ApiOptions`, `McpOptions` and `ConnectionOptions` types, and Stripe loses `StripeHeaderOptions`. Each `<Vendor>Options` is now a union of per-auth types, such as `StripeApiKeyOptions`, `NotionTokenOptions`, `VercelTokenOptions` and `CloudflareGlobalApiKeyOptions`.
+
+A Cloudflare Global API Key reaches every account and zone its user can reach. `auth: { type: "globalApiKey" }` therefore requires `pin: { accountIds, zoneIds }` unless the configuration states `unpinned: true`. It never writes `/user` or `/memberships`. Pins deny by default and also apply to GraphQL tags and list results. An operation that names no account or zone is refused unless it was reviewed as safe. Pins are optional for scoped API tokens. A Global API Key cannot reach R2.
+
+Every key connector applies one reviewed value-safety table. No REST tool response, success or error, returns a credential that grants access to the vendor or a third party, or a stored secret value. Operations that mint or hand out credentials are refused before they are sent. Stored secrets read as `"[redacted]"`. URLs that act as capabilities keep only their scheme and host, or lose their signing parameters. Reviewed operations withhold the vendor's error text unless their review keeps it. Results therefore lose fields they used to return. Stripe withholds client secrets, webhook signing secrets, Issuing card numbers and CVCs, and Checkout Session URLs other than those of guest payment sessions. Notion strips the signatures from pre-signed file URLs, so a returned file URL no longer downloads. Vercel returns `"[redacted]"` for environment values and header rule values. Cloudflare redacts Hyperdrive passwords, dispatch binding values and transform-rule header values. The guarantee assumes an honest vendor server and covers only the REST key connectors. Secrets that people type into free text, names or identifiers are out of scope. Hosted OAuth connections fall outside it: they return what the vendor's server returns, under Connecta's existing credential and `writeOnly` redaction.
+
+The four provider entries now carry both transports and a pinned index. Measured gzip, Stripe grows from 171 KB to 243 KB, Notion from 191 KB to 216 KB, Vercel from 190 KB to 231 KB and Cloudflare from 193 KB to 338 KB, all within their stated caps. Vercel admits only reviewed and approved MCP clients to its hosted server. If it refuses authorization for that reason, the deployment needs Vercel's approval or a token connector. Vercel's hosted connection now lists its four environment variable tools. The two that can return decrypted values are classified as writes. Cloudflare's hosted `execute` is always a write, so a read-only pool on a Cloudflare OAuth connector reaches only `search`. Use an API token for read-only API access. Agent evals against fake vendors for all four providers are planned. `documentation/provider-auth-migration.md` gives the step-by-step migration for each provider.
+
+### Changed
+
+- **Breaking:** `cloudflare()` now requires `auth`, which selects the implementation. `auth: { type: "oauth" }` connects Cloudflare's hosted MCP server (`search` and `execute`), OAuth only; bearer-token and credential auth to `mcp.cloudflare.com` are removed. `auth: { type: "apiToken" }` and `auth: { type: "globalApiKey" }` connect Connecta's own REST connector to the v4 API with an operator-managed credential: `cloudflare_api_search` and `cloudflare_api_details` read a pinned Cloudflare API index (3,336 operations, deprecated ones dropped), `cloudflare_api_read` (GET plus 47 reviewed read-only POSTs such as analytics, Analytics Engine and Log Explorer SQL, and KV bulk get) and `cloudflare_api_write` check every call against that index before sending it and return `{ status, data, page? }` with the envelope unwrapped, and the named tools are `verify_credential`, `list_accounts`, `list_zones`, `graphql_query` (read-only, refuses mutations), and `cloudflare_api_upload`. `accountId` and `zoneId` fill path placeholders; `pin: { accountIds, zoneIds }` restricts every call by default deny (an operation naming no account or zone is refused unless reviewed safe), including GraphQL tags and list results, and is required for a Global API Key unless `unpinned: true`. A reviewed value-safety table derived from the pinned spec gives every credential-bearing operation a verdict: credential producers (API tokens, Access service tokens, R2 temporary credentials, signing keys, direct-upload URLs, and more) and payment secrets are refused, stored and embedded secrets and environment and plain-text binding values are redacted on every method and tool, and operations that take or return credentials withhold vendor error text; URL Scanner captures are refused; a pinned connector's GraphQL documents hold one query and only fragments it uses, and a key-name, typed-secret, and URL-credential heuristic backs it up; a Global API Key never writes `/user` or `/memberships`. `surface`, `authentication`, `credential` overrides, the API-token mutation refusals, `verify_api_token`, `verify_global_api_key` (now `verify_credential`), `cloudflare_api_get`, `cloudflare_api_mutate`, the 23 hand-written reads from `get_zone` and `list_dns_records` to `list_pages_domains` (use `cloudflare_api_read`), `CLOUDFLARE_DNS_RECORD_TYPES`, `CLOUDFLARE_CONTENT_DNS_RECORD_TYPES`, and the `CloudflareApiOptions`, `CloudflareMcpOptions`, `CloudflareConnectionOptions`, and `CloudflareAuthentication` types are removed. See the provider auth migration guide.
+- Record that the auth mode selects the provider implementation: OAuth uses the vendor's hosted MCP and keys use a Connecta REST connector, superseding the hosted MCP ownership rule for Stripe, Vercel, Cloudflare and Notion (decision record 0005). Each provider's change is its own entry.
+- **Breaking:** `notion()` now requires `auth`, which selects the implementation, and `surface` is removed. `auth: { type: "oauth" }` connects Notion's hosted MCP server as the signed-in user, OAuth only, with the same reviewed catalog. `auth: { type: "token" }` connects Connecta's REST connector to `api.notion.com` as an internal integration with an operator-managed token: `notion_api_search`, `notion_api_details`, `notion_api_read`, and `notion_api_write` reach every operation in a pinned Notion API index (with the sent `Notion-Version` pinned to it), check each call against it before sending, admit Notion's read-only POST queries on the read tool, and return `{ status, data, page? }`, where `page.in: "body"` marks a body-borne cursor, `page.path` names a view query's continuation, and `hasMore` without `next` marks a cursorless cut-off such as meeting notes' limit. The token connector keeps `integration_search`, `integration_get_page`, `integration_get_page_content`, `integration_get_data_source_schema`, `integration_query_data_source`, `integration_create_page`, and `integration_append_blocks` (which now also takes `checklist`); `integration_get_page_property`, `integration_get_database`, `integration_list_users`, `integration_get_self`, `integration_list_comments`, `integration_update_page_properties`, `integration_trash_page`, and `integration_add_comment` are removed in favor of the generic tools. Notion's OAuth token endpoints and multipart file sends are refused. Notion's reconciliation table is retired. `npm run providers:spec` accepts `options.versionHeader` for documents that carry their API version in a header parameter. See the provider auth migration guide.
+- **Breaking:** `stripe()` now requires `auth`, which selects the implementation. `auth: { type: "oauth" }` connects Stripe's hosted MCP server exactly as before, OAuth only. `auth: { type: "apiKey" }` with `mode` (and optional `connectedAccount`) connects Connecta's own REST connector to `api.stripe.com` with an operator-managed secret or restricted key: `stripe_api_search` and `stripe_api_details` read a pinned Stripe API index, `stripe_api_read` and `stripe_api_write` check every call against that index before sending it, form-encode v1 bodies, send v2 bodies as JSON, send `Stripe-Version: 2026-09-30.endive` (the pinned index's version) on every v1 and v2 request whatever the account's default API version, so response shapes and accepted parameters follow it (check them with `stripe_api_details`), return `{ status, data, page? }` with optional `select`, and on every POST write send the caller's `idempotencyKey` or a generated one as `Idempotency-Key` and return it (DELETE sends none); `get_stripe_account_info` and `get_balance_summary` are named reads. A key whose prefix contradicts `mode` is refused before any request, and `connectedAccount` now works with an operator-managed key. Literal `headers` and hosted `credential` auth are removed; omitting `auth` is refused with the valid types. Providers gain the `"dual"` kind, `variants()` accepts a nested discriminant such as `["auth", "type"]`, the operator UI shows whether a provider connector uses hosted MCP or REST, and `npm run providers:spec` compiles pinned OpenAPI documents into operation indexes that `check:providers-generated` checks offline and `providers:check` compares with the live document. A POST write's key also reaches the caller when the response body is lost or the call deadline interrupts it: `write_outcome_unknown` now carries `uncertainCall.recovery` with the generated key, or a caller-supplied key of at most 128 characters (a longer caller key is still sent to Stripe but not echoed, since the caller already has it). See the provider auth migration guide.
+- **Breaking:** `vercel()` now requires `auth`, which selects the implementation, and `surface` is removed. `auth: { type: "oauth" }` connects Vercel's hosted MCP server as before, OAuth only; it now also lists `filter_project_envs`, `get_project_env`, `create_project_env`, and `edit_project_env`, with the two value-returning reads reviewed as writes. `auth: { type: "token" }` with optional `teamId` and `baseUrl` connects Connecta's own REST connector to `api.vercel.com` with an operator-managed access token, complete on its own: `vercel_api_search` and `vercel_api_details` read Vercel's OpenAPI document pinned by content hash, `vercel_api_read` (GET plus reviewed read-only POSTs such as `POST /v2/observability/query`) and `vercel_api_write` check every call against that index before sending it, apply the default team to operations that accept one (`teamId: null` for the personal account), and return `{ status, data, page? }` with `until` or `cursor` pagination. Named tools are `list_teams`, the value-safe environment variable tools, `get_deployment_build_logs`, `get_runtime_logs` (bounded by `waitMs` and `maxRows`), and `vercel_api_upload` for octet-stream operations. Value safety follows a reviewed per-operation table derived from the pinned spec (`scripts/value-safety.mjs` flags every operation whose response may carry a credential or secret value; a test fails on any without a verdict): credential minting, Connect authorization, project transfer requests, decrypted environment values, Global Config items and tokens, a domain move-out, KMS signing, and domain transfer codes are refused; environment values, protection-bypass secrets, deploy hook URLs, drain and webhook headers, signing secrets, and destination URLs beyond their origin, external route and redirect destinations beyond their origin, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and URL credentials are redacted on every path; a key-name heuristic covers the rest; and secret-family failures carry fixed messages. The 0.29 ownership refusals, reconciliation tables, `vercel_api_get`, `vercel_api_mutate`, `verify_project_domain`, `remove_project_domain`, `delete_deployment`, and the no-op `defaultPageSize` option are removed. See the provider auth migration guide.
+
+### Security
+
+- **Breaking:** Every key connector (Stripe, Notion, Cloudflare, Vercel) now applies one reviewed value-safety mechanism: one detector over each pinned spec (the union of the former Cloudflare and Vercel detectors), one per-vendor table of `refuse`, `redact`, and `safe` verdicts, one redaction engine on every result, and one error policy. Stripe refuses operations that hand out a credential (ephemeral keys, Terminal connection tokens and onboarding links, v1 and v2 account links, login links, account, customer, and billing portal sessions, file link creation, Financial Connections session creation, and the meter event session), refuses Issuing `number` and `cvc` expansions on every Issuing path, and redacts client secrets, webhook and event destination signing secrets, Apps secret payloads, app-install authorization codes, Terminal Wi-Fi passwords, forwarded header values, and Issuing card numbers and CVCs; webhook, file link, and pre-signed import URLs keep only their origin. Resource rules keyed on Stripe's `object` apply these wherever an object appears (expansions, lists, events and their `previous_attributes`). Identity verification URLs are unchanged; a Checkout Session's URL is returned whole only for a provably guest payment session (no `customer`, `customer_account`, customer creation, or saved payment method options) and otherwise keeps only its origin. Notion withholds the signature parameters of pre-signed file URLs and refuses its OAuth endpoints through the table. Cloudflare's review grows by 259 operations, newly redacting Hyperdrive passwords, RealtimeKit storage credentials, transform-rule header values, dispatch binding values, and webhook destinations beyond their origin. Vercel replaces environment values with `"[redacted]"` instead of dropping them, and redacts audit-event invite codes, integration drain headers, and route header values. Where the former engines differed the stricter rule holds: a credential-named field loses its whole value, and every reviewed operation (or one whose request takes a credential-named field) withholds the vendor's error text unless its review keeps it. `providers:spec` (now run under tsx) checks every reviewed path against the pinned response schema. `RestVendor.valueSafety` is required and the `redact` hook is removed; Cloudflare's generated index no longer carries `secrets`. See the provider auth migration guide.
+
 ## 0.30.0 — 2026-10-09
 
 Connecta 0.30.0 makes large results, sign-in and rich output dependable for agents, on both direct calls and programs. The six-tool surface from 0.29.0 stays. We measured the alternative, folding everything into `execute_code`, against it on Sonnet 5.5 and GPT-6-Luna (#765). The code-only surface scored lower and made a duplicate billable write, so it was not adopted.

package/README.md

@@ -65,16 +65,20 @@ across them in one task. Changing your connected services does not require
 changing the agent's connection. Your deployment decides which services and
 operations each caller can reach.
 
-Connecta includes maintained connections for <!-- providers:start -->Basecamp, Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Infisical, Linear, Mixpanel, Notion, Overflow, Planning Center, RevenueCat, Stripe, Tithe.ly, and Vercel<!-- providers:end -->.
+Connecta includes maintained connections for <!-- providers:start -->Basecamp, Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Infisical, Linear, Mixpanel, Notion, Overflow, Planning Center, RevenueCat, Stripe, Tithe.ly, Vercel, and Wispr Flow<!-- providers:end -->.
 Each connection has its own setup guide.
-Notion, Vercel, and Cloudflare offer hosted MCP connections and selected HTTP
-API capabilities. You can also connect other remote MCP servers or define the
-operations you need from an HTTP API.
+Stripe, Notion, Cloudflare, and Vercel use their hosted MCP servers when you
+sign in with OAuth, and Connecta's own API connections when you use an API key,
+a Cloudflare API token or Global API Key, a Notion integration token, or a
+Vercel access token. You can also
+connect other remote MCP servers or define the operations you need from an
+HTTP API.
 
 Google Workspace connections use the account your deployment assigns to each
 signed-in person. A Workspace administrator authorizes them for your domain.
-Gmail reads mail and writes drafts, but does not send mail. Google Drive can
-read, write, and share files, but does not permanently delete them. Available
+Gmail reads mail and attachments and writes drafts, but does not send mail.
+Google Drive can read, write, and share files, but does not permanently delete
+them. Available
 operations and account access depend on the integration and your deployment.
 
 Large results need not fill the conversation. The agent can filter and
@@ -82,19 +86,20 @@ summarize them in its program, or read a large result in smaller pieces.
 
 ## Writes, credentials, and access
 
-Connecta distinguishes reads from writes. By default, programs can read, and
-each change uses a separate visible tool call. Your agent's host controls
-whether it asks for approval. You can explicitly allow programs to make
-changes too; the host then sees the program tool as a write. This choice does
-not give a caller access to additional services.
+Connecta distinguishes reads from writes, and each endpoint is either writable
+or read-only. By default an endpoint is writable: your agent can make a change
+with one visible tool call or inside a program, and your agent's host decides
+whether to ask for approval; it sees the program tool as a write. You can mark
+the whole deployment or a single endpoint read-only, and then nothing there can
+change anything: search leaves write tools out and every write is refused. You
+make this choice explicitly for each deployment. Neither choice gives a caller
+access to additional services.
 
 ```mermaid
 flowchart TB
-    Change["Your agent wants to change something"] --> Choice{"Are programs allowed<br/>to make changes?"}
-    Choice -->|"Default: no"| Separate["A separate visible call for each change"]
-    Choice -->|"Explicit choice: yes"| Program["A program that can make changes"]
-    Separate --> Host["Your agent's host handles approval"]
-    Program --> Host
+    Change["Your agent wants to change something"] --> Choice{"Is this endpoint<br/>read-only?"}
+    Choice -->|"Explicit choice: yes"| Refused["Refused; nothing is sent"]
+    Choice -->|"Default: no"| Host["Your agent's host handles approval"]
     Host --> Access["Connecta checks the caller's access"]
     Access --> Services["The connected service receives the change"]
 

package/bin/connecta.mjs

@@ -77,6 +77,7 @@ async function init() {
   console.log("Next:");
   console.log(`  ${shellCd(target)}`);
   console.log("  npm install");
+  console.log("  # Choose readOnly in src/connecta.config.ts: false writes with client approval, true refuses writes.");
   console.log('  npm run --silent provision-token -- "local-machine"');
   console.log("  # Save the returned cta_ token privately for your MCP client and doctor.");
   console.log("  npm start");

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.30.0";
+export const CONNECTA_VERSION = "0.32.0";

package/dist/auth-elicitation.js

@@ -148,7 +148,7 @@ export class AuthElicitation {
                 requestSignal: AbortSignal.any([context.mcpReq.signal, this.options.requestSignal]),
             });
             // Recheck every entered read before restarting any part of a program.
-            // A trusted pool cannot authorize replay of a newly classified write.
+            // A writable endpoint cannot authorize replay of a newly classified write.
             for (const read of previous.reads) {
                 const current = await catalog.resolveTool(read.address, { signal: context.mcpReq.signal });
                 if (!current.ok ||

package/dist/call-recovery.js

@@ -0,0 +1,25 @@
+const MAX_FACTS = 4;
+const MAX_TEXT = 128;
+const NAME = /^[A-Za-z][A-Za-z0-9]*$/;
+const facts = new WeakMap();
+/**
+ * Record facts that let the caller reconcile or safely retry this call's
+ * write. Bounded: at most four string facts with short camelCase names; a fact
+ * outside the bound is dropped rather than truncated.
+ */
+export function recordRecovery(ctx, recovery) {
+    const kept = { ...facts.get(ctx) };
+    for (const [name, value] of Object.entries(recovery)) {
+        if (Object.keys(kept).length >= MAX_FACTS && !Object.hasOwn(kept, name))
+            break;
+        if (!NAME.test(name) || name.length > 32 || typeof value !== "string" || value.length > MAX_TEXT)
+            continue;
+        kept[name] = value;
+    }
+    facts.set(ctx, Object.freeze(kept));
+}
+/** The facts a connector recorded on this call's context, if any. */
+export function recoveryFor(ctx) {
+    const recorded = ctx ? facts.get(ctx) : undefined;
+    return recorded && Object.keys(recorded).length > 0 ? recorded : undefined;
+}

package/dist/catalog-service.js

@@ -377,6 +377,7 @@ export class CatalogService {
     concurrency;
     searchRoute;
     requestSignal;
+    readOnly;
     // The request-scoped catalog cache: one shared read per connector asked
     // about, started by the first asker and joined by every later one. A
     // success stays for the rest of the request, so a search and the call after
@@ -401,6 +402,7 @@ export class CatalogService {
         this.searchRoute = options.searchRoute ?? "search_tools";
         this.requestSignal = options.requestSignal;
         this.defer = options.defer;
+        this.readOnly = options.readOnly === true;
     }
     /**
      * Send a caller back to discovery through the surface it can actually reach.
@@ -460,9 +462,12 @@ export class CatalogService {
     // each settling in its input slot: an unavailable catalog is a Failure
     // there, not a failed discovery. `route` names the surface in a timeout.
     // A probe also ends with its request, so no listing outlives the caller
-    // that asked for it.
+    // that asked for it. On a read-only endpoint a write is absent from search
+    // and describe, as if the connector never had it. Guides are not filtered.
     discoveryCatalogs(ids, route) {
-        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.catalog(id, { signal }), {
+        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.readOnly
+            ? Effect.map(this.catalog(id, { signal }), (tools) => tools.filter((tool) => tool.classification === "read"))
+            : this.catalog(id, { signal }), {
             ...(this.requestSignal ? { signal: this.requestSignal } : {}),
             timeoutMs: this.probeTimeoutMs,
             timeoutError: new ConnectorCallError("timeout", `${route} probe of "${id}" timed out after ${this.probeTimeoutMs}ms`),

package/dist/config-schema.d.ts

@@ -25,9 +25,13 @@ type AnyField = Field<any, any, boolean>;
 export type Shape = {
     readonly [key: string]: AnyField;
 };
-/** A discriminated union of closed objects: `cases[value[key]]`, else `cases[otherwise]`. */
+/**
+ * A discriminated union of closed objects: `cases[value[key[0]][key[1]]…]`,
+ * else `cases[otherwise]`. Each case is the whole object's shape, including
+ * the nested objects on the key path.
+ */
 interface Variants {
-    readonly key: string;
+    readonly key: readonly string[];
     readonly cases: Readonly<Record<string, Shape>>;
     readonly otherwise?: string;
 }
@@ -116,13 +120,16 @@ export declare function instance<F extends AnyField>(field: F): F & {
 };
 /**
  * A closed object whose allowed keys depend on a discriminant, such as
- * `remoteMcp({ auth: { type: "headers", headers } })`. An omitted
+ * `remoteMcp({ auth: { type: "headers", headers } })`. The discriminant may
+ * be nested: `variants(["auth", "type"], cases)` selects the whole options
+ * shape from `options.auth.type`, so `{ auth: { type: "apiKey" }, mode }` and
+ * `{ auth: { type: "oauth" } }` accept different top-level keys. An omitted
  * discriminant selects `otherwise` when given; an omitted one without it, an
- * unrecognized one, or a value that is not an object throws with its path and
- * the valid values, so no union falls through to "no case". Only the walk
- * reads variants; the factory validates the remaining values itself.
+ * unrecognized one, or a value on the path that is not an object throws with
+ * its path and the valid values, so no union falls through to "no case". Only
+ * the walk reads variants; the factory validates the remaining values itself.
  */
-export declare function variants(key: string, cases: Readonly<Record<string, Shape>>, otherwise?: string): Field<unknown, unknown, true>;
+export declare function variants(key: string | readonly string[], cases: Readonly<Record<string, Shape>>, otherwise?: string): Field<unknown, unknown, true>;
 /**
  * A closed object for the unknown-key walk only: each named key may hold
  * anything, which its factory validates. For the options of a built-in

package/dist/config-schema.js

@@ -183,16 +183,22 @@ export function instance(field) {
 }
 /**
  * A closed object whose allowed keys depend on a discriminant, such as
- * `remoteMcp({ auth: { type: "headers", headers } })`. An omitted
+ * `remoteMcp({ auth: { type: "headers", headers } })`. The discriminant may
+ * be nested: `variants(["auth", "type"], cases)` selects the whole options
+ * shape from `options.auth.type`, so `{ auth: { type: "apiKey" }, mode }` and
+ * `{ auth: { type: "oauth" } }` accept different top-level keys. An omitted
  * discriminant selects `otherwise` when given; an omitted one without it, an
- * unrecognized one, or a value that is not an object throws with its path and
- * the valid values, so no union falls through to "no case". Only the walk
- * reads variants; the factory validates the remaining values itself.
+ * unrecognized one, or a value on the path that is not an object throws with
+ * its path and the valid values, so no union falls through to "no case". Only
+ * the walk reads variants; the factory validates the remaining values itself.
  */
 export function variants(key, cases, otherwise) {
+    const path = typeof key === "string" ? [key] : [...key];
+    if (path.length === 0)
+        throw new Error("variants() requires a discriminant key.");
     return {
         ...opaque(),
-        variants: { key, cases, ...(otherwise !== undefined ? { otherwise } : {}) },
+        variants: { key: path, cases, ...(otherwise !== undefined ? { otherwise } : {}) },
     };
 }
 /**
@@ -309,14 +315,27 @@ function inspectRecord(value, path, field) {
  * is never echoed.
  */
 function selectShape(inspected, path, variants) {
-    const at = `${path}.${variants.key}`;
+    const at = `${path}.${variants.key.join(".")}`;
     const valid = Object.keys(variants.cases)
         .map((name) => JSON.stringify(name))
         .join(", ");
-    const descriptor = inspected.own.find(([key]) => key === variants.key)?.[1];
-    if (descriptor && isAccessor(descriptor))
-        fail(`${at} must be a plain value, not a getter or setter.`);
-    const discriminant = descriptor?.value;
+    // Walk the key path one plain object at a time, reading descriptors only.
+    let holder = inspected;
+    let discriminant;
+    for (const [depth, key] of variants.key.entries()) {
+        const step = `${path}.${variants.key.slice(0, depth + 1).join(".")}`;
+        const descriptor = holder.own.find(([own]) => own === key)?.[1];
+        if (descriptor && isAccessor(descriptor))
+            fail(`${step} must be a plain value, not a getter or setter.`);
+        discriminant = descriptor?.value;
+        if (depth === variants.key.length - 1 || discriminant === undefined)
+            break;
+        if (typeof discriminant !== "object" || discriminant === null || isArrayAt(discriminant, step)) {
+            fail(`${step} must be an object.`);
+        }
+        holder = inspectRecord(discriminant, step, OPAQUE);
+        discriminant = undefined;
+    }
     if (discriminant === undefined) {
         if (variants.otherwise !== undefined)
             return variants.cases[variants.otherwise];

package/dist/config-value-sources.js

@@ -56,8 +56,10 @@ export function describeConfigSources(snapshot, raw) {
             source = provided(raw.serverInfo?.[key]);
         else if (group === "urls")
             source = key === "mcpPath" ? "default" : provided(raw[key]);
-        else if (group === "trust")
-            source = provided(raw.trust);
+        else if (group === "hasGrant")
+            source = provided(raw.grant);
+        else if (group === "readOnly")
+            source = provided(raw.readOnly);
         else if (group === "identity")
             source = provided(raw.identity?.[key]);
         else if (group === "storage")
@@ -67,7 +69,8 @@ export function describeConfigSources(snapshot, raw) {
         else if (group === "classification")
             source = provided(raw.classification);
         else if (group === "pools")
-            source = field === "trust" ? provided(raw.pools?.[key]?.trust) : provided(raw.pools);
+            // An inherited value comes from wherever the deployment's came from.
+            source = field === "readOnly" ? provided(raw.pools?.[key]?.readOnly ?? raw.readOnly) : provided(raw.pools);
         else if (group === "modules") {
             const module = key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens;
             const factory = moduleSources[key];

package/dist/config.d.ts

@@ -76,7 +76,7 @@ declare const execute: {
      */
     watchdogMs: import("./config-schema.js").Field<number, number, true>;
     /**
-     * Trusted-pool writes one program may send, on top of the host-call
+     * Writes one program may send on a writable endpoint, on top of the host-call
      * budget every call already spends. Default 10.
      */
     maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -183,8 +183,13 @@ declare const identity: {
     personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
 };
 declare const pool: {
-    /** Programs may write only in trusted pools. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
+    /**
+     * Whether this pool's endpoint refuses every write: write tools are absent
+     * from search_tools, tool listings, and describe, and every write call is
+     * refused. Inherits the deployment's `readOnly` unless set here, in either
+     * direction.
+     */
+    readOnly: import("./config-schema.js").Field<boolean, boolean | undefined, true>;
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: import("./config-schema.js").Field<readonly string[], readonly string[], false>;
     /**
@@ -233,18 +238,22 @@ declare const connectaConfig: {
             personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
         };
     };
+    /**
+     * Whether this admitted identity may open plain `/mcp`. Omitted admits
+     * everyone; only literal true admits when configured. Other returns and
+     * throws receive the same 404 as a refused or undeclared pool.
+     */
+    grant: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
     /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
     pools: import("./config-schema.js").Field<Record<string, {
-        trust?: "trusted" | "read-only" | undefined;
+        readOnly?: boolean | undefined;
         grant?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
         tools: readonly string[];
     }>, Readonly<Record<string, {
-        readonly trust: "trusted" | "read-only";
+        readonly readOnly: boolean | undefined;
         readonly tools: readonly string[];
         readonly grant: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
     }>> | undefined, true>;
-    /** Trust of the default /mcp endpoint. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: import("./config-schema.js").Field<Record<string, Record<string, "read" | "write">>, Readonly<Record<string, Readonly<Record<string, "read" | "write">>>> | undefined, true>;
     /**
@@ -394,7 +403,7 @@ declare const connectaConfig: {
              */
             watchdogMs: import("./config-schema.js").Field<number, number, true>;
             /**
-             * Trusted-pool writes one program may send, on top of the host-call
+             * Writes one program may send on a writable endpoint, on top of the host-call
              * budget every call already spends. Default 10.
              */
             maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -548,6 +557,15 @@ declare const connectaConfig: {
      * `customExecutor(myExecutor, { lifecycle: "self-managed" })`.
      */
     executor: import("./config-schema.js").Field<Executor, Executor, false>;
+    /**
+     * Required. Whether the default /mcp endpoint refuses every write. `true`:
+     * write tools are absent from search_tools, tool listings, and describe,
+     * and call_tool, call_destructive_tool, and program writes are refused.
+     * `false`: call_destructive_tool and programs may write, and the MCP
+     * client owns approval. Pools inherit it unless they set their own. It has
+     * no default while deployments migrate from `trust` (#820).
+     */
+    readOnly: import("./config-schema.js").Field<boolean, boolean, false>;
 };
 /** A deployment's whole configuration, passed to `createConnecta`. */
 export type ConnectaConfig = ConfigInput<typeof connectaConfig>;

package/dist/config.js

@@ -134,7 +134,7 @@ const execute = {
      */
     watchdogMs: whole({ min: 1, default: D.execute.watchdogMs }),
     /**
-     * Trusted-pool writes one program may send, on top of the host-call
+     * Writes one program may send on a writable endpoint, on top of the host-call
      * budget every call already spends. Default 10.
      */
     maxWrites: whole({ min: 1, default: D.execute.maxWrites }),
@@ -195,17 +195,21 @@ const identity = {
     /** Connecting or changing the caller's personal account. Defaults to none. */
     personalConnection: fn(),
 };
-const trust = () => opaque({
-    check: (value, path) => {
-        if (value !== "trusted" && value !== "read-only") {
-            throw new ConfigError(`${path} must be "trusted" or "read-only".`);
-        }
-    },
-    resolve: (value) => value ?? "read-only",
-});
+/** The choice every deployment makes explicitly while `trust` migrates (#820). */
+const READ_ONLY_REQUIRED = (path) => `${path} is required. Choose readOnly: true to refuse every write on /mcp, or readOnly: false to let ` +
+    "call_destructive_tool and programs write with MCP client approval. Pools inherit it unless they set their own.";
+function assertFlag(value, path) {
+    if (typeof value !== "boolean")
+        throw new ConfigError(`${path} must be true or false.`);
+}
 const pool = {
-    /** Programs may write only in trusted pools. Default read-only. */
-    trust: trust(),
+    /**
+     * Whether this pool's endpoint refuses every write: write tools are absent
+     * from search_tools, tool listings, and describe, and every write call is
+     * refused. Inherits the deployment's `readOnly` unless set here, in either
+     * direction.
+     */
+    readOnly: opaque({ check: assertFlag }),
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: required(opaque({
         check: (value, path) => {
@@ -240,7 +244,7 @@ const connectaConfig = {
     connectors: required(array(opaque({
         check: (value, path) => {
             if (isObject(value) && Object.hasOwn(value, "approval")) {
-                throw new ConfigError(`${path}.approval was removed; configure pool trust instead.`);
+                throw new ConfigError(`${path}.approval was removed; the MCP client owns approval. Set readOnly: true to refuse writes.`);
             }
             if (!isObject(value) ||
                 typeof value.id !== "string" ||
@@ -274,10 +278,14 @@ const connectaConfig = {
     }),
     /** Code-derived connection visibility and independent management permissions. */
     identity: object(identity),
+    /**
+     * Whether this admitted identity may open plain `/mcp`. Omitted admits
+     * everyone; only literal true admits when configured. Other returns and
+     * throws receive the same 404 as a refused or undeclared pool.
+     */
+    grant: fn(),
     /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
     pools: record(object(pool)),
-    /** Trust of the default /mcp endpoint. Default read-only. */
-    trust: trust(),
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: record(record(opaque({
         check: (value, path) => {
@@ -415,10 +423,21 @@ const connectaConfig = {
         '"@zackbart/connecta/quickjs" on Node, or ' +
         "workerExecutor({ loader: env.LOADER }) from " +
         '"@zackbart/connecta/worker" around DynamicWorkerExecutor on Workers.'),
+    /**
+     * Required. Whether the default /mcp endpoint refuses every write. `true`:
+     * write tools are absent from search_tools, tool listings, and describe,
+     * and call_tool, call_destructive_tool, and program writes are refused.
+     * `false`: call_destructive_tool and programs may write, and the MCP
+     * client owns approval. Pools inherit it unless they set their own. It has
+     * no default while deployments migrate from `trust` (#820).
+     */
+    readOnly: required(opaque({ check: assertFlag }), (path) => READ_ONLY_REQUIRED(path)),
 };
 const CONFIG = object(connectaConfig);
 /** Pause-only options #672 removed with `resume_execution`. */
 const RETIRED_PAUSE_OPTIONS = ["ConnectaConfig.execute.resumableWrites", "ConnectaConfig.execute.pausedRunTtlSeconds"];
+/** `trust`, on the deployment or a pool, was replaced by `readOnly` (#820). */
+const isRetiredTrust = (path) => path === "ConnectaConfig.trust" || (path.startsWith("ConnectaConfig.pools.") && path.endsWith(".trust"));
 function rejectUnknownOptions(paths) {
     if (paths.length === 0)
         return;
@@ -431,10 +450,13 @@ function rejectUnknownOptions(paths) {
             ? "\nMove branding into ui: operatorUi({ branding }) from @zackbart/connecta/ui."
             : "") +
         (paths.includes("ConnectaConfig.execute.approval")
-            ? '\nexecute.approval was removed. Set trust: "trusted" on a pool to allow program writes; the default is read-only.'
+            ? "\nexecute.approval was removed. The MCP client owns approval; set readOnly: true on the deployment or a pool to refuse writes."
             : "") +
         (paths.some((path) => RETIRED_PAUSE_OPTIONS.includes(path))
-            ? "\nPrograms no longer pause at writes, so there is nothing to configure: read-only pools route writes through call_destructive_tool; trusted pools allow program writes (issue #672). Delete the option."
+            ? "\nPrograms no longer pause at writes, so there is nothing to configure: writable endpoints let programs and call_destructive_tool write; readOnly endpoints refuse every write (issue #672). Delete the option."
+            : "") +
+        (paths.some(isRetiredTrust)
+            ? '\ntrust was removed (#820); set readOnly, which every deployment now chooses explicitly. trust: "read-only" becomes readOnly: true, which now also refuses call_destructive_tool. trust: "trusted" becomes readOnly: false. A pool inherits the deployment readOnly unless it sets its own.'
             : ""));
 }
 /** Checks that span fields; each value is already individually valid. */

package/dist/connector-access.d.ts

@@ -2,7 +2,8 @@ import type { ToolAccess } from "./registry.js";
 import type { AuthenticatedIdentity } from "./types.js";
 /** A declared pool after construction-time validation. */
 export interface ResolvedPool {
-    trust: import("./tool-safety.js").PoolTrust;
+    /** Resolved: the pool's own `readOnly`, else the deployment's. */
+    readOnly: boolean;
     access: ConnectorAccess;
     grant(identity: Readonly<AuthenticatedIdentity>): boolean | Promise<boolean>;
 }