@zackbart/connecta 0.31.0 → 0.32.0

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to this package are documented here.
 
+## 0.32.0 — 2026-10-14
+
+Connecta 0.32.0 makes each endpoint simply writable or read-only, and lets a deployment keep chosen callers, such as an agent's token, off plain `/mcp` (#820, #821). A deployment can then give an agent one token and per-person pools, and the agent sees only the pool its client picks for each turn.
+
+Every deployment must now choose `readOnly`, and this breaks existing configurations (#822). `readOnly` replaces the pool `trust` setting. The deployment's value applies to `/mcp`, and each pool inherits it unless it sets its own. A deployment that sets neither `readOnly` nor `trust` fails at startup and asks the operator to choose. One that still sets `trust` anywhere fails with a message naming `readOnly`. Replace `trust: "trusted"` with `readOnly: false`, and `trust: "read-only"` with `readOnly: true`. On a read-only endpoint, write tools are left out of search and describe, and every write is refused with `read_only_endpoint` before validation or dispatch, whether it comes from `call_tool`, `call_destructive_tool` or a program. That includes `call_destructive_tool`, which a read-only pool used to allow with host approval. On a writable endpoint, `call_destructive_tool` and programs write, and the MCP client owns approval. Guides are documentation and are not filtered, so a guide may name a tool the endpoint refuses. A deployment that set no `trust` used to let programs read only and allow host-approved direct writes. Choose `readOnly: true` to stop all writes, or `readOnly: false` to let programs write too. A pool that relied on the old read-only default now inherits the deployment's value, so set `readOnly: true` on every pool that must stay read-only. The Node template and Worker example set `readOnly: false`.
+
+A new top-level `grant(identity)` admits callers to plain `/mcp` the way pool grants admit callers to pools (#824). Without it, everyone admitted today is still admitted. Only a literal `true` admits. A refused caller gets the same 404 as a refused or undeclared pool, and can still open any pool whose own grant admits it. Result paging and the operator UI's catalog and config reads apply the same grant, so a refused token cannot read the full catalog through `/ui`. OAuth protected-resource metadata stays public, so MCP clients can still discover where to sign in. Deployments that don't set `grant` need no changes.
+
+`mixpanel()` gains a REST implementation, `via: "api"`, for what the hosted MCP server cannot answer (#825). It covers raw event export with a size bound, one user's activity stream, profile queries, saved Insights and Funnels reports, retention queries and event import. It authenticates with an operator-managed service account, takes `project_id` per call (with optional `defaultProjectId`) and lists the projects the account can reach. Profile updates are left out because Mixpanel's profile endpoint requires the project token, which service-account credentials alone don't provide. The hosted MCP implementation stays the default, so existing Mixpanel configurations are unchanged. A deployment that wants both declares two connections.
+
+The release also adds `excludeApps` to `planningCenter()`, Gmail `get_attachment` and a maintained Wispr Flow provider, and updates the Notion connector to Notion's current limits and errors. CI now runs its checks in parallel, and the redaction tests no longer depend on wall-clock time.
+
+### Added
+
+- Let deployments configure a grant for plain `/mcp`, independently of named pools. Refusals use the same 404 as refused pools, result paging and operator catalog reads respect the grant while OAuth metadata discovery stays public, and the operator UI and configuration snapshot report whether it is configured.
+- Read Gmail attachment text and small binary files with `get_attachment`. Attachment listings now expose immutable `partId` identifiers for reads across rotated download ids and for inline attachments. Binary content uses standard base64 for Drive uploads; downloads and whole results have explicit size limits.
+  
+  Parsed forwarded attachments include their headers and readable body after checking descendant sizes. MIME charset parameters accept whitespace and quoted values, unsupported charsets are reported, and inconsistent attachment byte counts are refused.
+- Let `mixpanel()` use service-account REST APIs with `via: "api"` for reachable projects, bounded raw event export, profile activity and queries, Insights and Funnels reports, retention queries and event import. Existing hosted MCP configurations remain the default. Retention queries cap intervals at 90 only for day units, as Mixpanel documents.
+- `planningCenter()` accepts `excludeApps`, a list of Planning Center products the connection never reaches, such as `["giving"]` for a deployment that keeps agents away from donor and financial data. An excluded product's named tools leave the catalog; the description, usage guide, and version pins stop naming it; and `pco_api_get` and `pco_api_mutate` refuse its paths with `provider_permission_denied` before sending, checked against the exact URL the transport would fetch. While any product is excluded, a hatch path must be literal (no dot segments, empty segments, backslashes, whitespace, or percent-encoded delimiters), and the connection also removes the People list tools and refuses People lists, list results, rules, and conditions by path or `include`, since a list's conditions can draw on any product; refuses webhook event and delivery payloads and any change to an existing webhook subscription; and accepts a new subscription only to a reachable product's event. Any product except People can be excluded; an unknown name or People throws at construction. The default excludes nothing and is unchanged. Exclusion does not hide records copied into a reachable product by the church's automations or staff, such as People workflow cards a Giving automation creates for first-time donors, notes, or custom fields; for a hard boundary, use a personal access token from a user with No Access in the excluded product, since Planning Center sets permissions per product for each user, and treat `excludeApps` as defense in depth.
+- Add a maintained Wispr Flow hosted-MCP provider for OAuth access to Notetaker meetings, Scratchpad notes, calendar events and tasks, with reviewed tool classification and account-specific usage guidance.
+
+### Changed
+
+- Run CI checks in parallel, cancel superseded PR runs, and request snapshot updates explicitly while preserving the full check gate.
+- **Breaking:** Each endpoint is now writable or read-only, set by a plain `readOnly` boolean that replaces pool `trust`. The deployment's `readOnly` sets `/mcp` and is required for this release: a deployment that sets neither `readOnly` nor the removed `trust` fails at startup with a configuration error asking the operator to choose `readOnly: true` or `readOnly: false`. Each pool inherits the deployment value unless it sets its own, in either direction. The client owns approval. A writable endpoint (`false`) behaves as a `trusted` pool did: `call_destructive_tool` and `execute_code` programs write (program writes stay capped by `execute.maxWrites`), `call_tool` still refuses writes, and `execute_code` is annotated `readOnlyHint: false, destructiveHint: true`. On a read-only endpoint (`true`), write tools are absent from `search_tools` results, `connecta.search`, and `connecta.describe`, and every write call through `call_tool`, `call_destructive_tool`, or a program is refused before validation or dispatch with the new code `read_only_endpoint` (`retryable: false`, no `nextAction`); reads still run, and `execute_code` is annotated `readOnlyHint: true, destructiveHint: false`. Guides are documentation and are not filtered: provider `SKILL.md` and usage guides, surfaced through `queryAnalysis.guideSummary`, `skills`, `connecta.skill`, and skill `resources/read`, may still name tools a read-only endpoint refuses. `tools/list` stays six tools on both. Resource reads, grants, `connectorAccess` (including guarded `requireReadOnly` grants), classification, and `execute.maxWrites` are unchanged. `describeConfig()` and the operator UI report `readOnly` instead of `trust`, and programs no longer receive `destructive_tool_requires_approval`, which remains `call_tool`'s refusal of a write on a writable endpoint.
+  
+  To migrate, set `readOnly` explicitly in deployment code and remove every `trust`; a config that still sets `trust`, on the deployment or a pool, fails at construction with a message naming `readOnly`, and one that sets no `readOnly` fails too. Replace `trust: "trusted"` with `readOnly: false`. Replace `trust: "read-only"` with `readOnly: true`, and note that a read-only endpoint now also refuses writes through `call_destructive_tool`; a pool that should still allow host-approved direct writes but no program writes has no equivalent and must choose. A deployment that set no `trust` was read-only for programs and allowed host-approved direct writes; choose `readOnly: true` to keep it from writing at all, or `readOnly: false` to let programs write too. Pools that relied on the old read-only default inherit the deployment value, so set `readOnly: true` on each pool that must stay read-only under a writable deployment. The Node template and Worker example now set `readOnly: false`, and `connecta init` asks operators to choose.
+
+### Fixed
+
+- Make redaction regression tests robust under machine load with CPU scaling, exact output and low-heap checks, without adding production instrumentation.
+- `notion()` over an integration token now splits text longer than Notion's 2,000-character rich-text run limit into consecutive runs in `integration_create_page` and `integration_append_blocks`, instead of sending a request Notion rejects, and refuses text no single value can carry. Failures follow Notion's current contract: a 429 whose reason is `public_api_request_blocked` is no longer retryable, the retry window falls back to the body's `additional_data.retry_after`, a 403 names the workspace block limit, a 5xx on a write that Notion reports as committed names the created object or appended blocks so the caller reads them instead of repeating the write, and a 5xx on a write that carries Notion's `retry_guidance` relays it, unless the operation withholds Notion's error text, and is not retryable. A data source query stopped at Notion's 10,000-result cap reports `incomplete: true` from `integration_query_data_source` and `page.hasMore` without `page.next` from the generic read. Projections name native Notion icons and custom emoji and read an `unsupported` formula or rollup value as `null`. The OAuth connector classifies `notion-ai-search`, `notion-get-self`, `notion-get-tool-access`, and `notion-download-skill` as reads. The guide routes whole-page reads and Markdown writes through the page Markdown endpoints.
+
 ## 0.31.0 — 2026-10-09
 
 Connecta 0.31.0 lets the auth mode choose how Stripe, Notion, Cloudflare and Vercel connect (#801). `auth: { type: "oauth" }` connects the vendor's hosted MCP server, OAuth only. A key connects Connecta's own REST connector with an operator-managed credential: Stripe `apiKey`, Notion `token`, Cloudflare `apiToken` or `globalApiKey`, and Vercel `token`. Each implementation is now complete on its own. This replaces the 0.29 split, in which the hosted server owned writes and the REST surface refused them, so a Cloudflare API token could not change a DNS record. Decision record 0005 explains the choice. Deployments that use none of these four providers need no changes.

package/README.md

@@ -65,7 +65,7 @@ across them in one task. Changing your connected services does not require
 changing the agent's connection. Your deployment decides which services and
 operations each caller can reach.
 
-Connecta includes maintained connections for <!-- providers:start -->Basecamp, Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Infisical, Linear, Mixpanel, Notion, Overflow, Planning Center, RevenueCat, Stripe, Tithe.ly, and Vercel<!-- providers:end -->.
+Connecta includes maintained connections for <!-- providers:start -->Basecamp, Breeze ChMS, Church Community Builder, Cloudflare, GitHub, Gmail, Google Docs, Google Drive, Google Forms, Google Sheets, Google Slides, Infisical, Linear, Mixpanel, Notion, Overflow, Planning Center, RevenueCat, Stripe, Tithe.ly, Vercel, and Wispr Flow<!-- providers:end -->.
 Each connection has its own setup guide.
 Stripe, Notion, Cloudflare, and Vercel use their hosted MCP servers when you
 sign in with OAuth, and Connecta's own API connections when you use an API key,
@@ -76,8 +76,9 @@ HTTP API.
 
 Google Workspace connections use the account your deployment assigns to each
 signed-in person. A Workspace administrator authorizes them for your domain.
-Gmail reads mail and writes drafts, but does not send mail. Google Drive can
-read, write, and share files, but does not permanently delete them. Available
+Gmail reads mail and attachments and writes drafts, but does not send mail.
+Google Drive can read, write, and share files, but does not permanently delete
+them. Available
 operations and account access depend on the integration and your deployment.
 
 Large results need not fill the conversation. The agent can filter and
@@ -85,19 +86,20 @@ summarize them in its program, or read a large result in smaller pieces.
 
 ## Writes, credentials, and access
 
-Connecta distinguishes reads from writes. By default, programs can read, and
-each change uses a separate visible tool call. Your agent's host controls
-whether it asks for approval. You can explicitly allow programs to make
-changes too; the host then sees the program tool as a write. This choice does
-not give a caller access to additional services.
+Connecta distinguishes reads from writes, and each endpoint is either writable
+or read-only. By default an endpoint is writable: your agent can make a change
+with one visible tool call or inside a program, and your agent's host decides
+whether to ask for approval; it sees the program tool as a write. You can mark
+the whole deployment or a single endpoint read-only, and then nothing there can
+change anything: search leaves write tools out and every write is refused. You
+make this choice explicitly for each deployment. Neither choice gives a caller
+access to additional services.
 
 ```mermaid
 flowchart TB
-    Change["Your agent wants to change something"] --> Choice{"Are programs allowed<br/>to make changes?"}
-    Choice -->|"Default: no"| Separate["A separate visible call for each change"]
-    Choice -->|"Explicit choice: yes"| Program["A program that can make changes"]
-    Separate --> Host["Your agent's host handles approval"]
-    Program --> Host
+    Change["Your agent wants to change something"] --> Choice{"Is this endpoint<br/>read-only?"}
+    Choice -->|"Explicit choice: yes"| Refused["Refused; nothing is sent"]
+    Choice -->|"Default: no"| Host["Your agent's host handles approval"]
     Host --> Access["Connecta checks the caller's access"]
     Access --> Services["The connected service receives the change"]
 

package/bin/connecta.mjs

@@ -77,6 +77,7 @@ async function init() {
   console.log("Next:");
   console.log(`  ${shellCd(target)}`);
   console.log("  npm install");
+  console.log("  # Choose readOnly in src/connecta.config.ts: false writes with client approval, true refuses writes.");
   console.log('  npm run --silent provision-token -- "local-machine"');
   console.log("  # Save the returned cta_ token privately for your MCP client and doctor.");
   console.log("  npm start");

package/bin/version.mjs

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.31.0";
+export const CONNECTA_VERSION = "0.32.0";

package/dist/auth-elicitation.js

@@ -148,7 +148,7 @@ export class AuthElicitation {
                 requestSignal: AbortSignal.any([context.mcpReq.signal, this.options.requestSignal]),
             });
             // Recheck every entered read before restarting any part of a program.
-            // A trusted pool cannot authorize replay of a newly classified write.
+            // A writable endpoint cannot authorize replay of a newly classified write.
             for (const read of previous.reads) {
                 const current = await catalog.resolveTool(read.address, { signal: context.mcpReq.signal });
                 if (!current.ok ||

package/dist/catalog-service.js

@@ -377,6 +377,7 @@ export class CatalogService {
     concurrency;
     searchRoute;
     requestSignal;
+    readOnly;
     // The request-scoped catalog cache: one shared read per connector asked
     // about, started by the first asker and joined by every later one. A
     // success stays for the rest of the request, so a search and the call after
@@ -401,6 +402,7 @@ export class CatalogService {
         this.searchRoute = options.searchRoute ?? "search_tools";
         this.requestSignal = options.requestSignal;
         this.defer = options.defer;
+        this.readOnly = options.readOnly === true;
     }
     /**
      * Send a caller back to discovery through the surface it can actually reach.
@@ -460,9 +462,12 @@ export class CatalogService {
     // each settling in its input slot: an unavailable catalog is a Failure
     // there, not a failed discovery. `route` names the surface in a timeout.
     // A probe also ends with its request, so no listing outlives the caller
-    // that asked for it.
+    // that asked for it. On a read-only endpoint a write is absent from search
+    // and describe, as if the connector never had it. Guides are not filtered.
     discoveryCatalogs(ids, route) {
-        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.catalog(id, { signal }), {
+        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.readOnly
+            ? Effect.map(this.catalog(id, { signal }), (tools) => tools.filter((tool) => tool.classification === "read"))
+            : this.catalog(id, { signal }), {
             ...(this.requestSignal ? { signal: this.requestSignal } : {}),
             timeoutMs: this.probeTimeoutMs,
             timeoutError: new ConnectorCallError("timeout", `${route} probe of "${id}" timed out after ${this.probeTimeoutMs}ms`),

package/dist/config-value-sources.js

@@ -56,8 +56,10 @@ export function describeConfigSources(snapshot, raw) {
             source = provided(raw.serverInfo?.[key]);
         else if (group === "urls")
             source = key === "mcpPath" ? "default" : provided(raw[key]);
-        else if (group === "trust")
-            source = provided(raw.trust);
+        else if (group === "hasGrant")
+            source = provided(raw.grant);
+        else if (group === "readOnly")
+            source = provided(raw.readOnly);
         else if (group === "identity")
             source = provided(raw.identity?.[key]);
         else if (group === "storage")
@@ -67,7 +69,8 @@ export function describeConfigSources(snapshot, raw) {
         else if (group === "classification")
             source = provided(raw.classification);
         else if (group === "pools")
-            source = field === "trust" ? provided(raw.pools?.[key]?.trust) : provided(raw.pools);
+            // An inherited value comes from wherever the deployment's came from.
+            source = field === "readOnly" ? provided(raw.pools?.[key]?.readOnly ?? raw.readOnly) : provided(raw.pools);
         else if (group === "modules") {
             const module = key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens;
             const factory = moduleSources[key];

package/dist/config.d.ts

@@ -76,7 +76,7 @@ declare const execute: {
      */
     watchdogMs: import("./config-schema.js").Field<number, number, true>;
     /**
-     * Trusted-pool writes one program may send, on top of the host-call
+     * Writes one program may send on a writable endpoint, on top of the host-call
      * budget every call already spends. Default 10.
      */
     maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -183,8 +183,13 @@ declare const identity: {
     personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
 };
 declare const pool: {
-    /** Programs may write only in trusted pools. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
+    /**
+     * Whether this pool's endpoint refuses every write: write tools are absent
+     * from search_tools, tool listings, and describe, and every write call is
+     * refused. Inherits the deployment's `readOnly` unless set here, in either
+     * direction.
+     */
+    readOnly: import("./config-schema.js").Field<boolean, boolean | undefined, true>;
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: import("./config-schema.js").Field<readonly string[], readonly string[], false>;
     /**
@@ -233,18 +238,22 @@ declare const connectaConfig: {
             personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
         };
     };
+    /**
+     * Whether this admitted identity may open plain `/mcp`. Omitted admits
+     * everyone; only literal true admits when configured. Other returns and
+     * throws receive the same 404 as a refused or undeclared pool.
+     */
+    grant: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
     /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
     pools: import("./config-schema.js").Field<Record<string, {
-        trust?: "trusted" | "read-only" | undefined;
+        readOnly?: boolean | undefined;
         grant?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
         tools: readonly string[];
     }>, Readonly<Record<string, {
-        readonly trust: "trusted" | "read-only";
+        readonly readOnly: boolean | undefined;
         readonly tools: readonly string[];
         readonly grant: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
     }>> | undefined, true>;
-    /** Trust of the default /mcp endpoint. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: import("./config-schema.js").Field<Record<string, Record<string, "read" | "write">>, Readonly<Record<string, Readonly<Record<string, "read" | "write">>>> | undefined, true>;
     /**
@@ -394,7 +403,7 @@ declare const connectaConfig: {
              */
             watchdogMs: import("./config-schema.js").Field<number, number, true>;
             /**
-             * Trusted-pool writes one program may send, on top of the host-call
+             * Writes one program may send on a writable endpoint, on top of the host-call
              * budget every call already spends. Default 10.
              */
             maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -548,6 +557,15 @@ declare const connectaConfig: {
      * `customExecutor(myExecutor, { lifecycle: "self-managed" })`.
      */
     executor: import("./config-schema.js").Field<Executor, Executor, false>;
+    /**
+     * Required. Whether the default /mcp endpoint refuses every write. `true`:
+     * write tools are absent from search_tools, tool listings, and describe,
+     * and call_tool, call_destructive_tool, and program writes are refused.
+     * `false`: call_destructive_tool and programs may write, and the MCP
+     * client owns approval. Pools inherit it unless they set their own. It has
+     * no default while deployments migrate from `trust` (#820).
+     */
+    readOnly: import("./config-schema.js").Field<boolean, boolean, false>;
 };
 /** A deployment's whole configuration, passed to `createConnecta`. */
 export type ConnectaConfig = ConfigInput<typeof connectaConfig>;

package/dist/config.js

@@ -134,7 +134,7 @@ const execute = {
      */
     watchdogMs: whole({ min: 1, default: D.execute.watchdogMs }),
     /**
-     * Trusted-pool writes one program may send, on top of the host-call
+     * Writes one program may send on a writable endpoint, on top of the host-call
      * budget every call already spends. Default 10.
      */
     maxWrites: whole({ min: 1, default: D.execute.maxWrites }),
@@ -195,17 +195,21 @@ const identity = {
     /** Connecting or changing the caller's personal account. Defaults to none. */
     personalConnection: fn(),
 };
-const trust = () => opaque({
-    check: (value, path) => {
-        if (value !== "trusted" && value !== "read-only") {
-            throw new ConfigError(`${path} must be "trusted" or "read-only".`);
-        }
-    },
-    resolve: (value) => value ?? "read-only",
-});
+/** The choice every deployment makes explicitly while `trust` migrates (#820). */
+const READ_ONLY_REQUIRED = (path) => `${path} is required. Choose readOnly: true to refuse every write on /mcp, or readOnly: false to let ` +
+    "call_destructive_tool and programs write with MCP client approval. Pools inherit it unless they set their own.";
+function assertFlag(value, path) {
+    if (typeof value !== "boolean")
+        throw new ConfigError(`${path} must be true or false.`);
+}
 const pool = {
-    /** Programs may write only in trusted pools. Default read-only. */
-    trust: trust(),
+    /**
+     * Whether this pool's endpoint refuses every write: write tools are absent
+     * from search_tools, tool listings, and describe, and every write call is
+     * refused. Inherits the deployment's `readOnly` unless set here, in either
+     * direction.
+     */
+    readOnly: opaque({ check: assertFlag }),
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: required(opaque({
         check: (value, path) => {
@@ -240,7 +244,7 @@ const connectaConfig = {
     connectors: required(array(opaque({
         check: (value, path) => {
             if (isObject(value) && Object.hasOwn(value, "approval")) {
-                throw new ConfigError(`${path}.approval was removed; configure pool trust instead.`);
+                throw new ConfigError(`${path}.approval was removed; the MCP client owns approval. Set readOnly: true to refuse writes.`);
             }
             if (!isObject(value) ||
                 typeof value.id !== "string" ||
@@ -274,10 +278,14 @@ const connectaConfig = {
     }),
     /** Code-derived connection visibility and independent management permissions. */
     identity: object(identity),
+    /**
+     * Whether this admitted identity may open plain `/mcp`. Omitted admits
+     * everyone; only literal true admits when configured. Other returns and
+     * throws receive the same 404 as a refused or undeclared pool.
+     */
+    grant: fn(),
     /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
     pools: record(object(pool)),
-    /** Trust of the default /mcp endpoint. Default read-only. */
-    trust: trust(),
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: record(record(opaque({
         check: (value, path) => {
@@ -415,10 +423,21 @@ const connectaConfig = {
         '"@zackbart/connecta/quickjs" on Node, or ' +
         "workerExecutor({ loader: env.LOADER }) from " +
         '"@zackbart/connecta/worker" around DynamicWorkerExecutor on Workers.'),
+    /**
+     * Required. Whether the default /mcp endpoint refuses every write. `true`:
+     * write tools are absent from search_tools, tool listings, and describe,
+     * and call_tool, call_destructive_tool, and program writes are refused.
+     * `false`: call_destructive_tool and programs may write, and the MCP
+     * client owns approval. Pools inherit it unless they set their own. It has
+     * no default while deployments migrate from `trust` (#820).
+     */
+    readOnly: required(opaque({ check: assertFlag }), (path) => READ_ONLY_REQUIRED(path)),
 };
 const CONFIG = object(connectaConfig);
 /** Pause-only options #672 removed with `resume_execution`. */
 const RETIRED_PAUSE_OPTIONS = ["ConnectaConfig.execute.resumableWrites", "ConnectaConfig.execute.pausedRunTtlSeconds"];
+/** `trust`, on the deployment or a pool, was replaced by `readOnly` (#820). */
+const isRetiredTrust = (path) => path === "ConnectaConfig.trust" || (path.startsWith("ConnectaConfig.pools.") && path.endsWith(".trust"));
 function rejectUnknownOptions(paths) {
     if (paths.length === 0)
         return;
@@ -431,10 +450,13 @@ function rejectUnknownOptions(paths) {
             ? "\nMove branding into ui: operatorUi({ branding }) from @zackbart/connecta/ui."
             : "") +
         (paths.includes("ConnectaConfig.execute.approval")
-            ? '\nexecute.approval was removed. Set trust: "trusted" on a pool to allow program writes; the default is read-only.'
+            ? "\nexecute.approval was removed. The MCP client owns approval; set readOnly: true on the deployment or a pool to refuse writes."
             : "") +
         (paths.some((path) => RETIRED_PAUSE_OPTIONS.includes(path))
-            ? "\nPrograms no longer pause at writes, so there is nothing to configure: read-only pools route writes through call_destructive_tool; trusted pools allow program writes (issue #672). Delete the option."
+            ? "\nPrograms no longer pause at writes, so there is nothing to configure: writable endpoints let programs and call_destructive_tool write; readOnly endpoints refuse every write (issue #672). Delete the option."
+            : "") +
+        (paths.some(isRetiredTrust)
+            ? '\ntrust was removed (#820); set readOnly, which every deployment now chooses explicitly. trust: "read-only" becomes readOnly: true, which now also refuses call_destructive_tool. trust: "trusted" becomes readOnly: false. A pool inherits the deployment readOnly unless it sets its own.'
             : ""));
 }
 /** Checks that span fields; each value is already individually valid. */

package/dist/connector-access.d.ts

@@ -2,7 +2,8 @@ import type { ToolAccess } from "./registry.js";
 import type { AuthenticatedIdentity } from "./types.js";
 /** A declared pool after construction-time validation. */
 export interface ResolvedPool {
-    trust: import("./tool-safety.js").PoolTrust;
+    /** Resolved: the pool's own `readOnly`, else the deployment's. */
+    readOnly: boolean;
     access: ConnectorAccess;
     grant(identity: Readonly<AuthenticatedIdentity>): boolean | Promise<boolean>;
 }

package/dist/connectors/guarded-fetch.d.ts

@@ -56,6 +56,8 @@ interface GuardedResponse {
     readonly status: number;
     readonly ok: boolean;
     readonly headers: Headers;
+    /** Cancel an unread body without waiting for the vendor to emit a chunk. */
+    cancel(): Promise<void>;
     /** The body as bytes. */
     bytes(): Promise<Uint8Array>;
     /** The body decoded as UTF-8. */
@@ -124,6 +126,13 @@ export interface GuardedFetchOptions {
      * absurd response is a fact about the API, not about HTTP.
      */
     maxResponseBytes: number;
+    /**
+     * Inspect the exact URL about to be fetched — confined, normalized, with its
+     * query encoded — and throw to refuse it. A policy that reads this URL reads
+     * what the downstream server will route, not a spelling of it. Runs before
+     * authentication, so a refused request never resolves a credential.
+     */
+    admit?: (url: URL, request: GuardedRequest) => void;
 }
 /** Sends one already-guarded request on behalf of one call's context. */
 type GuardedFetcher = (url: string, init: RequestInit, ctx: ConnectorContext) => Promise<Response>;

package/dist/connectors/guarded-fetch.js

@@ -181,6 +181,9 @@ function boundedResponse(provider, response, limit) {
             status: response.status,
             ok: response.ok,
             headers: response.headers,
+            cancel: async () => {
+                await response.body?.cancel();
+            },
             bytes: async () => new Uint8Array(),
             text: async () => "",
             json: emptyJson,
@@ -228,6 +231,9 @@ function boundedResponse(provider, response, limit) {
         status: response.status,
         ok: response.ok,
         headers: response.headers,
+        cancel: async () => {
+            await response.body?.cancel();
+        },
         bytes,
         text,
         json,
@@ -307,6 +313,7 @@ export function guardedFetch(options) {
             throw new Error(`A ${provider} request cannot carry both a JSON body and a raw body.`);
         }
         const url = confinedUrl(provider, base, basePath, request);
+        options.admit?.(url, request);
         const headers = { ...constantHeaders };
         for (const [name, value] of Object.entries(request.headers ?? {})) {
             if (value !== undefined)

package/dist/describe-config.d.ts

@@ -86,8 +86,10 @@ export interface ConnectaConfigDescription {
         execute: Record<keyof typeof CONFIG_DEFAULTS.execute, DescribedLimit>;
         requests: Record<keyof typeof CONFIG_DEFAULTS.admission.requests, DescribedLimit>;
     };
-    /** Trust and exact classification overrides from deployment code. */
-    trust: "trusted" | "read-only";
+    /** Whether the default /mcp endpoint refuses every write, and exact classification overrides from deployment code. */
+    readOnly: boolean;
+    /** Whether deployment code configures a grant for plain `/mcp`. */
+    hasGrant: boolean;
     classification: Record<string, Record<string, "read" | "write">>;
     /** Inbound auth providers in the order they are tried. */
     auth: Array<{
@@ -96,12 +98,13 @@ export interface ConnectaConfigDescription {
         ui?: string;
     }>;
     identity: Record<"connectorAccess" | "activityAccess" | "credentialAdministration" | "accessTokenManagement" | "personalConnection", "default" | "custom">;
+    /** `readOnly` is resolved: the pool's own value, else the deployment's. */
     pools: Array<{
         name: string;
         path: string;
         tools: string[];
         hasGrant: boolean;
-        trust: "trusted" | "read-only";
+        readOnly: boolean;
     }>;
     modules: {
         ui: {

package/dist/describe-config.js

@@ -240,7 +240,8 @@ export function describeConfig(input) {
             execute: limitGroup(config.execute, ownValue(raw, "execute"), Object.keys(D.execute)),
             requests: limitGroup(config.admission.requests, ownValue(ownValue(raw, "admission"), "requests"), Object.keys(D.admission.requests)),
         },
-        trust: config.trust,
+        readOnly: config.readOnly,
+        hasGrant: typeof config.grant === "function",
         classification: structuredClone(config.classification ?? {}),
         auth: config.auth.map((provider) => ({
             kind: String(provider.kind),
@@ -249,7 +250,7 @@ export function describeConfig(input) {
         })),
         identity: Object.fromEntries(IDENTITY_KEYS.map((key) => [key, typeof config.identity[key] === "function" ? "custom" : "default"])),
         pools: Object.entries(config.pools ?? {}).map(([name, pool]) => ({
-            trust: pool.trust,
+            readOnly: pool.readOnly ?? config.readOnly,
             name,
             path: `/mcp/${name}`,
             tools: pool.tools.map(String),

package/dist/errors.d.ts

@@ -33,7 +33,7 @@ export type ConnectorCallErrorCode = "timeout" | "auth_required" | "downstream_o
  * Adding a member fails typecheck until {@link CLASSIFICATION_CODE_TABLE}
  * lists it.
  */
-export type ClassificationCode = ConnectorCallErrorCode | ExecutorAdmissionErrorCode | "cancelled" | "unknown_address" | "unknown_tool" | "ambiguous_tool_alias" | "catalog_lookup_failed" | "result_too_large" | "destructive_tool_requires_approval" | "auth_replay_refused" | "write_outcome_unknown" | "result_processing_failed" | "budget_exceeded" | "executor_failed" | "program_error";
+export type ClassificationCode = ConnectorCallErrorCode | ExecutorAdmissionErrorCode | "cancelled" | "unknown_address" | "unknown_tool" | "ambiguous_tool_alias" | "catalog_lookup_failed" | "result_too_large" | "destructive_tool_requires_approval" | "read_only_endpoint" | "auth_replay_refused" | "write_outcome_unknown" | "result_processing_failed" | "budget_exceeded" | "executor_failed" | "program_error";
 /** `value` when it is a code connecta assigns, else undefined. */
 export declare function classificationCode(value: unknown): ClassificationCode | undefined;
 /** One bounded, payload-free explanation of an input-schema mismatch. */

package/dist/errors.js

@@ -28,6 +28,7 @@ const CLASSIFICATION_CODE_TABLE = {
     catalog_lookup_failed: true,
     result_too_large: true,
     destructive_tool_requires_approval: true,
+    read_only_endpoint: true,
     auth_replay_refused: true,
     write_outcome_unknown: true,
     result_processing_failed: true,

package/dist/execute.js

@@ -412,6 +412,8 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
     const catalog = new CatalogService(registry, baseUrl, {
         requestScope,
         requestSignal: hostAccessSignal,
+        // connecta.search and connecta.describe never show a read-only endpoint's writes.
+        readOnly: limits.readOnly,
         // A program that just missed an address cannot call search_tools.
         searchRoute: "connecta.search",
         concurrency: limits.discoveryConcurrency,
@@ -455,7 +457,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
         }
         return value;
     };
-    /** Budget and account for writes admitted by the pool trust decision. */
+    /** Budget and account for writes a writable endpoint admits. */
     const invocationContext = (sending, timeoutMs) => ({
         source: "execute_code",
         sentSecrets,
@@ -463,9 +465,9 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
         ...(signal !== undefined ? { requestSignal: signal } : {}),
         ...(limits.dispatchController ? { dispatchSignal: limits.dispatchController.signal } : {}),
         unwrapResult: true,
-        trust: limits.trust,
+        readOnly: limits.readOnly,
         processResult: async (value, resolved, secrets, format, raw) => {
-            const page = (data, valueFormat, wireBytes) => pageProgramResult(registry, baseUrl, resolved, data, valueFormat, secrets, limits.trust, requestScope, wireBytes);
+            const page = (data, valueFormat, wireBytes) => pageProgramResult(registry, baseUrl, resolved, data, valueFormat, secrets, requestScope, wireBytes);
             const envelope = resolved.connector.kind === "mcp" && raw !== null && typeof raw === "object"
                 ? raw
                 : undefined;
@@ -605,7 +607,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
             normalizeTimeoutMs(limits.defaultToolTimeoutMs) ??
             hostCallTimeoutMs;
         const timeoutMs = Math.min(requestedMs, Math.max(1, (limits.programDeadlineAt ?? Infinity) - Date.now()));
-        // A trusted-pool write settles here — unknown if the call never returned an
+        // A program write settles here — unknown if the call never returned an
         // outcome. Credentials are filtered from arguments; submitted private values are not.
         const sending = {};
         const outcome = yield* invocation
@@ -656,7 +658,7 @@ function sandboxProvider(registry, baseUrl, activity, limits, requestScope = {})
                 : Effect.raceAllFirst([reading, fromSignal(hostAccessSignal).pipe(Effect.mapError(cancelled))])).pipe(Effect.onExit((exit) => Effect.sync(() => diagnostics?.recordCatalog(operation, Date.now() - started, Exit.isSuccess(exit), Exit.isSuccess(exit) ? exit.value : undefined))));
     });
     const meta = createMetaTools(registry, baseUrl, {
-        trust: limits.trust,
+        readOnly: limits.readOnly,
         requestScope,
         onResultRead: (dependencies) => limits.resultDependencies?.push(...dependencies),
     });
@@ -1077,7 +1079,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 defaultToolTimeoutMs: config.defaultToolTimeoutMs,
                 programDeadlineAt: Date.now() + watchdog.ms,
                 defer: config.defer,
-                trust: config.trust,
+                readOnly: config.readOnly,
                 maxWrites: config.maxWrites,
                 programWrites,
                 resultDependencies,
@@ -1087,7 +1089,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
                 return yield* Effect.fail(new ExecutorAdmissionError("executor_cancelled", "Execution was cancelled during sandbox setup."));
             }
             const admitted = lease;
-            // A trusted-pool write may still be on the wire when the program settles:
+            // A program write may still be on the wire when the program settles:
             // close, so a write gated after this is not sent, then let the ones
             // already dispatched finish before the scope aborts them — an
             // abandoned write would be one whose outcome nobody knows.
@@ -1114,7 +1116,7 @@ export function createExecuteTool(registry, baseUrl, executor, logger, activity,
             emitted,
             diagnostics,
             program,
-            guardResult: (value, maxChars) => guardProgramReturn(value, registry, baseUrl, [...new Map(resultDependencies.map((dependency) => [JSON.stringify(dependency), dependency])).values()], sentSecrets, config.trust, logger, maxChars, programWrites.hasSucceeded),
+            guardResult: (value, maxChars) => guardProgramReturn(value, registry, baseUrl, [...new Map(resultDependencies.map((dependency) => [JSON.stringify(dependency), dependency])).values()], sentSecrets, logger, maxChars, programWrites.hasSucceeded),
         };
         const exited = Effect.exit(Effect.scoped(run)).pipe(Effect.flatMap((exit) => 
         // Releasing a QuickJS lease ends its child and rejects execute() with
@@ -1336,7 +1338,7 @@ function connectorInventory(connectors) {
         return `${prefix}${shown.join(", ")}.`;
     return `${prefix}${shown.join(", ")}${shown.length > 0 ? "; " : ""}+${omitted} more.`;
 }
-const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, trust) => `One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. ${trust === "trusted" ? "Trusted pool: programs may read and write; the host approves the program as a write." : "Read-only pool: programs read; writes use call_destructive_tool."} Limits: ${hostLimits.maxHostCalls} host calls, ${maxWrites} writes, ${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
+const executeDescription = (emitBudgets, hostLimits, connectorGuides, connectors, maxWrites, readOnly) => `${readOnly ? "One known read: call_tool. Everything else: execute_code. Read-only endpoint: search and describe omit write tools, and every write call is refused." : "One known read: call_tool. One known write: call_destructive_tool. Everything else: execute_code. Writable endpoint: programs may read and write; the client approves."} Limits: ${hostLimits.maxHostCalls} host calls, ${readOnly ? "" : `${maxWrites} writes, `}${hostLimits.hostCallTimeoutMs / 1_000}s/host call.
 ${connectorInventory(connectors)}
 
 Use async () => { ... }, no arguments. No portable ambient capabilities. API:
@@ -1383,7 +1385,7 @@ export function registerExecuteTool(server, registry, ctx) {
         hostCallTimeoutMs: hostLimits.hostCallTimeoutMs,
         watchdogMs: ctx.watchdogMs,
         defer: ctx.defer,
-        trust: ctx.trust,
+        readOnly: ctx.readOnly,
         maxWrites,
         requestScope: ctx.requestScope,
     });
@@ -1391,13 +1393,13 @@ export function registerExecuteTool(server, registry, ctx) {
         description: executeDescription(emitBudgets, {
             ...hostLimits,
             hostCallTimeoutMs: normalizeTimeoutMs(ctx.defaultToolTimeoutMs) ?? hostLimits.hostCallTimeoutMs,
-        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.trust ?? "read-only"),
+        }, hasConnectorGuides(connectors), connectors, maxWrites, ctx.readOnly === true),
         inputSchema: EXECUTE_INPUT,
         outputSchema: EXECUTE_OUTPUT,
-        // The host sees execute_code as a write only on a trusted endpoint.
+        // The client sees execute_code as a write exactly when the endpoint writes.
         annotations: {
-            readOnlyHint: ctx.trust !== "trusted",
-            destructiveHint: ctx.trust === "trusted",
+            readOnlyHint: ctx.readOnly === true,
+            destructiveHint: ctx.readOnly !== true,
             openWorldHint: true,
         },
     }, (args, extra) => {