@zackbart/connecta 0.31.0 → 0.33.0

package/dist/agent-identity.js

@@ -0,0 +1,47 @@
+// Code-declared agents (#837): the names deployment code lists in `agents`,
+// the identity an admitted agent carries, and the one provider trusted to
+// assert it. Pure, so core reads it without reaching the token module.
+import { ConfigError } from "./config-schema.js";
+/** Agent names: lowercase letters, digits, `_` and `-`. */
+const AGENT_NAME_RE = /^[a-z0-9_-]+$/u;
+/** Longest accepted agent name, so a name always fits a storage key. */
+const MAX_AGENT_NAME_LENGTH = 64;
+/** Directory namespace of agent subjects and activity actors. */
+export const AGENT_NAMESPACE = "connecta:access-tokens:v1";
+/** Whether `value` is an acceptable agent name. */
+export function isAgentName(value) {
+    return typeof value === "string" && value.length <= MAX_AGENT_NAME_LENGTH && AGENT_NAME_RE.test(value);
+}
+/**
+ * The subject id that partitions an agent's per-caller state, such as result
+ * handles. The `agent:` prefix keeps it apart from the UUID subjects older
+ * tokens used in the same namespace.
+ */
+export function agentSubjectId(name) {
+    return `agent:${name}`;
+}
+/** Validate a declared agent list: an array of unique, well-formed names. */
+export function assertAgentNames(value, path) {
+    if (!Array.isArray(value))
+        throw new ConfigError(`${path} must be an array of agent names.`);
+    const seen = new Set();
+    value.forEach((name, index) => {
+        if (!isAgentName(name)) {
+            throw new ConfigError(`${path}[${index}] must be an agent name: 1 to ${MAX_AGENT_NAME_LENGTH} characters of ` +
+                "lowercase letters, digits, _ and -.");
+        }
+        if (seen.has(name))
+            throw new ConfigError(`${path}[${index}] repeats the agent name "${name}".`);
+        seen.add(name);
+    });
+}
+const agentProviders = new WeakSet();
+/** Mark the built-in access-token adapter as the one provider whose `agent` is trusted. */
+export function trustAgentProvider(provider) {
+    agentProviders.add(provider);
+    return provider;
+}
+/** Whether `provider` is the built-in access-token adapter. */
+export function assertsAgents(provider) {
+    return agentProviders.has(provider);
+}

package/dist/auth/cloudflare-access.js

@@ -1,3 +1,4 @@
+import { withDeadline } from "../timeout.js";
 import { authorizationCredential } from "../inbound-credential.js";
 import { validIdentityReference } from "../identity.js";
 function identityString(identity, field) {
@@ -9,7 +10,7 @@ function identityString(identity, field) {
 function unauthorized() {
     return {
         ok: false,
-        response: Response.json({ error: "Cloudflare Access authentication required" }, { status: 401, headers: { "WWW-Authenticate": 'Bearer scope="openid email"' } }),
+        response: Response.json({ error: "Cloudflare Access authentication required" }, { status: 401, headers: { "WWW-Authenticate": 'Bearer scope="openid email"', "Cache-Control": "no-store" } }),
     };
 }
 /**
@@ -34,17 +35,24 @@ export function cloudflareAccessAuth() {
                 return unauthorized();
             let identity;
             try {
-                identity = await access.getIdentity();
+                identity = await withDeadline(() => access.getIdentity(), {
+                    timeoutMs: 5000,
+                    signal: request.signal,
+                    timeoutError: new Error("Access identity lookup timed out"),
+                });
             }
             catch {
-                return unauthorized();
+                return {
+                    ok: false,
+                    response: Response.json({ error: "Cloudflare Access identity unavailable", problem: "identity_unavailable" }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }),
+                };
             }
             // Access binds ctx.access.aud to its Worker application at the edge.
             // Service credentials can pass that edge, but connecta machines must
             // present a cta_ token to the machine provider instead.
             const forbidden = () => ({
                 ok: false,
-                response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403 }),
+                response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
             });
             if (!identity || typeof identity !== "object" || Array.isArray(identity))
                 return forbidden();
@@ -56,7 +64,7 @@ export function cloudflareAccessAuth() {
             if (!userId) {
                 return {
                     ok: false,
-                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403 }),
+                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
                 };
             }
             return { ok: true, userId, subjectId: userId };

package/dist/auth-elicitation.js

@@ -148,7 +148,7 @@ export class AuthElicitation {
                 requestSignal: AbortSignal.any([context.mcpReq.signal, this.options.requestSignal]),
             });
             // Recheck every entered read before restarting any part of a program.
-            // A trusted pool cannot authorize replay of a newly classified write.
+            // A writable endpoint cannot authorize replay of a newly classified write.
             for (const read of previous.reads) {
                 const current = await catalog.resolveTool(read.address, { signal: context.mcpReq.signal });
                 if (!current.ok ||

package/dist/call-admission-context.js

@@ -0,0 +1,15 @@
+import { chargeCallBudget } from "./runtime/call-admission.js";
+import { runEdge } from "./runtime/run.js";
+const permits = new WeakMap();
+export function attachCallAdmission(ctx, permit) {
+    permits.set(ctx, permit);
+}
+/**
+ * Charge one sequential auxiliary request using the enclosing concurrency slot.
+ * Await before dispatch and propagate refusal. Contexts outside an invocation
+ * have no registry policy to charge.
+ */
+export function chargeConnectorCall(ctx) {
+    const permit = permits.get(ctx);
+    return permit ? runEdge(chargeCallBudget(permit, ctx.signal)) : Promise.resolve();
+}

package/dist/call-admission.js

@@ -1,6 +1,7 @@
 import { Deferred, Duration, Effect } from "effect";
+import { CALL_ADMISSION } from "./provider.js";
 import { ConnectorCallError } from "./errors.js";
-import { provideCallAdmissionProgram, startCallAdmission } from "./runtime/call-admission.js";
+import { provideCallAdmissionProgram, provideCallBudgetCharge, startCallAdmission } from "./runtime/call-admission.js";
 import { fromSignal, runEdge } from "./runtime/run.js";
 const DEFAULT_MAX_QUEUE_SIZE = 32;
 const DEFAULT_QUEUE_TIMEOUT_MS = 5_000;
@@ -50,18 +51,6 @@ export function aggregateCallAdmissionSnapshots(snapshots) {
     }
     return aggregate;
 }
-function positiveWhole(value, name) {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1) {
-        throw new TypeError(`${name} must be a positive whole number.`);
-    }
-    return value;
-}
-function nonNegativeWhole(value, name) {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-        throw new TypeError(`${name} must be a non-negative whole number.`);
-    }
-    return value;
-}
 /**
  * Per-runtime, per-connector call admission. State contains only bounded
  * partition keys, counters, timestamps, signals, and promise continuations;
@@ -88,36 +77,14 @@ export class ConnectorCallAdmissionController {
     queueWaitMaxMs = 0;
     constructor(connectorId, policy) {
         this.connectorId = connectorId;
-        if (!Array.isArray(policy.rules) || policy.rules.length !== 1) {
-            throw new TypeError(`connector "${connectorId}" callAdmission.rules must contain exactly one rule in this release.`);
-        }
+        policy = CALL_ADMISSION.parse(policy, `connector "${connectorId}" callAdmission`);
         const rule = policy.rules[0];
-        if (rule.maxConcurrency === undefined && rule.budget === undefined) {
-            throw new TypeError(`connector "${connectorId}" callAdmission rule must declare maxConcurrency or budget.`);
-        }
-        this.maxConcurrency =
-            rule.maxConcurrency === undefined
-                ? undefined
-                : positiveWhole(rule.maxConcurrency, `connector "${connectorId}" callAdmission maxConcurrency`);
-        if (this.maxConcurrency === undefined &&
-            (rule.maxQueueSize !== undefined || rule.queueTimeoutMs !== undefined || rule.retryAfterMs !== undefined)) {
-            throw new TypeError(`connector "${connectorId}" callAdmission queue settings require maxConcurrency.`);
-        }
-        this.maxQueueSize = nonNegativeWhole(rule.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE, `connector "${connectorId}" callAdmission maxQueueSize`);
-        this.queueTimeoutMs = positiveWhole(rule.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS, `connector "${connectorId}" callAdmission queueTimeoutMs`);
-        this.retryAfterMs = nonNegativeWhole(rule.retryAfterMs ?? DEFAULT_RETRY_AFTER_MS, `connector "${connectorId}" callAdmission retryAfterMs`);
-        this.maxPartitions = positiveWhole(policy.maxPartitions ?? DEFAULT_MAX_PARTITIONS, `connector "${connectorId}" callAdmission maxPartitions`);
-        if (rule.budget) {
-            if (rule.budget.kind !== "rolling-window") {
-                throw new TypeError(`connector "${connectorId}" callAdmission budget kind must be "rolling-window".`);
-            }
-            const maxCalls = positiveWhole(rule.budget.maxCalls, `connector "${connectorId}" callAdmission budget.maxCalls`);
-            const windowMs = positiveWhole(rule.budget.windowMs, `connector "${connectorId}" callAdmission budget.windowMs`);
-            this.budget = { maxCalls, windowMs };
-        }
-        else {
-            this.budget = undefined;
-        }
+        this.maxConcurrency = rule.maxConcurrency;
+        this.maxQueueSize = rule.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
+        this.queueTimeoutMs = rule.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS;
+        this.retryAfterMs = rule.retryAfterMs ?? DEFAULT_RETRY_AFTER_MS;
+        this.maxPartitions = policy.maxPartitions ?? DEFAULT_MAX_PARTITIONS;
+        this.budget = rule.budget ? { maxCalls: rule.budget.maxCalls, windowMs: rule.budget.windowMs } : undefined;
         this.partitionKey = rule.partitionKey;
     }
     acquire(input) {
@@ -179,7 +146,7 @@ export class ConnectorCallAdmissionController {
             this.queueWaitMaxMs = Math.max(this.queueWaitMaxMs, waitMs);
         }
         let released = false;
-        return {
+        const permit = {
             waitMs,
             release: () => {
                 if (released)
@@ -190,6 +157,26 @@ export class ConnectorCallAdmissionController {
                 this.pump(state);
             },
         };
+        provideCallBudgetCharge(permit, (chargedAt, signal) => {
+            if (this.closed || released) {
+                return Effect.fail(new CallAdmissionError("closed", "unavailable", `Connector "${this.connectorId}" call admission ${this.closed ? "is closed" : "permit is released"}.`));
+            }
+            if (signal?.aborted) {
+                this.cancelledTotal++;
+                return Effect.fail(this.cancelled(signal));
+            }
+            this.pruneBudget(state, chargedAt);
+            const retryAfterMs = this.budgetRetryAfterMs(state, chargedAt);
+            if (retryAfterMs !== undefined) {
+                this.rateLimitedTotal++;
+                return Effect.fail(this.budgetLimited(retryAfterMs));
+            }
+            if (this.budget)
+                state.admittedAt.push(chargedAt);
+            this.admittedTotal++;
+            return Effect.void;
+        });
+        return permit;
     }
     pump(state) {
         if (this.closed || this.maxConcurrency === undefined)

package/dist/call-recovery.js

@@ -1,18 +1,22 @@
 const MAX_FACTS = 4;
 const MAX_TEXT = 128;
+// Shared with the REST write schema so every accepted key survives recovery.
+export const IDEMPOTENCY_KEY_MAX_LENGTH = 255;
 const NAME = /^[A-Za-z][A-Za-z0-9]*$/;
 const facts = new WeakMap();
 /**
  * Record facts that let the caller reconcile or safely retry this call's
  * write. Bounded: at most four string facts with short camelCase names; a fact
- * outside the bound is dropped rather than truncated.
+ * outside the bound is dropped rather than truncated. Idempotency keys allow
+ * 255 characters to match the REST write schema; other values allow 128.
  */
 export function recordRecovery(ctx, recovery) {
     const kept = { ...facts.get(ctx) };
     for (const [name, value] of Object.entries(recovery)) {
         if (Object.keys(kept).length >= MAX_FACTS && !Object.hasOwn(kept, name))
             break;
-        if (!NAME.test(name) || name.length > 32 || typeof value !== "string" || value.length > MAX_TEXT)
+        const maxLength = name === "idempotencyKey" ? IDEMPOTENCY_KEY_MAX_LENGTH : MAX_TEXT;
+        if (!NAME.test(name) || name.length > 32 || typeof value !== "string" || value.length > maxLength)
             continue;
         kept[name] = value;
     }

package/dist/catalog-service.js

@@ -377,6 +377,7 @@ export class CatalogService {
     concurrency;
     searchRoute;
     requestSignal;
+    readOnly;
     // The request-scoped catalog cache: one shared read per connector asked
     // about, started by the first asker and joined by every later one. A
     // success stays for the rest of the request, so a search and the call after
@@ -401,6 +402,7 @@ export class CatalogService {
         this.searchRoute = options.searchRoute ?? "search_tools";
         this.requestSignal = options.requestSignal;
         this.defer = options.defer;
+        this.readOnly = options.readOnly === true;
     }
     /**
      * Send a caller back to discovery through the surface it can actually reach.
@@ -460,9 +462,12 @@ export class CatalogService {
     // each settling in its input slot: an unavailable catalog is a Failure
     // there, not a failed discovery. `route` names the surface in a timeout.
     // A probe also ends with its request, so no listing outlives the caller
-    // that asked for it.
+    // that asked for it. On a read-only endpoint a write is absent from search
+    // and describe, as if the connector never had it. Guides are not filtered.
     discoveryCatalogs(ids, route) {
-        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.catalog(id, { signal }), {
+        return Effect.forEach(ids, (id) => Effect.result(withDeadlineEffect((signal) => this.readOnly
+            ? Effect.map(this.catalog(id, { signal }), (tools) => tools.filter((tool) => tool.classification === "read"))
+            : this.catalog(id, { signal }), {
             ...(this.requestSignal ? { signal: this.requestSignal } : {}),
             timeoutMs: this.probeTimeoutMs,
             timeoutError: new ConnectorCallError("timeout", `${route} probe of "${id}" timed out after ${this.probeTimeoutMs}ms`),

package/dist/config-value-sources.js

@@ -44,7 +44,6 @@ function factorySource(sources, parts) {
 export function describeConfigSources(snapshot, raw) {
     const sources = {};
     const connectorSources = new Map(raw.connectors.map((connector) => [connector.id, factorySources(connector)]));
-    const moduleSources = { accessTokens: factorySources(raw.accessTokens) };
     const provided = (value) => (value === undefined ? "default" : "config");
     for (const path of configValuePaths(snapshot)) {
         const parts = path.split(".").slice(1);
@@ -56,10 +55,12 @@ export function describeConfigSources(snapshot, raw) {
             source = provided(raw.serverInfo?.[key]);
         else if (group === "urls")
             source = key === "mcpPath" ? "default" : provided(raw[key]);
-        else if (group === "trust")
-            source = provided(raw.trust);
-        else if (group === "identity")
-            source = provided(raw.identity?.[key]);
+        else if (group === "maintainers")
+            source = provided(raw.maintainers);
+        else if (group === "readOnly")
+            source = provided(raw.readOnly);
+        else if (group === "agents")
+            source = provided(raw.agents);
         else if (group === "storage")
             source = provided(raw.storage);
         else if (group === "deploymentInfo")
@@ -67,11 +68,15 @@ export function describeConfigSources(snapshot, raw) {
         else if (group === "classification")
             source = provided(raw.classification);
         else if (group === "pools")
-            source = field === "trust" ? provided(raw.pools?.[key]?.trust) : provided(raw.pools);
+            // An inherited value comes from wherever the deployment's came from.
+            source =
+                field === "readOnly"
+                    ? provided(raw.pools?.[key]?.readOnly ?? raw.readOnly)
+                    : field === "owner"
+                        ? provided(raw.pools?.[key]?.owner)
+                        : provided(raw.pools);
         else if (group === "modules") {
-            const module = key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens;
-            const factory = moduleSources[key];
-            source = (factory ? factorySource(factory, parts.slice(2)) : undefined) ?? provided(module);
+            source = provided(key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens);
         }
         else if (group === "branding") {
             const brand = raw.ui?.branding;

package/dist/config.d.ts

@@ -1,10 +1,8 @@
-import type { ConnectorGrant } from "./connector-access.js";
 import type { CredentialVault } from "./credential-contract.js";
 import { type ConfigInput, type ConfigOutput } from "./config-schema.js";
+import type { MemberRef } from "./membership.js";
 import type { AccessTokensModule, ActivityModule, OperatorSurface } from "./module-contracts.js";
-import type { AuthenticatedIdentity, Connector, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
-/** Config-owned identity rules for one deployment and tenant. */
-export type ConnectorPermission = "all" | "none" | readonly string[];
+import type { Connector, Executor, InboundAuth, KVStorage, Logger } from "./types.js";
 declare const discovery: {
     /**
      * Maximum connector catalogs/status probes fetched at once by discovery
@@ -76,7 +74,7 @@ declare const execute: {
      */
     watchdogMs: import("./config-schema.js").Field<number, number, true>;
     /**
-     * Trusted-pool writes one program may send, on top of the host-call
+     * Writes one program may send on a writable endpoint, on top of the host-call
      * budget every call already spends. Default 10.
      */
     maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -162,89 +160,64 @@ declare const admission: {
         };
     };
 };
-declare const identity: {
+declare const pool: {
     /**
-     * What this admitted identity may discover and call: `"all"`, or a list
-     * whose entries are connector ids (the whole connector) and `connector.tool`
-     * addresses (that tool only), or `{ tool: "connector.tool",
-     * requireReadOnly: true }` for an exact tool only while its loaded catalog
-     * explicitly classifies it read-only. Grants are additive: an unrestricted
-     * connector or address grant wins over the guarded form. An address naming
-     * a tool the catalog lacks is unreachable and warned once, never widened.
+     * Whether this pool's endpoint refuses every write: write tools are absent
+     * from search_tools, tool listings, and describe, and every write call is
+     * refused. Inherits the deployment's `readOnly` unless set here, in either
+     * direction.
      */
-    connectorAccess: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>, ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined, true>;
-    /** Global payload-free activity reads. Defaults to interactive humans. */
-    activityAccess: import("./config-schema.js").Field<(principal: Readonly<IdentityReference>) => boolean | Promise<boolean>, ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined, true>;
-    /** Shared credential and OAuth administration. Defaults to none. */
-    credentialAdministration: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-    /** Client-token lifecycle management by interactive humans. Defaults to false. */
-    accessTokenManagement: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
-    /** Connecting or changing the caller's personal account. Defaults to none. */
-    personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-};
-declare const pool: {
-    /** Programs may write only in trusted pools. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
+    readOnly: import("./config-schema.js").Field<boolean, boolean | undefined, true>;
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: import("./config-schema.js").Field<readonly string[], readonly string[], false>;
     /**
-     * Whether this admitted identity may open the pool. Denied by default:
-     * a pool with no grant serves nobody. A false return, a throw, and an
-     * undeclared pool name are the same 404.
+     * Who may open `/mcp/<name>`: principal ids in the namespace of the one
+     * interactive auth provider, `{ namespace, id }`, or `"agent:<name>"` for a
+     * declared agent. Required and non-empty; the pool serves exactly its
+     * `tools` to these members and the same 404 to everyone else.
+     */
+    members: import("./config-schema.js").Field<readonly MemberRef[], readonly MemberRef[], false>;
+    /**
+     * The Google Workspace address agents in this pool act as, on a Workspace
+     * connector whose `subject` is a mapping function. Humans always act as
+     * themselves through that mapping, and a fixed `subject` address applies to
+     * everyone. Without an owner, an agent's Workspace calls fail
+     * `auth_required`.
      */
-    grant: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
+    owner: import("./config-schema.js").Field<string, string | undefined, true>;
 };
 declare const connectaConfig: {
     connectors: import("./config-schema.js").Field<Connector[], readonly Connector[], false>;
     /** Inbound auth adapters, such as clerkAuth(...); omit for open (dev). */
     auth: import("./config-schema.js").Field<InboundAuth | InboundAuth[], readonly InboundAuth[], true>;
-    /** Code-derived connection visibility and independent management permissions. */
-    identity: import("./config-schema.js").Field<{
-        connectorAccess?: ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined;
-        activityAccess?: ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined;
-        credentialAdministration?: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-        accessTokenManagement?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
-        personalConnection?: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-    }, {
-        readonly connectorAccess: ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined;
-        readonly activityAccess: ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined;
-        readonly credentialAdministration: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-        readonly accessTokenManagement: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
-        readonly personalConnection: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-    }, true> & {
-        readonly shape: {
-            /**
-             * What this admitted identity may discover and call: `"all"`, or a list
-             * whose entries are connector ids (the whole connector) and `connector.tool`
-             * addresses (that tool only), or `{ tool: "connector.tool",
-             * requireReadOnly: true }` for an exact tool only while its loaded catalog
-             * explicitly classifies it read-only. Grants are additive: an unrestricted
-             * connector or address grant wins over the guarded form. An address naming
-             * a tool the catalog lacks is unreachable and warned once, never widened.
-             */
-            connectorAccess: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>, ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined, true>;
-            /** Global payload-free activity reads. Defaults to interactive humans. */
-            activityAccess: import("./config-schema.js").Field<(principal: Readonly<IdentityReference>) => boolean | Promise<boolean>, ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined, true>;
-            /** Shared credential and OAuth administration. Defaults to none. */
-            credentialAdministration: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-            /** Client-token lifecycle management by interactive humans. Defaults to false. */
-            accessTokenManagement: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
-            /** Connecting or changing the caller's personal account. Defaults to none. */
-            personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-        };
-    };
-    /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
+    /**
+     * Agents, declared by name: lowercase letters, digits, `_` and `-`, each
+     * unique. Each has one `cta_` token slot that operators issue, rotate, and
+     * revoke; nothing outside code adds, renames, or rebinds an agent. Removing
+     * a name stops its token on the next request. Requires `accessTokens`.
+     * An admitted agent carries `identity.agent` and has no principal, so
+     * personal connectors are absent for it. Defaults to none.
+     */
+    agents: import("./config-schema.js").Field<readonly string[], readonly string[], true>;
+    /**
+     * The people who may use plain `/mcp`, which serves the whole catalog with
+     * the deployment's `readOnly`, and who administer the deployment. Same
+     * reference forms as pool `members`, people only. Required with inbound
+     * auth; a maintainer opens no pool unless listed among its members.
+     */
+    maintainers: import("./config-schema.js").Field<readonly MemberRef[], readonly MemberRef[] | undefined, true>;
+    /** Named tool pools, each served at `/mcp/<name>` to its members only. */
     pools: import("./config-schema.js").Field<Record<string, {
-        trust?: "trusted" | "read-only" | undefined;
-        grant?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
+        readOnly?: boolean | undefined;
+        owner?: string | undefined;
         tools: readonly string[];
+        members: readonly MemberRef[];
     }>, Readonly<Record<string, {
-        readonly trust: "trusted" | "read-only";
+        readonly readOnly: boolean | undefined;
         readonly tools: readonly string[];
-        readonly grant: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
+        readonly members: readonly MemberRef[];
+        readonly owner: string | undefined;
     }>> | undefined, true>;
-    /** Trust of the default /mcp endpoint. Default read-only. */
-    trust: import("./config-schema.js").Field<"trusted" | "read-only", "trusted" | "read-only", true>;
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: import("./config-schema.js").Field<Record<string, Record<string, "read" | "write">>, Readonly<Record<string, Readonly<Record<string, "read" | "write">>>> | undefined, true>;
     /**
@@ -272,7 +245,7 @@ declare const connectaConfig: {
     vault: import("./config-schema.js").Field<CredentialVault, CredentialVault | undefined, true>;
     /** Optional connection UI, created by operatorUi() from /ui. */
     ui: import("./config-schema.js").Field<OperatorSurface, OperatorSurface | undefined, true>;
-    /** Optional managed client tokens, created by accessTokens() from /auth/access-tokens. */
+    /** Optional agent tokens for the declared `agents`, created by accessTokens() from /auth/access-tokens. */
     accessTokens: import("./config-schema.js").Field<AccessTokensModule, AccessTokensModule | undefined, true>;
     /** Tool-catalog TTL bounds and probe deadlines. */
     discovery: import("./config-schema.js").Field<{
@@ -394,7 +367,7 @@ declare const connectaConfig: {
              */
             watchdogMs: import("./config-schema.js").Field<number, number, true>;
             /**
-             * Trusted-pool writes one program may send, on top of the host-call
+             * Writes one program may send on a writable endpoint, on top of the host-call
              * budget every call already spends. Default 10.
              */
             maxWrites: import("./config-schema.js").Field<number, number, true>;
@@ -548,6 +521,15 @@ declare const connectaConfig: {
      * `customExecutor(myExecutor, { lifecycle: "self-managed" })`.
      */
     executor: import("./config-schema.js").Field<Executor, Executor, false>;
+    /**
+     * Required. Whether the default /mcp endpoint refuses every write. `true`:
+     * write tools are absent from search_tools, tool listings, and describe,
+     * and call_tool, call_destructive_tool, and program writes are refused.
+     * `false`: call_destructive_tool and programs may write, and the MCP
+     * client owns approval. Pools inherit it unless they set their own. It has
+     * no default while deployments migrate from `trust` (#820).
+     */
+    readOnly: import("./config-schema.js").Field<boolean, boolean, false>;
 };
 /** A deployment's whole configuration, passed to `createConnecta`. */
 export type ConnectaConfig = ConfigInput<typeof connectaConfig>;
@@ -563,11 +545,9 @@ export type AdmissionPoolConfig = ConfigInput<typeof codeAdmission>;
 export type RequestAdmissionConfig = ConfigInput<typeof requestAdmission>;
 /** Runtime-portable server-memory boundaries for `/mcp` and fallback code-mode work. */
 export type ConnectaAdmissionConfig = ConfigInput<typeof admission>;
-export type ConnectaIdentityConfig = ConfigInput<typeof identity>;
 /**
- * A named tool pool served at `/mcp/<name>`. The pool is the slice a client
- * pointed at that endpoint may see; the identity's own `connectorAccess`
- * remains its ceiling and the pool can only narrow it.
+ * A named tool pool served at `/mcp/<name>`: exactly its `tools`, to its
+ * `members` only.
  */
 export type ConnectaPoolConfig = ConfigInput<typeof pool>;
 type Parsed = ConfigOutput<typeof connectaConfig>;