@zackbart/connecta 0.32.0 → 0.34.0

package/templates/node/src/connecta.config.ts

@@ -25,6 +25,7 @@ export interface Env {
   CONNECTA_DATABASE?: string;
   CLERK_PUBLISHABLE_KEY?: string;
   CLERK_SECRET_KEY?: string;
+  CONNECTA_MAINTAINERS?: string;
   CONNECTA_CREDENTIAL_KEY?: string;
   CONNECTA_ACTIVITY?: string;
 }
@@ -76,19 +77,34 @@ export default defineConfig((env: Env) => {
     // Required: model-written programs run in a bounded QuickJS child.
     executor: quickJsExecutor(),
     auth: clerk ? [clerk] : [],
-    // Always installed: an empty database refuses machine requests. Provision
-    // locally with `npm run provision-token -- "machine-name"`, or grant an
-    // interactive human `identity.accessTokenManagement` for later issuance.
-    // v0.23 client tokens survive `connecta migrate-state` on this storage.
+    // Required with Clerk: the Clerk user ids (comma-separated in
+    // CONNECTA_MAINTAINERS) who use plain /mcp, which serves every connector,
+    // and the operator UI. They alone administer shared credentials, manage
+    // agent tokens, and read activity. Everyone else uses a pool that lists
+    // them. Agents are never maintainers.
+    maintainers: clerk
+      ? (set("CONNECTA_MAINTAINERS") ?? "")
+          .split(",")
+          .map((id) => id.trim())
+          .filter(Boolean)
+      : [],
+    // Each pool serves exactly its tools to its members: Clerk user ids at
+    // /mcp/<name>, and "agent:<name>" for a declared agent at /agent/<name>.
+    // A member connects their own account on the pool's personal connectors.
+    // `npm run doctor` checks /agent/local-machine with its token. The starter
+    // pool is the agent's base pool, its lowest tier (shared connectors, no
+    // owner), named after the agent as the agent pool layout requires.
+    pools: { "local-machine": { tools: ["time"], members: ["agent:local-machine"] } },
+    // Machine clients are agents declared here by name, each with one cta_
+    // token. Issue or rotate one locally with
+    // `npm run --silent rotate-token -- local-machine`, or as a signed-in
+    // maintainer from the operator UI. Removing a name stops its token on the
+    // next request.
+    agents: ["local-machine"],
+    // Always installed: a slot with no issued token refuses every request.
+    // Tokens from before agents stop admitting until `npm run adopt-token`
+    // binds each machine's token to an agent; human-bound tokens never do.
     accessTokens: accessTokens(storage),
-    // Connection management permissions default to none, so the template
-    // grants them. Split members from operators with `connectorAccess`,
-    // `activityAccess`, and `accessTokenManagement`, each derived from the
-    // authenticated identity and never from an MCP argument.
-    identity: {
-      credentialAdministration: () => "all",
-      personalConnection: () => "all",
-    },
     vault: credentialKey ? encryptedCredentialVault(storage, credentialKey) : undefined,
     // Payload-free activity history at /activity: who called what, when, how
     // long it took, and whether it worked. Each write prunes rows older than

package/templates/node/src/rotate-token.ts

@@ -0,0 +1,17 @@
+/**
+ * Trusted local provisioning: issue or rotate one declared agent's token
+ * against the same configuration and database the server uses. The previous
+ * secret stops working on its next request.
+ */
+import { AccessTokenManager } from "@zackbart/connecta/auth/access-tokens";
+import connectaConfig from "./connecta.config.js";
+
+const agent = process.argv[2];
+if (!agent || process.argv.length !== 3) {
+  throw new Error("Usage: npm run --silent rotate-token -- <agent>");
+}
+const { storage, agents } = connectaConfig(process.env);
+const manager = new AccessTokenManager(storage!, { agents: agents ?? [] });
+const { token } = await manager.rotate(agent, "local-provisioning");
+// The secret is returned once. Keep stdout private; storage holds its hash.
+process.stdout.write(`${token}\n`);

package/templates/node/src/provision-token.ts

@@ -1,17 +0,0 @@
-/** Trusted local provisioning against the same database the server uses. */
-import { AccessTokenManager } from "@zackbart/connecta/auth/access-tokens";
-import { openSqlite, sqliteStorage } from "@zackbart/connecta/sqlite";
-
-const name = process.argv[2];
-if (!name || process.argv.length !== 3) {
-  throw new Error('Usage: npm run provision-token -- "machine-name"');
-}
-const database = openSqlite(process.env.CONNECTA_DATABASE || "./.connecta.sqlite");
-try {
-  const manager = new AccessTokenManager(sqliteStorage(database));
-  const { token } = await manager.create(name, "local-provisioning");
-  // The secret is returned once. Keep stdout private; storage holds its hash.
-  process.stdout.write(`${token}\n`);
-} finally {
-  database.close();
-}