@zackbart/connecta 0.32.0 → 0.34.0

package/dist/activity.d.ts

@@ -126,10 +126,13 @@ export interface ActivityStore extends ActivitySink {
     /**
      * The adapter and its retention, for `Connecta.describeConfig()`. Kinds
      * other than the shipped `"d1"` and `"sqlite"` are described as `"custom"`.
+     * `optionSources` says whether code set `retentionDays` (`"config"`) or the
+     * store chose it (`"default"`); without it the retention reads as a default.
      */
     describe?(): {
         kind: string;
         retentionDays?: number;
+        optionSources?: Readonly<Record<string, "default" | "config">>;
     };
 }
 /** Reader implementations throw this for an opaque cursor they cannot decode. */

package/dist/agent-identity.js

@@ -0,0 +1,47 @@
+// Code-declared agents (#837): the names deployment code lists in `agents`,
+// the identity an admitted agent carries, and the one provider trusted to
+// assert it. Pure, so core reads it without reaching the token module.
+import { ConfigError } from "./config-schema.js";
+/** Agent names: lowercase letters, digits, `_` and `-`. */
+const AGENT_NAME_RE = /^[a-z0-9_-]+$/u;
+/** Longest accepted agent name, so a name always fits a storage key. */
+const MAX_AGENT_NAME_LENGTH = 64;
+/** Directory namespace of agent subjects and activity actors. */
+export const AGENT_NAMESPACE = "connecta:access-tokens:v1";
+/** Whether `value` is an acceptable agent name. */
+export function isAgentName(value) {
+    return typeof value === "string" && value.length <= MAX_AGENT_NAME_LENGTH && AGENT_NAME_RE.test(value);
+}
+/**
+ * The subject id that partitions an agent's per-caller state, such as result
+ * handles. The `agent:` prefix keeps it apart from the UUID subjects older
+ * tokens used in the same namespace.
+ */
+export function agentSubjectId(name) {
+    return `agent:${name}`;
+}
+/** Validate a declared agent list: an array of unique, well-formed names. */
+export function assertAgentNames(value, path) {
+    if (!Array.isArray(value))
+        throw new ConfigError(`${path} must be an array of agent names.`);
+    const seen = new Set();
+    value.forEach((name, index) => {
+        if (!isAgentName(name)) {
+            throw new ConfigError(`${path}[${index}] must be an agent name: 1 to ${MAX_AGENT_NAME_LENGTH} characters of ` +
+                "lowercase letters, digits, _ and -.");
+        }
+        if (seen.has(name))
+            throw new ConfigError(`${path}[${index}] repeats the agent name "${name}".`);
+        seen.add(name);
+    });
+}
+const agentProviders = new WeakSet();
+/** Mark the built-in access-token adapter as the one provider whose `agent` is trusted. */
+export function trustAgentProvider(provider) {
+    agentProviders.add(provider);
+    return provider;
+}
+/** Whether `provider` is the built-in access-token adapter. */
+export function assertsAgents(provider) {
+    return agentProviders.has(provider);
+}

package/dist/auth/cloudflare-access.js

@@ -1,3 +1,4 @@
+import { withDeadline } from "../timeout.js";
 import { authorizationCredential } from "../inbound-credential.js";
 import { validIdentityReference } from "../identity.js";
 function identityString(identity, field) {
@@ -9,7 +10,7 @@ function identityString(identity, field) {
 function unauthorized() {
     return {
         ok: false,
-        response: Response.json({ error: "Cloudflare Access authentication required" }, { status: 401, headers: { "WWW-Authenticate": 'Bearer scope="openid email"' } }),
+        response: Response.json({ error: "Cloudflare Access authentication required" }, { status: 401, headers: { "WWW-Authenticate": 'Bearer scope="openid email"', "Cache-Control": "no-store" } }),
     };
 }
 /**
@@ -34,17 +35,24 @@ export function cloudflareAccessAuth() {
                 return unauthorized();
             let identity;
             try {
-                identity = await access.getIdentity();
+                identity = await withDeadline(() => access.getIdentity(), {
+                    timeoutMs: 5000,
+                    signal: request.signal,
+                    timeoutError: new Error("Access identity lookup timed out"),
+                });
             }
             catch {
-                return unauthorized();
+                return {
+                    ok: false,
+                    response: Response.json({ error: "Cloudflare Access identity unavailable", problem: "identity_unavailable" }, { status: 503, headers: { "Cache-Control": "no-store", "Retry-After": "1" } }),
+                };
             }
             // Access binds ctx.access.aud to its Worker application at the edge.
             // Service credentials can pass that edge, but connecta machines must
             // present a cta_ token to the machine provider instead.
             const forbidden = () => ({
                 ok: false,
-                response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403 }),
+                response: Response.json({ error: "Cloudflare Access human identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
             });
             if (!identity || typeof identity !== "object" || Array.isArray(identity))
                 return forbidden();
@@ -56,7 +64,7 @@ export function cloudflareAccessAuth() {
             if (!userId) {
                 return {
                     ok: false,
-                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403 }),
+                    response: Response.json({ error: "Cloudflare Access user identity required" }, { status: 403, headers: { "Cache-Control": "no-store" } }),
                 };
             }
             return { ok: true, userId, subjectId: userId };

package/dist/branding.d.ts

@@ -99,6 +99,13 @@ export interface PageLayout {
  * `mastheadEnd`, and `tail` are the caller's markup and are not.
  */
 export declare function renderPage(branding: ConnectaBranding | undefined, layout: PageLayout): string;
+/**
+ * The mark beside the brand name. Connecta's drawn "C" belongs to an
+ * unbranded deployment only; a deployment that serves its own SVG favicon
+ * shows that; any other branding shows its name alone.
+ */
+export type BrandMark = "connecta" | "favicon" | "none";
+export declare function brandMark(branding: ConnectaBranding | undefined, uiMounted: boolean): BrandMark;
 /**
  * Status marks for one-message pages. Decorative: the label and heading beside
  * each carry the meaning, so the shape repeats it and color is never alone.

package/dist/branding.js

@@ -1,4 +1,4 @@
-import { PAGE_CSS, TOKENS_CSS } from "./page-styles.js";
+import { PAGE_CSS, PAGE_FONTS, TOKENS_CSS } from "./page-styles.js";
 import { htmlSecurityHeaders } from "./html-security.js";
 /** Connecta's default monochrome "C" mark. */
 export const CONNECTA_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
@@ -9,6 +9,7 @@ export const CONNECTA_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" vie
   <path class="fg" d="M27 9.4A13 13 0 1 0 27 22.6l-4.4-2.5a8 8 0 1 1 0-8.2z"/>
 </svg>`;
 const DEFAULT_FAVICON_HREF = "/favicon.svg";
+const DEFAULT_PRODUCT_NAME = "Connecta";
 /**
  * Branding arrives from operator config, which is untyped at a JS call site, so
  * every field is treated as `unknown`: a non-string is read as unset rather than
@@ -19,7 +20,7 @@ function trimmedString(value) {
     return typeof value === "string" ? value.trim() || undefined : undefined;
 }
 export function resolveBranding(branding) {
-    const productName = trimmedString(branding?.productName) ?? "Connecta";
+    const productName = trimmedString(branding?.productName) ?? DEFAULT_PRODUCT_NAME;
     const ownerName = trimmedString(branding?.ownerName);
     // Operator branding URLs become masthead/callback hrefs, so a non-http(s)
     // scheme (javascript:, data:) is dropped the same as an unset URL — the
@@ -34,7 +35,7 @@ export function resolveBranding(branding) {
         ...(ownerUrl && isSafeHttpUrl(ownerUrl) ? { ownerUrl } : {}),
         description: trimmedString(branding?.description) ??
             `Manage the services this ${productName} instance makes available to agents.`,
-        pageTitle: trimmedString(branding?.pageTitle) ?? (ownerName ? `${productName} — ${ownerName}` : productName),
+        pageTitle: trimmedString(branding?.pageTitle) ?? (ownerName ? `${productName} · ${ownerName}` : productName),
         faviconHref: faviconHref && isSafeIconHref(faviconHref) ? faviconHref : DEFAULT_FAVICON_HREF,
         themeColor: configuredThemeColor(branding) ?? "#ffffff",
         theme: resolveTheme(branding?.theme),
@@ -128,6 +129,46 @@ export function droppedThemeTokens(theme) {
     }
     return dropped.map((token) => `theme.${token}`);
 }
+function rgbOf(hex) {
+    const digits = hex.slice(1);
+    // `#rgb` and `#rgba` double each digit; alpha never affects contrast here.
+    const short = digits.length <= 4;
+    const pairs = [0, 1, 2].map((i) => (short ? digits[i].repeat(2) : digits.slice(i * 2, i * 2 + 2)));
+    return pairs.map((pair) => parseInt(pair, 16));
+}
+function luminance([r, g, b]) {
+    const channel = (value) => {
+        const c = value / 255;
+        return c <= 0.03928 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+    };
+    return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b);
+}
+function contrast(a, b) {
+    const [hi, lo] = [luminance(a), luminance(b)].sort((x, y) => y - x);
+    return (hi + 0.05) / (lo + 0.05);
+}
+const hexOf = (rgb) => `#${rgb.map((c) => Math.round(c).toString(16).padStart(2, "0")).join("")}`;
+/** The dark palette's lightest surface that carries accent text (`--hover`). */
+const DARK_TEXT_GROUND = [0x24, 0x22, 0x1e];
+/**
+ * A configured accent's two derived colors. Text on its fill is white or
+ * near-black, whichever reads better; accent text on dark surfaces mixes the
+ * accent with white until it reaches 4.5:1, starting from the built-in
+ * accent's 80% so a light accent keeps its color.
+ */
+function accentTokens(accent) {
+    const rgb = rgbOf(accent);
+    const ink = [0x0f, 0x0e, 0x1f];
+    const onAccent = contrast(rgb, [255, 255, 255]) >= contrast(rgb, ink) ? "#ffffff" : hexOf(ink);
+    let darkText = hexOf(rgb.map((c) => c * 0.8 + 255 * 0.2));
+    for (let share = 0.8; share >= 0; share -= 0.05) {
+        const mixed = rgb.map((c) => c * share + 255 * (1 - share));
+        darkText = hexOf(mixed);
+        if (contrast(mixed, DARK_TEXT_GROUND) >= 4.5)
+            break;
+    }
+    return { onAccent, darkText };
+}
 /**
  * The resolved theme as a `:root` block, or "" when a deployment configured
  * nothing. It is emitted after the stylesheet so it overrides the defaults.
@@ -135,8 +176,10 @@ export function droppedThemeTokens(theme) {
  * anything that would need escaping is dropped rather than rewritten.
  */
 export function themeCss(theme) {
+    const derived = theme.accent ? accentTokens(theme.accent) : undefined;
     const declarations = [
         theme.accent ? `--accent:${theme.accent}` : "",
+        derived ? `--custom-on-accent:${derived.onAccent};--custom-accent-text:${derived.darkText}` : "",
         theme.radius !== undefined ? `--radius:${theme.radius}` : "",
         theme.fontFamily ? `--sans:${theme.fontFamily}` : "",
         theme.monoFamily ? `--mono:${theme.monoFamily}` : "",
@@ -156,11 +199,11 @@ export function escapeHtml(value) {
     return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
 }
 /**
- * The masthead's `--surface` in each palette, for the browser chrome a
+ * The top bar's `--bg` in each palette, for the browser chrome a
  * `theme-color` paints. A configured `themeColor` wins; without one a dark
  * page should not sit under a white status bar.
  */
-const SURFACE = { light: "#ffffff", dark: "#151a21" };
+const SURFACE = { light: "#f6f4ef", dark: "#12110f" };
 /** The operator's own `themeColor`, read the one way both callers read it. */
 function configuredThemeColor(branding) {
     return trimmedString(branding?.themeColor);
@@ -202,6 +245,7 @@ export function renderPage(branding, layout) {
         : label("brand", brand.productName, brand.productUrl);
     const product = brand.ownerName ? label("product", brand.productName, brand.productUrl) : "";
     const customIcon = brand.faviconHref !== DEFAULT_FAVICON_HREF;
+    const mark = brandMarkHtml(brandMark(branding, layout.uiMounted));
     // `isSafeIconHref` already limited a relative href to one leading slash, so
     // resolving it can only land on `iconOrigin` itself.
     const iconHref = (href) => layout.iconOrigin && href.startsWith("/") ? new URL(href, layout.iconOrigin).toString() : href;
@@ -214,7 +258,13 @@ export function renderPage(branding, layout) {
     const skip = layout.skipTo
         ? `<a class="skip-link" href="#${escapeHtml(layout.skipTo.id)}">${escapeHtml(layout.skipTo.label)}</a>\n`
         : "";
-    const styles = (layout.styles ?? TOKENS_CSS + PAGE_CSS) + (layout.extraStyles ?? "");
+    // The operator bundle declares its own fonts. Other pages link the same
+    // files only where the UI module serves them, root-relative so the page's
+    // own origin serves them; elsewhere the stacks fall back to system fonts.
+    const fonts = layout.uiMounted
+        ? PAGE_FONTS.map((font) => `@font-face{font-family:"${font.family}";font-style:normal;font-weight:${font.weight};font-display:swap;src:url("${font.path}") format("woff2")}`).join("")
+        : "";
+    const styles = (layout.styles ?? fonts + TOKENS_CSS + PAGE_CSS) + (layout.extraStyles ?? "");
     return `<!doctype html>
 <html lang="en"${schemeAttribute(brand.theme)}>
 <head>
@@ -231,7 +281,7 @@ ${layout.head ?? ""}
 ${skip}<header class="masthead shell">
   <div class="masthead-inner">
     <div class="mast-nav">
-      ${owner}${product ? `\n      ${product}` : ""}
+      ${mark}${owner}${product ? `\n      ${product}` : ""}
     </div>${layout.mastheadEnd ? `\n    ${layout.mastheadEnd}` : ""}
   </div>
 </header>
@@ -239,6 +289,23 @@ ${layout.body}${layout.tail ? `\n${layout.tail}` : ""}
 </body>
 </html>`;
 }
+export function brandMark(branding, uiMounted) {
+    if (uiMounted && trimmedString(branding?.favicon?.svg))
+        return "favicon";
+    const brand = resolveBranding(branding);
+    const unbranded = brand.productName === DEFAULT_PRODUCT_NAME &&
+        !brand.ownerName &&
+        brand.faviconHref === DEFAULT_FAVICON_HREF &&
+        !branding?.favicon?.svg;
+    return unbranded ? "connecta" : "none";
+}
+function brandMarkHtml(mark) {
+    if (mark === "connecta")
+        return '<span class="brand-mark" aria-hidden="true"></span>';
+    if (mark === "favicon")
+        return `<img class="brand-mark" src="${DEFAULT_FAVICON_HREF}" alt="">`;
+    return "";
+}
 /**
  * Status marks for one-message pages. Decorative: the label and heading beside
  * each carry the meaning, so the shape repeats it and color is never alone.
@@ -281,12 +348,12 @@ export function notFoundResponse(request, opts) {
       <p class="status-label">404</p>
     </div>
     <h1>Page not found</h1>
-    <p class="status-copy">Nothing is served at this address. Check the link, or ask whoever runs ${escapeHtml(brand.productName)} for the right one.</p>
+    <p class="status-copy">Nothing is here. Check the link, or ask whoever runs ${escapeHtml(brand.productName)}.</p>
     ${home}
   </section>
 </main>`;
     return new Response(renderPage(opts.ui?.branding, {
-        title: `Page not found — ${brand.pageTitle}`,
+        title: `Page not found · ${brand.pageTitle}`,
         uiMounted,
         // Same bytes on either host: the icons, like the home link, come from
         // the public origin.

package/dist/call-admission-context.js

@@ -0,0 +1,15 @@
+import { chargeCallBudget } from "./runtime/call-admission.js";
+import { runEdge } from "./runtime/run.js";
+const permits = new WeakMap();
+export function attachCallAdmission(ctx, permit) {
+    permits.set(ctx, permit);
+}
+/**
+ * Charge one sequential auxiliary request using the enclosing concurrency slot.
+ * Await before dispatch and propagate refusal. Contexts outside an invocation
+ * have no registry policy to charge.
+ */
+export function chargeConnectorCall(ctx) {
+    const permit = permits.get(ctx);
+    return permit ? runEdge(chargeCallBudget(permit, ctx.signal)) : Promise.resolve();
+}

package/dist/call-admission.js

@@ -1,6 +1,7 @@
 import { Deferred, Duration, Effect } from "effect";
+import { CALL_ADMISSION } from "./provider.js";
 import { ConnectorCallError } from "./errors.js";
-import { provideCallAdmissionProgram, startCallAdmission } from "./runtime/call-admission.js";
+import { provideCallAdmissionProgram, provideCallBudgetCharge, startCallAdmission } from "./runtime/call-admission.js";
 import { fromSignal, runEdge } from "./runtime/run.js";
 const DEFAULT_MAX_QUEUE_SIZE = 32;
 const DEFAULT_QUEUE_TIMEOUT_MS = 5_000;
@@ -50,18 +51,6 @@ export function aggregateCallAdmissionSnapshots(snapshots) {
     }
     return aggregate;
 }
-function positiveWhole(value, name) {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 1) {
-        throw new TypeError(`${name} must be a positive whole number.`);
-    }
-    return value;
-}
-function nonNegativeWhole(value, name) {
-    if (!Number.isFinite(value) || !Number.isInteger(value) || value < 0) {
-        throw new TypeError(`${name} must be a non-negative whole number.`);
-    }
-    return value;
-}
 /**
  * Per-runtime, per-connector call admission. State contains only bounded
  * partition keys, counters, timestamps, signals, and promise continuations;
@@ -88,36 +77,14 @@ export class ConnectorCallAdmissionController {
     queueWaitMaxMs = 0;
     constructor(connectorId, policy) {
         this.connectorId = connectorId;
-        if (!Array.isArray(policy.rules) || policy.rules.length !== 1) {
-            throw new TypeError(`connector "${connectorId}" callAdmission.rules must contain exactly one rule in this release.`);
-        }
+        policy = CALL_ADMISSION.parse(policy, `connector "${connectorId}" callAdmission`);
         const rule = policy.rules[0];
-        if (rule.maxConcurrency === undefined && rule.budget === undefined) {
-            throw new TypeError(`connector "${connectorId}" callAdmission rule must declare maxConcurrency or budget.`);
-        }
-        this.maxConcurrency =
-            rule.maxConcurrency === undefined
-                ? undefined
-                : positiveWhole(rule.maxConcurrency, `connector "${connectorId}" callAdmission maxConcurrency`);
-        if (this.maxConcurrency === undefined &&
-            (rule.maxQueueSize !== undefined || rule.queueTimeoutMs !== undefined || rule.retryAfterMs !== undefined)) {
-            throw new TypeError(`connector "${connectorId}" callAdmission queue settings require maxConcurrency.`);
-        }
-        this.maxQueueSize = nonNegativeWhole(rule.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE, `connector "${connectorId}" callAdmission maxQueueSize`);
-        this.queueTimeoutMs = positiveWhole(rule.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS, `connector "${connectorId}" callAdmission queueTimeoutMs`);
-        this.retryAfterMs = nonNegativeWhole(rule.retryAfterMs ?? DEFAULT_RETRY_AFTER_MS, `connector "${connectorId}" callAdmission retryAfterMs`);
-        this.maxPartitions = positiveWhole(policy.maxPartitions ?? DEFAULT_MAX_PARTITIONS, `connector "${connectorId}" callAdmission maxPartitions`);
-        if (rule.budget) {
-            if (rule.budget.kind !== "rolling-window") {
-                throw new TypeError(`connector "${connectorId}" callAdmission budget kind must be "rolling-window".`);
-            }
-            const maxCalls = positiveWhole(rule.budget.maxCalls, `connector "${connectorId}" callAdmission budget.maxCalls`);
-            const windowMs = positiveWhole(rule.budget.windowMs, `connector "${connectorId}" callAdmission budget.windowMs`);
-            this.budget = { maxCalls, windowMs };
-        }
-        else {
-            this.budget = undefined;
-        }
+        this.maxConcurrency = rule.maxConcurrency;
+        this.maxQueueSize = rule.maxQueueSize ?? DEFAULT_MAX_QUEUE_SIZE;
+        this.queueTimeoutMs = rule.queueTimeoutMs ?? DEFAULT_QUEUE_TIMEOUT_MS;
+        this.retryAfterMs = rule.retryAfterMs ?? DEFAULT_RETRY_AFTER_MS;
+        this.maxPartitions = policy.maxPartitions ?? DEFAULT_MAX_PARTITIONS;
+        this.budget = rule.budget ? { maxCalls: rule.budget.maxCalls, windowMs: rule.budget.windowMs } : undefined;
         this.partitionKey = rule.partitionKey;
     }
     acquire(input) {
@@ -179,7 +146,7 @@ export class ConnectorCallAdmissionController {
             this.queueWaitMaxMs = Math.max(this.queueWaitMaxMs, waitMs);
         }
         let released = false;
-        return {
+        const permit = {
             waitMs,
             release: () => {
                 if (released)
@@ -190,6 +157,26 @@ export class ConnectorCallAdmissionController {
                 this.pump(state);
             },
         };
+        provideCallBudgetCharge(permit, (chargedAt, signal) => {
+            if (this.closed || released) {
+                return Effect.fail(new CallAdmissionError("closed", "unavailable", `Connector "${this.connectorId}" call admission ${this.closed ? "is closed" : "permit is released"}.`));
+            }
+            if (signal?.aborted) {
+                this.cancelledTotal++;
+                return Effect.fail(this.cancelled(signal));
+            }
+            this.pruneBudget(state, chargedAt);
+            const retryAfterMs = this.budgetRetryAfterMs(state, chargedAt);
+            if (retryAfterMs !== undefined) {
+                this.rateLimitedTotal++;
+                return Effect.fail(this.budgetLimited(retryAfterMs));
+            }
+            if (this.budget)
+                state.admittedAt.push(chargedAt);
+            this.admittedTotal++;
+            return Effect.void;
+        });
+        return permit;
     }
     pump(state) {
         if (this.closed || this.maxConcurrency === undefined)

package/dist/call-recovery.js

@@ -1,18 +1,22 @@
 const MAX_FACTS = 4;
 const MAX_TEXT = 128;
+// Shared with the REST write schema so every accepted key survives recovery.
+export const IDEMPOTENCY_KEY_MAX_LENGTH = 255;
 const NAME = /^[A-Za-z][A-Za-z0-9]*$/;
 const facts = new WeakMap();
 /**
  * Record facts that let the caller reconcile or safely retry this call's
  * write. Bounded: at most four string facts with short camelCase names; a fact
- * outside the bound is dropped rather than truncated.
+ * outside the bound is dropped rather than truncated. Idempotency keys allow
+ * 255 characters to match the REST write schema; other values allow 128.
  */
 export function recordRecovery(ctx, recovery) {
     const kept = { ...facts.get(ctx) };
     for (const [name, value] of Object.entries(recovery)) {
         if (Object.keys(kept).length >= MAX_FACTS && !Object.hasOwn(kept, name))
             break;
-        if (!NAME.test(name) || name.length > 32 || typeof value !== "string" || value.length > MAX_TEXT)
+        const maxLength = name === "idempotencyKey" ? IDEMPOTENCY_KEY_MAX_LENGTH : MAX_TEXT;
+        if (!NAME.test(name) || name.length > 32 || typeof value !== "string" || value.length > maxLength)
             continue;
         kept[name] = value;
     }

package/dist/catalog-service.js

@@ -582,7 +582,7 @@ export class CatalogService {
         }
         return withAuthorizationHandoff(this.requestScope, error);
     }
-    async search(args) {
+    async search(args, onCatalogReference) {
         if (args.query !== undefined && typeof args.query !== "string") {
             throw new DiscoveryPolicyError("invalid_args", "query must be a string. Omit it or use an empty string to browse the catalog.");
         }
@@ -915,6 +915,20 @@ export class CatalogService {
                 : "No single tool matched every term in the catalogs that answered. Split distinct intents into separate searches.";
         };
         const guidance = searchGuidance();
+        // Counts, ranking, and term analysis use the whole searched corpus, not
+        // just this page's tools. Bind every searched connector, including failed
+        // catalogs and off-page matches, so paging cannot reveal a hidden
+        // connector's contribution. Keep provenance host-only.
+        for (const connector of connectors)
+            onCatalogReference?.(connector.id);
+        for (const entry of entries)
+            onCatalogReference?.(entry.connector.id, entry.tool.name);
+        for (const connector of absence?.configuredConnectors ?? [])
+            onCatalogReference?.(connector);
+        // An unknown scope's guidance lists the visible roster without searching it.
+        if (reportsQueryAnalysis && args.connector && !scopedConnector)
+            for (const connector of visibleConnectors)
+                onCatalogReference?.(connector.id);
         return {
             catalogErrors,
             ...(absence ? { absence } : {}),

package/dist/config-value-sources.js

@@ -44,7 +44,6 @@ function factorySource(sources, parts) {
 export function describeConfigSources(snapshot, raw) {
     const sources = {};
     const connectorSources = new Map(raw.connectors.map((connector) => [connector.id, factorySources(connector)]));
-    const moduleSources = { accessTokens: factorySources(raw.accessTokens) };
     const provided = (value) => (value === undefined ? "default" : "config");
     for (const path of configValuePaths(snapshot)) {
         const parts = path.split(".").slice(1);
@@ -56,12 +55,12 @@ export function describeConfigSources(snapshot, raw) {
             source = provided(raw.serverInfo?.[key]);
         else if (group === "urls")
             source = key === "mcpPath" ? "default" : provided(raw[key]);
-        else if (group === "hasGrant")
-            source = provided(raw.grant);
+        else if (group === "maintainers")
+            source = provided(raw.maintainers);
         else if (group === "readOnly")
             source = provided(raw.readOnly);
-        else if (group === "identity")
-            source = provided(raw.identity?.[key]);
+        else if (group === "agents")
+            source = provided(raw.agents);
         else if (group === "storage")
             source = provided(raw.storage);
         else if (group === "deploymentInfo")
@@ -70,11 +69,19 @@ export function describeConfigSources(snapshot, raw) {
             source = provided(raw.classification);
         else if (group === "pools")
             // An inherited value comes from wherever the deployment's came from.
-            source = field === "readOnly" ? provided(raw.pools?.[key]?.readOnly ?? raw.readOnly) : provided(raw.pools);
+            source =
+                field === "readOnly"
+                    ? provided(raw.pools?.[key]?.readOnly ?? raw.readOnly)
+                    : field === "owner"
+                        ? provided(raw.pools?.[key]?.owner)
+                        : field === "description"
+                            ? provided(raw.pools?.[key]?.description)
+                            : provided(raw.pools);
+        else if (group === "modules" && key === "activity" && field === "store" && parts[3] !== "kind")
+            // A store option such as retentionDays is set only when the store says so.
+            source = factorySource(factorySources(raw.activity?.store), parts.slice(3)) ?? "default";
         else if (group === "modules") {
-            const module = key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens;
-            const factory = moduleSources[key];
-            source = (factory ? factorySource(factory, parts.slice(2)) : undefined) ?? provided(module);
+            source = provided(key === "ui" ? raw.ui : key === "vault" ? raw.vault : key === "activity" ? raw.activity : raw.accessTokens);
         }
         else if (group === "branding") {
             const brand = raw.ui?.branding;