@zackbart/connecta 0.32.0 → 0.34.0

package/dist/config.d.ts

@@ -1,10 +1,8 @@
-import type { ConnectorGrant } from "./connector-access.js";
 import type { CredentialVault } from "./credential-contract.js";
 import { type ConfigInput, type ConfigOutput } from "./config-schema.js";
+import type { MemberRef } from "./membership.js";
 import type { AccessTokensModule, ActivityModule, OperatorSurface } from "./module-contracts.js";
-import type { AuthenticatedIdentity, Connector, Executor, IdentityReference, InboundAuth, KVStorage, Logger } from "./types.js";
-/** Config-owned identity rules for one deployment and tenant. */
-export type ConnectorPermission = "all" | "none" | readonly string[];
+import type { Connector, Executor, InboundAuth, KVStorage, Logger } from "./types.js";
 declare const discovery: {
     /**
      * Maximum connector catalogs/status probes fetched at once by discovery
@@ -162,26 +160,6 @@ declare const admission: {
         };
     };
 };
-declare const identity: {
-    /**
-     * What this admitted identity may discover and call: `"all"`, or a list
-     * whose entries are connector ids (the whole connector) and `connector.tool`
-     * addresses (that tool only), or `{ tool: "connector.tool",
-     * requireReadOnly: true }` for an exact tool only while its loaded catalog
-     * explicitly classifies it read-only. Grants are additive: an unrestricted
-     * connector or address grant wins over the guarded form. An address naming
-     * a tool the catalog lacks is unreachable and warned once, never widened.
-     */
-    connectorAccess: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>, ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined, true>;
-    /** Global payload-free activity reads. Defaults to interactive humans. */
-    activityAccess: import("./config-schema.js").Field<(principal: Readonly<IdentityReference>) => boolean | Promise<boolean>, ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined, true>;
-    /** Shared credential and OAuth administration. Defaults to none. */
-    credentialAdministration: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-    /** Client-token lifecycle management by interactive humans. Defaults to false. */
-    accessTokenManagement: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
-    /** Connecting or changing the caller's personal account. Defaults to none. */
-    personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-};
 declare const pool: {
     /**
      * Whether this pool's endpoint refuses every write: write tools are absent
@@ -193,66 +171,63 @@ declare const pool: {
     /** Connector ids and exact `connector.tool` addresses in this pool. */
     tools: import("./config-schema.js").Field<readonly string[], readonly string[], false>;
     /**
-     * Whether this admitted identity may open the pool. Denied by default:
-     * a pool with no grant serves nobody. A false return, a throw, and an
-     * undeclared pool name are the same 404.
+     * Who may open `/mcp/<name>`: principal ids in the namespace of the one
+     * interactive auth provider, `{ namespace, id }`, or `"agent:<name>"` for a
+     * declared agent. Required and non-empty; the pool serves exactly its
+     * `tools` to these members and the same 404 to everyone else.
+     */
+    members: import("./config-schema.js").Field<readonly MemberRef[], readonly MemberRef[], false>;
+    /**
+     * The Google Workspace address agents in this pool act as, on a Workspace
+     * connector whose `subject` is a mapping function. Humans always act as
+     * themselves through that mapping, and a fixed `subject` address applies to
+     * everyone. Without an owner, a mapping-subject Workspace connector is
+     * absent for this pool's agents, as a personal connector is; people in the
+     * pool still see it.
+     */
+    owner: import("./config-schema.js").Field<string, string | undefined, true>;
+    /**
+     * What this pool is for, in plain words for the model: appended to the MCP
+     * `initialize` instructions at `/mcp/<name>` and `/agent/<name>`, so a
+     * caller learns its scope ("Team tier: shared tools only."). Trimmed, 1 to
+     * 500 characters, no line breaks or control characters. It grants and hides nothing; plain
+     * `/mcp` never shows it.
      */
-    grant: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
+    description: import("./config-schema.js").Field<string, string | undefined, true>;
 };
 declare const connectaConfig: {
     connectors: import("./config-schema.js").Field<Connector[], readonly Connector[], false>;
     /** Inbound auth adapters, such as clerkAuth(...); omit for open (dev). */
     auth: import("./config-schema.js").Field<InboundAuth | InboundAuth[], readonly InboundAuth[], true>;
-    /** Code-derived connection visibility and independent management permissions. */
-    identity: import("./config-schema.js").Field<{
-        connectorAccess?: ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined;
-        activityAccess?: ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined;
-        credentialAdministration?: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-        accessTokenManagement?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
-        personalConnection?: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-    }, {
-        readonly connectorAccess: ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined;
-        readonly activityAccess: ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined;
-        readonly credentialAdministration: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-        readonly accessTokenManagement: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
-        readonly personalConnection: ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined;
-    }, true> & {
-        readonly shape: {
-            /**
-             * What this admitted identity may discover and call: `"all"`, or a list
-             * whose entries are connector ids (the whole connector) and `connector.tool`
-             * addresses (that tool only), or `{ tool: "connector.tool",
-             * requireReadOnly: true }` for an exact tool only while its loaded catalog
-             * explicitly classifies it read-only. Grants are additive: an unrestricted
-             * connector or address grant wins over the guarded form. An address naming
-             * a tool the catalog lacks is unreachable and warned once, never widened.
-             */
-            connectorAccess: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>, ((identity: Readonly<AuthenticatedIdentity>) => "all" | readonly ConnectorGrant[] | Promise<"all" | readonly ConnectorGrant[]>) | undefined, true>;
-            /** Global payload-free activity reads. Defaults to interactive humans. */
-            activityAccess: import("./config-schema.js").Field<(principal: Readonly<IdentityReference>) => boolean | Promise<boolean>, ((principal: Readonly<IdentityReference>) => boolean | Promise<boolean>) | undefined, true>;
-            /** Shared credential and OAuth administration. Defaults to none. */
-            credentialAdministration: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-            /** Client-token lifecycle management by interactive humans. Defaults to false. */
-            accessTokenManagement: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
-            /** Connecting or changing the caller's personal account. Defaults to none. */
-            personalConnection: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>, ((identity: Readonly<AuthenticatedIdentity>) => ConnectorPermission | Promise<ConnectorPermission>) | undefined, true>;
-        };
-    };
     /**
-     * Whether this admitted identity may open plain `/mcp`. Omitted admits
-     * everyone; only literal true admits when configured. Other returns and
-     * throws receive the same 404 as a refused or undeclared pool.
+     * Agents, declared by name: lowercase letters, digits, `_` and `-`, each
+     * unique. Each has one `cta_` token slot that operators issue, rotate, and
+     * revoke; nothing outside code adds, renames, or rebinds an agent. Removing
+     * a name stops its token on the next request. Requires `accessTokens`.
+     * An admitted agent carries `identity.agent` and has no principal, so
+     * personal connectors are absent for it. Defaults to none.
+     */
+    agents: import("./config-schema.js").Field<readonly string[], readonly string[], true>;
+    /**
+     * The people who may use plain `/mcp`, which serves the whole catalog with
+     * the deployment's `readOnly`, and who administer the deployment. Same
+     * reference forms as pool `members`, people only. Required with inbound
+     * auth; a maintainer opens no pool unless listed among its members.
      */
-    grant: import("./config-schema.js").Field<(identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>, ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined, true>;
-    /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
+    maintainers: import("./config-schema.js").Field<readonly MemberRef[], readonly MemberRef[] | undefined, true>;
+    /** Named tool pools, each served at `/mcp/<name>` to its members only. */
     pools: import("./config-schema.js").Field<Record<string, {
         readOnly?: boolean | undefined;
-        grant?: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
+        owner?: string | undefined;
+        description?: string | undefined;
         tools: readonly string[];
+        members: readonly MemberRef[];
     }>, Readonly<Record<string, {
         readonly readOnly: boolean | undefined;
         readonly tools: readonly string[];
-        readonly grant: ((identity: Readonly<AuthenticatedIdentity>) => boolean | Promise<boolean>) | undefined;
+        readonly members: readonly MemberRef[];
+        readonly owner: string | undefined;
+        readonly description: string | undefined;
     }>> | undefined, true>;
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: import("./config-schema.js").Field<Record<string, Record<string, "read" | "write">>, Readonly<Record<string, Readonly<Record<string, "read" | "write">>>> | undefined, true>;
@@ -281,7 +256,7 @@ declare const connectaConfig: {
     vault: import("./config-schema.js").Field<CredentialVault, CredentialVault | undefined, true>;
     /** Optional connection UI, created by operatorUi() from /ui. */
     ui: import("./config-schema.js").Field<OperatorSurface, OperatorSurface | undefined, true>;
-    /** Optional managed client tokens, created by accessTokens() from /auth/access-tokens. */
+    /** Optional agent tokens for the declared `agents`, created by accessTokens() from /auth/access-tokens. */
     accessTokens: import("./config-schema.js").Field<AccessTokensModule, AccessTokensModule | undefined, true>;
     /** Tool-catalog TTL bounds and probe deadlines. */
     discovery: import("./config-schema.js").Field<{
@@ -581,11 +556,9 @@ export type AdmissionPoolConfig = ConfigInput<typeof codeAdmission>;
 export type RequestAdmissionConfig = ConfigInput<typeof requestAdmission>;
 /** Runtime-portable server-memory boundaries for `/mcp` and fallback code-mode work. */
 export type ConnectaAdmissionConfig = ConfigInput<typeof admission>;
-export type ConnectaIdentityConfig = ConfigInput<typeof identity>;
 /**
- * A named tool pool served at `/mcp/<name>`. The pool is the slice a client
- * pointed at that endpoint may see; the identity's own `connectorAccess`
- * remains its ceiling and the pool can only narrow it.
+ * A named tool pool served at `/mcp/<name>`: exactly its `tools`, to its
+ * `members` only.
  */
 export type ConnectaPoolConfig = ConfigInput<typeof pool>;
 type Parsed = ConfigOutput<typeof connectaConfig>;

package/dist/config.js

@@ -12,10 +12,12 @@
 // reads, with defaults applied once, so no later layer re-derives a value or
 // re-plumbs a field.
 import { CONFIG_DEFAULTS as D } from "./config-defaults.js";
-import { array, ConfigError, fn, object, opaque, record, required, seconds, readPlain, text, whole, } from "./config-schema.js";
+import { array, ConfigError, object, opaque, record, required, seconds, readPlain, text, whole, } from "./config-schema.js";
+import { assertAgentNames } from "./agent-identity.js";
 import { assertExecutor } from "./executor-contract.js";
 import { memoryStorage } from "./storage/memory.js";
 import { CONNECTA_VERSION } from "./version.js";
+import { isWorkspaceAddress } from "./workspace-address.js";
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const STORAGE_METHODS = ["get", "set", "delete", "list", "compareAndSet"];
 const hasMethods = (value, methods) => isObject(value) && methods.every((method) => typeof value[method] === "function");
@@ -175,26 +177,6 @@ const admission = {
      */
     code: object(codeAdmission),
 };
-const identity = {
-    /**
-     * What this admitted identity may discover and call: `"all"`, or a list
-     * whose entries are connector ids (the whole connector) and `connector.tool`
-     * addresses (that tool only), or `{ tool: "connector.tool",
-     * requireReadOnly: true }` for an exact tool only while its loaded catalog
-     * explicitly classifies it read-only. Grants are additive: an unrestricted
-     * connector or address grant wins over the guarded form. An address naming
-     * a tool the catalog lacks is unreachable and warned once, never widened.
-     */
-    connectorAccess: fn(),
-    /** Global payload-free activity reads. Defaults to interactive humans. */
-    activityAccess: fn(),
-    /** Shared credential and OAuth administration. Defaults to none. */
-    credentialAdministration: fn(),
-    /** Client-token lifecycle management by interactive humans. Defaults to false. */
-    accessTokenManagement: fn(),
-    /** Connecting or changing the caller's personal account. Defaults to none. */
-    personalConnection: fn(),
-};
 /** The choice every deployment makes explicitly while `trust` migrates (#820). */
 const READ_ONLY_REQUIRED = (path) => `${path} is required. Choose readOnly: true to refuse every write on /mcp, or readOnly: false to let ` +
     "call_destructive_tool and programs write with MCP client approval. Pools inherit it unless they set their own.";
@@ -202,6 +184,37 @@ function assertFlag(value, path) {
     if (typeof value !== "boolean")
         throw new ConfigError(`${path} must be true or false.`);
 }
+/** Longest pool `description`, in characters, after trimming. */
+const MAX_POOL_DESCRIPTION_LENGTH = 500;
+/**
+ * A pool description is one line of prose for the model. C0 and C1 controls
+ * (including NEL), plus Unicode line and paragraph separators, are refused.
+ * A scan, as in remote-mcp.ts,
+ * because a character class over the control range trips `no-control-regex`.
+ */
+function hasLineBreakOrControlCharacter(value) {
+    for (let index = 0; index < value.length; index++) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x1f || (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029)
+            return true;
+    }
+    return false;
+}
+function assertPoolDescription(value, path) {
+    const trimmed = typeof value === "string" ? value.trim() : undefined;
+    if (trimmed === undefined ||
+        trimmed.length === 0 ||
+        [...trimmed].length > MAX_POOL_DESCRIPTION_LENGTH ||
+        hasLineBreakOrControlCharacter(trimmed)) {
+        throw new ConfigError(`${path} must be text of 1 to ${MAX_POOL_DESCRIPTION_LENGTH} characters after trimming, with no line breaks or control characters.`);
+    }
+}
+/** Shape only; each reference resolves against auth and agents in createConnecta. */
+function assertMemberList(value, path) {
+    if (!Array.isArray(value)) {
+        throw new ConfigError(`${path} must be an array of principal ids, { namespace, id }, or "agent:<name>".`);
+    }
+}
 const pool = {
     /**
      * Whether this pool's endpoint refuses every write: write tools are absent
@@ -219,11 +232,35 @@ const pool = {
         },
     })),
     /**
-     * Whether this admitted identity may open the pool. Denied by default:
-     * a pool with no grant serves nobody. A false return, a throw, and an
-     * undeclared pool name are the same 404.
+     * Who may open `/mcp/<name>`: principal ids in the namespace of the one
+     * interactive auth provider, `{ namespace, id }`, or `"agent:<name>"` for a
+     * declared agent. Required and non-empty; the pool serves exactly its
+     * `tools` to these members and the same 404 to everyone else.
+     */
+    members: required(opaque({ check: assertMemberList }), (path) => `${path} is required: list who may open this pool, as principal ids, { namespace, id }, or "agent:<name>".`),
+    /**
+     * The Google Workspace address agents in this pool act as, on a Workspace
+     * connector whose `subject` is a mapping function. Humans always act as
+     * themselves through that mapping, and a fixed `subject` address applies to
+     * everyone. Without an owner, a mapping-subject Workspace connector is
+     * absent for this pool's agents, as a personal connector is; people in the
+     * pool still see it.
+     */
+    owner: opaque({
+        check: (value, path) => {
+            if (typeof value !== "string" || !isWorkspaceAddress(value.trim())) {
+                throw new ConfigError(`${path} must be a Google Workspace email address.`);
+            }
+        },
+    }),
+    /**
+     * What this pool is for, in plain words for the model: appended to the MCP
+     * `initialize` instructions at `/mcp/<name>` and `/agent/<name>`, so a
+     * caller learns its scope ("Team tier: shared tools only."). Trimmed, 1 to
+     * 500 characters, no line breaks or control characters. It grants and hides nothing; plain
+     * `/mcp` never shows it.
      */
-    grant: fn(),
+    description: opaque({ check: assertPoolDescription }),
 };
 const icon = {
     src: required(text()),
@@ -276,15 +313,26 @@ const connectaConfig = {
         },
         resolve: (value) => normalizeAuth(value === undefined ? [] : Array.isArray(value) ? value : [value]),
     }),
-    /** Code-derived connection visibility and independent management permissions. */
-    identity: object(identity),
     /**
-     * Whether this admitted identity may open plain `/mcp`. Omitted admits
-     * everyone; only literal true admits when configured. Other returns and
-     * throws receive the same 404 as a refused or undeclared pool.
+     * Agents, declared by name: lowercase letters, digits, `_` and `-`, each
+     * unique. Each has one `cta_` token slot that operators issue, rotate, and
+     * revoke; nothing outside code adds, renames, or rebinds an agent. Removing
+     * a name stops its token on the next request. Requires `accessTokens`.
+     * An admitted agent carries `identity.agent` and has no principal, so
+     * personal connectors are absent for it. Defaults to none.
+     */
+    agents: opaque({
+        check: (value, path) => assertAgentNames(value, path),
+        resolve: (value) => Object.freeze([...(value ?? [])]),
+    }),
+    /**
+     * The people who may use plain `/mcp`, which serves the whole catalog with
+     * the deployment's `readOnly`, and who administer the deployment. Same
+     * reference forms as pool `members`, people only. Required with inbound
+     * auth; a maintainer opens no pool unless listed among its members.
      */
-    grant: fn(),
-    /** Named tool pools, each served at `/mcp/<name>` to identities its grant admits. */
+    maintainers: opaque({ check: assertMemberList }),
+    /** Named tool pools, each served at `/mcp/<name>` to its members only. */
     pools: record(object(pool)),
     /** Exact connector id -> tool name -> verdict. Unknown names fail at catalog publication. */
     classification: record(record(opaque({
@@ -364,11 +412,11 @@ const connectaConfig = {
             }
         },
     }),
-    /** Optional managed client tokens, created by accessTokens() from /auth/access-tokens. */
+    /** Optional agent tokens for the declared `agents`, created by accessTokens() from /auth/access-tokens. */
     accessTokens: opaque({
         check: (value) => {
             const auth = isObject(value) ? value.auth : undefined;
-            if (!hasMethods(value, ["handle"]) ||
+            if (!hasMethods(value, ["handle", "slots", "forAgents"]) ||
                 !isObject(auth) ||
                 typeof auth.authorize !== "function" ||
                 auth.interactiveOperator) {
@@ -436,8 +484,46 @@ const connectaConfig = {
 const CONFIG = object(connectaConfig);
 /** Pause-only options #672 removed with `resume_execution`. */
 const RETIRED_PAUSE_OPTIONS = ["ConnectaConfig.execute.resumableWrites", "ConnectaConfig.execute.pausedRunTtlSeconds"];
+/** Access options pools replaced (#837, decisions/0006). */
+const isRetiredPoolGrant = (path) => /^ConnectaConfig\.pools\.[^.]+\.grant$/.test(path);
+/** Management resolvers maintainers and pool membership replaced (#837, decisions/0006). */
+const RETIRED_IDENTITY = [
+    ["credentialAdministration", "maintainers administer shared credentials and OAuth grants. List them in maintainers."],
+    [
+        "personalConnection",
+        "pool members connect and disconnect their own personal connectors in their pools, and maintainers their own. Add people to a pool's members.",
+    ],
+    [
+        "accessTokenManagement",
+        "maintainers issue, rotate, and revoke agent tokens from an interactive session. List them in maintainers.",
+    ],
+    ["activityAccess", "maintainers read activity; activity.readGate can still narrow it. List them in maintainers."],
+];
 /** `trust`, on the deployment or a pool, was replaced by `readOnly` (#820). */
 const isRetiredTrust = (path) => path === "ConnectaConfig.trust" || (path.startsWith("ConnectaConfig.pools.") && path.endsWith(".trust"));
+/**
+ * `identity` was removed whole (#837), so the walk reports only the section.
+ * Name each key it still holds, read by descriptor without running a getter
+ * or echoing a value, so a retired resolver's message names its replacement.
+ */
+function expandRetiredIdentity(config, paths) {
+    if (!paths.includes("ConnectaConfig.identity"))
+        return paths;
+    let keys = [];
+    try {
+        const descriptor = Reflect.getOwnPropertyDescriptor(config, "identity");
+        const value = descriptor && "value" in descriptor ? descriptor.value : undefined;
+        if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+            keys = Reflect.ownKeys(value).filter((key) => typeof key === "string");
+        }
+    }
+    catch {
+        keys = [];
+    }
+    if (keys.length === 0)
+        return paths;
+    return paths.flatMap((path) => path === "ConnectaConfig.identity" ? keys.map((key) => `ConnectaConfig.identity.${key}`) : [path]);
+}
 function rejectUnknownOptions(paths) {
     if (paths.length === 0)
         return;
@@ -455,6 +541,21 @@ function rejectUnknownOptions(paths) {
         (paths.some((path) => RETIRED_PAUSE_OPTIONS.includes(path))
             ? "\nPrograms no longer pause at writes, so there is nothing to configure: writable endpoints let programs and call_destructive_tool write; readOnly endpoints refuse every write (issue #672). Delete the option."
             : "") +
+        (paths.includes("ConnectaConfig.identity.connectorAccess")
+            ? "\nidentity.connectorAccess was removed (#837): pools are the access model. List who may use plain /mcp in maintainers, and give each pool its tools and members. A guarded { tool, requireReadOnly: true } grant becomes a pool with readOnly: true."
+            : "") +
+        RETIRED_IDENTITY.filter(([key]) => paths.includes(`ConnectaConfig.identity.${key}`))
+            .map(([key, replacement]) => `\nidentity.${key} was removed (#837): ${replacement}`)
+            .join("") +
+        (paths.some((path) => path === "ConnectaConfig.identity" || path.startsWith("ConnectaConfig.identity."))
+            ? "\nThe identity section was removed (#837): maintainers and pool members decide access and management. Delete it."
+            : "") +
+        (paths.includes("ConnectaConfig.grant")
+            ? "\nThe top-level grant was removed (#837); list the people who may use plain /mcp in maintainers."
+            : "") +
+        (paths.some(isRetiredPoolGrant)
+            ? "\nPool grant was removed (#837); list who may open the pool in its members."
+            : "") +
         (paths.some(isRetiredTrust)
             ? '\ntrust was removed (#820); set readOnly, which every deployment now chooses explicitly. trust: "read-only" becomes readOnly: true, which now also refuses call_destructive_tool. trust: "trusted" becomes readOnly: false. A pool inherits the deployment readOnly unless it sets its own.'
             : ""));
@@ -465,6 +566,10 @@ function assertCoherent(config) {
         config.discovery.catalogMaxTtlSeconds > 86_400) {
         throw new ConfigError("ConnectaConfig.discovery requires catalogMinTtlSeconds <= catalogMaxTtlSeconds <= 86400.");
     }
+    if (config.agents.length > 0 && !config.accessTokens) {
+        throw new ConfigError("ConnectaConfig.agents needs accessTokens: accessTokens(storage) from @zackbart/connecta/auth/access-tokens " +
+            "holds each agent's token slot.");
+    }
 }
 /**
  * Validate a configuration and apply every default. Unknown keys are refused
@@ -483,7 +588,7 @@ export function resolveConfig(config) {
  */
 export function readConfig(config) {
     const read = readPlain(config, "ConnectaConfig", CONFIG);
-    rejectUnknownOptions(read.unknown);
+    rejectUnknownOptions(expandRetiredIdentity(config, read.unknown));
     const input = read.value;
     const parsed = CONFIG.parse(input, "ConnectaConfig");
     assertCoherent(parsed);
@@ -492,10 +597,13 @@ export function readConfig(config) {
         name: parsed.serverInfo.name ?? "connecta",
         version: parsed.serverInfo.version ?? CONNECTA_VERSION,
     };
+    // The token module admits exactly the agents this configuration declares.
+    const accessTokens = parsed.accessTokens?.forAgents(parsed.agents);
     const resolved = Object.freeze({
         ...parsed,
+        accessTokens,
         // A managed-token module contributes one more provider, ordered with the rest.
-        auth: parsed.accessTokens ? normalizeAuth([parsed.accessTokens.auth, ...parsed.auth]) : parsed.auth,
+        auth: accessTokens ? normalizeAuth([accessTokens.auth, ...parsed.auth]) : parsed.auth,
         serverInfo: Object.freeze(info),
     });
     return { input, resolved };

package/dist/connector-access.d.ts

@@ -1,48 +1,18 @@
 import type { ToolAccess } from "./registry.js";
-import type { AuthenticatedIdentity } from "./types.js";
-/** A declared pool after construction-time validation. */
-export interface ResolvedPool {
-    /** Resolved: the pool's own `readOnly`, else the deployment's. */
-    readOnly: boolean;
-    access: ConnectorAccess;
-    grant(identity: Readonly<AuthenticatedIdentity>): boolean | Promise<boolean>;
-}
 export declare const POOL_NAME_RE: RegExp;
 /**
  * One derived view: which connectors, and for connectors granted by address
  * only, which tools. A connector absent from `toolAccess` is visible whole.
- * `guardedToolAccess` is a subset of `toolAccess` checked against the loaded
- * catalog each time tools are discovered or invoked.
  */
 export interface ConnectorAccess {
     connectorIds: "all" | readonly string[];
     toolAccess?: ToolAccess;
-    /** Exact tool grants that also require a current explicit read-only annotation. */
-    guardedToolAccess?: ToolAccess;
-}
-interface ReadOnlyToolGrant {
-    tool: string;
-    requireReadOnly: true;
 }
-export type ConnectorGrant = string | ReadOnlyToolGrant;
 /**
- * Normalize a grant list. A bare connector id grants every tool on that
+ * Normalize a pool's `tools`. A bare connector id grants every tool on that
  * connector; a `connector.tool` address grants one tool. Grants are additive,
  * so a bare id beside addresses for the same connector means the whole
- * connector. Identity resolution can opt into `{ tool, requireReadOnly: true }`
- * for a fixed address that also needs a current explicit read-only annotation;
- * pool declarations remain strings. Anything else throws, and the caller
- * decides whether that is a construction failure or a 403: a grant that
- * cannot be parsed must never fail open.
- */
-export declare function parseConnectorAccess(value: unknown, options?: {
-    allowReadOnly?: boolean;
-}): ConnectorAccess;
-/**
- * The view a pool endpoint serves: the pool's grants, never wider than the
- * identity's own. A connector or tool outside either side is gone; a
- * connector whose tool intersection is empty is gone too, so the pool can
- * only narrow what the identity resolver already allowed.
+ * connector. Anything else throws: a grant that cannot be parsed must never
+ * fail open.
  */
-export declare function intersectAccess(ceiling: ConnectorAccess, pool: ConnectorAccess): ConnectorAccess;
-export {};
+export declare function parseConnectorAccess(value: unknown): ConnectorAccess;

package/dist/connector-access.js

@@ -2,121 +2,37 @@ import { hasControlCharacters } from "./tool-name.js";
 export const POOL_NAME_RE = /^[a-z0-9_-]+$/;
 const CONNECTOR_ID_RE = /^[a-z0-9_-]+$/;
 // MCP does not restrict tool names, and remote servers ship spaced and
-// non-ASCII ones. Only control characters are refused, so a grant for a
-// legitimately named tool cannot 403 the whole identity at request time.
+// non-ASCII ones. Only control characters are refused, so a pool naming a
+// legitimately named tool still constructs.
 const TOOL_ADDRESS_RE = /^[a-z0-9_-]+\..{1,256}$/su;
 /**
- * Normalize a grant list. A bare connector id grants every tool on that
+ * Normalize a pool's `tools`. A bare connector id grants every tool on that
  * connector; a `connector.tool` address grants one tool. Grants are additive,
  * so a bare id beside addresses for the same connector means the whole
- * connector. Identity resolution can opt into `{ tool, requireReadOnly: true }`
- * for a fixed address that also needs a current explicit read-only annotation;
- * pool declarations remain strings. Anything else throws, and the caller
- * decides whether that is a construction failure or a 403: a grant that
- * cannot be parsed must never fail open.
+ * connector. Anything else throws: a grant that cannot be parsed must never
+ * fail open.
  */
-export function parseConnectorAccess(value, options = {}) {
-    if (value === "all")
-        return { connectorIds: "all" };
+export function parseConnectorAccess(value) {
     if (!Array.isArray(value))
         throw new Error("invalid connector permission");
     const whole = new Set();
-    const plain = new Map();
-    const guarded = new Map();
-    for (const entry of value) {
-        if (typeof entry === "string" && CONNECTOR_ID_RE.test(entry)) {
-            whole.add(entry);
+    const partial = new Map();
+    for (const address of value) {
+        if (typeof address === "string" && CONNECTOR_ID_RE.test(address)) {
+            whole.add(address);
             continue;
         }
-        const isGuarded = typeof entry !== "string";
-        if (isGuarded &&
-            (!options.allowReadOnly ||
-                entry === null ||
-                typeof entry !== "object" ||
-                Array.isArray(entry) ||
-                !Object.hasOwn(entry, "tool") ||
-                !Object.hasOwn(entry, "requireReadOnly") ||
-                Object.keys(entry).length !== 2 ||
-                entry.requireReadOnly !== true)) {
-            throw new Error("invalid connector permission");
-        }
-        const address = isGuarded ? entry.tool : entry;
         if (typeof address !== "string" || !TOOL_ADDRESS_RE.test(address) || hasControlCharacters(address)) {
             throw new Error("invalid connector permission");
         }
         const dot = address.indexOf(".");
         const connectorId = address.slice(0, dot);
-        const target = isGuarded ? guarded : plain;
-        const tools = target.get(connectorId) ?? new Set();
+        const tools = partial.get(connectorId) ?? new Set();
         tools.add(address.slice(dot + 1));
-        target.set(connectorId, tools);
-    }
-    for (const id of whole) {
-        plain.delete(id);
-        guarded.delete(id);
-    }
-    for (const [id, names] of plain) {
-        const restricted = guarded.get(id);
-        if (!restricted)
-            continue;
-        for (const name of names)
-            restricted.delete(name);
-        if (restricted.size === 0)
-            guarded.delete(id);
-    }
-    const partial = new Map(plain);
-    for (const [id, names] of guarded) {
-        const combined = partial.get(id) ?? new Set();
-        for (const name of names)
-            combined.add(name);
-        partial.set(id, combined);
+        partial.set(connectorId, tools);
     }
+    for (const id of whole)
+        partial.delete(id);
     const connectorIds = [...new Set([...whole, ...partial.keys()])];
-    return {
-        connectorIds,
-        ...(partial.size > 0 ? { toolAccess: partial } : {}),
-        ...(guarded.size > 0 ? { guardedToolAccess: guarded } : {}),
-    };
-}
-/**
- * The view a pool endpoint serves: the pool's grants, never wider than the
- * identity's own. A connector or tool outside either side is gone; a
- * connector whose tool intersection is empty is gone too, so the pool can
- * only narrow what the identity resolver already allowed.
- */
-export function intersectAccess(ceiling, pool) {
-    if (pool.connectorIds === "all")
-        return ceiling;
-    const allowedIds = ceiling.connectorIds === "all" ? null : new Set(ceiling.connectorIds);
-    const connectorIds = [];
-    const toolAccess = new Map();
-    const guardedToolAccess = new Map();
-    for (const id of pool.connectorIds) {
-        if (allowedIds && !allowedIds.has(id))
-            continue;
-        const fromPool = pool.toolAccess?.get(id);
-        const fromCeiling = ceiling.toolAccess?.get(id);
-        if (fromPool && fromCeiling) {
-            const both = new Set([...fromPool].filter((name) => fromCeiling.has(name)));
-            if (both.size === 0)
-                continue;
-            toolAccess.set(id, both);
-        }
-        else if (fromPool ?? fromCeiling) {
-            toolAccess.set(id, (fromPool ?? fromCeiling));
-        }
-        const guarded = ceiling.guardedToolAccess?.get(id);
-        if (guarded) {
-            const allowed = toolAccess.get(id);
-            const retained = allowed ? new Set([...guarded].filter((name) => allowed.has(name))) : guarded;
-            if (retained.size > 0)
-                guardedToolAccess.set(id, retained);
-        }
-        connectorIds.push(id);
-    }
-    return {
-        connectorIds,
-        ...(toolAccess.size > 0 ? { toolAccess } : {}),
-        ...(guardedToolAccess.size > 0 ? { guardedToolAccess } : {}),
-    };
+    return { connectorIds, ...(partial.size > 0 ? { toolAccess: partial } : {}) };
 }