@zackbart/connecta 0.33.0 → 0.34.1

package/dist/providers/_shared/google/workspace.js

@@ -12,8 +12,10 @@
  * Workspace address, and the provider reads the identity core attached beside
  * the context. An agent, which has no Workspace account, acts instead as the
  * `owner` of the pool it came through, which core copies from that pool's
- * config beside the identity; the mapping never sees an agent, and an agent
- * in a pool without an owner fails `auth_required` (decisions/0006). A fixed
+ * config beside the identity; the mapping never sees an agent. In a pool
+ * without an owner the connector is absent for agents (core's scoped
+ * registry view hides it), and this provider still fails `auth_required` if
+ * one reaches it anyway (decisions/0006). A fixed
  * `subject` address is every caller's, owners aside. No tool argument,
  * header, or program can name the subject — every product's base URL is
  * confined beneath `users/me`, or its product's equivalent, so the token's
@@ -59,7 +61,7 @@ import { tagWorkspaceSubject } from "../../../workspace-subject.js";
 import { delegatedToken, forgetDelegatedToken, parseServiceAccount, } from "./service-account.js";
 /** The closed options every Workspace provider accepts; see `assertKnownOptions`. */
 export const GOOGLE_WORKSPACE_OPTIONS = optionsOf()({
-    ...keys("purpose", "subject", "title", "instructions", "maxResultBytes", "baseUrl"),
+    ...keys("purpose", "subject", "title", "instructions", "maxResultBytes", "baseUrl", "readOnly"),
     // A string is the key's JSON; only the object form has keys to check.
     serviceAccount: optionsOf()(keys("clientEmail", "privateKey", "clientId")),
     callAdmission: CALL_ADMISSION,
@@ -109,6 +111,8 @@ async function subjectFor(provider, subject, ctx) {
     // An agent has no Workspace account of its own. It acts as the owner of the
     // pool it came through, which core copied from that pool's config, and the
     // mapping, which answers for people, is never asked about it (decisions/0006).
+    // Core's scoped view already hides the connector from an agent without an
+    // owner; this refusal is the fallback for any context built without it.
     if (caller.identity.agent !== undefined) {
         if (caller.pool !== undefined && isWorkspaceAddress(caller.poolOwner))
             return caller.poolOwner;

package/dist/providers/basecamp/index.d.ts

@@ -27,6 +27,8 @@ export interface BasecampOptions {
     instructions?: string;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     /**
      * Optional per-runtime policy. There is no default: Basecamp's API documents
      * several dynamically adjusted limits (GET versus POST, per second, hour,

package/dist/providers/breeze/index.d.ts

@@ -27,6 +27,8 @@ export interface BreezeOptions {
     callAdmission?: ConnectorCallAdmissionPolicy;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     /** Default `list_people` page size. Defaults to 100; connecta's cap is 1,000. */
     defaultPageSize?: number;
 }

package/dist/providers/ccb/index.d.ts

@@ -98,6 +98,8 @@ export interface CcbOptions {
     callAdmission?: ConnectorCallAdmissionPolicy;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
 }
 /** A maintained Church Community Builder (Pushpay ChMS) v2 connection. */
 export declare const ccb: import("../../provider.js").ProviderFactory<CcbOptions>;

package/dist/providers/ccb/index.js

@@ -25,7 +25,7 @@ import { skill } from "./skill.generated.js";
  *
  * Drift is handled the Vercel way: `src/providers/ccb/drift.json` records
  * every endpoint a named tool touches, and
- * `npm run providers:check -- --provider ccb` compares those rows with the
+ * `pnpm run providers:check --provider ccb` compares those rows with the
  * published, credential-free OpenAPI document at
  * https://docs.pushpay.io/chms-v2/openapi/chms-api-specs.json.
  */
@@ -1651,7 +1651,7 @@ function defaultTitle(environment, mode, writable) {
 }
 /** The closed options ccb() accepts; see `assertKnownOptions`. */
 const CCB_OPTIONS = optionsOf()({
-    ...keys("purpose", "title", "instructions", "environment", "mode", "clientId", "clientSecret", "access", "scopes", "subdomain", "defaultPerPage", "maxResultBytes"),
+    ...keys("purpose", "title", "instructions", "environment", "mode", "clientId", "clientSecret", "access", "scopes", "subdomain", "defaultPerPage", "maxResultBytes", "readOnly"),
     callAdmission: CALL_ADMISSION,
 });
 /** A maintained Church Community Builder (Pushpay ChMS) v2 connection. */

package/dist/providers/cloudflare/index.d.ts

@@ -15,6 +15,8 @@ interface CloudflareCommonOptions {
     instructions?: string;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
 }
 /** Cloudflare's hosted MCP server (`search` and `execute`) over OAuth. */
 export interface CloudflareOAuthOptions extends CloudflareCommonOptions {

package/dist/providers/cloudflare/index.js

@@ -68,6 +68,10 @@ const GLOBAL_API_KEY_CREDENTIAL = {
  */
 const CLOUDFLARE_MCP_CLASSIFICATION = {
     tools: {
+        docs: {
+            verdict: "read",
+            reason: "Searches Cloudflare documentation without executing API methods.",
+        },
         search: {
             verdict: "read",
             reason: "Searches the Cloudflare OpenAPI contract without executing API methods.",
@@ -116,7 +120,7 @@ function keyUsageGuide(auth, options) {
 
 REST with ${scheme}. Connector purpose: ${options.purpose}${auth === "globalApiKey" ? global_warning.trimEnd() : ""}${pin}${defaultLine}${key}${shared}${key_tail}${instructionsSection(options.instructions)}`;
 }
-const COMMON = keys("title", "authScope", "purpose", "instructions", "maxResultBytes");
+const COMMON = keys("title", "authScope", "purpose", "instructions", "maxResultBytes", "readOnly");
 const KEY_COMMON = keys("accountId", "zoneId", "baseUrl", "maxConcurrency");
 const PIN = optionsOf()(keys("accountIds", "zoneIds"));
 /** The closed options cloudflare() accepts, selected by `auth.type`; see `assertKnownOptions`. */