@zackbart/connecta 0.34.0 → 0.34.1

package/dist/providers/vercel/skill.generated.js

@@ -4,7 +4,7 @@ export const skill = {
     "instructionsHeading": "Account instructions",
     "fragments": {
         "oauth": "\n\nTool names, descriptions, argument schemas, and result schemas come from Vercel's live server. Connecta applies release-reviewed classification; reviewed writes stay writes even when Vercel claims they only read.\n\n- Discover the live catalog before assuming a tool exists. Vercel can change the surface independently of a Connecta release, and account features may affect what the authorization can reach.\n- Complete authorization and grant access to the owning team before acting. Listing this server does not prove team access.\n- MCP pagination and arguments follow the live MCP schemas; do not apply REST pagination or argument shapes to them.\n- Diagnose deployments with `get_deployment`, then build logs, runtime error clusters, and runtime logs.\n- `get_project_env` and `filter_project_envs` can return decrypted environment values, so Connecta reviews them as writes, and a read-only endpoint refuses them. Prefer reading variable keys and targets without values.\n- Purchase tools change billing. Read a quote first and carry its price, idempotency key, and requested term into the confirmed purchase unchanged.\n- `get_access_to_vercel_url` creates a temporary access grant. Treat the URL it returns as a credential and do not expose it outside the requested task.\n- `web_fetch_vercel_url` runs application code and is reviewed as destructive; the toolbar reply, reaction, edit, and resolve tools are writes.\n- `deploy_to_vercel` and `import-claude-design-from-url` can create or update live projects. Read the target and deployment mode before invoking them.\n- An `auth_required` failure means this connector's OAuth grant is missing or expired. Run `authorize_connector` for this connector id, then retry.\n",
-        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in deployment `errorMessage`, build-event `payload.text`/`text`, and runtime-log `message` on the reviewed deployment/log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Deployment metadata and other application content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. Deployment creation also inspects decoded `files[].data` when `encoding` is `base64` (one decode bounded by the field's encoded length and the host's request limit; malformed base64 is refused). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
+        "key": "\n\n- This is Connecta's REST connector to `api.vercel.com`, holding one operator-managed access token. A default team routes calls; it does not narrow what the token can reach.\n- `vercel_api_search` finds API operations, not records: it searches the pinned API index and names the tool that calls each operation. `vercel_api_details` returns one operation's parameters with types, enums, and required names. Neither sends a request.\n- `vercel_api_read` calls GET operations, plus reviewed POSTs that only read: `POST /v2/observability/query`, registrar availability, price, and search, and `POST /v8/artifacts`. `vercel_api_write` calls every other POST, PUT, PATCH, and DELETE, with `method` and `path` stated; a read-only endpoint refuses it.\n- Paths are concrete and carry the version search returned: `/v13/deployments/dpl_123`, not `/deployments/dpl_123`. Pass `query` and `body` as JSON objects named as `vercel_api_details` lists them. Every call is checked against the pinned index before it is sent: an unknown path returns the nearest operations, and an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Vercel, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }`. On a list, `page.next` is the cursor and `page.param` the query parameter to pass it as: `until` (a millisecond timestamp from `pagination.next`) on most lists, `cursor` on newer ones. Lists belong inside `execute_code`; pass `select` (dot paths such as `deployments.uid` and `deployments.state`) to keep only the fields the question needs.\n- `list_teams` returns team ids and slugs and the connection's default team. `get_deployment_build_logs` reads a deployment's build events without following live output. `get_runtime_logs` collects the runtime log stream for at most `waitMs` or `maxRows`, then stops and says why. Generic reads refuse `follow` and the runtime-log stream, which never end on their own.\n- `vercel_api_upload` sends explicit text or base64 bytes to an octet-stream operation, such as `POST /v2/files` before a deployment (Connecta computes `x-vercel-digest`). `vercel_api_write` sends JSON only.\n- Environment values never come back. `list_project_env_vars` never decrypts. `upsert_project_env_var` (`upsert: false` for create-only), `update_project_env_var`, and `delete_project_env_var` return metadata without values; values are write input only. Generic reads refuse `GET /v1/projects/{idOrName}/env/{id}`, `GET /v10/projects/{idOrName}/env`, `GET /v1/env/{id}`, and any `decrypt`, and Connecta replaces the value of every environment variable in any result with `\"[redacted]\"`, including project reads, shared variables, and audit events.\n- Other secrets read as `[redacted]` in every result: credential-named fields and their whole contents (`token`, `secret`, `password`, `jwt`, `credentials`, `Authorization`, …), protection-bypass secrets (each bypass's metadata stays under a numbered placeholder), deploy hook URLs, daemon liveness-probe header values and internal endpoint ciphertext, drain and webhook headers and signing secrets (including the one a new webhook or drain returns), drain and webhook destination URLs and external route, rewrite, and redirect destinations beyond their scheme and host, the args and values of every header, cookie, and query rule (route transforms and conditions, firewall conditions), conditional firewall bypass compiled `condition` expressions and their credential match values, team invite codes, synced Global Config items, and credentials inside other URLs. Failures of every reviewed operation, and of any operation whose request takes a credential-named field, say only the status and a reviewed code. Read or rotate withheld secrets in the Vercel dashboard. A `[redacted]` field is never the real value; do not send it back.\n- Refused by design: endpoints that mint credentials (access tokens, AI Gateway API keys, project OIDC and trace tokens, Connect and SSO tokens, Edge Config tokens, KMS-signed tokens, Flags SDK keys, protection-bypass secrets, installation credential rotation), Connect authorization requests, project transfer requests (the code lets another team claim the project), KMS signing, a domain move-out (its answer is a transfer token), Global Config items, backups, and tokens, and domain transfer auth codes. Each refusal names its reason.\n- The hosted OAuth connection's documentation search, runtime error clusters, toolbar threads, agent runs, web analytics summaries, purchase quotes, `deploy_to_vercel`, and access grants for protected URLs do not exist with a token. Configure an OAuth connector for those.\n- A `429` carries Vercel's reset time; Vercel meters endpoints separately, so wait before retrying the same operation. An `auth_required` failure means the token is missing, expired, or outside this team: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. A rejected argument comes back in Vercel's own words; read it rather than replacing the token.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in deployment `errorMessage`, build-event `payload.text`/`text`, and runtime-log `message` on the reviewed deployment/log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. Deployment metadata and other application content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. Deployment creation also inspects decoded `files[].data` when `encoding` is `base64` (one decode bounded by the field's encoded length and the host's request limit; malformed base64 is refused). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan.\n",
         "shared": "- Resolve team, project, and deployment ids with list reads; never guess one. Team ids begin `team_`, project ids `prj_`, and deployment ids `dpl_`.\n- Diagnose a deployment by reading its state first (`readyState`, `errorCode`, `errorMessage`), then its build logs, then runtime logs for a deployment that built. Narrow time windows before raising limits.\n- Environment variable changes apply only to future deployments; a new deployment is a separate write. Promoting an existing deployment to production does not rebuild it.\n- Treat every create, update, delete, promotion, cancellation, and purchase as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n"
     }
 };

package/dist/providers/vercel/value-safety.js

@@ -24,7 +24,7 @@
 // Residual risk, as with Infisical: a secret a person typed into a free-text
 // name, description, log line, or identifier is out of scope.
 // Embedded URL verdict (#812): reviewed paths + global signing parameters.
-// Evidence: pinned index/candidates sha256:32399b3ed273 identify deployment
+// Evidence: pinned index/candidates sha256:5a702fd2dc76 identify deployment
 // reads/creation/listing, build events and runtime logs; the operation/path
 // list below scans errorMessage, deployments.errorMessage, payload.text/text
 // and message respectively, both lists and individual named-stream rows.
@@ -33,9 +33,9 @@
 // other application content retain generic query parameters byte for byte.
 // Literal X-Amz-/X-Goog- Signature/Credential/Security-Token values are
 // withheld in every string. Existing structured-capability rules still apply.
-// The original full response document is unavailable at its unversioned URL:
-// current upstream differs and is supplementary evidence only. This is not a
-// claim of complete pinned-response review or of a Vercel-wide host policy.
+// The full pinned response document was reviewed on 2026-10-19, including
+// CI failureReason and task recommendations: no vendor-minted bearer links
+// are documented there. This is not a Vercel-wide host policy.
 import { redact, refuse as refusal, safe, under, } from "../_shared/rest/value-safety.js";
 /** A refusal's reason reads as a sentence about the operation: "It mints …". */
 const refuse = (reason) => refusal(`It ${reason}`);
@@ -51,6 +51,7 @@ const PROJECT = [
     "internalRoutes[].missing[?header].value",
     "security.firewallRoutes[].has[?header].value",
     "security.firewallRoutes[].missing[?header].value",
+    "security.firewallRoutes[].response_has[?header].value",
 ];
 /** Project metadata whose names contain a credential word. */
 const PROJECT_ALLOW = [
@@ -112,6 +113,7 @@ const FIREWALL_CONDITIONS = [
 ];
 /** Every firewall config shape: rules, rulesets, and top-level conditions, active, draft, and versions. */
 const FIREWALL = under(["rules[]", "rulesets[]", "conditions[]"], FIREWALL_CONDITIONS);
+const BYPASS_CONDITIONS = ["condition", "conditionGroup[].conditions[?header].value"];
 const FIREWALL_REASON = "Firewall rules match header, cookie, and query values, which can be credentials a rule checks for (an X-Auth-Key).";
 const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team (visible to owners).";
 /**
@@ -120,6 +122,11 @@ const TEAM_INVITE = "Teams carry inviteCode, which lets its holder join the team
  * these operations project it themselves (value-safe environment variables).
  */
 const VALUE_SAFETY = {
+    "GET /ai-gateway/budgets/list": safe("Coverage counts per API key; no key value.", ["defaultCoveredCounts.api-key"]),
+    "GET /v8/artifacts/status": safe("Remote-cache read-only status is a flag.", ["readOnly"]),
+    "GET /v1/security/firewall/bypass/rules": redact(FIREWALL_REASON, under(["", "rules[]"], BYPASS_CONDITIONS)),
+    "POST /v1/security/firewall/bypass/rules": redact("The compiled condition and header, cookie, or query matches can contain stored credentials.", BYPASS_CONDITIONS),
+    "DELETE /v1/security/firewall/bypass/rules": safe("Deletes a conditional bypass rule; no response value."),
     "PATCH /aliases/{id}/protection-bypass": refuse("creates a shareable link that bypasses Deployment Protection."),
     "POST /api-keys": refuse("mints an AI Gateway API key and returns it in cleartext."),
     "POST /v1/connect/authorize/{connector}": refuse("starts a Connect authorization for a caller-chosen subject and returns its verifier and device code."),
@@ -185,6 +192,9 @@ const VALUE_SAFETY = {
     "POST /v1/kms/issuers/{issuerId}/sign/token": refuse("signs a token with the issuer's private key."),
     "GET /v1/microfrontends/groups/{groupId}/projects": redact(PROJECT_REASON, under(["projects[]"], PROJECT), under(["projects[]"], PROJECT_ALLOW)),
     "POST /v1/projects/traces/session": refuse("mints a trace session token for a deployment."),
+    "GET /v1/projects/{idOrName}/daemons": redact("Daemon liveness probes store custom HTTP header values that may authenticate under arbitrary names; encrypted internal endpoint data is also withheld.", ["daemons.config.livenessProbe.httpGet.httpHeaders.value", "daemons.replicas.items.iroh.publicKeyCiphertext"]),
+    "PUT /v1/projects/{idOrName}/daemons/{daemonName}/instances": safe("Returns only an ok boolean after scaling instances."),
+    "POST /v1/projects/{idOrName}/daemons/{daemonName}/instances/{instanceId}/restart": safe("Returns only an ok boolean after accepting an instance restart."),
     "POST /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
     "DELETE /v1/projects/{idOrName}/avatar": redact(PROJECT_REASON, PROJECT, PROJECT_ALLOW),
     "DELETE /v1/projects/{idOrName}/env": redact(ENV_REASON, PROJECT_ENV),

package/dist/registry.d.ts

@@ -124,6 +124,8 @@ export interface RegistryView {
     /** Age of the complete cached catalog; null for static or unobserved catalogs. */
     catalogAgeMs(id: string): number | null;
     statusFor(id: string, baseUrl: string, requestScope?: object, callOptions?: ConnectorOperationOptions): Promise<ConnectorStatus>;
+    /** Rebuild a status with this partition's latest bounded observations, without probing. */
+    withCatalogObservations(id: string, baseUrl: string, status: ConnectorStatus): ConnectorStatus;
     invalidateStored(id: string): Promise<void>;
     /** Bind returned OAuth state to its initiating user for either owner scope. */
     bindOAuthHandoff(id: string, authorizationUrl: string, principalKey?: string): Promise<void>;
@@ -159,13 +161,8 @@ export declare class Registry implements RegistryView {
     private readonly catalogObservedAt;
     /** Last payload-free agent catalog access in this runtime. */
     private readonly catalogAccess;
-    /** Count-only intake findings, including catalogs loaded from storage. */
-    private droppedToolNames;
-    /**
-     * Schema digest verification per reviewed facts array. Only the registry's
-     * own deep-frozen arrays are keys, so an entry stays true while they live.
-     */
-    private readonly verifiedFacts;
+    /** Bounded tokens isolating count-only observations by catalog identity. */
+    private readonly catalogObservationPartitions;
     private readonly observedOutputSchemas;
     /** Result-size guard cap threaded to the meta-tools. */
     readonly maxResultBytes: number;
@@ -220,11 +217,10 @@ export declare class Registry implements RegistryView {
     }): Promise<CallAdmissionPermit>;
     /** Connector totals across root and personal controllers; health removes ids. */
     callAdmissionSnapshot(): Record<string, ConnectorCallAdmissionSnapshot>;
-    /**
-     * The drift a connector last showed in this runtime: the registry's own
-     * observation against a connector's `classification`, otherwise whatever
-     * the connector's `catalogDrift()` seam reports, bounded either way.
-     */
+    /** The admitted identity fields used by both catalog caching and reporting. */
+    private catalogPartition;
+    /** Bounded, in-memory tokens; no principal or catalog data is persisted. */
+    private catalogObservationPartition;
     private catalogDriftOf;
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission(): void;
@@ -268,8 +264,6 @@ export declare class Registry implements RegistryView {
     private loadDownstreamTools;
     /** The served catalog excludes control-character names; raw caches stay complete. */
     private acceptToolNames;
-    /** Observe intake once, never while serving an older cached listing. */
-    private observeDroppedToolNames;
     /**
      * One connector's catalog as served: the cached downstream facts, classified
      * on every read by the connector's `classification`, into fresh objects.
@@ -287,6 +281,8 @@ export declare class Registry implements RegistryView {
     credentialDriftFor(id: string): Promise<string | undefined>;
     /** Age of a complete cache entry; reads never refresh it. */
     catalogAgeMs(id: string): number | null;
+    /** Pure lookup shared by status probes and operator catalog refreshes. */
+    withCatalogObservations(id: string, baseUrl: string, status: ConnectorStatus, scope?: RegistryScope): ConnectorStatus;
     /** Best-effort connector status for the operator UI. */
     statusFor(id: string, baseUrl: string, requestScope?: object, callOptions?: ConnectorOperationOptions, scope?: RegistryScope): Promise<ConnectorStatus>;
     /** Rotate the storage generation; in-flight old readers cannot republish it. */

package/dist/registry.js

@@ -229,13 +229,8 @@ export class Registry {
     catalogObservedAt = new Map();
     /** Last payload-free agent catalog access in this runtime. */
     catalogAccess = new Map();
-    /** Count-only intake findings, including catalogs loaded from storage. */
-    droppedToolNames = new Map();
-    /**
-     * Schema digest verification per reviewed facts array. Only the registry's
-     * own deep-frozen arrays are keys, so an entry stays true while they live.
-     */
-    verifiedFacts = new WeakMap();
+    /** Bounded tokens isolating count-only observations by catalog identity. */
+    catalogObservationPartitions = new Map();
     observedOutputSchemas;
     /** Result-size guard cap threaded to the meta-tools. */
     maxResultBytes;
@@ -263,6 +258,9 @@ export class Registry {
             if (this.connectors.has(c.id)) {
                 throw new Error(`Duplicate connector id "${c.id}"`);
             }
+            if (c.readOnly !== undefined && typeof c.readOnly !== "boolean") {
+                throw new Error(`Connector "${c.id}" readOnly must be a boolean.`);
+            }
             if (c.authScope !== undefined && c.authScope !== "shared" && c.authScope !== "personal") {
                 throw new Error(`Invalid authScope on connector "${c.id}": expected "shared" or "personal"`);
             }
@@ -332,9 +330,6 @@ export class Registry {
             catalogStorage: this.opts.catalogStorage ?? this.opts.storage,
             constructionChecks: false,
         });
-        // Counts only, like the connector-wide reviewed drift observation. No
-        // principal, credentials, or catalog payload crosses this registry boundary.
-        registry.droppedToolNames = this.droppedToolNames;
         if (this.callAdmissionClosed)
             registry.closeCallAdmission();
         this.personalRegistries.set(principalKey, registry);
@@ -503,13 +498,7 @@ export class Registry {
         attachCaller(context, scope?.caller);
         attachCatalogCache(context, {
             storage: this.opts.catalogStorage ?? this.opts.storage,
-            partition: JSON.stringify([
-                scope?.principalKey ?? this.opts.credentialOwner ?? null,
-                scope?.subjectKey ?? null,
-                scope?.caller?.identity ?? null,
-                scope?.caller?.authenticated ?? false,
-                scope?.caller?.pool ?? null,
-            ]),
+            partition: this.catalogPartition(scope),
             sharedPartition: JSON.stringify([baseUrl, this.opts.publicUrl ?? null, scope?.caller?.pool ?? null]),
             defaultTtlMs: (this.opts.toolCacheTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds) * 1000,
             minTtlMs: (this.opts.catalogMinTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogMinTtlSeconds) * 1000,
@@ -553,26 +542,38 @@ export class Registry {
         }
         return Object.fromEntries([...snapshots].map(([id, values]) => [id, aggregateCallAdmissionSnapshots(values)]));
     }
-    /**
-     * The drift a connector last showed in this runtime: the registry's own
-     * observation against a connector's `classification`, otherwise whatever
-     * the connector's `catalogDrift()` seam reports, bounded either way.
-     */
-    catalogDriftOf(connector) {
-        const report = boundedCatalogDrift(catalogReviewOf(connector) ? observedCatalogDrift(connector) : connector.catalogDrift?.());
-        const dropped = this.droppedToolNames.get(connector.id);
-        if (!dropped)
-            return report;
-        return {
-            ...(report ?? {
-                unclassifiedTools: 0,
-                unservedTools: 0,
-                annotationConflicts: 0,
-                schemaChanges: 0,
-            }),
-            observedAt: dropped.observedAt,
-            ...(dropped.count > 0 ? { droppedTools: dropped.count } : {}),
-        };
+    /** The admitted identity fields used by both catalog caching and reporting. */
+    catalogPartition(scope) {
+        return JSON.stringify([
+            scope?.principalKey ?? this.opts.credentialOwner ?? null,
+            scope?.subjectKey ?? null,
+            scope?.caller?.identity ?? null,
+            scope?.caller?.authenticated ?? false,
+            scope?.caller?.pool ?? null,
+        ]);
+    }
+    /** Bounded, in-memory tokens; no principal or catalog data is persisted. */
+    catalogObservationPartition(id, baseUrl, scope, create = false) {
+        const key = JSON.stringify([id, this.catalogPartition(scope), baseUrl, this.opts.publicUrl ?? null]);
+        let partition = this.catalogObservationPartitions.get(key);
+        if (!partition && create) {
+            partition = {};
+            this.catalogObservationPartitions.set(key, partition);
+            if (this.catalogObservationPartitions.size > 1024)
+                this.catalogObservationPartitions.delete(this.catalogObservationPartitions.keys().next().value);
+        }
+        return partition;
+    }
+    catalogDriftOf(connector, baseUrl, scope) {
+        const partition = this.catalogObservationPartition(connector.id, baseUrl, scope);
+        const observed = partition ? observedCatalogDrift(connector, partition) : undefined;
+        // Plugin reports cannot establish a reviewed baseline or schema coverage
+        // that this registry has not checked. Personal plugin seams have no subject
+        // parameter and must never bypass the partition above.
+        const fallback = !observed && !catalogReviewOf(connector) && connector.authScope !== "personal"
+            ? connector.catalogDrift?.()
+            : undefined;
+        return boundedCatalogDrift(observed ?? (fallback ? { ...fallback, reviewedBaseline: false } : undefined));
     }
     /** Reject queued/future downstream admission; active permits release safely. */
     closeCallAdmission() {
@@ -745,7 +746,7 @@ export class Registry {
         if (!connector)
             throw new Error(`Unknown connector "${id}"`);
         if (connector.staticTools)
-            return markCatalogFreshness(connector.staticTools, Infinity);
+            return { tools: markCatalogFreshness(connector.staticTools, Infinity), verification: undefined };
         const ctx = this.contextFor(id, baseUrl, requestScope, callOptions, scope);
         let listed;
         try {
@@ -766,10 +767,8 @@ export class Registry {
         }
         const facts = frozenFacts(structuredClone(tools));
         const accepted = this.acceptToolNames(facts);
-        this.observeDroppedToolNames(connector, facts.length - accepted.length);
         const review = catalogReviewOf(connector);
-        if (review)
-            await observeReviewedDrift(connector, review, accepted, this.opts.logger);
+        const verification = await observeReviewedDrift(connector, review, accepted, this.opts.logger, this.catalogObservationPartition(id, baseUrl, scope, true), facts.length - accepted.length);
         if (catalogFetchedAt(ctx) === undefined) {
             try {
                 await storeCustomCatalogFallback(ctx, id, facts);
@@ -791,19 +790,13 @@ export class Registry {
             state: freshUntil > Date.now() ? "fresh" : "stale",
             observedAt: new Date().toISOString(),
         });
-        return markCatalogFreshness(facts, freshUntil);
+        return { tools: markCatalogFreshness(accepted, freshUntil), verification };
     }
     /** The served catalog excludes control-character names; raw caches stay complete. */
     acceptToolNames(tools) {
         const accepted = tools.filter((tool) => !hasControlCharacters(tool.name));
         return accepted.length === tools.length ? tools : accepted;
     }
-    /** Observe intake once, never while serving an older cached listing. */
-    observeDroppedToolNames(connector, count) {
-        if (count > 0 || this.droppedToolNames.has(connector.id)) {
-            this.droppedToolNames.set(connector.id, { count, observedAt: new Date().toISOString() });
-        }
-    }
     /**
      * One connector's catalog as served: the cached downstream facts, classified
      * on every read by the connector's `classification`, into fresh objects.
@@ -813,7 +806,7 @@ export class Registry {
      * the next read.
      */
     async loadTools(id, baseUrl, requestScope, callOptions = {}, scope) {
-        const tools = await this.loadDownstreamTools(id, baseUrl, requestScope, callOptions, scope);
+        const { tools, verification } = await this.loadDownstreamTools(id, baseUrl, requestScope, callOptions, scope);
         const connector = this.connectors.get(id);
         if (!connector)
             throw new Error(`Unknown connector "${id}"`);
@@ -822,7 +815,7 @@ export class Registry {
         this.validateClassification(id, accepted, overrides);
         const review = catalogReviewOf(connector);
         return carryCatalogFreshness(tools, review
-            ? await classifyCatalog(review, id, accepted, this.opts.logger, this.verifiedFacts, overrides)
+            ? await classifyCatalog(review, id, accepted, this.opts.logger, overrides, verification)
             : accepted.map((tool) => this.publishUnreviewedTool(id, tool)));
     }
     publishUnreviewedTool(id, tool) {
@@ -904,6 +897,20 @@ export class Registry {
         const observedAt = this.catalogObservedAt.get(id);
         return observedAt === undefined ? null : Math.max(0, Date.now() - observedAt);
     }
+    /** Pure lookup shared by status probes and operator catalog refreshes. */
+    withCatalogObservations(id, baseUrl, status, scope) {
+        const connector = this.connectors.get(id);
+        if (!connector)
+            return ownStatus({ state: "error", message: "Unknown connector" });
+        const report = this.catalogDriftOf(connector, baseUrl, scope);
+        const access = this.catalogAccess.get(id);
+        // Connector.status is an open plugin seam. Rebuild its public fields so
+        // it cannot smuggle payload or another partition's observations (INV-6).
+        return Object.assign(boundedStatus(status), {
+            ...(report ? { catalogDrift: report } : {}),
+            ...(access ? { catalogAccess: { ...access } } : {}),
+        });
+    }
     /** Best-effort connector status for the operator UI. */
     async statusFor(id, baseUrl, requestScope = {}, callOptions = {}, scope) {
         const connector = this.connectors.get(id);
@@ -917,18 +924,7 @@ export class Registry {
         // The report is rebuilt rather than spread through: what the seam returned
         // is third-party output, and status is read by the operator UI and copied
         // into responses.
-        const withObservations = (status) => {
-            const report = this.catalogDriftOf(connector);
-            const access = this.catalogAccess.get(id);
-            // Connector.status is an open plugin seam. Rebuild its public fields so
-            // a connector cannot smuggle payload through either registry-owned
-            // observation when this runtime has not made one, nor through its
-            // message, which survives only when connecta wrote it (INV-6).
-            return Object.assign(boundedStatus(status), {
-                ...(report ? { catalogDrift: report } : {}),
-                ...(access ? { catalogAccess: { ...access } } : {}),
-            });
-        };
+        const withObservations = (status) => this.withCatalogObservations(id, baseUrl, status, scope);
         // Credential declarations own their readiness even when a static catalog
         // or a plugin status would otherwise report success. Never probe an empty slot.
         if (connector.credential) {
@@ -1108,6 +1104,10 @@ class ScopedRegistryView {
             ? registry.statusFor(args[0], args[1], args[2], args[3], this.scope)
             : Promise.resolve({ state: "error", message: "Unknown connector" });
     }
+    withCatalogObservations(id, baseUrl, status) {
+        return (this.registryFor(id)?.withCatalogObservations(id, baseUrl, status, this.scope) ??
+            ownStatus({ state: "error", message: "Unknown connector" }));
+    }
     invalidateStored(id) {
         const registry = this.registryFor(id);
         return registry ? registry.invalidateStored(id) : Promise.resolve();

package/dist/routes/ui-data.js

@@ -74,7 +74,13 @@ export function uiData(registry, baseUrl, options) {
                 }))).pipe(Effect.map((tools) => ({ status, tools, catalogFailed: false })), 
                 // The registry owns the failed catalog observation; the page only
                 // needs to know there was one.
-                Effect.catch(() => Effect.succeed({ status, tools: [], catalogFailed: !signal.aborted })));
+                Effect.catch(() => Effect.succeed({ status, tools: [], catalogFailed: !signal.aborted })), 
+                // Loading the catalog may replace an earlier clean observation.
+                // Read this view's current bounded facts without another status probe.
+                Effect.map((observed) => ({
+                    ...observed,
+                    status: registry.withCatalogObservations(c.id, baseUrl, observed.status),
+                })));
             }).pipe(Effect.catch((error) => Effect.succeed({
                 status: failureStatus(c.id, error),
                 tools: [],
@@ -168,7 +174,7 @@ export function uiData(registry, baseUrl, options) {
                 toolCount: tools.length,
                 tools,
                 // Counts only, and only when a refresh in this runtime produced them.
-                // `Registry.statusFor` already rebuilt the report through
+                // `Registry.withCatalogObservations` rebuilt the report through
                 // `boundedCatalogDrift`, so what lands here cannot carry a name or a
                 // schema even if the plugin seam returned one.
                 ...(status.catalogDrift ? { catalogDrift: status.catalogDrift } : {}),

package/dist/skills.js

@@ -86,7 +86,11 @@ export function connectorSkillName(connectorId) {
 export function connectorGuide(connector) {
     const guide = connector.usageGuide;
     const content = typeof guide === "string" ? guide : guide?.content;
-    return content && content.trim() !== "" ? content : undefined;
+    if (!content || content.trim() === "")
+        return undefined;
+    return connector.readOnly === true
+        ? `Read-only connection: only read-classified tools are available. Write calls are refused, including tools named in this guide.\n\n${content}`
+        : content;
 }
 /** Discovery budget for one connector-guide summary, including an ellipsis. */
 export const GUIDE_SUMMARY_LENGTH = 120;
@@ -298,7 +302,9 @@ export function connectorGuideSummary(connector) {
             // normalization here so direct Connector callers see the same text.
             boundedSummary(connector.usageGuide.summary ?? "")
         : undefined;
-    return configured ?? summarizeGuide(connector, guide);
+    const original = typeof connector.usageGuide === "string" ? connector.usageGuide : connector.usageGuide?.content;
+    const summary = configured ?? summarizeGuide(connector, original ?? guide);
+    return connector.readOnly === true ? boundedSummary(`Read-only. ${summary}`) : summary;
 }
 /** Whether correct use always depends on conventions outside the tool schema. */
 export function connectorGuideRequired(connector) {

package/dist/types.d.ts

@@ -252,12 +252,15 @@ export interface ReviewedTool {
     /** Why the verdict holds when the name or downstream annotations do not say. */
     readonly reason?: string;
     /**
-     * `sha256:<hex>` digest of the input and output schemas the review read.
+     * `sha256-sets-v1:<hex>` digest of the reviewed input/output schemas.
+     * Legacy `sha256:<hex>` pins retain literal array ordering.
      * Omit until a review has actually read them; an invented digest reports
      * drift that never happened. When the live schema no longer matches it, or
      * it cannot be checked, the verdict lapses and the tool is served as a write.
      */
     readonly schemaDigest?: string;
+    /** Absence is expected under plan, feature, or permission gating. */
+    readonly optional?: boolean;
 }
 /**
  * A reviewed classification of a downstream MCP catalog, keyed by exact tool
@@ -287,7 +290,7 @@ export interface CatalogDriftCounts {
     droppedTools?: number;
     /** Live tools no release classified. Each one fails closed at call time. */
     unclassifiedTools: number;
-    /** Classified names this catalog no longer serves — plan gating included. */
+    /** Required reviewed names this catalog no longer serves. */
     unservedTools: number;
     /** Explicit downstream annotations that contradict a vetted verdict. */
     annotationConflicts: number;
@@ -296,6 +299,15 @@ export interface CatalogDriftCounts {
 }
 /** One drift observation, taken while serving a catalog refresh. */
 export interface CatalogDriftReport extends CatalogDriftCounts {
+    /** False when this listing has no reviewed classification to compare. */
+    reviewedBaseline?: boolean;
+    /** Whether all pinned schemas could be checked on this observation. */
+    verification?: "complete" | "unavailable";
+    /** Live reviewed tools with and without recorded schema digests. */
+    schemaCoverage?: {
+        pinned: number;
+        unpinned: number;
+    };
     /** When the observation was taken; never when a probe was scheduled. */
     observedAt: string;
 }
@@ -364,6 +376,8 @@ export type ConnectorSkillResourceContents = {
 });
 /** The whole plugin contract — the one open seam. */
 export interface Connector {
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     id: string;
     /**
      * Who owns this connector's downstream authentication. `shared` keeps one
@@ -398,7 +412,7 @@ export interface Connector {
      * cross-operation sequencing rule).
      *
      * Served as `skill://connecta/connectors/<slug>/SKILL.md`, with generated
-     * frontmatter followed by the unchanged guide body. `connector:<id>` is a
+     * frontmatter, a read-only policy notice when configured, and the guide body. `connector:<id>` is a
      * one-release lookup alias. The guide remains deployment-owned configuration;
      * no runtime registration or shared mutable copy exists.
      */
@@ -605,7 +619,7 @@ export interface ConnectorDescription {
     tools?: ConnectorToolDescription[];
 }
 export interface ConnectorUsageGuide {
-    /** Markdown returned verbatim by `skills({ name: "connector:<id>" })`. */
+    /** Markdown served by `skills`, with a policy notice when the connector is read-only. */
     content: string;
     /**
      * Discovery hint describing the conventions the guide covers. Whitespace is

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const CONNECTA_VERSION = "0.34.0";
+export declare const CONNECTA_VERSION = "0.34.1";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Generated from package.json by scripts/generate-version.mjs.
 // Workers-safe: no runtime filesystem read or deployment override.
-export const CONNECTA_VERSION = "0.34.0";
+export const CONNECTA_VERSION = "0.34.1";

package/documentation/architecture.md

@@ -148,6 +148,7 @@ An admitted non-preflight `/mcp` request then takes five steps in
    (`src/membership.ts`, `admitsMaintainer`, `memberPool`, and `agentPool` in
    `src/routes/shared.ts`). Nothing intersects or widens either view; every
    refusal is one 404 naming no pool.
+   Connector `readOnly` is enforced by catalog discovery and invocation before dispatch: effective read-only is endpoint OR connector, including on plain `/mcp`. Maintained provider construction carries the policy through the shared factory.
    The endpoint's `readOnly` is the pool's own value, else the deployment's;
    plain `/mcp` uses the deployment's. It travels to the meta-tools and the
    program as one boolean that drops writes from `CatalogService` search and
@@ -158,7 +159,7 @@ An admitted non-preflight `/mcp` request then takes five steps in
    narrower slice, and the subject and principal keys. Personal connectors use
    the principal partition and result paging the subject partition with principal,
    endpoint/pool, origin, connector, and tool bindings. Paging re-admits the
-   caller at its endpoint and rechecks the endpoint's `readOnly`; no caller parameter selects a partition (`test/identity-scope.test.ts`).
+   caller at its endpoint and rechecks endpoint OR connector `readOnly`; no caller parameter selects a partition (`test/identity-scope.test.ts`).
 5. **Serve.** Refuse `?toolkit=` with a 404 — the toolkits are gone
    ([#178](https://github.com/zackbart/connecta/issues/178)) but their URLs were
    handed out, and retiring a scoping boundary into fail-open is worse than any
@@ -1062,7 +1063,7 @@ every vendor ships one reviewed table through one mechanism
    message/error and raw string/object source payloads in both events and
    invocation maps. The shared review harness rejects embedded-URL operation
    keys absent from each vendor's pinned index and invalid path syntax.
-   Vercel's unavailable full pin remains a review limitation.
+   The current Vercel pin was reviewed from its full response document; its unversioned URL does not retain older documents.
    Generic parameters in descriptions, metadata, nicknames, billing footers,
    notes, DNS TXT, KV values and operator HTML retain their original bytes,
    including whole URL strings. Ordinary code/key URLs can be false positives
@@ -1165,7 +1166,7 @@ a table.
 
 `remoteMcp({ classify })` is the public way to declare what a downstream's
 tools do: `{ tools: { name: "read" | "write" | "destructive" | { verdict,
-reason?, schemaDigest? } }, unlisted?: "hide" }`, validated at construction. It fails closed
+reason?, schemaDigest?, optional? } }, unlisted?: "hide" }`, validated at construction. It fails closed
 (INV-1): a reviewed read fills silence but yields to an explicit write
 annotation, a reviewed write stays a write whatever the downstream claims, an
 unlisted tool is a read only when it says so, and a reviewed tool whose
@@ -1191,8 +1192,50 @@ receives a separate deep copy of its definition, so mutations cannot change
 classification, schemas, or write accounting later in the same program.
 A restart applies the current review to cached SDK facts. Retired registry
 manifest versions 2 and 3 are ignored and expire on their original TTL.
-During successful listings the registry counts drift against the same record, and `scripts/drift-check.mjs` compares
-its names with published inventories. The internal `withVettedCatalog()`
+During listings the registry counts drift against the same record. Optional
+reviewed tools do not count as unserved when gated out. Reports carry an explicit
+reviewed-baseline fact, counts of live reviewed tools with and without schema
+pins, and complete/unavailable schema verification. A digest failure replaces
+the previous observation rather than retaining a stale clean result (INV-1,
+INV-6). Observation and classification share the same verification result for each
+listing; classification still fails closed.
+
+Reports are in-memory only, weakly keyed by connector and a registry-owned
+catalog partition token. The partition uses the same admitted principal,
+subject, caller identity, authenticated flag and pool as catalog caching, plus
+connector id and endpoint URLs. Personal registries do not share tokens with
+each other or the root. Each registry retains at most 1,024 tokens; eviction or
+restart yields no observation, never another subject's counts. No new storage
+key or durable catalog record is introduced.
+
+New schema pins use `sha256-sets-v1:<hex>`. Canonicalization sorts object keys
+and schema `required`, `enum`, and `type` arrays, including schema-valued
+legacy dependencies. Tuple arrays and JSON data
+inside defaults, constants, enum members and examples retain order. Existing
+`sha256:<hex>` pins continue using the original key-sorted, literal-array
+algorithm; their reviewed digests are unchanged. Migrating a legacy pin requires
+reviewing the complete schemas and recording a new versioned digest. Legacy
+pins may still report conservative drift for array reordering until migrated.
+The iterative digest retains the whole-schema node ceiling in both formats.
+
+Contributor evidence: `test/provider-schema-pins.test.ts` checks every provider
+construction case in the generated roster. Every pinned digest requires a
+complete captured schema that passes runtime verification; changed input or
+output schemas must fail it. The guard also exercises both digest prefixes.
+
+The maintainer `scripts/drift-check.mjs` compares published inventories with
+provider evidence. Table inventories can require `inventory.accessColumn` and
+record `reviewedAccess` (`read` or `write`, with destructive verdicts recorded
+as write). These access snapshots must agree with the provider's runtime
+classification. A documented access change or disappearance of a reviewed explicit Access
+value is advisory drift, never an
+automatically accepted verdict. An explicit access value makes an
+`acknowledgedUnclassified` entry stale: report it and resume reporting that
+unreviewed tool as an addition. Missing tools and already reviewed names also
+invalidate such acknowledgements. Duplicate explicit access values must agree;
+a blank duplicate does not erase an explicit value elsewhere. Missing required
+columns in any tool table, unknown access values and conflicting rows are provider-local parser
+findings. The internal `withVettedCatalog()`
 helper has been removed. Public provider `*_VETTED_CATALOG` exports remain
 deprecated aliases derived from each definition
 (`test/classified-decorators.test.ts`, `test/hosted-presets.test.ts`).