@zackbart/connecta 0.34.0 → 0.34.1

package/dist/connectors/option-shapes.js

@@ -5,7 +5,7 @@
 // path instead of silently doing nothing (INV-11). Values stay the factory's
 // to validate; handlers, schemas, and loggers pass through as `opaque()`.
 import { array, keys, optionsOf, strings, variants } from "../config-schema.js";
-export { CALL_ADMISSION, PROVIDER_COMMON } from "../provider.js";
+export { READ_ONLY, CALL_ADMISSION, PROVIDER_COMMON } from "../provider.js";
 export const CREDENTIAL = optionsOf()({
     ...keys("label", "description", "placeholder"),
     fields: array(optionsOf()(keys("name", "label", "description", "placeholder", "inputType"))),

package/dist/connectors/remote-mcp.d.ts

@@ -82,6 +82,8 @@ export interface RemoteMcpOptions {
      * construct.
      */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     /** Optional per-runtime downstream call-admission policy. */
     callAdmission?: ConnectorCallAdmissionPolicy;
     /**

package/dist/connectors/remote-mcp.js

@@ -24,7 +24,7 @@ import { retryAfterMs } from "./guarded-fetch.js";
 import { resourceUriMatchesTemplates } from "./resource-uri.js";
 import { callerOf } from "../connector-caller.js";
 import { readNegotiation, storeNegotiation } from "./negotiation-cache.js";
-import { CALL_ADMISSION, REMOTE_MCP_AUTH, USAGE_GUIDE } from "./option-shapes.js";
+import { READ_ONLY, CALL_ADMISSION, REMOTE_MCP_AUTH, USAGE_GUIDE } from "./option-shapes.js";
 /**
  * Apply a maintained provider's slot copy and header framing to credential
  * auth the deployment left bare.
@@ -46,6 +46,7 @@ export function withCredentialDefaults(auth, defaults) {
 /** The closed options remoteMcp() accepts; see `assertKnownOptions`. */
 const REMOTE_MCP_OPTIONS = optionsOf()({
     ...keys("url", "title", "description", "authScope", "maxResultBytes", "versionNegotiation", "redirects", "requireHttps", "logger", "_transportFactory", "classify", "skills"),
+    readOnly: READ_ONLY,
     callAdmission: CALL_ADMISSION,
     usageGuide: USAGE_GUIDE,
     auth: REMOTE_MCP_AUTH,
@@ -1024,6 +1025,8 @@ function registrationErrorCode(body) {
  */
 export function remoteMcp(id, opts) {
     opts = assertKnownOptions(opts, `remoteMcp(${JSON.stringify(id)})`, REMOTE_MCP_OPTIONS);
+    if (opts.readOnly !== undefined)
+        READ_ONLY.parse(opts.readOnly, `Connector(${JSON.stringify(id)}).readOnly`);
     if (opts.callAdmission !== undefined)
         CALL_ADMISSION.parse(opts.callAdmission, `remoteMcp(${JSON.stringify(id)}).callAdmission`);
     const skillsEnabled = opts.skills;
@@ -2194,6 +2197,7 @@ export function remoteMcp(id, opts) {
             },
         }),
         ...(opts.description !== undefined ? { description: opts.description } : {}),
+        ...(opts.readOnly !== undefined ? { readOnly: opts.readOnly } : {}),
         ...(opts.authScope !== undefined ? { authScope: opts.authScope } : {}),
         ...(opts.maxResultBytes !== undefined ? { maxResultBytes: opts.maxResultBytes } : {}),
         ...(opts.callAdmission !== undefined ? { callAdmission: opts.callAdmission } : {}),

package/dist/describe-config.d.ts

@@ -20,6 +20,8 @@ export type DescribedMember = {
 };
 /** One connector as `describeConfig()` reports it. */
 export interface DescribedConnector {
+    /** Connector policy, independent of endpoint policy; omitted when false. */
+    readOnly?: boolean;
     id: string;
     title?: string;
     description?: string;

package/dist/describe-config.js

@@ -133,6 +133,7 @@ function describeConnector(connector, deploymentCap, registry) {
     const guideSummary = connectorGuideSummary(connector);
     const guided = connector.usageGuide !== undefined;
     return {
+        ...(connector.readOnly === true ? { readOnly: true } : {}),
         id: connector.id,
         ...(str(connector.title) !== undefined ? { title: connector.title } : {}),
         ...(str(connector.description) !== undefined ? { description: connector.description } : {}),

package/dist/invocation.js

@@ -464,9 +464,10 @@ export class InvocationService {
                         reconciliationRequired: true,
                     };
                 }
-                const refusal = writeRefusal(target.definition.classification, context.source, context.readOnly);
+                const connectorReadOnly = target.connector.readOnly === true;
+                const refusal = writeRefusal(target.definition.classification, context.source, context.readOnly || connectorReadOnly);
                 if (refusal === "read_only_endpoint") {
-                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and this endpoint is read-only. Nothing here can send it.`);
+                    return framingError("read_only_endpoint", `Tool "${canonicalAddress}" is a write, and ${connectorReadOnly ? `connector "${target.connector.id}"` : "this endpoint"} is read-only. Nothing here can send it.`);
                 }
                 if (refusal === "destructive_tool_requires_approval") {
                     return framingError("destructive_tool_requires_approval", `Tool "${canonicalAddress}" is a write. Invoke it through call_destructive_tool so the MCP host can request approval.`);

package/dist/meta-tools.js

@@ -796,14 +796,15 @@ function metaToolsForRequest(registry, baseUrl, opts = {}) {
                                 return false;
                             continue;
                         }
-                        if (!registry.getConnector(dependency.connector))
+                        const connector = registry.getConnector(dependency.connector);
+                        if (!connector)
                             return false;
                         const tools = await registry.getTools(dependency.connector, baseUrl, requestScope, options.signal ? { signal: options.signal } : {});
                         const tool = tools.find((tool) => tool.name === dependency.tool);
                         if (!tool ||
                             !(dependency.access === "catalog" ||
                                 (dependency.classification === "read" && tool.classification === "read") ||
-                                opts.readOnly !== true))
+                                (opts.readOnly !== true && connector.readOnly !== true)))
                             return false;
                     }
                     return true;

package/dist/operator-ui/config-summary.js

@@ -401,6 +401,7 @@ const AUTH_MODE = {
  * catalog. Anything else becomes a tile, so a new field is never hidden.
  */
 const CONNECTOR_KNOWN = [
+    "readOnly",
     "id",
     "title",
     "description",
@@ -488,6 +489,8 @@ export function connectorSummary(connector, sources = {}) {
     const base = `config.connectors.${connector.id}`;
     const kind = SOURCE_KIND[connector.source.kind] ?? SOURCE_KIND.custom;
     const badges = [{ id: "kind", label: kind.label, icon: kind.icon }];
+    if (connector.readOnly)
+        badges.push({ id: "readOnly", label: "Read-only" });
     if (connector.source.provider)
         badges.push({ id: "provider", label: connector.source.provider, icon: "box" });
     badges.push(connector.authScope === "personal"

package/dist/operator-ui/connection-map.js

@@ -210,7 +210,8 @@ export function connectionMap(contract, options = {}) {
     const maintainers = new Set((contract.root?.maintainers ?? []).flatMap((member) => member.kind === "human" ? [`person:${member.namespace}:${member.id}`] : []));
     const connectors = (contract.role === "maintainer" ? (contract.config?.connectors ?? []) : []).flatMap((config) => {
         const live = contract.live.connectors.find((c) => c.id === config.id);
-        return live ? [{ config, live, health: connectorVerdict(live, options.signals?.[config.id]) }] : [];
+        const signals = options.signals && Object.hasOwn(options.signals, config.id) ? options.signals[config.id] : undefined;
+        return live ? [{ config, live, health: connectorVerdict(live, signals) }] : [];
     });
     const health = new Map(connectors.map(({ config, health }) => [config.id, health]));
     const nodes = [];

package/dist/operator-ui/endpoints.js

@@ -63,7 +63,7 @@ function endpointGroups(contract, grants, readOnly, pool) {
         if (!live || !grant)
             return [];
         const tools = live.tools.filter((tool) => {
-            if (readOnly && tool.classification !== "read")
+            if ((readOnly || config.readOnly) && tool.classification !== "read")
                 return false;
             return (grant.tools === "all" ||
                 grant.tools.some((g) => g.name === tool.name && (!g.requireReadOnly || tool.classification === "read")));