@zackbart/connecta 0.34.0 → 0.35.0

package/dist/operator-ui/agents.js

@@ -7,7 +7,7 @@ export function slotActions(slot) {
     return slot.state === "issued" ? ["rotate", "revoke"] : ["issue"];
 }
 function contractSlot(agent) {
-    return { name: agent.name, ...agent.token };
+    return agent.token ? { name: agent.name, ...agent.token } : null;
 }
 function maintainerAgents(contract) {
     return contract?.role === "maintainer" ? contract.agents : [];
@@ -22,7 +22,8 @@ export function resolveSlot(contract, slots, name) {
     if (listed)
         return { slot: listed, live: true };
     const agent = maintainerAgents(contract).find((candidate) => candidate.name === name);
-    return agent ? { slot: contractSlot(agent), live: false } : null;
+    const slot = agent && contractSlot(agent);
+    return slot ? { slot, live: false } : null;
 }
 /**
  * One row per declared agent, in the slot list's order, then any agent only
@@ -33,20 +34,29 @@ export function agentRows(contract, slots, unresolved = []) {
     const declared = new Map(agents.map((agent) => [agent.name, agent]));
     const names = [...slots.map((slot) => slot.name), ...agents.map((agent) => agent.name)];
     return [...new Set(names)].map((name) => {
-        const { slot, live } = resolveSlot(contract, slots, name);
+        const { slot, live } = resolveSlot(contract, slots, name) ?? { slot: null, live: false };
         const agent = declared.get(name);
         return {
             name,
             pools: agent?.pools ?? [],
+            credentialTypes: agent?.credentialTypes ?? [],
             slot,
             live,
-            blocked: !live ? SLOT_UNAVAILABLE : unresolved.includes(name) || !slot.revision ? SLOT_UNRESOLVED : null,
+            blocked: !slot
+                ? "Agent tokens aren't configured."
+                : !live
+                    ? SLOT_UNAVAILABLE
+                    : unresolved.includes(name) || !slot.revision
+                        ? SLOT_UNRESOLVED
+                        : null,
             lastSeenAt: agent?.lastSeenAt ?? null,
-            actions: slotActions(slot),
+            actions: slot ? slotActions(slot) : [],
         };
     });
 }
 export function slotBadge(slot) {
+    if (!slot)
+        return { label: "Not configured", tone: "neutral" };
     if (slot.state === "issued")
         return { label: "Issued", tone: "ok" };
     if (slot.state === "revoked")
@@ -55,9 +65,9 @@ export function slotBadge(slot) {
 }
 /** When the slot last changed, issued or revoked (its badge says which); a dash when it never has. */
 export function slotSince(slot, format) {
-    if (slot.state === "issued")
+    if (slot?.state === "issued")
         return format(slot.issuedAt);
-    if (slot.state === "revoked")
+    if (slot?.state === "revoked")
         return format(slot.revokedAt);
     return "—";
 }

package/dist/operator-ui/config-summary.js

@@ -17,7 +17,7 @@ function formatBytes(bytes) {
     return `${NUMBER.format(bytes)} B`;
 }
 /** The exact count behind a rounded size, for a tooltip. */
-export function exactBytes(bytes) {
+function exactBytes(bytes) {
     return `${bytes.toLocaleString("en-US")} bytes`;
 }
 const DURATIONS = [
@@ -39,7 +39,7 @@ function formatMs(ms) {
     return `${NUMBER.format(ms)} ms`;
 }
 /** Format one value. Booleans read On or Off, never true or false; null reads None. */
-export function formatValue(value, format) {
+function formatValue(value, format) {
     if (value === null || value === undefined)
         return "None";
     if (typeof value === "boolean")
@@ -67,7 +67,7 @@ export function formatValue(value, format) {
 }
 const UNIT_SUFFIX = /(Ms|Seconds|Bytes|Days)$/;
 /** The format a key's name implies: `probeTimeoutMs` is a duration, `maxStashBytes` a size. */
-export function inferFormat(key, value) {
+function inferFormat(key, value) {
     if (typeof value === "boolean")
         return "toggle";
     if (typeof value !== "number")
@@ -84,7 +84,7 @@ export function inferFormat(key, value) {
                     : "count";
 }
 /** `maxStashEntries` reads "Max stash entries"; a unit suffix drops because the value carries it. */
-export function humanizeKey(key) {
+function humanizeKey(key) {
     // A word with two capitals is an acronym (OAuth, URL) and keeps its case.
     const words = key
         .replace(UNIT_SUFFIX, "")
@@ -158,6 +158,7 @@ const SIGN_IN = {
     clerk: { label: "Clerk", mark: "clerk" },
     "cloudflare-access": { label: "Cloudflare Access", mark: "access" },
     access_token: { label: "Agent tokens", mark: "tokens" },
+    vercel_oidc: { label: "Vercel workloads", mark: "tokens" },
 };
 const STORE = { memory: "Memory", d1: "D1", sqlite: "SQLite", custom: "Custom" };
 /** Known modules; any other `modules.<name>.enabled` becomes a tile named from its key. */
@@ -401,6 +402,7 @@ const AUTH_MODE = {
  * catalog. Anything else becomes a tile, so a new field is never hidden.
  */
 const CONNECTOR_KNOWN = [
+    "readOnly",
     "id",
     "title",
     "description",
@@ -488,6 +490,8 @@ export function connectorSummary(connector, sources = {}) {
     const base = `config.connectors.${connector.id}`;
     const kind = SOURCE_KIND[connector.source.kind] ?? SOURCE_KIND.custom;
     const badges = [{ id: "kind", label: kind.label, icon: kind.icon }];
+    if (connector.readOnly)
+        badges.push({ id: "readOnly", label: "Read-only" });
     if (connector.source.provider)
         badges.push({ id: "provider", label: connector.source.provider, icon: "box" });
     badges.push(connector.authScope === "personal"

package/dist/operator-ui/connection-map.js

@@ -25,11 +25,11 @@ function plural(count, one, many = `${one}s`) {
     return `${count} ${count === 1 ? one : many}`;
 }
 /** Cut a name to `limit` characters, ending in an ellipsis when it was longer. */
-export function truncate(text, limit) {
+function truncate(text, limit) {
     return text.length <= limit ? text : `${text.slice(0, limit - 1).trimEnd()}…`;
 }
 /** Where an endpoint's row opens on the Endpoints page. */
-export function endpointHref(path) {
+function endpointHref(path) {
     return `/endpoints#${path.replace(/^\//, "")}`;
 }
 /** The endpoint path an Endpoints page hash names, or null. */
@@ -41,7 +41,7 @@ function connectorHref(id, healthy) {
     return `/connectors/${encodeURIComponent(id)}#${healthy ? "tools" : "connection"}`;
 }
 function tokenWorks(agent) {
-    return agent?.token.state === "issued";
+    return agent?.credentialTypes.includes("vercel_oidc") === true || agent?.token?.state === "issued";
 }
 /**
  * People in the order the contract first lists them (plain /mcp's
@@ -118,13 +118,15 @@ function callerSummary(caller) {
         : `${name} uses ${through}, which serves no connectors.`;
     if (caller.kind !== "agent" || tokenWorks(caller.agent))
         return reach;
-    const state = caller.agent?.token.state;
+    const state = caller.agent?.token?.state;
     return `${reach} ${state === "revoked" ? "Its token is revoked" : "It has no token"}, so it can't connect.`;
 }
 function callerDetail(caller, maintainers) {
     if (caller.kind === "person")
         return maintainers.has(caller.id) ? "maintainer" : "member";
-    const state = caller.agent?.token.state;
+    if (caller.agent?.credentialTypes.includes("vercel_oidc"))
+        return "agent · Vercel OIDC";
+    const state = caller.agent?.token?.state;
     return state === "issued"
         ? "agent · token issued"
         : state === "revoked"
@@ -210,7 +212,8 @@ export function connectionMap(contract, options = {}) {
     const maintainers = new Set((contract.root?.maintainers ?? []).flatMap((member) => member.kind === "human" ? [`person:${member.namespace}:${member.id}`] : []));
     const connectors = (contract.role === "maintainer" ? (contract.config?.connectors ?? []) : []).flatMap((config) => {
         const live = contract.live.connectors.find((c) => c.id === config.id);
-        return live ? [{ config, live, health: connectorVerdict(live, options.signals?.[config.id]) }] : [];
+        const signals = options.signals && Object.hasOwn(options.signals, config.id) ? options.signals[config.id] : undefined;
+        return live ? [{ config, live, health: connectorVerdict(live, signals) }] : [];
     });
     const health = new Map(connectors.map(({ config, health }) => [config.id, health]));
     const nodes = [];

package/dist/operator-ui/contract.d.ts

@@ -50,6 +50,8 @@ export interface OperatorPoolV2 {
     /** `/agent/<name>`. */
     agentPath: string;
     readOnly: boolean;
+    surface: "meta" | "native";
+    executeCode: boolean;
     /** Workspace address agents act as; null in the member view. */
     owner: string | null;
     /** The pool's declared tools, unfiltered. */
@@ -105,13 +107,15 @@ export type OperatorMemberManage = {
 export interface OperatorAgent {
     name: string;
     pools: string[];
+    /** Supported credential kinds from this agent's deployment declaration. */
+    credentialTypes: Array<"access_token" | "vercel_oidc">;
     /**
-     * The agent's token slot. `revision` is the same opaque value GET
+     * The agent's token slot. Null when the managed token module is absent. `revision` is the same opaque value GET
      * /ui/access-tokens lists for the slot, on every state including "none":
      * it changes on every commit to the slot, and a token mutation sends it as
      * `expect`, so one decided from a stale view refuses with 409 `slot_changed`.
      */
-    token: {
+    token: null | {
         state: "none";
         revision: string;
     } | {
@@ -123,7 +127,7 @@ export interface OperatorAgent {
         revokedAt: string;
         revision: string;
     };
-    /** Latest activity row for this agent, null when activity is off or none is visible. */
+    /** Latest successful endpoint admission or visible historical activity; null when unknown or withheld. */
     lastSeenAt: string | null;
 }
 /**

package/dist/operator-ui/endpoints.js

@@ -63,7 +63,7 @@ function endpointGroups(contract, grants, readOnly, pool) {
         if (!live || !grant)
             return [];
         const tools = live.tools.filter((tool) => {
-            if (readOnly && tool.classification !== "read")
+            if ((readOnly || config.readOnly) && tool.classification !== "read")
                 return false;
             return (grant.tools === "all" ||
                 grant.tools.some((g) => g.name === tool.name && (!g.requireReadOnly || tool.classification === "read")));
@@ -98,6 +98,8 @@ export function endpointRows(contract) {
             path: contract.root.path,
             agentPath: null,
             readOnly: contract.root.readOnly,
+            surface: "meta",
+            executeCode: true,
             toolCount: toolCount(groups),
             groups,
             access: accessChips(contract.root.maintainers),
@@ -111,6 +113,8 @@ export function endpointRows(contract) {
             path: pool.humanPath,
             agentPath: pool.members.some((member) => member.kind === "agent") ? pool.agentPath : null,
             readOnly: pool.readOnly,
+            surface: pool.surface,
+            executeCode: pool.executeCode,
             toolCount: toolCount(groups),
             groups,
             access: accessChips(pool.members),
@@ -206,16 +210,3 @@ export function matrixCellLabel(connector, column, cell) {
             : `${cell.coverage.granted} of ${cell.coverage.total} live tools`;
     return `${where}: ${what}${column.readOnly ? ", read-only" : ""}`;
 }
-/** The connector's subject for the matrix's Runs as column: the /mcp cell, else its first pool's. */
-export function connectorRunsAs(contract, connectorId) {
-    const cells = contract.matrix.filter((cell) => cell.connectorId === connectorId);
-    const root = cells.find((cell) => cell.pool === null);
-    if (root)
-        return root.runsAs;
-    for (const pool of contract.pools) {
-        const cell = cells.find((c) => c.pool === pool.name);
-        if (cell)
-            return cell.runsAs;
-    }
-    return null;
-}

package/dist/operator-ui/fix-prompts.d.ts

@@ -11,7 +11,7 @@ import type { UiCredentialProblem, UiProblem } from "./model.js";
  * `refusedNotice` in view.ts); what remains are the page's own sentences and a
  * credential form's field checks.
  */
-export type FixPromptKind = UiProblem | UiCredentialProblem | "credential_test_failed" | "oauth_action_failed" | "catalog_drift";
+export type FixPromptKind = UiProblem | UiCredentialProblem | "credential_test_failed" | "oauth_action_failed";
 /** The clipboard text for one failure. Fixed by kind; see `CATALOGUE`. */
 export declare function fixPrompt(kind: FixPromptKind, connectorId?: string): string;
 /** Every kind, so a test can walk the whole catalogue. */

package/dist/operator-ui/fix-prompts.js

@@ -70,14 +70,6 @@ const CATALOGUE = {
             "Pin or upgrade the @zackbart/connecta version if a maintained provider's catalog changed shape underneath it.",
         ],
     },
-    catalog_drift: {
-        problem: "A hosted provider's live catalog differs from the reviewed manifest shipped with connecta: new unclassified tools, unserved tools, annotation conflicts, or schema changes.",
-        steps: [
-            "Unclassified tools are withheld until a release classifies them. Check whether a newer @zackbart/connecta release has, and upgrade if so.",
-            "If a tool the deployment depends on is now unserved or changed shape, review callers of it before upgrading.",
-            "Report drift the release does not cover as an issue on the connecta repository, naming the provider and the kinds of drift but no tool data.",
-        ],
-    },
 };
 /** The clipboard text for one failure. Fixed by kind; see `CATALOGUE`. */
 export function fixPrompt(kind, connectorId) {