@zackbart/connecta 0.34.1 → 0.36.0

package/dist/routes/shared.d.ts

@@ -4,6 +4,7 @@ import type { AdmissionController } from "../executor-admission.js";
 import type { Registry } from "../registry.js";
 import { type ResolvedPool } from "../membership.js";
 import type { AuthenticatedIdentity, Executor, IdentityReference, InboundAuth, InboundAuthRuntimeContext } from "../types.js";
+import type { Logger } from "../types.js";
 import type { ResolvedConfig } from "../config.js";
 export { msg } from "../errors.js";
 export interface ServerOptions {
@@ -65,7 +66,7 @@ export declare function authMetadata(request: Request, baseUrl: string, auth: re
     provider: InboundAuth;
     response: Response;
 } | null>;
-export declare function authorize(request: Request, baseUrl: string, auth: readonly InboundAuth[], runtimeContext?: RuntimeExecutionContext, partitionIdentity?: boolean, interactiveOnly?: boolean): Promise<{
+export declare function authorize(request: Request, baseUrl: string, auth: readonly InboundAuth[], runtimeContext?: RuntimeExecutionContext, partitionIdentity?: boolean, interactiveOnly?: boolean, logger?: Logger): Promise<{
     ok: true;
     actor: ActivityActor;
     identity: AuthenticatedIdentity;
@@ -78,14 +79,14 @@ export declare function authorize(request: Request, baseUrl: string, auth: reado
 }>;
 /**
  * Admission at an agent endpoint, `/agent/<pool>` (#837). Only the built-in
- * `cta_` adapter is consulted: Clerk and Access never run, cookies and Clerk
+ * agent credential adapters are consulted: Clerk and Access never run, cookies and Clerk
  * handshake parameters are stripped, and the runtime context, which carries
  * Access's `ctx.access` even on a bypassed path, is never passed. Anything but
  * an admitted declared agent gets the machine-only challenge.
  */
-export declare function authorizeAgent(request: Request, baseUrl: string, auth: readonly InboundAuth[]): Promise<Awaited<ReturnType<typeof authorize>>>;
+export declare function authorizeAgent(request: Request, baseUrl: string, auth: readonly InboundAuth[], logger?: Logger, settle?: (pending: Promise<unknown>) => void): Promise<Awaited<ReturnType<typeof authorize>>>;
 /** Human routes reject machine credentials before any verification or storage I/O. */
-export declare function authorizeUiIdentity(request: Request, baseUrl: string, auth: readonly InboundAuth[], purpose: string, runtimeContext?: RuntimeExecutionContext): Promise<Awaited<ReturnType<typeof authorize>>>;
+export declare function authorizeUiIdentity(request: Request, baseUrl: string, auth: readonly InboundAuth[], purpose: string, runtimeContext?: RuntimeExecutionContext, logger?: Logger): Promise<Awaited<ReturnType<typeof authorize>>>;
 export declare function isSameOrigin(request: Request, baseUrl: string): boolean;
 export declare function withSecurityHeaders(response: Response, requestUrl: URL, _path: string): Response;
 type AuthorizedIdentity = Extract<Awaited<ReturnType<typeof authorize>>, {

package/dist/routes/shared.js

@@ -1,9 +1,13 @@
 import { authorizationCredential, authorizationRequest, isMachineCredential } from "../inbound-credential.js";
+import { isVercelAgentCredential } from "../auth/vercel-agent.js";
 import { htmlSecurityHeaders } from "../html-security.js";
 import { isMaintainer, isMember } from "../membership.js";
 import { identityStorageKey, validIdentityReference } from "../identity.js";
 import { assertsAgents, isAgentName } from "../agent-identity.js";
+import { authenticate } from "../auth-admission.js";
 export { msg } from "../errors.js";
+import { authCall, authFlow, authInvoke, authProgram, registerAuth } from "../auth/native.js";
+import { runEdge } from "../runtime/run.js";
 export function privateJson(body, init = {}) {
     const headers = new Headers(init.headers);
     headers.set("Content-Type", "application/json");
@@ -76,36 +80,42 @@ export async function authMetadata(request, baseUrl, auth) {
     }
     return null;
 }
-async function providerChallenge(response, request, baseUrl, auth, refusingProvider) {
-    const privateHeaders = new Headers(response.headers);
-    privateHeaders.set("Cache-Control", "no-store");
-    response = new Response(response.body, {
-        status: response.status,
-        statusText: response.statusText,
-        headers: privateHeaders,
-    });
-    if (response.status !== 401)
-        return response;
-    if (!response.headers.has("WWW-Authenticate")) {
-        const headers = new Headers(response.headers);
-        headers.set("WWW-Authenticate", refusingProvider?.challenge?.(request, baseUrl) ?? "Bearer");
-        response = new Response(response.body, { status: response.status, statusText: response.statusText, headers });
-    }
-    const path = new URL(request.url).pathname;
-    const pool = /^\/mcp\/([a-z0-9_-]+)$/.exec(path)?.[1];
-    const metadataRequest = new Request(new URL(`/.well-known/oauth-protected-resource${pool ? `/mcp/${pool}` : ""}`, baseUrl), { signal: request.signal });
-    const owner = await authMetadata(metadataRequest, baseUrl, auth);
-    if (!owner)
-        return response;
-    // Metadata is an ordinary bounded response, never retained across requests.
-    await owner.response.body?.cancel();
-    const challenge = owner.provider.challenge?.(request, baseUrl);
-    if (!challenge)
-        return response;
-    const headers = new Headers(response.headers);
-    headers.set("WWW-Authenticate", challenge);
-    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+function providerChallenge(response, request, baseUrl, auth, refusingProvider) {
+    return runEdge(authProgram(providerChallengeNative, [response, request, baseUrl, auth, refusingProvider]));
 }
+const providerChallengeNative = /* @__PURE__ */ registerAuth(providerChallenge, function (response, request, baseUrl, auth, refusingProvider) {
+    return authFlow(function* () {
+        const privateHeaders = new Headers(response.headers);
+        privateHeaders.set("Cache-Control", "no-store");
+        response = new Response(response.body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: privateHeaders,
+        });
+        if (response.status !== 401)
+            return response;
+        if (!response.headers.has("WWW-Authenticate")) {
+            const headers = new Headers(response.headers);
+            headers.set("WWW-Authenticate", refusingProvider?.challenge?.(request, baseUrl) ?? "Bearer");
+            response = new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+        }
+        const path = new URL(request.url).pathname;
+        const pool = /^\/mcp\/([a-z0-9_-]+)$/.exec(path)?.[1];
+        const metadataRequest = new Request(new URL(`/.well-known/oauth-protected-resource${pool ? `/mcp/${pool}` : ""}`, baseUrl), { signal: request.signal });
+        const owner = (yield authCall(authMetadata, [metadataRequest, baseUrl, auth]));
+        if (!owner)
+            return response;
+        // Metadata is an ordinary bounded response, never retained across requests.
+        if (owner.response.body)
+            yield authInvoke(owner.response.body, "cancel", []);
+        const challenge = owner.provider.challenge?.(request, baseUrl);
+        if (!challenge)
+            return response;
+        const headers = new Headers(response.headers);
+        headers.set("WWW-Authenticate", challenge);
+        return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+    });
+});
 function recognizedProvider(request, auth, runtimeContext) {
     for (const provider of auth) {
         if (!provider.recognizesCredential)
@@ -122,123 +132,158 @@ function recognizedProvider(request, auth, runtimeContext) {
     }
     return undefined;
 }
-export async function authorize(request, baseUrl, auth, runtimeContext, partitionIdentity = true, interactiveOnly = false) {
-    const credential = authorizationCredential(request);
-    const explicit = credential.kind !== "absent";
-    if (credential.kind === "invalid") {
-        const challenge = auth.find((provider) => provider.kind !== "access_token")?.challenge?.(request, baseUrl) ?? "Bearer";
-        return {
-            ok: false,
-            response: await providerChallenge(privateJson({ error: "unauthorized" }, {
-                status: 401,
-                headers: { "WWW-Authenticate": challenge },
-            }), request, baseUrl, auth),
-        };
-    }
-    request = authorizationRequest(request);
-    if (explicit && runtimeContext)
-        runtimeContext = { waitUntil: runtimeContext.waitUntil.bind(runtimeContext) };
-    const machineCredential = isMachineCredential(request);
-    if (interactiveOnly && machineCredential) {
-        return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
-    }
-    // Every caller of this function is a human route. Agents reach pools only at
-    // `/agent/<pool>` (#837), so a `cta_` token refuses here without consulting
-    // token storage, and never falls back to a cookie, session, or Access context.
-    if (machineCredential) {
-        return {
-            ok: false,
-            response: await providerChallenge(privateJson({ error: "unauthorized" }, {
-                status: 401,
-                headers: { "WWW-Authenticate": "Bearer" },
-            }), request, baseUrl, auth),
-        };
-    }
-    if (auth.length === 0 && !interactiveOnly && !explicit) {
-        const actor = { kind: "anonymous" };
-        const identity = { actor, interactive: false };
-        return { ok: true, actor, identity };
-    }
-    // The built-in agent adapter answers only agent endpoints. A deployment
-    // whose only provider is that adapter still refuses here, never opens.
-    const humanAuth = auth.filter((provider) => !assertsAgents(provider));
-    let recognized;
-    try {
-        recognized = recognizedProvider(request, humanAuth, runtimeContext);
-    }
-    catch {
-        return { ok: false, response: privateJson({ error: "credential recognition failed" }, { status: 403 }) };
-    }
-    if (interactiveOnly && recognized && !recognized.interactiveOperator) {
-        return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
-    }
-    let lastResponse = null;
-    const eligible = humanAuth.filter((provider) => (!interactiveOnly || provider.interactiveOperator) &&
-        (!explicit || provider.kind !== "access_token" || !provider.recognizesCredential));
-    // A header owns one verdict even for adapters without a recognition hook.
-    const candidates = recognized ? [recognized] : explicit ? eligible.slice(0, 1) : eligible;
-    for (const provider of candidates) {
-        const result = await provider.authorize(request, baseUrl, runtimeContext);
-        // Only the built-in access-token adapter asserts an agent, and it never
-        // answers here. Any `agent` claim refuses like an unknown token.
-        const agent = result.ok ? result.agent : undefined;
-        if (result.ok && agent !== undefined) {
-            lastResponse = privateJson({ error: "unauthorized" }, {
-                status: 401,
-                headers: { "WWW-Authenticate": "Bearer" },
-            });
-            break;
-        }
-        if (result.ok) {
-            if (interactiveOnly && !result.userId) {
-                return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
-            }
-            const subjectId = result.subjectId ?? result.userId;
-            const actorNamespace = activityActorNamespace(provider);
-            const derivedPrincipal = result.userId && actorNamespace ? { namespace: actorNamespace, id: result.userId } : undefined;
-            const principal = validIdentityReference(result.principal) ? result.principal : derivedPrincipal;
-            const subject = subjectId
-                ? { namespace: actorNamespace ?? `connecta:auth:${provider.kind}`, id: subjectId }
-                : principal;
-            const interactive = Boolean(result.userId && provider.interactiveOperator);
-            // Principal-only API callers still need a stable typed actor for history
-            // ownership. Never collapse distinct personal partitions into { kind }.
-            const actorId = agent ?? subjectId ?? principal?.id;
-            const recordNamespace = actorNamespace ?? (subjectId === undefined ? principal?.namespace : undefined);
-            const actor = {
-                kind: provider.kind,
-                ...(actorId ? { id: actorId } : {}),
-                ...(actorId && recordNamespace ? { namespace: recordNamespace } : {}),
-            };
-            const identity = {
-                actor,
-                ...(subject ? { subject } : {}),
-                ...(principal ? { principal } : {}),
-                ...(agent !== undefined ? { agent } : {}),
-                interactive,
+export function authorize(request, baseUrl, auth, runtimeContext, partitionIdentity = true, interactiveOnly = false, logger = console) {
+    return runEdge(authProgram(authorizeNative, [request, baseUrl, auth, runtimeContext, partitionIdentity, interactiveOnly, logger]));
+}
+const authorizeNative = /* @__PURE__ */ registerAuth(authorize, function (request, baseUrl, auth, runtimeContext, partitionIdentity = true, interactiveOnly = false, logger = console) {
+    return authFlow(function* () {
+        const credential = authorizationCredential(request);
+        const explicit = credential.kind !== "absent";
+        if (credential.kind === "invalid") {
+            const challenge = auth.find((provider) => !assertsAgents(provider))?.challenge?.(request, baseUrl) ?? "Bearer";
+            return {
+                ok: false,
+                response: (yield authCall(providerChallenge, [
+                    privateJson({ error: "unauthorized" }, {
+                        status: 401,
+                        headers: { "WWW-Authenticate": challenge },
+                    }),
+                    request,
+                    baseUrl,
+                    auth,
+                ])),
             };
+        }
+        request = authorizationRequest(request);
+        if (explicit && runtimeContext)
+            runtimeContext = { waitUntil: runtimeContext.waitUntil.bind(runtimeContext) };
+        const machineCredential = isMachineCredential(request) || isVercelAgentCredential(request);
+        if (interactiveOnly && machineCredential) {
+            return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
+        }
+        // Every caller of this function is a human route. Agents reach pools only at
+        // `/agent/<pool>` (#837), so a workload or `cta_` credential refuses here
+        // without verification, and never falls back to a cookie, session or Access context.
+        if (machineCredential) {
             return {
-                ok: true,
-                actor,
-                identity,
-                ...(result.sessionCookies?.length ? { sessionCookies: result.sessionCookies } : {}),
-                ...(subject && partitionIdentity ? { subjectKey: await identityStorageKey(subject) } : {}),
-                ...(principal && partitionIdentity ? { principalKey: await identityStorageKey(principal) } : {}),
+                ok: false,
+                response: (yield authCall(providerChallenge, [
+                    privateJson({ error: "unauthorized" }, {
+                        status: 401,
+                        headers: { "WWW-Authenticate": "Bearer" },
+                    }),
+                    request,
+                    baseUrl,
+                    auth,
+                ])),
             };
         }
-        lastResponse = result.response;
-        if (recognized || result.response.status !== 401)
-            break;
-    }
-    return {
-        ok: false,
-        response: await providerChallenge(lastResponse ??
-            privateJson({ error: "unauthorized" }, {
-                status: 401,
-                headers: { "WWW-Authenticate": "Bearer" },
-            }), request, baseUrl, auth, explicit ? candidates[0] : undefined),
-    };
-}
+        if (auth.length === 0 && !interactiveOnly && !explicit) {
+            const actor = { kind: "anonymous" };
+            const identity = { actor, interactive: false };
+            return { ok: true, actor, identity };
+        }
+        // The built-in agent adapter answers only agent endpoints. A deployment
+        // whose only provider is that adapter still refuses here, never opens.
+        const humanAuth = auth.filter((provider) => !assertsAgents(provider));
+        let recognized;
+        try {
+            recognized = recognizedProvider(request, humanAuth, runtimeContext);
+        }
+        catch {
+            return { ok: false, response: privateJson({ error: "credential recognition failed" }, { status: 403 }) };
+        }
+        if (interactiveOnly && recognized && !recognized.interactiveOperator) {
+            return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
+        }
+        let lastResponse = null;
+        const eligible = humanAuth.filter((provider) => (!interactiveOnly || provider.interactiveOperator) &&
+            (!explicit || provider.kind !== "access_token" || !provider.recognizesCredential));
+        // A header owns one verdict even for adapters without a recognition hook.
+        const candidates = recognized ? [recognized] : explicit ? eligible.slice(0, 1) : eligible;
+        for (const provider of candidates) {
+            const admission = (yield authCall(authenticate, [
+                provider,
+                request,
+                baseUrl,
+                runtimeContext,
+                logger,
+                runtimeContext?.waitUntil.bind(runtimeContext),
+            ]));
+            if (!admission.admitted)
+                return { ok: false, response: admission.response };
+            const result = admission.result;
+            // Only built-in agent credential adapters assert an agent, and they never
+            // answer here. Any `agent` claim refuses like an unknown token.
+            const agent = result.ok ? result.agent : undefined;
+            if (result.ok && agent !== undefined) {
+                lastResponse = privateJson({ error: "unauthorized" }, {
+                    status: 401,
+                    headers: { "WWW-Authenticate": "Bearer" },
+                });
+                break;
+            }
+            if (result.ok) {
+                if (interactiveOnly && !result.userId) {
+                    return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
+                }
+                const subjectId = result.subjectId ?? result.userId;
+                const actorNamespace = activityActorNamespace(provider);
+                const derivedPrincipal = result.userId && actorNamespace ? { namespace: actorNamespace, id: result.userId } : undefined;
+                const principal = validIdentityReference(result.principal) ? result.principal : derivedPrincipal;
+                const subject = subjectId
+                    ? { namespace: actorNamespace ?? `connecta:auth:${provider.kind}`, id: subjectId }
+                    : principal;
+                const interactive = Boolean(result.userId && provider.interactiveOperator);
+                // Principal-only API callers still need a stable typed actor for history
+                // ownership. Never collapse distinct personal partitions into { kind }.
+                const actorId = agent ?? subjectId ?? principal?.id;
+                const recordNamespace = actorNamespace ?? (subjectId === undefined ? principal?.namespace : undefined);
+                const actor = {
+                    kind: provider.kind,
+                    ...(actorId ? { id: actorId } : {}),
+                    ...(actorId && recordNamespace ? { namespace: recordNamespace } : {}),
+                };
+                const identity = {
+                    actor,
+                    ...(subject ? { subject } : {}),
+                    ...(principal ? { principal } : {}),
+                    ...(agent !== undefined ? { agent } : {}),
+                    interactive,
+                };
+                return {
+                    ok: true,
+                    actor,
+                    identity,
+                    ...(result.sessionCookies?.length ? { sessionCookies: result.sessionCookies } : {}),
+                    ...(subject && partitionIdentity
+                        ? { subjectKey: (yield authCall(identityStorageKey, [subject])) }
+                        : {}),
+                    ...(principal && partitionIdentity
+                        ? { principalKey: (yield authCall(identityStorageKey, [principal])) }
+                        : {}),
+                };
+            }
+            lastResponse = result.response;
+            if (recognized || result.response.status !== 401)
+                break;
+        }
+        return {
+            ok: false,
+            response: (yield authCall(providerChallenge, [
+                lastResponse ??
+                    privateJson({ error: "unauthorized" }, {
+                        status: 401,
+                        headers: { "WWW-Authenticate": "Bearer" },
+                    }),
+                request,
+                baseUrl,
+                auth,
+                explicit ? candidates[0] : undefined,
+            ])),
+        };
+    });
+});
 /** The machine-only challenge: Bearer, with no authorization server to discover. */
 function agentChallenge() {
     return {
@@ -248,49 +293,71 @@ function agentChallenge() {
 }
 /**
  * Admission at an agent endpoint, `/agent/<pool>` (#837). Only the built-in
- * `cta_` adapter is consulted: Clerk and Access never run, cookies and Clerk
+ * agent credential adapters are consulted: Clerk and Access never run, cookies and Clerk
  * handshake parameters are stripped, and the runtime context, which carries
  * Access's `ctx.access` even on a bypassed path, is never passed. Anything but
  * an admitted declared agent gets the machine-only challenge.
  */
-export async function authorizeAgent(request, baseUrl, auth) {
-    const provider = auth.find(assertsAgents);
-    if (!provider || !isMachineCredential(request))
-        return agentChallenge();
-    let result;
-    try {
-        result = await provider.authorize(authorizationRequest(request), baseUrl, undefined);
-    }
-    catch {
-        return agentChallenge();
-    }
-    if (!result.ok) {
-        void result.response.body?.cancel().catch(() => { });
-        return agentChallenge();
-    }
-    const { agent } = result;
-    if (!isAgentName(agent) || result.userId !== undefined || result.principal !== undefined)
-        return agentChallenge();
-    const namespace = activityActorNamespace(provider);
-    const subject = { namespace: namespace ?? `connecta:auth:${provider.kind}`, id: result.subjectId ?? agent };
-    const actor = { kind: provider.kind, id: agent, ...(namespace ? { namespace } : {}) };
-    return {
-        ok: true,
-        actor,
-        identity: { actor, subject, agent, interactive: false },
-        subjectKey: await identityStorageKey(subject),
-    };
+export function authorizeAgent(request, baseUrl, auth, logger = console, settle) {
+    return runEdge(authProgram(authorizeAgentNative, [request, baseUrl, auth, logger, settle]));
 }
-/** Human routes reject machine credentials before any verification or storage I/O. */
-export async function authorizeUiIdentity(request, baseUrl, auth, purpose, runtimeContext) {
-    if (!auth.some((provider) => provider.interactiveOperator)) {
+const authorizeAgentNative = /* @__PURE__ */ registerAuth(authorizeAgent, function (request, baseUrl, auth, logger = console, settle) {
+    return authFlow(function* () {
+        const provider = auth.find((candidate) => assertsAgents(candidate) && candidate.recognizesCredential?.(request) === true);
+        if (!provider)
+            return agentChallenge();
+        let result;
+        try {
+            const admission = (yield authCall(authenticate, [
+                provider,
+                authorizationRequest(request),
+                baseUrl,
+                undefined,
+                logger,
+                settle,
+            ]));
+            if (!admission.admitted)
+                return { ok: false, response: admission.response };
+            result = admission.result;
+        }
+        catch {
+            return agentChallenge();
+        }
+        if (!result.ok) {
+            if (result.response.status === 503)
+                return result;
+            void result.response.body?.cancel().catch(() => { });
+            return agentChallenge();
+        }
+        const { agent } = result;
+        if (!isAgentName(agent) || result.userId !== undefined || result.principal !== undefined)
+            return agentChallenge();
+        const namespace = activityActorNamespace(provider);
+        const subject = { namespace: namespace ?? `connecta:auth:${provider.kind}`, id: result.subjectId ?? agent };
+        const actor = { kind: provider.kind, id: agent, ...(namespace ? { namespace } : {}) };
         return {
-            ok: false,
-            response: privateJson({ error: `${purpose} requires interactive user authentication` }, { status: 403 }),
+            ok: true,
+            actor,
+            identity: { actor, subject, agent, interactive: false },
+            subjectKey: (yield authCall(identityStorageKey, [subject])),
         };
-    }
-    return authorize(request, baseUrl, auth, runtimeContext, true, true);
+    });
+});
+/** Human routes reject machine credentials before any verification or storage I/O. */
+export function authorizeUiIdentity(request, baseUrl, auth, purpose, runtimeContext, logger = console) {
+    return runEdge(authProgram(authorizeUiIdentityNative, [request, baseUrl, auth, purpose, runtimeContext, logger]));
 }
+const authorizeUiIdentityNative = /* @__PURE__ */ registerAuth(authorizeUiIdentity, function (request, baseUrl, auth, purpose, runtimeContext, logger = console) {
+    return authFlow(function* () {
+        if (!auth.some((provider) => provider.interactiveOperator)) {
+            return {
+                ok: false,
+                response: privateJson({ error: `${purpose} requires interactive user authentication` }, { status: 403 }),
+            };
+        }
+        return (yield authCall(authorize, [request, baseUrl, auth, runtimeContext, true, true, logger]));
+    });
+});
 export function isSameOrigin(request, baseUrl) {
     const origin = request.headers.get("origin");
     if (!origin)

package/dist/routes/skills.js

@@ -1,5 +1,7 @@
+import { upwardStep } from "../upward.js";
+import { authCall, authInvoke, authFlow, authMethod } from "../auth/native.js";
 import { ProtocolError } from "@modelcontextprotocol/server";
-import { z } from "zod";
+import * as z from "zod";
 import { ConnectorCallError } from "../errors.js";
 import { SkillsRegistry } from "../skills.js";
 /** Native Skills methods use the same request-view registry as both text readers. */
@@ -11,9 +13,9 @@ export function registerSkills(server, view, baseUrl, options) {
     const listParams = z.object({ cursor: z.string().max(128).optional() });
     const getParams = z.object({ uri: z.string().min(1).max(32_768).startsWith("skill://") });
     const result = z.record(z.string(), z.unknown());
-    const safely = async (read) => {
+    const safely = authMethod((read) => authFlow(function* () {
         try {
-            return await read();
+            return yield* upwardStep(authCall(read, []));
         }
         catch (error) {
             if (error instanceof ConnectorCallError && (error.code === "not_found" || error.code === "invalid_args")) {
@@ -22,9 +24,9 @@ export function registerSkills(server, view, baseUrl, options) {
             // No raw downstream cause can become an SDK/operator diagnostic.
             throw new ProtocolError(-32603, "Skills are unavailable.");
         }
-    };
-    server.server.setRequestHandler("skills/list", { params: listParams, result }, (params) => safely(() => registry.list(params.cursor)));
-    server.server.setRequestHandler("skills/get", { params: getParams, result }, (params) => safely(() => registry.get(params.uri)));
-    server.server.setRequestHandler("resources/list", { params: listParams, result }, (params) => safely(() => registry.resources(params.cursor)));
-    server.server.setRequestHandler("resources/read", { params: getParams, result }, (params) => safely(() => registry.read(params.uri)));
+    }));
+    server.server.setRequestHandler("skills/list", { params: listParams, result }, (params) => safely(authMethod(() => authInvoke(registry, "list", [params.cursor]))));
+    server.server.setRequestHandler("skills/get", { params: getParams, result }, (params) => safely(authMethod(() => authInvoke(registry, "get", [params.uri]))));
+    server.server.setRequestHandler("resources/list", { params: listParams, result }, (params) => safely(authMethod(() => authInvoke(registry, "resources", [params.cursor]))));
+    server.server.setRequestHandler("resources/read", { params: getParams, result }, (params) => safely(authMethod(() => authInvoke(registry, "read", [params.uri]))));
 }

package/dist/routes/ui-config.js

@@ -1,3 +1,5 @@
+import { agentDescriptions } from "../agent-description.js";
+import { readAgentAdmission } from "../agent-observation.js";
 // `GET /ui/api/config`: operator contract v2 (#837, decisions/0006), the
 // operator page's only gate. A maintainer gets the unfiltered view; a human
 // pool member gets exactly their own projection; anyone else gets the private
@@ -167,7 +169,9 @@ function scanActivity(context, authz, registry, rows, agents) {
                     // A last call is a call; any row recorded for an agent, a catalog
                     // refresh included, is a sign it was seen.
                     const row = event.kind !== "catalog_drift" && OUTCOMES.has(event.outcome) ? byId.get(event.connectorId) : undefined;
-                    const agent = event.actor.kind === "access_token" && event.actor.namespace === AGENT_NAMESPACE && event.actor.id
+                    const agent = (event.actor.kind === "access_token" || event.actor.kind === "vercel_oidc") &&
+                        event.actor.namespace === AGENT_NAMESPACE &&
+                        event.actor.id
                         ? byAgent.get(event.actor.id)
                         : undefined;
                     if ((!row && !agent) || !activityEventVisible(context, authz, registry, event))
@@ -376,19 +380,37 @@ function maintainerRead(context, authz) {
             humanPath: `/mcp/${name}`,
             agentPath: `/agent/${name}`,
             readOnly: pool.readOnly,
+            surface: pool.native ? "native" : "meta",
+            executeCode: pool.native?.executeCode !== false,
             owner: ownersVisible ? (pool.owner ?? null) : null,
             tools: grants(pool.access, allIds),
             members: pool.members.map((member) => member.kind === "agent" ? { kind: "agent", name: member.name } : human(member)),
         }));
-        const agents = slots.map(({ name, ...token }) => ({
+        const tokenSlots = new Map(slots.map(({ name, ...token }) => [name, token]));
+        if (opts.config.accessTokens && opts.config.agents.some((name) => !tokenSlots.has(name))) {
+            return yield* refuse("agent token slots could not be read", 503);
+        }
+        const agents = agentDescriptions(opts.config).map(({ name, credentialTypes }) => ({
             name,
+            credentialTypes: [...credentialTypes],
             pools: [...opts.pools]
                 .filter(([, pool]) => pool.members.some((member) => member.kind === "agent" && member.name === name))
                 .map(([pool]) => pool),
-            token,
+            token: tokenSlots.get(name) ?? null,
             lastSeenAt: null,
         }));
         const activity = yield* scanActivity(context, authz, registry, rows, agents);
+        let admissionsVisible = readsActivity(opts, authz) && activity !== "forbidden";
+        // A configured read gate still applies when the history store has no list.
+        if (admissionsVisible && activity === "unconfigured" && opts.config.activity?.readGate) {
+            admissionsVisible = yield* bounded(context, () => attempt(async () => (await opts.config.activity.readGate(authz.actor)) === true), () => Effect.succeed(false));
+        }
+        if (admissionsVisible) {
+            yield* bounded(context, () => Effect.forEach(agents, (agent) => readAgentAdmission(opts.config.storage, agent.name).pipe(Effect.catch(() => Effect.succeed(null)), Effect.map((at) => {
+                if (at && (!agent.lastSeenAt || at > agent.lastSeenAt))
+                    agent.lastSeenAt = at;
+            })), { concurrency: resolveDiscoveryConcurrency(opts.config.discovery.concurrency) }), () => Effect.succeed(undefined));
+        }
         const matrix = yield* matrixFor(context, visible, rows, ownersVisible);
         const contract = {
             schemaVersion: 2,
@@ -533,6 +555,8 @@ function memberRead(context, authz, pools) {
                 humanPath: `/mcp/${name}`,
                 agentPath: `/agent/${name}`,
                 readOnly: pool.readOnly,
+                surface: pool.native ? "native" : "meta",
+                executeCode: pool.native?.executeCode !== false,
                 owner: null,
                 tools: grants(pool.access, allIds),
                 members: [],