@zackbart/connecta 0.34.1 → 0.36.0

package/dist/connectors/guarded-fetch.js

@@ -1,48 +1,41 @@
+import { confinementBase, REDIRECT_STATUSES, BODILESS_STATUSES } from "../http-policy.js";
+export { retryAfterMs } from "../http-policy.js";
+import { callerSignal, duringViewCall, settleOnClose, viewSignal } from "../runtime/call.js";
 /**
  * The safety machinery every hand-written HTTP surface needs, extracted once
  * (#341): path confinement, encoded query and framed bodies, per-request
  * credential headers applied last, a refused redirect, a bounded read, and
- * network-failure normalization. It owns no *meaning* — it never reads a status
- * code and never invents an auth scheme, because the same 403 means an ungranted
+ * network-failure normalization. It owns no vendor-specific meaning and never
+ * invents an auth scheme, because the same 403 means an ungranted
  * capability at one provider and a token scope at another, and those want
  * opposite next moves. The provider's `authenticate` supplies headers and its
- * mapper turns one `GuardedResponse` into a result or a typed failure.
+ * mapper turns one `GuardedResponse` into a result or a typed failure. Core
+ * then settles retry advice and write outcome from the served classification
+ * and dispatch facts, consistently across every provider (INV-9).
  *
  * Not exported this release: the migrations proved the shape preserves behavior
  * for connectors that already had this machinery, not that it is the right
  * public surface. Web APIs only.
  */
 import { ConnectorCallError, unavailableCallError } from "../errors.js";
+import { assertProviderCallOpen, dispatchProviderRequest, handoffProviderRequest, isRecordingFetch, recordProviderResponse, providerRequest, responseProviderRequest, vendorRefusal, } from "../provider-call.js";
+import { providerCallFailure, providerCallResult } from "../write-outcome.js";
 import { sentSecretsFor } from "../sent-secrets.js";
-/** Parse delta-seconds or an HTTP-date into a non-negative wait window. */
-export function retryAfterMs(headers) {
-    const raw = headers.get("retry-after");
-    if (!raw)
-        return undefined;
-    const seconds = Number(raw.trim());
-    if (Number.isFinite(seconds)) {
-        return seconds < 0 ? undefined : Math.trunc(seconds * 1000);
-    }
-    // Require the HTTP-date shape, so Date.parse cannot reinterpret "-1" as
-    // a calendar date on runtimes that accept loose date strings.
-    if (!/^[A-Za-z]{3}, \d{2} [A-Za-z]{3} \d{4} \d{2}:\d{2}:\d{2} GMT$/.test(raw.trim()))
-        return undefined;
-    const date = Date.parse(raw);
-    return Number.isFinite(date) ? Math.max(0, date - Date.now()) : undefined;
-}
 /**
  * The transport half of a guarded connector that authenticates through its
  * own `api()` OAuth grant: no header of the helper's making, and every request
  * sent through `ctx.oauth.fetch`, which adds the calling owner's bearer token,
  * refuses any origin outside the grant's `apiOrigins`, and spends one
- * coordinated refresh and one replay on a 401 before answering
- * `auth_required`. Spread it into the options:
+ * coordinated refresh on a 401: a read is replayed once before answering
+ * `auth_required`, and a write is never sent again (INV-9). Spread it into
+ * the options:
  * `guardedFetch({ provider, baseUrl, maxResponseBytes, ...oauthBearer(provider) })`.
  *
  * Confinement still happens here first, so a request reaches the grant only
  * once it is provably beneath `baseUrl`; the grant's origin check is the second
  * fence, not the only one.
  */
+const oauthSenders = new WeakSet();
 export function oauthBearer(provider) {
     const send = (url, init, ctx) => {
         const grant = ctx.oauth;
@@ -53,37 +46,10 @@ export function oauthBearer(provider) {
         }
         return grant.fetch(url, init);
     };
+    oauthSenders.add(send);
     return { authenticate: () => ({}), fetch: send };
 }
-/** Statuses that instruct a client to re-send somewhere else. Never followed. */
-const REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-/** Statuses the HTTP spec defines as carrying no body at all. */
-const BODILESS_STATUSES = new Set([204, 205, 304]);
 const decoder = new TextDecoder();
-/**
- * A base URL is deployment configuration, so a bad one is a structural mistake
- * and throws where it is written rather than on the first call that uses it.
- */
-function confinementBase(provider, baseUrl) {
-    let base;
-    try {
-        base = new URL(baseUrl);
-    }
-    catch {
-        throw new Error(`${provider} baseUrl must be an absolute URL.`);
-    }
-    const loopback = base.hostname === "localhost" || base.hostname === "127.0.0.1" || base.hostname === "[::1]";
-    if (base.protocol !== "https:" && !(base.protocol === "http:" && loopback)) {
-        throw new Error(`${provider} baseUrl must be https (http is allowed only for a loopback proxy or test double).`);
-    }
-    if (base.username || base.password) {
-        throw new Error(`${provider} baseUrl must not embed URL credentials; authentication belongs in headers.`);
-    }
-    if (base.search || base.hash) {
-        throw new Error(`${provider} baseUrl must not carry a query or fragment.`);
-    }
-    return base;
-}
 /**
  * Resolve a provider-relative path beneath the base and prove it stayed there.
  *
@@ -132,13 +98,32 @@ function readableBody(response) {
     return body && typeof body.getReader === "function" ? body : null;
 }
 /** Read a stream to the ceiling and stop there — never past it. */
-async function drain(provider, stream, limit) {
+function ownedReader(stream, signal) {
     const reader = stream.getReader();
+    void reader.closed.catch(() => { });
+    const abort = () => {
+        void reader.cancel().catch(() => { });
+    };
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted)
+        abort();
+    return {
+        reader,
+        close: () => {
+            signal.removeEventListener("abort", abort);
+            reader.releaseLock();
+        },
+    };
+}
+async function drain(provider, stream, limit, signal) {
+    const { reader, close } = ownedReader(stream, signal);
     const chunks = [];
     let total = 0;
     try {
         while (true) {
             const { done, value } = await reader.read();
+            if (signal.aborted)
+                throw signal.reason;
             if (done)
                 break;
             if (!value)
@@ -152,7 +137,7 @@ async function drain(provider, stream, limit) {
         }
     }
     finally {
-        reader.releaseLock();
+        close();
     }
     const body = new Uint8Array(total);
     let offset = 0;
@@ -174,7 +159,7 @@ async function drain(provider, stream, limit) {
  * with a parse error and turns a response nobody was allowed to read into an
  * empty success.
  */
-function boundedResponse(provider, response, limit) {
+function boundedResponse(provider, response, limit, signal) {
     if (BODILESS_STATUSES.has(response.status)) {
         const emptyJson = async () => undefined;
         return {
@@ -195,7 +180,7 @@ function boundedResponse(provider, response, limit) {
     const prefix = async (maxBytes) => {
         const keep = Math.min(Math.max(0, Math.trunc(maxBytes)), limit);
         if (stream)
-            return await readPrefix(stream, keep);
+            return await readPrefix(stream, keep, signal);
         // A runtime with no body stream buffers the body regardless; the
         // ceiling still bounds what is accepted.
         const buffer = new Uint8Array(await response.arrayBuffer());
@@ -207,7 +192,7 @@ function boundedResponse(provider, response, limit) {
     let read;
     const bytes = () => {
         read ??= stream
-            ? drain(provider, stream, limit)
+            ? drain(provider, stream, limit, signal)
             : response.arrayBuffer().then((buffer) => {
                 if (buffer.byteLength > limit) {
                     throw oversized(provider, limit, `${buffer.byteLength} bytes`);
@@ -232,7 +217,7 @@ function boundedResponse(provider, response, limit) {
         ok: response.ok,
         headers: response.headers,
         cancel: async () => {
-            await response.body?.cancel();
+            await (stream ?? response.body)?.cancel();
         },
         bytes,
         text,
@@ -248,14 +233,16 @@ function boundedResponse(provider, response, limit) {
  * A BYOB reader could stop at `keep + 1` exactly, but not every runtime's
  * fetch body offers one, and one chunk is a bounded overrun.
  */
-async function readPrefix(stream, keep) {
-    const reader = stream.getReader();
+async function readPrefix(stream, keep, signal) {
+    const { reader, close } = ownedReader(stream, signal);
     const chunks = [];
     let total = 0;
     let truncated = false;
     try {
         while (true) {
             const { done, value } = await reader.read();
+            if (signal.aborted)
+                throw signal.reason;
             if (done)
                 break;
             if (!value)
@@ -273,7 +260,7 @@ async function readPrefix(stream, keep) {
             await reader.cancel().catch(() => { });
     }
     finally {
-        reader.releaseLock();
+        close();
     }
     const bytes = new Uint8Array(total);
     let offset = 0;
@@ -293,6 +280,15 @@ async function jsonResult(read) {
         return { parseError: cause };
     }
 }
+// Each response a mapper reads, and the ledger entry of the request it answered.
+const answeredRequests = new WeakMap();
+/**
+ * Test-only legacy response lookup for renewal-provenance fixtures outside
+ * the kit. Production renewal uses the kit ledger. Undefined for other objects.
+ */
+export function answeredRequest(response) {
+    return answeredRequests.get(response);
+}
 /**
  * Build the transport a connector sends every request through. `maxResponseBytes`
  * is required rather than defaulted: what counts as an absurd response is a fact
@@ -303,84 +299,182 @@ export function guardedFetch(options) {
     if (!Number.isInteger(limit) || limit < 1) {
         throw new Error(`${provider} maxResponseBytes must be a whole number of bytes >= 1; received ${String(limit)}.`);
     }
+    const authFirst = options.authBeforeExecution;
+    if (authFirst &&
+        (typeof authFirst.evidence !== "string" || !authFirst.evidence.trim() || typeof authFirst.matches !== "function")) {
+        throw new Error(`${provider} authBeforeExecution needs nonempty evidence and a narrow matches predicate.`);
+    }
     const base = confinementBase(provider, options.baseUrl);
     // "" for a root base, so joining never doubles the separator.
     const basePath = base.pathname.replace(/\/+$/, "");
     const constantHeaders = { ...options.headers };
     const send = options.fetch ?? ((url, init) => fetch(url, init));
-    return async function guarded(request, ctx, map) {
-        if (request.body !== undefined && request.rawBody !== undefined) {
-            throw new Error(`A ${provider} request cannot carry both a JSON body and a raw body.`);
-        }
-        const url = confinedUrl(provider, base, basePath, request);
-        options.admit?.(url, request);
-        const headers = { ...constantHeaders };
-        for (const [name, value] of Object.entries(request.headers ?? {})) {
-            if (value !== undefined)
-                headers[name] = value;
-        }
-        if (request.body !== undefined && !hasHeader(headers, "content-type")) {
-            headers["Content-Type"] = "application/json";
+    // The reviewed predicate is trusted code; one that throws proves nothing.
+    const authenticatedFirst = (response, request) => {
+        try {
+            return (authFirst?.matches({ status: 401, headers: response.headers, method: request.method, path: request.path }) ===
+                true);
         }
-        // Authentication is applied last and may not be shadowed. A caller-shaped
-        // header that reaches this point wearing the credential's name is a bug
-        // worth failing on, not a precedence question worth resolving quietly.
-        for (const [name, value] of Object.entries(await options.authenticate(ctx))) {
-            const shadow = hasHeader(headers, name);
-            if (shadow) {
-                throw new ConnectorCallError("invalid_args", `A ${provider} request may not set the ${shadow} header; authentication is connector-owned.`);
-            }
-            headers[name] = value;
-            sentSecretsFor(ctx).header(value);
+        catch {
+            return false;
         }
+    };
+    return async function guarded(request, ctx, map) {
+        const auxiliary = options.auxiliary === true || request.auxiliary === true;
+        // A call that already ended sends nothing more, not even a credential read.
+        assertProviderCallOpen(ctx, provider, auxiliary);
+        const signal = viewSignal(ctx, auxiliary);
+        let dispatch = providerRequest(ctx, auxiliary, provider, {
+            method: request.method,
+            ...(request.classification ? { classification: request.classification } : {}),
+            ...(request.idempotencyKey === undefined ? {} : { key: request.idempotencyKey }),
+        });
         let response;
+        let result;
         try {
-            const init = {
-                method: request.method,
-                headers,
-                ...(request.body !== undefined
-                    ? { body: JSON.stringify(request.body) }
-                    : request.rawBody !== undefined
-                        ? { body: request.rawBody }
-                        : {}),
-                // A redirect is an instruction to re-send the credential to whatever
-                // origin `Location` names, and a confinement a redirect can undo was
-                // never one. Refused below rather than followed.
-                redirect: "manual",
-                ...(ctx.signal ? { signal: ctx.signal } : {}),
-            };
-            sentSecretsFor(ctx).request(url, init);
-            for (const [name, value] of Object.entries(request.visibleHeaders ?? {})) {
+            // Own the whole helper, including refusal cleanup between I/O and the
+            // mapper. Settle its ledger outside the race so revocation cannot skip
+            // the dispatched write's final verdict.
+            result = await settleOnClose(ctx, () => requestOnce(request, ctx, map), auxiliary);
+        }
+        catch (error) {
+            // Auxiliary preparation has always refused an ended request in the
+            // provider's words, even if closure wins the whole-helper race first.
+            const source = callerSignal(ctx);
+            if (auxiliary || !(source?.aborted && error === source.reason))
+                assertProviderCallOpen(ctx, provider, auxiliary);
+            // No rejection proves a dispatched write unsent: fetch may have made
+            // several attempts behind it (a 421 or HTTP/2 refused-stream resend, a
+            // retrying dispatcher), whatever the last one reports.
+            throw providerCallFailure(ctx, { title: provider }, vendorRefusal(error, dispatch), {
+                dispatched: dispatch.dispatched && !auxiliary,
+                ...(response ? { status: response.status } : {}),
+                fallback: dispatch.classification ?? "write",
+                repeatable: request.idempotencyKey !== undefined,
+                authBeforeExecution: dispatch.authBeforeExecution === true,
+                ...(auxiliary ? {} : { request: dispatch }),
+            });
+        }
+        const unknown = providerCallResult(ctx, dispatch.classification ?? "write", dispatch);
+        if (unknown)
+            throw unknown;
+        return result;
+        async function requestOnce(request, ctx, map) {
+            if (request.body !== undefined && request.rawBody !== undefined) {
+                throw new Error(`A ${provider} request cannot carry both a JSON body and a raw body.`);
+            }
+            const url = confinedUrl(provider, base, basePath, request);
+            options.admit?.(url, request);
+            const headers = { ...constantHeaders };
+            for (const [name, value] of Object.entries(request.headers ?? {})) {
+                if (value !== undefined) {
+                    const previous = hasHeader(headers, name);
+                    if (previous)
+                        delete headers[previous];
+                    headers[name] = value;
+                }
+            }
+            if (request.body !== undefined && !hasHeader(headers, "content-type")) {
+                headers["Content-Type"] = "application/json";
+            }
+            // Authentication is applied last and may not be shadowed. A caller-shaped
+            // header that reaches this point wearing the credential's name is a bug
+            // worth failing on, not a precedence question worth resolving quietly.
+            let authentication;
+            try {
+                authentication = await duringViewCall(ctx, () => Promise.resolve(options.authenticate(ctx)), auxiliary);
+            }
+            catch (error) {
+                assertProviderCallOpen(ctx, provider, auxiliary);
+                throw error;
+            }
+            for (const [name, value] of Object.entries(authentication)) {
                 const shadow = hasHeader(headers, name);
                 if (shadow) {
-                    throw new ConnectorCallError("invalid_args", `A ${provider} request sets the ${shadow} header twice.`);
+                    throw new ConnectorCallError("invalid_args", `A ${provider} request may not set the ${shadow.toLowerCase()} header; authentication is connector-owned.`);
                 }
                 headers[name] = value;
+                sentSecretsFor(ctx).header(value);
+            }
+            try {
+                const body = request.body !== undefined ? JSON.stringify(request.body) : request.rawBody;
+                const init = {
+                    method: request.method,
+                    headers,
+                    ...(body !== undefined ? { body } : {}),
+                    // A redirect is an instruction to re-send the credential to whatever
+                    // origin `Location` names, and a confinement a redirect can undo was
+                    // never one. Refused below rather than followed.
+                    redirect: "manual",
+                    signal,
+                };
+                sentSecretsFor(ctx).request(url, init);
+                for (const [name, value] of Object.entries(request.visibleHeaders ?? {})) {
+                    const shadow = hasHeader(headers, name);
+                    if (shadow) {
+                        throw new ConnectorCallError("invalid_args", `A ${provider} request sets the ${shadow.toLowerCase()} header twice.`);
+                    }
+                    headers[name] = value;
+                }
+                if (oauthSenders.has(send) && isRecordingFetch(ctx.oauth?.fetch))
+                    handoffProviderRequest(init, dispatch);
+                else
+                    dispatchProviderRequest(ctx, dispatch, headers, init.method);
+                response = await duringViewCall(ctx, async () => {
+                    const answer = await send(url.toString(), init, ctx);
+                    // A custom transport may ignore cancellation. Its late response
+                    // owns no live mapper or body after revocation.
+                    if (signal.aborted) {
+                        void answer.body?.cancel().catch(() => { });
+                        throw signal.reason;
+                    }
+                    return answer;
+                }, auxiliary);
+                const answered = responseProviderRequest(response, dispatch);
+                if (answered)
+                    dispatch = answered;
+                else
+                    recordProviderResponse(dispatch, response.status);
+            }
+            catch (cause) {
+                // A cancelled wait is the caller's own reason, not a network failure.
+                if (signal.aborted && cause === signal.reason)
+                    throw cause;
+                if (cause instanceof ConnectorCallError)
+                    throw cause;
+                throw unavailableCallError(cause, url.href, `Could not reach the ${provider} API.`, signal);
+            }
+            if (response.status === 401 && authenticatedFirst(response, request))
+                dispatch.authBeforeExecution = true;
+            if (REDIRECT_STATUSES.has(response.status)) {
+                await response.body?.cancel().catch(() => { });
+                throw new ConnectorCallError("connector_call_failed", `${provider} answered HTTP ${response.status} with a redirect; this connector talks to exactly one origin and never forwards its credential to another.`, { retryable: false });
+            }
+            const declared = Number(response.headers.get("content-length"));
+            // A prefix read takes only what it was asked for, so a long body is not
+            // a reason to refuse it; the ceiling still bounds what is read. A HEAD
+            // response has no body: its Content-Length describes the GET
+            // representation, which is exactly what a HEAD asks about.
+            if (Number.isFinite(declared) &&
+                declared > limit &&
+                request.method !== "HEAD" &&
+                !(request.prefixOnly && response.ok)) {
+                await response.body?.cancel().catch(() => { });
+                throw oversized(provider, limit, `a declared ${declared} bytes`);
+            }
+            const answer = boundedResponse(provider, response, limit, signal);
+            answeredRequests.set(answer, dispatch);
+            const abort = () => {
+                void response?.body?.cancel().catch(() => { });
+            };
+            signal.addEventListener("abort", abort, { once: true });
+            try {
+                return await duringViewCall(ctx, () => Promise.resolve(map(answer, ctx)), auxiliary);
+            }
+            finally {
+                signal.removeEventListener("abort", abort);
             }
-            response = await send(url.toString(), init, ctx);
-        }
-        catch (cause) {
-            if (cause instanceof ConnectorCallError)
-                throw cause;
-            throw unavailableCallError(cause, url.href, `Could not reach the ${provider} API.`, ctx.signal);
-        }
-        if (REDIRECT_STATUSES.has(response.status)) {
-            await response.body?.cancel().catch(() => { });
-            throw new ConnectorCallError("connector_call_failed", `${provider} answered HTTP ${response.status} with a redirect; this connector talks to exactly one origin and never forwards its credential to another.`, { retryable: false });
-        }
-        const declared = Number(response.headers.get("content-length"));
-        // A prefix read takes only what it was asked for, so a long body is not
-        // a reason to refuse it; the ceiling still bounds what is read. A HEAD
-        // response has no body: its Content-Length describes the GET
-        // representation, which is exactly what a HEAD asks about.
-        if (Number.isFinite(declared) &&
-            declared > limit &&
-            request.method !== "HEAD" &&
-            !(request.prefixOnly && response.ok)) {
-            await response.body?.cancel().catch(() => { });
-            throw oversized(provider, limit, `a declared ${declared} bytes`);
         }
-        return await map(boundedResponse(provider, response, limit), ctx);
     };
 }
 /** The stored spelling of a header already present, case-insensitively. */

package/dist/connectors/negotiation-cache.js

@@ -1,13 +1,18 @@
+import { runEdge } from "../runtime/run.js";
+import { authFlow, authProgram, registerAuth, authStorage } from "../auth/native.js";
 import { isSpecType } from "@modelcontextprotocol/client";
 import { failureRecord, logFailure } from "../operator-record.js";
 import { sentSecretsForRequest } from "../sent-secrets.js";
 import { assertDownstreamOutputSafe } from "../downstream-input-context.js";
 import { negotiationKeys, NEGOTIATION_TTL_SECONDS } from "../storage/keys.js";
 /** Verdicts carry data only. Clients, signals and secrets remain request-local. */
-export async function readNegotiation(ctx, digest) {
+export function readNegotiation(ctx, digest) {
+    return runEdge(authProgram(readNegotiationNative, [ctx, digest]));
+}
+const readNegotiationNative = /* @__PURE__ */ registerAuth(readNegotiation, (ctx, digest) => authFlow(function* () {
     let prior;
     try {
-        const raw = await ctx.storage.get(negotiationKeys.verdict(digest));
+        const raw = (yield authStorage(ctx.storage, "get", [negotiationKeys.verdict(digest)]));
         if (!raw)
             return;
         const value = JSON.parse(raw);
@@ -21,26 +26,31 @@ export async function readNegotiation(ctx, digest) {
     catch (error) {
         logFailure(ctx.logger, "negotiation cache read failed", failureRecord({}, error));
     }
-    // Privacy refusals are not cache misses and must not enter cache diagnostics.
     if (prior)
         assertDownstreamOutputSafe(ctx.requestScope ?? ctx, prior);
     return prior;
+}));
+export function storeNegotiation(ctx, digest, prior) {
+    return runEdge(authProgram(storeNegotiationNative, [ctx, digest, prior]));
 }
-export async function storeNegotiation(ctx, digest, prior) {
+const storeNegotiationNative = /* @__PURE__ */ registerAuth(storeNegotiation, (ctx, digest, prior) => authFlow(function* () {
     if (ctx.signal?.aborted)
         return;
     assertDownstreamOutputSafe(ctx.requestScope ?? ctx, prior);
-    // DiscoverResult instructions, metadata and capability keys can echo auth.
     const clean = sentSecretsForRequest(ctx.requestScope ?? ctx).redactCredentials(prior);
     if (clean.kind === "modern" && !isSpecType.DiscoverResult(clean.discover))
         return;
     try {
-        await ctx.storage.set(negotiationKeys.verdict(digest), JSON.stringify({
-            prior: clean,
-            expiresAt: Date.now() + NEGOTIATION_TTL_SECONDS * 1000,
-        }), { ttlSeconds: NEGOTIATION_TTL_SECONDS });
+        (yield authStorage(ctx.storage, "set", [
+            negotiationKeys.verdict(digest),
+            JSON.stringify({
+                prior: clean,
+                expiresAt: Date.now() + NEGOTIATION_TTL_SECONDS * 1000,
+            }),
+            { ttlSeconds: NEGOTIATION_TTL_SECONDS },
+        ]));
     }
     catch (error) {
         logFailure(ctx.logger, "negotiation cache write failed", failureRecord({}, error));
     }
-}
+}));

package/dist/connectors/remote-mcp.d.ts

@@ -1,7 +1,7 @@
 import { type RemoteOAuthClient } from "../auth/downstream-client-metadata.js";
 import type { FetchLike, Transport } from "@modelcontextprotocol/client";
 import { ConnectorCallError } from "../errors.js";
-import type { Connector, ConnectorCallAdmissionPolicy, ConnectorContext, ConnectorCredentialConfig, ConnectorUsageGuide, Logger, ToolClassification } from "../types.js";
+import type { Connector, ConnectorCallAdmissionPolicy, ConnectorContext, ConnectorCredentialConfig, ConnectorUsageGuide, Logger } from "../types.js";
 /**
  * A static downstream credential supplied through the connection in the
  * operator UI rather than baked into deployment source.
@@ -29,7 +29,7 @@ interface RemoteMcpCredentialAuth {
      * an empty string) sends the stored value verbatim, for an endpoint that
      * reads a bare key. A scheme whose last token is `Basic` declares
      * HTTP Basic credentials: the stored `user:secret` is base64-encoded first,
-     * so `"Basic"` produces `Basic <base64>` and Mixpanel's documented
+     * so `"Basic"` produces `Basic <base64>` and a nested
      * `"Bearer Basic"` produces `Bearer Basic <base64>`.
      */
     scheme?: string | null;
@@ -52,20 +52,6 @@ export type RemoteMcpAuth = {
     /** Space-separated default scopes when the resource server does not advertise them. */
     scope?: string;
 };
-/**
- * Apply a maintained provider's slot copy and header framing to credential
- * auth the deployment left bare.
- *
- * A provider knows what its own key is called and how the endpoint expects it
- * framed; a deployment that states either one keeps its answer. Every other
- * auth shape passes through untouched, so a provider can hand this its whole
- * `auth` option without branching first.
- */
-export declare function withCredentialDefaults(auth: RemoteMcpAuth, defaults: {
-    credential: ConnectorCredentialConfig;
-    /** Provider framing; omit to leave the `Bearer` default in place. */
-    scheme?: string | null;
-}): RemoteMcpAuth;
 export type RemoteMcpRedirectPolicy = "none" | "same-origin";
 export interface RemoteMcpOptions {
     url: string;
@@ -96,20 +82,12 @@ export interface RemoteMcpOptions {
     skills?: boolean;
     auth?: RemoteMcpAuth;
     /**
-     * Reviewed read/write verdicts for this downstream's tools, by exact name.
-     * Validated at construction. A listed read fills downstream silence but
-     * never overrules an explicit write annotation; a listed write or
-     * destructive tool stays a write whatever the downstream claims; an unlisted
-     * tool is read-only only when it says so explicitly; a listed tool whose
-     * `schemaDigest` no longer matches, or cannot be checked, is served as a
-     * write. Setting it also reports
-     * catalog drift against the list: unclassified, unserved, contradicted, and
-     * schema-changed tools, as counts. The connector carries it as
-     * `classification`, and its `listTools` returns the downstream's listing
-     * unclassified: the registry classifies every read. Omit it to keep the
-     * downstream's own annotations, which still fail closed.
+     * Non-secret resource context headers. Never credentials: use auth for those.
+     * Auth-owned, HTTP transport/session and OAuth client-auth headers are
+     * reserved. Cannot be combined with inline headers auth. Sent only at the
+     * resource URL path; echoed values are redacted at eight characters or more.
      */
-    classify?: ToolClassification | undefined;
+    headers?: Record<string, string>;
     /**
      * Downstream MCP version-negotiation mode. Defaults to `"auto"`, which
      * probes with `server/discover` and falls back to the legacy lifecycle when
@@ -123,7 +101,9 @@ export interface RemoteMcpOptions {
      * rejected. `"same-origin"` follows at most five redirects while preserving
      * standard 301/302/303/307/308 method semantics. Cross-origin redirects and
      * HTTPS downgrades are always refused, so credentials never cross the
-     * configured request's origin.
+     * configured request's origin. A write is never sent to a redirect target
+     * under either policy: a redirect answering a write fails it as an unknown
+     * outcome (INV-9), so set `url` to the endpoint that answers directly.
      */
     redirects?: RemoteMcpRedirectPolicy;
     /**