@zackbart/connecta 0.35.0 → 0.36.1

package/dist/auth/static-oauth.js

@@ -54,6 +54,15 @@ const RESERVED_AUTHORIZATION_PARAMS = new Set([
     "code_challenge_method",
     "resource",
 ]);
+/** Protocol response fields have their own validation, never static assertions. */
+const RESERVED_CALLBACK_PARAMS = new Set([
+    "code",
+    "state",
+    "iss",
+    "error",
+    "error_description",
+    "error_uri",
+]);
 /** Token-request headers the grant owns: client authentication and framing. */
 const RESERVED_TOKEN_HEADERS = new Set([
     "authorization",
@@ -92,65 +101,91 @@ function settingsFor(id, config) {
     if (!config || typeof config !== "object") {
         throw new Error(`[connecta] connector "${id}" oauth must be an object.`);
     }
+    const invalid = (detail) => {
+        throw new Error(`[connecta] connector "${id}" oauth.${detail}`);
+    };
     const authorizationEndpoint = configuredUrl(id, "authorizationEndpoint", config.authorizationEndpoint);
     const tokenEndpoint = configuredUrl(id, "tokenEndpoint", config.tokenEndpoint);
+    const revocationEndpoint = config.revocationEndpoint === undefined
+        ? undefined
+        : configuredUrl(id, "revocationEndpoint", config.revocationEndpoint);
+    if (revocationEndpoint?.search)
+        invalid(`revocationEndpoint must not carry a query.`);
+    const revocationRequestFormat = config.revocationRequestFormat ?? "form";
+    if ((revocationRequestFormat !== "form" && revocationRequestFormat !== "json") ||
+        (config.revocationRequestFormat !== undefined && !revocationEndpoint))
+        invalid(`revocationRequestFormat requires an endpoint and form or json.`);
     if (tokenEndpoint.search) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpoint must not carry a query.`);
+        invalid(`tokenEndpoint must not carry a query.`);
     }
     if (typeof config.clientId !== "string" || config.clientId.trim() === "") {
-        throw new Error(`[connecta] connector "${id}" oauth.clientId must be a non-empty string.`);
+        invalid(`clientId must be a non-empty string.`);
     }
     if (config.clientSecret !== undefined && (typeof config.clientSecret !== "string" || config.clientSecret === "")) {
         // Usually an unset environment variable read as "". Never echo it.
-        throw new Error(`[connecta] connector "${id}" oauth.clientSecret must be a non-empty string when set.`);
+        invalid(`clientSecret must be a non-empty string when set.`);
     }
     const clientAuthentication = config.tokenEndpointAuthMethod ?? (config.clientSecret !== undefined ? "client_secret_basic" : "none");
     if (!CLIENT_AUTHENTICATION.has(clientAuthentication)) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpointAuthMethod must be ` +
-            '"client_secret_basic", "client_secret_post", or "none".');
+        invalid(`tokenEndpointAuthMethod must be ` + '"client_secret_basic", "client_secret_post", or "none".');
     }
     if (clientAuthentication === "none" && config.clientSecret !== undefined) {
         throw new Error(`[connecta] connector "${id}" oauth declares a clientSecret with ` +
             'tokenEndpointAuthMethod "none"; a public client sends no secret.');
     }
     if (clientAuthentication !== "none" && config.clientSecret === undefined) {
-        throw new Error(`[connecta] connector "${id}" oauth.tokenEndpointAuthMethod ` + `"${clientAuthentication}" needs a clientSecret.`);
+        invalid(`tokenEndpointAuthMethod ` + `"${clientAuthentication}" needs a clientSecret.`);
     }
     assertOAuthScope(id, config.scope);
     const authorizationParams = [];
     for (const [name, value] of Object.entries(config.authorizationParams ?? {})) {
         if (RESERVED_AUTHORIZATION_PARAMS.has(name)) {
-            throw new Error(`[connecta] connector "${id}" oauth.authorizationParams may not set ` +
-                `"${name}"; the authorization request owns it.`);
+            invalid(`authorizationParams may not set ` + `"${name}"; the authorization request owns it.`);
         }
         if (typeof value !== "string") {
-            throw new Error(`[connecta] connector "${id}" oauth.authorizationParams.${name} must be a string.`);
+            invalid(`authorizationParams.${name} must be a string.`);
         }
         authorizationParams.push([name, value]);
     }
+    const expectedCallbackParameters = [];
+    if (config.expectedCallbackParameters !== undefined &&
+        (!config.expectedCallbackParameters ||
+            typeof config.expectedCallbackParameters !== "object" ||
+            Array.isArray(config.expectedCallbackParameters))) {
+        invalid(`expectedCallbackParameters must be a string record.`);
+    }
+    for (const [name, value] of Object.entries(config.expectedCallbackParameters ?? {})) {
+        if (!/^[A-Za-z0-9_.-]+$/.test(name) ||
+            RESERVED_CALLBACK_PARAMS.has(name) ||
+            typeof value !== "string" ||
+            value === "") {
+            invalid(`expectedCallbackParameters must use nonempty parameter names ` +
+                "(ASCII letters, digits, dots, underscores or hyphens), nonempty string values, and no OAuth response fields.");
+        }
+        expectedCallbackParameters.push([name, value]);
+    }
     const tokenRequestHeaders = [];
     for (const [name, value] of Object.entries(config.tokenRequestHeaders ?? {})) {
         if (!HEADER_NAME.test(name)) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders has an invalid header name.`);
+            invalid(`tokenRequestHeaders has an invalid header name.`);
         }
         if (RESERVED_TOKEN_HEADERS.has(name.toLowerCase())) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders may not set ` + `"${name}"; the token request owns it.`);
+            invalid(`tokenRequestHeaders may not set ` + `"${name}"; the token request owns it.`);
         }
         if (typeof value !== "string" || value.includes("\r") || value.includes("\n") || value.includes("\0")) {
-            throw new Error(`[connecta] connector "${id}" oauth.tokenRequestHeaders.${name} must be a single-line string.`);
+            invalid(`tokenRequestHeaders.${name} must be a single-line string.`);
         }
         tokenRequestHeaders.push([name, value]);
     }
     const origins = Array.isArray(config.apiOrigins) ? config.apiOrigins : [];
     if (origins.length === 0) {
-        throw new Error(`[connecta] connector "${id}" oauth.apiOrigins must name at least one ` +
-            "origin; ctx.oauth.fetch sends the access token nowhere else.");
+        invalid(`apiOrigins must name at least one ` + "origin; ctx.oauth.fetch sends the access token nowhere else.");
     }
     const apiOrigins = new Set();
     for (const origin of origins) {
         const url = configuredUrl(id, "apiOrigins", origin);
         if (url.origin !== origin) {
-            throw new Error(`[connecta] connector "${id}" oauth.apiOrigins entries must be exact ` +
+            invalid(`apiOrigins entries must be exact ` +
                 'origins, like "https://api.example.com", with no path or trailing slash.');
         }
         apiOrigins.add(url.origin);
@@ -158,12 +193,15 @@ function settingsFor(id, config) {
     return {
         authorizationEndpoint,
         tokenEndpoint,
+        ...(revocationEndpoint ? { revocationEndpoint } : {}),
+        revocationRequestFormat,
         clientId: config.clientId,
         ...(config.clientSecret !== undefined ? { clientSecret: config.clientSecret } : {}),
         clientAuthentication,
         ...(config.scope !== undefined ? { scope: config.scope } : {}),
         pkce: config.pkce ?? true,
         authorizationParams,
+        expectedCallbackParameters,
         tokenRequestHeaders,
         apiOrigins,
         serverUrl: new URL(origins[0]),
@@ -202,6 +240,29 @@ class StaticOAuthProvider extends KvOAuthProvider {
             tokenEndpoint: this.settings.tokenEndpoint.href,
         };
     }
+    configuredClientInformation() {
+        const { settings } = this;
+        return {
+            client_id: settings.clientId,
+            ...(settings.clientSecret !== undefined ? { client_secret: settings.clientSecret } : {}),
+            redirect_uris: [this.redirectUrl],
+            token_endpoint_auth_method: settings.clientAuthentication,
+            issuer: settings.identity,
+        };
+    }
+    revocationSnapshot(body) {
+        const { settings } = this;
+        return {
+            body: {
+                ...body,
+                client: { value: this.configuredClientInformation() },
+                discovery: {
+                    authorizationServerUrl: settings.identity,
+                    authorizationServerMetadata: { revocation_endpoint: settings.revocationEndpoint.href },
+                },
+            },
+        };
+    }
     saveClientInformation() {
         return runEdge(authOwnMethod(StaticOAuthProvider.prototype, this, "saveClientInformation", []));
     }
@@ -245,16 +306,7 @@ class StaticOAuthProvider extends KvOAuthProvider {
     }
     static {
         registerAuthMethod(StaticOAuthProvider.prototype, "clientInformation", function () {
-            return authValue(() => {
-                const { settings } = this;
-                return {
-                    client_id: settings.clientId,
-                    ...(settings.clientSecret !== undefined ? { client_secret: settings.clientSecret } : {}),
-                    redirect_uris: [this.redirectUrl],
-                    token_endpoint_auth_method: settings.clientAuthentication,
-                    issuer: settings.identity,
-                };
-            });
+            return authValue(() => this.configuredClientInformation());
         }, StaticOAuthProvider.prototype.clientInformation);
         registerAuthMethod(StaticOAuthProvider.prototype, "saveClientInformation", function () {
             // Nothing to save: the SDK only saves a client it registered or stamped.
@@ -359,6 +411,10 @@ const readChallengeNative = /* @__PURE__ */ registerAuth(readChallenge, function
 /** The grant behind one `api()` connector's `oauth`, as the hooks it exposes. */
 export function staticOAuth(id, config) {
     const settings = settingsFor(id, config);
+    const callbackParametersMatch = (params) => settings.expectedCallbackParameters.every(([name, expected]) => {
+        const values = params?.getAll(name);
+        return values?.length === 1 && values[0] === expected;
+    });
     const issuerContext = { issuer: settings.identity };
     const coordinatorFor = refreshCoordinatorsByPartition();
     // Keyed by request scope, so nothing here outlives the request that set it.
@@ -830,7 +886,25 @@ export function staticOAuth(id, config) {
     const disconnectAuth = authMethod((ctx) => {
         return authFlow(function* () {
             rejectedScopes.delete(scopeOf(ctx));
-            (yield authInvoke(providerFor(ctx), "resetAuthorization", [true]));
+            if (!settings.revocationEndpoint) {
+                (yield authInvoke(providerFor(ctx), "resetAuthorization", [true]));
+                return;
+            }
+            (yield authInvoke(providerFor(ctx), "disconnectAuthorization", [
+                authMethod((input, init = {}) => {
+                    // Register the standard form's credentials before any JSON framing.
+                    trackRemoteClientRequest(sentSecretsFor(ctx), input, init);
+                    if (settings.revocationRequestFormat === "json" && init.body instanceof URLSearchParams) {
+                        const params = new URLSearchParams(init.body);
+                        params.delete("token_type_hint");
+                        const headers = new Headers(init.headers);
+                        headers.set("Content-Type", "application/json");
+                        headers.set("Accept", "application/json");
+                        init = { ...init, headers, body: JSON.stringify(Object.fromEntries(params)) };
+                    }
+                    return authCall(tokenEndpointFetch, [sentSecretsFor(ctx), input, init]);
+                }),
+            ]));
         });
     });
     const verifyState = authMethod((state, ctx) => {
@@ -854,6 +928,9 @@ export function staticOAuth(id, config) {
                 if (!consent || !(yield authInvoke(provider, "verifyCallbackState", [consent]))) {
                     throw new ConnectorCallError("connector_call_failed", `Connector "${id}" authorization callback matches no pending consent; nothing was exchanged.`);
                 }
+                if (!callbackParametersMatch(callbackParams)) {
+                    throw new ConnectorCallError("connector_call_failed", `Connector "${id}" authorization callback did not match its configured parameters; nothing was exchanged.`);
+                }
                 provider.validateCallbackIssuer(callbackParams?.get("iss") ?? null);
                 provider.exchanging(authorizationCode);
                 (yield authInvoke(provider, "bindFlow", []));
@@ -877,6 +954,7 @@ export function staticOAuth(id, config) {
         startAuth: retainAuthPartition(startAuth, 0),
         disconnectAuth: retainAuthPartition(disconnectAuth, 0),
         verifyState: retainAuthPartition(verifyState, 1),
+        verifyCallbackParameters: retainAuthPartition(authMethod((params, _ctx) => authValue(() => callbackParametersMatch(params))), 1),
         verifyCallbackIssuer: retainAuthPartition(authMethod((issuer, ctx) => {
             return authValue(() => {
                 const provider = callbackProviders.get(scopeOf(ctx));

package/dist/connectors/api-connector.d.ts

@@ -42,6 +42,10 @@ export interface ApiOAuthConfig {
     authorizationEndpoint: string;
     /** Where codes are exchanged and refresh tokens redeemed. Absolute https URL. */
     tokenEndpoint: string;
+    /** Trusted RFC 7009 endpoint; disconnect removes the local grant then attempts revocation once. */
+    revocationEndpoint?: string;
+    /** Revocation body encoding, default form. JSON omits the RFC 7009 token_type_hint. */
+    revocationRequestFormat?: "form" | "json";
     /** The client id the provider issued for this deployment. */
     clientId: string;
     /**
@@ -64,6 +68,15 @@ export interface ApiOAuthConfig {
      * `access_type`. The grant's own parameters cannot be overridden.
      */
     authorizationParams?: Record<string, string>;
+    /**
+     * Fixed provider callback parameters, such as a configured company id.
+     * After pending-state verification, each must occur exactly once with this
+     * exact value, before issuer validation or code exchange. OAuth response
+     * fields (code, state, iss, error, error_description, error_uri) are reserved.
+     * Names must be nonempty ASCII letters, digits, dots, underscores or hyphens;
+     * values must be nonempty strings. Values are never described or returned.
+     */
+    expectedCallbackParameters?: Readonly<Record<string, string>>;
     /**
      * Headers added to every token-endpoint request — the code exchange and
      * each refresh — for a provider whose token endpoint demands its own
@@ -199,6 +212,7 @@ export declare const API_OPTIONS: import("../config-schema.js").Field<unknown, u
         oauth: import("../config-schema.js").Field<unknown, unknown, true> & {
             readonly shape: {
                 authorizationParams: import("../config-schema.js").Field<Record<string, string>, Readonly<Record<string, string>> | undefined, true>;
+                expectedCallbackParameters: import("../config-schema.js").Field<Record<string, string>, Readonly<Record<string, string>> | undefined, true>;
                 tokenRequestHeaders: import("../config-schema.js").Field<Record<string, string>, Readonly<Record<string, string>> | undefined, true>;
                 scope: import("../config-schema.js").Field<unknown, unknown, true>;
                 authorizationEndpoint: import("../config-schema.js").Field<unknown, unknown, true>;
@@ -208,6 +222,8 @@ export declare const API_OPTIONS: import("../config-schema.js").Field<unknown, u
                 pkce: import("../config-schema.js").Field<unknown, unknown, true>;
                 clientId: import("../config-schema.js").Field<unknown, unknown, true>;
                 clientSecret: import("../config-schema.js").Field<unknown, unknown, true>;
+                revocationEndpoint: import("../config-schema.js").Field<unknown, unknown, true>;
+                revocationRequestFormat: import("../config-schema.js").Field<unknown, unknown, true>;
             };
         };
         tools: import("../config-schema.js").Field<unknown[], readonly unknown[] | undefined, true>;
@@ -233,6 +249,7 @@ export interface ApiOAuthHooks {
     }): Promise<ConnectorStatus>;
     disconnectAuth(ctx: ConnectorContext): Promise<void>;
     verifyState(state: string | null, ctx: ConnectorContext): Promise<boolean>;
+    verifyCallbackParameters(params: URLSearchParams, ctx: ConnectorContext): Promise<boolean>;
     verifyCallbackIssuer(issuer: string | null, ctx: ConnectorContext): Promise<boolean>;
     consumeAuthError(ctx: ConnectorContext): Promise<void>;
     /** Requires callbackParams with a nonempty state, including without PKCE. */

package/dist/connectors/api-connector.js

@@ -57,8 +57,9 @@ export const API_OPTIONS = optionsOf()({
     usageGuide: USAGE_GUIDE,
     credential: CREDENTIAL,
     oauth: optionsOf()({
-        ...keys("authorizationEndpoint", "tokenEndpoint", "clientId", "clientSecret", "tokenEndpointAuthMethod", "scope", "pkce", "apiOrigins"),
+        ...keys("authorizationEndpoint", "tokenEndpoint", "clientId", "clientSecret", "tokenEndpointAuthMethod", "scope", "pkce", "apiOrigins", "revocationEndpoint", "revocationRequestFormat"),
         authorizationParams: strings(),
+        expectedCallbackParameters: strings(),
         tokenRequestHeaders: strings(),
     }),
     // A tool's annotations stay open: MCP lets a tool carry hints Connecta
@@ -158,6 +159,7 @@ export function apiConnector(id, opts, oauth) {
                 // Callback work belongs to its request, including the route's
                 // uninterruptible exchange, rather than any resource call.
                 verifyState: (state, ctx) => settleOnClose(ctx, () => oauth.verifyState(state, ctx), true),
+                verifyCallbackParameters: (params, ctx) => settleOnClose(ctx, () => oauth.verifyCallbackParameters(params, ctx), true),
                 verifyCallbackIssuer: (issuer, ctx) => settleOnClose(ctx, () => oauth.verifyCallbackIssuer(issuer, ctx), true),
                 consumeAuthError: (ctx) => settleOnClose(ctx, () => oauth.consumeAuthError(ctx), true),
                 finishAuth: (code, ctx, callbackParams) => settleOnClose(ctx, () => oauth.finishAuth(code, ctx, callbackParams), true),

package/dist/http/client.js

@@ -324,7 +324,7 @@ function bodyInit(request) {
             return { body: body.body };
         case "Uint8Array":
             // The retained text when there is one, so the wire carries exactly the
-            // string guarded-fetch sent and goldens record the same body.
+            // string guarded-fetch sent.
             return { body: (body.text ?? body.body) };
         case "FormData":
             return { body: body.formData };

package/dist/http/hatch-paging.js

@@ -1,5 +1,5 @@
-// Internal opt-in adapters for the standard hatch. No maintained provider opts
-// in until its separate step-2 migration. Inputs have crossed connection safety.
+// Internal opt-in adapters for the standard hatch. Inputs have crossed
+// connection safety.
 import { ConnectorCallError } from "../errors.js";
 function record(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};

package/dist/http/paging.js

@@ -1,30 +1,17 @@
 // Provider kit (decision 0010, B.4). Unreachable from src/index.ts.
 //
-// Paging is a strategy plus one cursor codec. A strategy turns "the next page
-// after this cursor" into a vendor request and reads back rows and the next
-// vendor cursor; tools take one page, and `allRows` walks every page as a
-// Stream for programs and the hatch. The codec is the only place a cursor is
-// minted: `plain` hands the vendor's cursor through (what shipped providers
-// promise today, so goldens hold), `bound` ties it to the tool and its
-// arguments so a cursor from another call is refused instead of silently
-// reading the wrong list.
-import { Effect, Option, Schema, Stream } from "effect";
+// List tools take one page at a time. Lookahead detects an extra row; bound
+// cursors authenticate the tool, arguments, connection and credential owner.
+import { Effect, Schema } from "effect";
 import { ConnectorCallError } from "../errors.js";
 import { Refusal } from "./errors.js";
-import { confinementBase } from "../http-policy.js";
 import { canonicalJson } from "../canonical-json.js";
 import { ContinuationBinding, ContinuationStorage } from "../runtime/call.js";
 import { continuationKeys } from "../storage/keys.js";
-/** The `page` object every list tool returns. */
-export const PageInfo = Schema.Struct({
-    hasMore: Schema.Boolean,
-    nextCursor: Schema.NullOr(Schema.String),
-});
 /**
  * The standard `page` (decision 0011 S2): `nextCursor` is present exactly
  * when `hasMore` is true and continuation is safe. A hatch adapter can report
  * more data without a cursor when its continuation cannot be confined.
- * Step-1 lists keep `PageInfo` until their step 2.
  */
 export const StandardPage = Schema.Struct({
     hasMore: Schema.Boolean,
@@ -56,79 +43,6 @@ export function lookahead(options) {
         return { rows, page: { hasMore, nextCursor: id } };
     });
 }
-/** Vendor-supplied continuation, read only after the connection made its data safe. */
-export function token(options) {
-    return Effect.flatMap(Effect.suspend(options.fetch), ({ rows, hasMore, nextCursor }) => {
-        if (hasMore && !nextCursor)
-            return badPage("The vendor reported another page without a next cursor.");
-        return Effect.succeed({ rows, page: { hasMore, nextCursor: hasMore ? nextCursor : null } });
-    });
-}
-/** Offset paging advances by the rows actually returned, with a total when supplied. */
-export function offset(options) {
-    return Effect.gen(function* () {
-        yield* position(options.offset, 0);
-        yield* position(options.limit, 1);
-        return yield* Effect.map(options.fetch(options.offset, options.limit), ({ rows, total }) => {
-            const next = options.offset + rows.length;
-            const hasMore = rows.length > 0 && (total === undefined ? rows.length >= options.limit : next < total);
-            return { rows, page: { hasMore, nextCursor: hasMore ? String(next) : null } };
-        });
-    });
-}
-/** Page numbers from a vendor's safe body or headers, with full-page fallback. */
-export function page(options) {
-    return Effect.gen(function* () {
-        yield* position(options.page, 1);
-        yield* position(options.limit, 1);
-        return yield* Effect.map(options.fetch(options.page, options.limit), ({ rows, hasMore, totalPages }) => {
-            const more = hasMore ?? (totalPages === undefined ? rows.length >= options.limit : options.page < totalPages);
-            return { rows, page: { hasMore: more, nextCursor: more ? String(options.page + 1) : null } };
-        });
-    });
-}
-/** Extract only a cursor from a next URL confined to this connection's origin and path. */
-export function link(options) {
-    const base = confinementBase("Paging", options.baseUrl);
-    const prefix = base.pathname.replace(/\/+$/, "");
-    if (!options.param)
-        throw new Error("Link paging needs a cursor parameter.");
-    return Effect.flatMap(Effect.suspend(options.fetch), ({ rows, next }) => {
-        if (!next)
-            return Effect.succeed({ rows, page: { hasMore: false, nextCursor: null } });
-        let url;
-        try {
-            url = new URL(next, base);
-        }
-        catch {
-            return badPage("The vendor returned an invalid next-page URL.");
-        }
-        if (url.origin !== base.origin ||
-            !`${url.pathname}/`.startsWith(`${prefix}/`) ||
-            url.username ||
-            url.password ||
-            url.hash)
-            return badPage("The vendor returned a next-page URL outside this connection.");
-        const cursors = url.searchParams.getAll(options.param);
-        if (cursors.length !== 1 || !cursors[0])
-            return badPage("The vendor returned no unique next-page cursor.");
-        return Effect.succeed({ rows, page: { hasMore: true, nextCursor: cursors[0] } });
-    });
-}
-function position(value, minimum) {
-    return Number.isSafeInteger(value) && value >= minimum
-        ? Effect.void
-        : Effect.fail(new Refusal({
-            error: new ConnectorCallError("invalid_args", "Paging positions and limits must be whole numbers within their bounds."),
-        }));
-}
-function badPage(message) {
-    return Effect.fail(new Refusal({ error: new ConnectorCallError("connector_call_failed", message, { retryable: false }) }));
-}
-/** Every row of every page, fetched as the stream is pulled. */
-export function allRows(fetchPage) {
-    return Stream.paginate(undefined, (cursor) => Effect.map(fetchPage(cursor), ({ rows, page }) => [rows, Option.fromNullishOr(page.hasMore ? page.nextCursor : null)]));
-}
 const STRAY_CURSOR = "This cursor belongs to a different call. Pass back the nextCursor from the previous page of this same call, with the same arguments.";
 /** Resolved, nonextractable keys only: no request promise is retained between calls. */
 const signingKeys = new WeakMap();

package/dist/http/provider.js

@@ -191,8 +191,7 @@ export function defineApiProvider(definition) {
             // The declared fact the Writes convention states must match what the write builders send.
             if (idempotencyKey !== undefined && [...builtTools, ...hatchTools].some(takesIdempotencyKey) !== idempotencyKey)
                 throw new Error(`${metadata.title} declares idempotencyKey: ${idempotencyKey}, but its write tools ${idempotencyKey ? "send no" : "send an"} idempotency key.`);
-            const usageGuide = guide(options);
-            const renderedGuide = "content" in usageGuide ? usageGuide : provider.usageGuide(usageGuide);
+            const renderedGuide = provider.usageGuide(guide(options));
             const connector = tracksEveryRequest(api(id, {
                 ...(defaultCallAdmission
                     ? {

package/dist/http/services.js

@@ -6,7 +6,7 @@ import { fromSignal } from "../runtime/run.js";
 import { callFromContext, ContinuationBinding, ContinuationStorage, openCall as openCoreCall, serviceFor, Signal, } from "../runtime/call.js";
 import { RequestRefused, ResendRefused } from "./errors.js";
 export { writeRequestKey } from "./write-request.js";
-export { Caller, Credentials, Secrets, RequestSecrets, Budget, Recovery, Signal, Classification, Ledger, openRequest, operationView, deriveView, viewCaller, callView, chargeView, } from "../runtime/call.js";
+export { Caller, Credentials, Secrets, RequestSecrets, Budget, Recovery, Signal, Classification, Ledger, } from "../runtime/call.js";
 /** Permanent write reservations plus resource dispatches, in reservation order. */
 export class Dispatches extends Context.Service()("connecta/http/Dispatches") {
 }

package/dist/http/tools.js

@@ -22,7 +22,7 @@ import { causeError, runEdge } from "../runtime/run.js";
 import { recordUnauthorized, Refusal, RequestRefused, toConnectorCallError, withheldDefect, } from "./errors.js";
 import { fieldsInput, fieldsProblem, selectFields } from "./fields.js";
 import { catalogSchema, Integer } from "./json-schema.js";
-import { boundCursor, Cursor, PageInfo, StandardPage } from "./paging.js";
+import { boundCursor, Cursor, StandardPage } from "./paging.js";
 import { Classification, Dispatches, IdempotencyKey, Recovery, ReadTool, WriteCapacity, writeRequestKey, fromConnectorContext, } from "./services.js";
 const inputs = new WeakMap();
 const keyed = new WeakSet();
@@ -118,28 +118,6 @@ export function get(connection, spec) {
 export function list(connection, spec) {
     if (spec.cursor !== undefined && spec.cursor !== "plain" && spec.cursor !== "bound")
         throw new Error('A list cursor must be "plain" or "bound".');
-    if (!("key" in spec))
-        return standardList(connection, spec);
-    if (!spec.key || spec.key === "page")
-        throw new Error("A list needs a row key distinct from page.");
-    return read(connection, {
-        ...spec,
-        output: Schema.Struct({ [spec.key]: Schema.Array(spec.row), page: PageInfo }),
-        run: (args) => Effect.gen(function* () {
-            const fields = args;
-            const supplied = typeof fields.cursor === "string" ? fields.cursor : undefined;
-            const cursor = supplied !== undefined && spec.cursor === "bound"
-                ? yield* boundCursor.decode(spec.name, fields, supplied)
-                : supplied;
-            const result = yield* spec.page(args, cursor);
-            const nextCursor = result.page.nextCursor !== null && spec.cursor === "bound"
-                ? yield* boundCursor.encode(spec.name, fields, result.page.nextCursor)
-                : result.page.nextCursor;
-            return { [spec.key]: result.rows, page: { ...result.page, nextCursor } };
-        }),
-    });
-}
-function standardList(connection, spec) {
     const { default: size, max } = spec.limit;
     if (spec.total !== undefined && spec.total !== true)
         throw new Error(`${spec.name} total must opt in with true for a vendor-stated exact count.`);
@@ -264,10 +242,6 @@ export function write(connection, spec) {
         ...(spec.idempotent === undefined ? {} : { idempotentHint: spec.idempotent }),
     }, spec.idempotency);
 }
-/** Money, mail, and refunds are always destructive and never idempotent hints. */
-export function action(connection, spec) {
-    return build(connection, spec, "write", { readOnlyHint: false, destructiveHint: true, idempotentHint: false });
-}
 /**
  * A key the transport may send: not blank, and only characters an HTTP
  * header carries. The REST layer refuses the same keys before dispatch.

package/dist/operator-ui/contract.d.ts

@@ -2,6 +2,7 @@ import type { ActivityOutcome } from "../activity.js";
 import type { ConnectaConfigDescription } from "../describe-config.js";
 import type { ConnectorStatus, ConnectorToolDescription } from "../types.js";
 import type { UiProblem } from "./model.js";
+export type OperatorPage = "overview" | "endpoints" | "settings" | "connector" | "tokens" | "connections" | "activity";
 /** The registry's final verdict, independent of whether the viewer's endpoint is read-only. */
 export interface OperatorTool extends ConnectorToolDescription {
     address: string;