@zackbart/connecta 0.37.0 → 0.38.0

package/dist/routes/shared.js

@@ -5,6 +5,7 @@ import { isMaintainer, isMember } from "../membership.js";
 import { identityStorageKey, validIdentityReference } from "../identity.js";
 import { assertsAgents, isAgentName } from "../agent-identity.js";
 import { authenticate } from "../auth-admission.js";
+import { attachFailureFacts, carryFailureFacts, failureRecord, logFailure } from "../operator-record.js";
 export { msg } from "../errors.js";
 import { authCall, authFlow, authInvoke, authProgram, registerAuth } from "../auth/native.js";
 import { runEdge } from "../runtime/run.js";
@@ -87,17 +88,17 @@ const providerChallengeNative = /* @__PURE__ */ registerAuth(providerChallenge,
     return authFlow(function* () {
         const privateHeaders = new Headers(response.headers);
         privateHeaders.set("Cache-Control", "no-store");
-        response = new Response(response.body, {
+        response = carryFailureFacts(response, new Response(response.body, {
             status: response.status,
             statusText: response.statusText,
             headers: privateHeaders,
-        });
+        }));
         if (response.status !== 401)
             return response;
         if (!response.headers.has("WWW-Authenticate")) {
             const headers = new Headers(response.headers);
             headers.set("WWW-Authenticate", refusingProvider?.challenge?.(request, baseUrl) ?? "Bearer");
-            response = new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+            response = carryFailureFacts(response, new Response(response.body, { status: response.status, statusText: response.statusText, headers }));
         }
         const path = new URL(request.url).pathname;
         const pool = /^\/mcp\/([a-z0-9_-]+)$/.exec(path)?.[1];
@@ -113,7 +114,7 @@ const providerChallengeNative = /* @__PURE__ */ registerAuth(providerChallenge,
             return response;
         const headers = new Headers(response.headers);
         headers.set("WWW-Authenticate", challenge);
-        return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+        return carryFailureFacts(response, new Response(response.body, { status: response.status, statusText: response.statusText, headers }));
     });
 });
 function recognizedProvider(request, auth, runtimeContext) {
@@ -162,7 +163,7 @@ const authorizeNative = /* @__PURE__ */ registerAuth(authorize, function (reques
             return { ok: false, response: privateJson({ error: "authenticated user required" }, { status: 403 }) };
         }
         // Every caller of this function is a human route. Agents reach pools only at
-        // `/agent/<pool>` (#837), so a workload or `cta_` credential refuses here
+        // `/agent/<pool>`, so a workload or `cta_` credential refuses here
         // without verification, and never falls back to a cookie, session or Access context.
         if (machineCredential) {
             return {
@@ -213,6 +214,12 @@ const authorizeNative = /* @__PURE__ */ registerAuth(authorize, function (reques
             if (!admission.admitted)
                 return { ok: false, response: admission.response };
             const result = admission.result;
+            if (!result.ok && result.response.status === 503 && provider.kind === "cloudflare-access") {
+                logFailure(logger, "Cloudflare Access verification unavailable", failureRecord({
+                    accessContext: Boolean(runtimeContext?.access),
+                    authorizationHeader: credential.kind,
+                }, result.response));
+            }
             // Only built-in agent credential adapters assert an agent, and they never
             // answer here. Any `agent` claim refuses like an unknown token.
             const agent = result.ok ? result.agent : undefined;
@@ -272,10 +279,10 @@ const authorizeNative = /* @__PURE__ */ registerAuth(authorize, function (reques
             ok: false,
             response: (yield authCall(providerChallenge, [
                 lastResponse ??
-                    privateJson({ error: "unauthorized" }, {
+                    attachFailureFacts(privateJson({ error: "unauthorized" }, {
                         status: 401,
                         headers: { "WWW-Authenticate": "Bearer" },
-                    }),
+                    }), { reason: "authentication_provider_missing" }),
                 request,
                 baseUrl,
                 auth,
@@ -292,7 +299,7 @@ function agentChallenge() {
     };
 }
 /**
- * Admission at an agent endpoint, `/agent/<pool>` (#837). Only the built-in
+ * Admission at an agent endpoint, `/agent/<pool>`. Only the built-in
  * agent credential adapters are consulted: Clerk and Access never run, cookies and Clerk
  * handshake parameters are stripped, and the runtime context, which carries
  * Access's `ctx.access` even on a bypassed path, is never passed. Anything but
@@ -369,7 +376,7 @@ export function isSameOrigin(request, baseUrl) {
         return false;
     }
 }
-export function withSecurityHeaders(response, requestUrl, _path) {
+export function withSecurityHeaders(response, requestUrl) {
     const headers = response.headers.get("Content-Type")?.toLowerCase().startsWith("text/html")
         ? htmlSecurityHeaders(response.headers)
         : new Headers(response.headers);
@@ -385,7 +392,7 @@ export function withSecurityHeaders(response, requestUrl, _path) {
     });
 }
 /**
- * Plain `/mcp` and every operator route admit a maintainer (#837). An open
+ * Plain `/mcp` and every operator route admit a maintainer. An open
  * deployment has no inbound auth and so no maintainers: its one anonymous
  * caller keeps the whole default endpoint, as the startup warning says.
  */
@@ -394,7 +401,7 @@ export function admitsMaintainer(opts, authz) {
 }
 /**
  * The declared pool `/mcp/<name>` serves to this person, or undefined for the
- * same 404. An agent is never admitted here, even when listed (#837).
+ * same 404. An agent is never admitted here, even when listed.
  */
 export function memberPool(opts, name, identity) {
     if (identity.agent !== undefined)
@@ -410,7 +417,7 @@ export function agentPool(opts, name, identity) {
     return pool?.members.some((member) => member.kind === "agent" && isMember(member, identity)) ? pool : undefined;
 }
 /**
- * The connectors of every pool this identity is a member of (#837): what a
+ * The connectors of every pool this identity is a member of: what a
  * pool member may ever manage, and only their personal ones among these.
  */
 export function memberConnectors(opts, identity) {
@@ -428,7 +435,7 @@ export function memberConnectors(opts, identity) {
 }
 /**
  * Whether this identity may start, finish, or remove a connector's auth
- * (#837). Only an interactive person ever may; an agent or any other machine
+ * Only an interactive person ever may; an agent or any other machine
  * credential manages nothing. Shared auth is deployment-wide, so it takes a
  * maintainer. A personal connector takes a stable principal that is a
  * maintainer, whose plain `/mcp` includes it, or a member of a pool that
@@ -447,12 +454,12 @@ export function mayManageConnector(opts, authz, connector) {
     const pools = memberConnectors(opts, identity);
     return pools === "all" || pools.has(connector.id);
 }
-/** Agent token list, issue, rotate, and revoke: an interactive maintainer only (#837). */
+/** Agent token list, issue, rotate, and revoke: an interactive maintainer only. */
 export function managesAgentTokens(opts, authz) {
     return (authz.identity.interactive && authz.identity.agent === undefined && isMaintainer(opts.maintainers, authz.identity));
 }
 /**
- * Activity reads: a maintainer principal, interactive or not (#837). Members
+ * Activity reads: a maintainer principal, interactive or not. Members
  * and agents read none, and an open deployment has no maintainer.
  */
 export function readsActivity(opts, authz) {

package/dist/routes/ui-config.js

@@ -23,7 +23,7 @@ import { closeScope } from "../runtime/connector-scope.js";
 import { withDeadlineEffect } from "../runtime/run.js";
 import { uiProblemFor } from "../ui.js";
 import { workspaceSubjectOf } from "../workspace-subject.js";
-import { authorized, refuse, scopeFor, serveOperator } from "./operator.js";
+import { authorized, operatorViewerKey, refuse, scopeFor, serveOperator, } from "./operator.js";
 import { isMaintainer, isMember } from "../membership.js";
 import { admitsMaintainer, mayManageConnector, privateJson, readsActivity } from "./shared.js";
 const cachedMaintainers = new WeakSet();
@@ -338,7 +338,7 @@ function matrixFor(context, visible, rows, ownersVisible) {
 function maintainerRead(context, authz) {
     const { opts } = context;
     return Effect.gen(function* () {
-        const registry = opts.registry.scoped(scopeFor(authz));
+        const registry = opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0));
         const selected = context.url.searchParams.get("connector");
         const visible = registry.listConnectors().filter((connector) => selected === null || connector.id === selected);
         if (selected !== null && visible.length === 0)
@@ -359,7 +359,7 @@ function maintainerRead(context, authz) {
             .map(([id, tools]) => [id, Object.fromEntries(Object.entries(tools).filter(([name]) => validName(name)))]));
         // A pool owner is a Workspace mailbox address. Only an authenticated
         // maintainer reads it; an open deployment's anonymous caller, which this
-        // route admits, gets null, the same as an unset owner (#837).
+        // route admits, gets null, the same as an unset owner.
         const ownersVisible = opts.config.auth.length > 0 && isMaintainer(opts.maintainers, authz.identity);
         config.pools = config.pools.map((pool) => ({
             ...pool,
@@ -442,7 +442,7 @@ function maintainerRead(context, authz) {
             agents,
             matrix,
             connectors: [],
-            you: { interactive: authz.identity.interactive },
+            you: { interactive: authz.identity.interactive, viewerKey: yield* operatorViewerKey(context, authz) },
         };
         return privateJson(contract);
     });
@@ -553,7 +553,7 @@ function memberRead(context, authz, pools) {
     return Effect.gen(function* () {
         const allIds = opts.registry.listConnectors().map((c) => c.id);
         const ids = new Set(allIds.filter((id) => pools.some(([, pool]) => servesConnector(pool, id))));
-        const registry = opts.registry.scoped(scopeFor(authz, [...ids]));
+        const registry = opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0, [...ids]));
         const selected = context.url.searchParams.get("connector");
         const visible = registry
             .listConnectors()
@@ -583,7 +583,7 @@ function memberRead(context, authz, pools) {
             agents: [],
             matrix: [],
             connectors,
-            you: { interactive: authz.identity.interactive },
+            you: { interactive: authz.identity.interactive, viewerKey: yield* operatorViewerKey(context, authz) },
         };
         return privateJson(contract);
     });

package/dist/routes/ui-data.js

@@ -30,10 +30,10 @@ export function uiData(registry, baseUrl, options) {
          * connecta described the failure itself, that failure's typed facts. The
          * message is never logged, whatever it looks like: a connector's own
          * `status()` can quote a downstream error body, which can quote the
-         * secret it just rejected (INV-6). An `ok` status is simply dropped.
+         * secret it just rejected (INV-6). Non-error `ok` and `per_caller` states are dropped.
          */
         const logStatus = (id, state, failure, requestScope) => {
-            if (state === "ok")
+            if (state === "ok" || state === "per_caller")
                 return;
             const logger = registry.contextFor(id, baseUrl, requestScope).logger;
             logFailure(logger, "operator status", failureRecord({ connector: id, state }, failure), state === "auth_required" ? "info" : "warn");

package/dist/routes/ui.js

@@ -9,7 +9,7 @@ import { Effect } from "effect";
 import { CONNECTA_VERSION } from "../version.js";
 import { CONNECTA_FAVICON_ICO } from "../favicon.js";
 import { CONNECTA_FAVICON_SVG, operatorPageForPath, renderUiHtml } from "../ui.js";
-import { authorized, refuse, scopeFor, serveOperator, visibleRegistry, } from "./operator.js";
+import { authorized, operatorViewerKey, refuse, scopeFor, serveOperator, visibleRegistry, } from "./operator.js";
 import { managesAgentTokens, mayManageConnector, privateJson, readsActivity } from "./shared.js";
 import { routeUiConfig, scanOperatorActivity } from "./ui-config.js";
 import { uiData } from "./ui-data.js";
@@ -144,7 +144,7 @@ function connectorDetail(context, id) {
         const connector = registry.getConnector(id);
         if (!connector)
             return yield* refuse("unknown connector", 404);
-        const data = yield* uiData(opts.registry.scoped(scopeFor(authz, [connector.id])), baseUrl, {
+        const data = yield* uiData(opts.registry.scoped(scopeFor(authz, opts.config.auth.length > 0, [connector.id])), baseUrl, {
             serverInfo: opts.config.serverInfo,
             activityContext: operatorActivityContext(context, authz),
             credentialVault: opts.config.vault,
@@ -168,7 +168,11 @@ function connectorDetail(context, id) {
                 signal: request.signal,
                 timeoutError: new Error("Activity observation timed out."),
             }).pipe(Effect.catch(() => Effect.succeed("unavailable")));
-        return privateJson({ ...detail, permissions: permissions(connector) });
+        return privateJson({
+            ...detail,
+            viewerKey: yield* operatorViewerKey(context, authz),
+            permissions: permissions(connector),
+        });
     });
 }
 /** The summary: every visible connector as "loading", with no probe at all. */
@@ -178,10 +182,11 @@ function summary(context) {
         const authz = yield* authorized(context);
         const registry = yield* visibleRegistry(context, authz);
         const { visible, mayManage, permissions, activityEnabled, credentialManagement } = operatorView(context, authz, registry);
-        // Only maintainers reach here (#837); setup commands are offered for every
+        // Only maintainers reach here; setup commands are offered for every
         // declared pool, since they administer them all.
         const pools = [...opts.pools.keys()];
         return privateJson({
+            viewerKey: yield* operatorViewerKey(context, authz),
             ...(pools.length ? { pools } : {}),
             serverInfo: opts.config.serverInfo,
             connectaVersion: CONNECTA_VERSION,

package/dist/runtime/call-admission.js

@@ -7,7 +7,7 @@
 // block: the one place outside its instance methods that may read its private
 // bookkeeping, and one that emits nothing into the `.d.ts`.
 //
-// The two controllers stay separate on purpose (#453): request admission
+// The two controllers stay separate on purpose: request admission
 // bounds executor work, this bounds calls to one downstream connector, and a
 // shared queue between them was refused.
 import { Effect } from "effect";

package/dist/runtime/call.js

@@ -106,7 +106,7 @@ function ended() {
     return new ConnectorCallError("connector_call_failed", "This call has ended; a capability kept from it can no longer be used.", { retryable: false });
 }
 /** Build one call's services. Invocation calls this in the scoped attempt that owns the permit (B.1). */
-export function openCall(inputs) {
+function openCall(inputs) {
     let open = true;
     const parentSignal = inputs.parent ? Context.get(inputs.parent.services, Signal) : undefined;
     const parents = [inputs.signal, parentSignal, inputs.requestSignal].filter((signal) => signal !== undefined);

package/dist/runtime/settlement.js

@@ -10,7 +10,7 @@
 // it was created.") when the Worker's compatibility date is 2025-06-16 or
 // later, in releases since September 2026. The refusal throws out of the call
 // that completed the Deferred, failing the request that released a slot, and
-// the waiter never resumes (#1106). Awaiting a Promise around that wait is no
+// the waiter never resumes. Awaiting a Promise around that wait is no
 // help: the fiber waiting on the Deferred inside the Promise is resumed in the
 // completing request just the same.
 //

package/dist/runtime/shared-read.js

@@ -1,18 +1,5 @@
-// One read that several readers in one request wait on, each on its own terms.
-//
-// Discovery and the registry both coalesce a connector's catalog read inside
-// one request, so a search, a describe, and the call after them cost one
-// downstream listing. The read used to run under whichever reader asked
-// first: its signal was the read's signal, so a short-deadline call that
-// happened to start the read failed a search that joined it with the call's
-// timeout, and a cancelled search cancelled a read others were still waiting
-// on (#571).
-//
-// So the read owns its signal. Each reader waits under its own cancellation,
-// and the read is cancelled only when no reader is left to want it. Nothing
-// here is shared across requests: a SharedRead lives in one request's map and
-// is waited on only by that request's fibers, which is why a plain count of
-// readers is enough and no edge is needed between them.
+// Request-local catalog reads own their signal. Each reader waits under its own
+// cancellation; the read is cancelled only when no reader remains (INV-7).
 import { Deferred, Effect, Exit } from "effect";
 import { forkRequest } from "./run.js";
 import { requestOwner } from "./request-scope.js";

package/dist/sent-secrets.d.ts

@@ -47,6 +47,9 @@ export declare class SentSecrets {
     request(input: RequestInfo | URL, init?: RequestInit): void;
     /** Serialized wire text about to be returned, stored, or paged, under payload rules. */
     text(value: string): string;
+    /** An SDK response body, checked after it has been fully read so late registrations
+     * still apply. An idle set leaves the original serialization untouched. */
+    serializedAgentOutput(body: string, json: boolean): string;
     /** A plain-data snapshot of `value` with every match removed: own enumerable data properties
      * (an error's own fields, non-enumerable ones included), read once each. Accessors are never
      * invoked, except an error's stack and the accessors its class defines, read once into the
@@ -154,10 +157,16 @@ export declare class SentSecrets {
      * decoded views are matched together, as one lane between unmatched separators. Each decode
      * is paid for from the call's work budget; a part the budget cannot check is withheld. */
     private encodedLeaves;
-    /** The parts' joined text, matched once, with each part's replacement. A tiny or short
-     * private value equal to a whole part withholds it. A number or a serialized container that
-     * a match touches is withheld whole. A bounded lane also loses an unfinished tail, and is
-     * withheld whole when the set could not tell where one begins. */
+    /** Check replacements as returned, including their placeholder seams. Numbers touched by
+     * the first scan get one chance beside the replaced strings; every later hit withholds its
+     * entire part. Each changing round therefore removes at least one remaining part. Unchanged
+     * lanes pay for no retry. Large lanes recheck changed parts and the seams touching them; an
+     * unaffordable check withholds every part it read and all original retention candidates. */
+    private settleParts;
+    /** The parts' joined text, with each part's replacement. A touched number is checked again
+     * after string replacement before withholding it whole. Tiny or short whole private values,
+     * deep matches and unchecked runs still withhold changed numbers whole. A bounded lane also
+     * loses an unfinished tail, and withholds every touched number without a second check. */
     private safeParts;
     /** Leaves too large to match joined within the work budget: each is matched alone, in order,
      * and one that does not fit is withheld without spending what a smaller one needs. A run
@@ -215,7 +224,6 @@ export declare function agentOutputOperations<T extends Record<string, (...args:
 /** Slot reads cover custom handlers too, including keys put in query strings. A field named
  * as an identifier (an application or client ID, a username, a public key) is matched whole. */
 export declare function registerCredentialValues(secrets: SentSecrets, values: import("./types.js").ConnectorCredentialValues | null): void;
-export declare function trackCredentialReads(ctx: ConnectorContext): void;
 /** A connector's result or error as it enters: every connector's credentials and the
  * request's private arguments, under payload rules. */
 export declare function redactSentSecrets<T>(ctx: ConnectorContext, value: T): T;
@@ -226,7 +234,7 @@ export declare function requestSentSecrets(ctx: ConnectorContext): SentSecrets;
  * extracted from. Redact it whole first: a cut through an echoed form can leave a remnant
  * shorter than any fragment the output boundary matches, and a normalized number or
  * extracted substring may no longer hold the form at all. */
-export declare function redactBeforeCut<T>(ctx: ConnectorContext, value: T): T;
+export declare const redactBeforeCut: typeof redactSentSecrets;
 /** Base64, or base64url with `url`, of bytes or UTF-8 text Connecta returns to an agent: a
  * download, an attachment, a REST body, a page cursor. Every such encoding goes through here,
  * since no later pass reads through an encoding the output does not declare: the content is