@zackbart/connecta 0.37.0 → 0.38.0

package/guides/how-it-works.md

@@ -115,8 +115,8 @@ unbounded data.
 
 With meta-tools, one discovered read can use a direct call. Finding an unfamiliar
 action, combining several calls, or reducing a large answer belongs in a program.
-On a writable endpoint, a program may also change data. The AI app decides
-whether to ask for approval before running it.
+On a writable endpoint, a program may also change data; see
+[approval boundaries](./safety-and-trust.md#read-only-blocks-actions-that-change-data).
 
 The [endpoint workflow](../documentation/operating.md) and
 [code reference](../documentation/code-mode.md) explain the mechanics.

package/guides/safety-and-trust.md

@@ -71,7 +71,10 @@ or contradictory read hints count as writes, but a service can mislabel an
 action and an operator can override its label. Use restricted service
 credentials as another boundary where possible.
 
-The AI app owns approvals. It may ask based on an earlier tool label. If a
+The Eve helper defaults to unattended authorized writes. For interactive use,
+`gateWrites: true` asks before tools not marked read-only; an explicit Eve
+approval policy takes precedence. The AI app owns approvals. It may ask based
+on an earlier tool label. If a
 read becomes a write, a writable pool can execute it without a fresh
 approval; a read-only pool refuses it. Connecta does not pause a program to
 ask a person partway through.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind a code-first surface of six meta-tools.",
@@ -191,7 +191,6 @@
     "check:declarations": "node scripts/check-declarations.mjs --dist .",
     "check:bundle": "node scripts/bundle-size.mjs",
     "providers:check": "tsx scripts/drift-check.mjs --specs --manual",
-    "drift:check": "tsx scripts/drift-check.mjs",
     "eval:selftest": "tsx eval/selftest.ts",
     "eval:agent": "tsx eval/run-agent.ts",
     "eval:smoke": "tsx eval/run-smoke.ts",
@@ -257,31 +256,32 @@
   "devDependencies": {
     "@clerk/backend": "3.12.0",
     "@cloudflare/codemode": "^0.5.0",
-    "@cloudflare/vitest-pool-workers": "^0.18.8",
-    "@cloudflare/workers-types": "^4.20250101.0 || ^5.0.0",
+    "@cloudflare/vitest-plugin": "^1.4.3",
+    "@cloudflare/workers-types": "5.20260804.1",
     "@effect/platform-node": "4.0.5",
     "@fontsource-variable/hanken-grotesk": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
-    "@playwright/test": "^1.62.0",
-    "@radix-ui/react-dialog": "^1.2.0",
-    "@radix-ui/react-tabs": "^1.1.22",
-    "@tanstack/react-router": "^1.170.41",
-    "@types/node": "^22.0.0",
+    "@playwright/test": "^1.64.1",
+    "@radix-ui/react-dialog": "^1.3.1",
+    "@radix-ui/react-tabs": "^1.2.1",
+    "@tanstack/react-router": "^1.170.44",
+    "@types/node": "^22.20.5",
     "@types/react": "^19.3.0",
     "@types/react-dom": "^19.3.0",
     "alchemy": "2.0.0-beta.83",
     "cmdk": "^1.1.1",
-    "esbuild": "^0.28.0",
-    "knip": "^6.29.0",
-    "oxfmt": "0.72.0",
-    "oxlint": "^1.76.0",
+    "esbuild": "^0.28.2",
+    "knip": "^6.41.0",
+    "oxfmt": "0.73.0",
+    "oxlint": "^1.88.0",
     "quickjs-emscripten": "^0.32.0",
-    "react": "^19.3.0",
-    "react-dom": "^19.3.0",
-    "tsx": "^4.23.1",
-    "typescript": "^5.9.3",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "tsx": "^4.23.15",
+    "typescript": "^6.0.3",
     "undici": "6.29.1",
-    "vitest": "^4.1.6",
-    "wrangler": "^4.114.0"
+    "vite": "^8.3.4",
+    "vitest": "^5.0.4",
+    "wrangler": "^4.151.0"
   }
 }

package/templates/node/README.md

@@ -19,19 +19,9 @@ npm start
 ```
 
 Keep the template's pinned `undici` dependency and its `listen` import from
-`@zackbart/connecta/node`. `listen` installs the owned HTTP transport used by
-every maintained-provider request, reads included, remote MCP writes, and
-downstream OAuth token, registration and revocation POSTs.
-Without `listen()`, maintained-provider writes, reviewed POST reads and remote
-MCP writes are refused before sending; downstream OAuth credential POSTs also
-require the owned sender. It connects directly by default. For an HTTP(S) CONNECT
-proxy, configure `listen(connecta, { port, proxy: "http://proxy.example.com:8080" })`
-in `src/index.ts`. Ambient proxy variables and host dispatchers do not configure
-the owned sender. Remote MCP reads and OAuth discovery GETs retain native fetch
-and need their own host proxy policy. An uncertain refresh requires fresh
-authorization rather than replaying the spent token. See
-[Node transport requirements](https://github.com/zackbart/connecta/blob/main/documentation/deploying.md#start-on-node)
-for proxy credentials and TLS trust.
+`@zackbart/connecta/node`. Follow the
+[Node transport and proxy requirements](https://github.com/zackbart/connecta/blob/main/documentation/deploying.md#start-on-node)
+when changing `src/index.ts` or configuring egress.
 
 The manifest approves only `esbuild@0.28.2` to run its install script. `tsx`
 uses esbuild to run this TypeScript source, so that script is part of the
@@ -128,19 +118,12 @@ first use, and commits one row per write. Back it up as one file, together
 with its `-wal` file while the server runs. Node 22 and 23 print an
 experimental-feature warning for `node:sqlite` once at startup.
 
-Upgrading from 0.28, which kept state in `.connecta-state.json`: stop the
-server, then copy the old file into the database once, before the first start:
-
-```sh
-npx connecta migrate-state .connecta-state.json .connecta.sqlite
-```
-
-In the container, mount the old file and import it into the volume:
-`docker compose run --rm -v "$PWD/.connecta-state.json:/import/state.json:ro"
-connecta npx connecta migrate-state /import/state.json /data/connecta.sqlite`. It copies every live entry with its expiry, keeps any
-key the database already holds, and never changes the old file; delete that
-once the deployment is verified. The 0.28 activity log
-(`.connecta-activity.jsonl`) is not imported; history starts fresh.
+Upgrading from the pre-SQLite JSON state format requires importing it with
+Connecta 0.37.1 before installing the release that removes migrations. The
+current package has no `importStateFile` or `connecta migrate-state`; SQLite
+never reads `.connecta-state.json`. Follow the installed package's
+`documentation/migration-retired-layouts.md`, including opening every OAuth
+grant on 0.37.1, before changing the pin.
 
 A build with no lockfile in the context resolves the pinned Connecta version
 itself, and a lockfile npm writes inside the image never reaches this project.

package/templates/node/package.json

@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.12.0",
-    "@zackbart/connecta": "0.37.0",
+    "@zackbart/connecta": "0.38.0",
     "quickjs-emscripten": "0.32.0",
     "undici": "6.29.1"
   },

package/dist/auth/oauth-v2-migration.js

@@ -1,135 +0,0 @@
-import { runEdge } from "../runtime/run.js";
-import { oauthV2Keys } from "../storage/keys.js";
-import { authAll, authCall, authFlow, authInvoke, authMap, authMethod, authProgram, authStorage, registerAuth, } from "./native.js";
-function plainObject(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parse(raw) {
-    try {
-        return JSON.parse(raw);
-    }
-    catch {
-        return undefined;
-    }
-}
-/** The issuer a discovery record names, as the SDK derives it. */
-export function discoveryIssuer(state) {
-    if (!plainObject(state) || typeof state.authorizationServerUrl !== "string")
-        return undefined;
-    const metadata = state.authorizationServerMetadata;
-    const issuer = plainObject(metadata) && typeof metadata.issuer === "string" ? metadata.issuer : state.authorizationServerUrl;
-    return issuer === "" ? undefined : issuer;
-}
-/**
- * Layout 2's grant in this namespace, or nothing when it holds none.
- *
- * Only issuer-stamped envelopes (`connectaOAuthVersion: 2`, written since
- * v0.9.0) of the active generation are read; anything older, and any value
- * the vault cannot open, is left behind, as layout 2's own flow entry would
- * have retired it. A grant is kept only when every credential carries a
- * stamp, the stamps agree, and they name the server the generation's
- * discovery names, if any; otherwise it migrates empty and needs consent.
- * One-shot consent state (pending URL, verifier, state) is not carried.
- */
-export function readV2Grant(storage, sealer) {
-    return runEdge(authProgram(readV2GrantNative, [storage, sealer]));
-}
-const readV2GrantNative = /* @__PURE__ */ registerAuth(readV2Grant, function (storage, sealer) {
-    return authFlow(function* () {
-        const keys = (yield authCall(listV2Keys, [storage]));
-        if (keys.length === 0)
-            return undefined;
-        const generation = (yield authStorage(storage, "get", [oauthV2Keys.generation])) ?? "legacy";
-        if (generation.startsWith("disconnected:"))
-            return { disconnected: true, body: {} };
-        if (!generation.startsWith("v2:") && generation !== "legacy") {
-            // An unfinished reset, or a numeric generation from before epochs.
-            return { disconnected: false, body: {} };
-        }
-        const epoch = generation === "legacy" ? null : generation;
-        const read = authMethod((field) => {
-            return authFlow(function* () {
-                const physicalKey = oauthV2Keys.value(field, epoch);
-                const raw = (yield authStorage(storage, "get", [physicalKey]));
-                if (raw === null)
-                    return undefined;
-                let parsed = parse(raw);
-                if (plainObject(parsed) && parsed.connectaOAuthSealed === 1 && typeof parsed.sealed === "string") {
-                    if (!sealer)
-                        return undefined;
-                    try {
-                        parsed = parse((yield authInvoke(sealer, "open", [physicalKey, parsed.sealed])));
-                    }
-                    catch {
-                        return undefined;
-                    }
-                }
-                if (plainObject(parsed) &&
-                    parsed.connectaOAuthVersion === 2 &&
-                    parsed.generation === generation &&
-                    (parsed.issuer === undefined || typeof parsed.issuer === "string") &&
-                    (parsed.binding === undefined || typeof parsed.binding === "string")) {
-                    return {
-                        value: parsed.value,
-                        ...(parsed.issuer !== undefined ? { issuer: parsed.issuer } : {}),
-                        ...(parsed.binding !== undefined ? { binding: parsed.binding } : {}),
-                        ...(parsed.carried === true ? { carried: true } : {}),
-                    };
-                }
-                // Layout 2 wrote discovery bare under the legacy generation.
-                return field === oauthV2Keys.field.discovery && epoch === null && discoveryIssuer(parsed)
-                    ? { value: parsed }
-                    : undefined;
-            });
-        });
-        const [client, tokens, discovery] = (yield authAll([
-            authCall(read, [oauthV2Keys.field.client]),
-            authCall(read, [oauthV2Keys.field.tokens]),
-            authCall(read, [oauthV2Keys.field.discovery]),
-        ], false));
-        const named = discovery ? discoveryIssuer(discovery.value) : undefined;
-        const credentials = [client, tokens].filter((value) => value !== undefined);
-        const issuer = credentials[0]?.issuer ?? named;
-        const consistent = credentials.every((value) => value.issuer !== undefined && value.issuer === issuer && plainObject(value.value)) &&
-            (named === undefined || named === issuer);
-        if (!consistent || issuer === undefined)
-            return { disconnected: false, body: {} };
-        return {
-            disconnected: false,
-            body: {
-                issuer,
-                ...(client
-                    ? {
-                        client: {
-                            value: client.value,
-                            ...(client.binding !== undefined ? { binding: client.binding } : {}),
-                            ...(client.carried ? { carried: true } : {}),
-                        },
-                    }
-                    : {}),
-                ...(tokens ? { tokens: tokens.value } : {}),
-                ...(discovery && named !== undefined ? { discovery: discovery.value } : {}),
-            },
-        };
-    });
-});
-/** Only historical families are removed, never grants, flows, or leases. */
-function listV2Keys(storage) {
-    return runEdge(authProgram(listV2KeysNative, [storage]));
-}
-const listV2KeysNative = /* @__PURE__ */ registerAuth(listV2Keys, function (storage) {
-    return authFlow(function* () {
-        return (yield authStorage(storage, "list", [oauthV2Keys.scan])).filter((key) => oauthV2Keys.family.prefixes.some((prefix) => key.startsWith(prefix)));
-    });
-});
-/** Return true only when every historical key was deleted. */
-export function deleteV2Keys(storage) {
-    return runEdge(authProgram(deleteV2KeysNative, [storage]));
-}
-const deleteV2KeysNative = /* @__PURE__ */ registerAuth(deleteV2Keys, function (storage) {
-    return authFlow(function* () {
-        const keys = (yield authCall(listV2Keys, [storage]));
-        const results = (yield authMap(keys, (key) => authStorage(storage, "delete", [key]), true));
-        return results.every((result) => result.status === "fulfilled");
-    });
-});

package/dist/provider-call-facts.d.ts

@@ -1,115 +0,0 @@
-import { ConnectorCallError } from "./errors.js";
-import type { Connector } from "./types.js";
-export interface ProviderRequest {
-    readonly dispatched: boolean;
-    readonly status?: number;
-    auxiliary: boolean;
-    /** A kit auxiliary declared as a read lacked physical GET/HEAD proof at dispatch. */
-    readonly blocksAuxiliaryProof?: true;
-    provider: string;
-    /** The HTTP method it was sent with, when its channel knows it. */
-    readonly method?: string;
-    /** Positive operation/tool evidence; an HTTP method alone proves no read. */
-    classification?: "read" | "write" | undefined;
-    /** Remote MCP's source class said write, recorded at physical dispatch. */
-    readonly sourceWrite?: true;
-    /** The genuine, legal idempotency key the vendor honors that it carried; nothing else. */
-    key?: string;
-    /**
-     * Its answer was a 401 that the transport's reviewed `authBeforeExecution`
-     * evidence covers: the vendor rejected the credential before it acted on
-     * the request. Only that makes a 401 a refusal (`servedRefusal`).
-     */
-    authBeforeExecution?: true;
-    /**
-     * Its answer was a 401, and a renewal then replaced the credential it sent
-     * with a different one ({@link renewedAfterUnauthorized}). The 401 no
-     * longer needs the operator's recovery. The single `settleWrite` decider
-     * still reports unknown, without the handoff (Q8).
-     */
-    readonly renewed?: true;
-}
-export type CallTool = Connector["callTool"];
-interface Boundary {
-    /** The api() or remoteMcp() object whose own code enters the logical call. */
-    boundary: object;
-    own: CallTool;
-}
-export declare function originalCallIdentity(connector: object): object;
-export declare function boundaryFor(connector: object): Boundary | undefined;
-export declare function delegatorFor(connector: object): CallTool | undefined;
-/** A physical send owns its fields permanently; its own answer is recorded once. */
-export declare function recordRequestField(request: ProviderRequest, field: keyof ProviderRequest, value: unknown): void;
-export declare function recordProviderResponse(request: ProviderRequest, status: number): void;
-/**
- * Declare that every request the connector's handlers send goes through a
- * channel the call ledger records: a guarded transport, `ctx.fetch`, or
- * `ctx.oauth.fetch`. Only then does an empty ledger prove that a failed
- * write never left. Maintained providers declare it; an arbitrary `api()`
- * handler can reach the network some other way, so its ledger proves nothing.
- */
-export declare function tracksEveryRequest<T extends object>(connector: T): T;
-export declare function tracksRequests(connector: object): boolean;
-/**
- * Declare a maintained connector whose `callTool` hands each call to at most
- * one api() or remoteMcp() boundary and sends nothing else that could apply
- * it (GitHub). Only then may that boundary's verdict stand for the call. The
- * object and its function are recorded now, at construction: a later
- * assignment to the property, or a copy of the object, declares nothing.
- */
-export declare function delegatesEachCall<T extends Connector>(connector: T): T;
-/**
- * Record a just-built api() or remoteMcp() object as a boundary, with its
- * published `callTool`. Its own code then names the same object, from its
- * closure, in {@link enterProviderBoundary}.
- */
-export declare function providerBoundary(connector: Connector): void;
-/**
- * `alias` serves `base` itself (`defineProvider`'s inheriting stamp), so it
- * takes `base`'s recorded identities. Only construction code calls this.
- */
-export declare function aliasCallIdentity(alias: object, base: object): void;
-/**
- * Whether a served HTTP status says the request was refused, not applied: a
- * 4xx other than 408. A 408 is a timeout, whose request may have been acted
- * on; a 2xx or 5xx never proves a write unapplied. A 401 passes here, and
- * `servedRefusal` still asks for the vendor's reviewed evidence.
- */
-export declare function refusedStatus(status: number | undefined): boolean;
-/**
- * Refusal provenance, recorded where the answer is observed: the request was
- * served a refusing status (`refusedStatus`) and the mapper failed on it. An
- * error code alone is never this evidence.
- */
-export declare function vendorRefusal<T>(error: T, request: ProviderRequest): T;
-/** An authorization verdict, the kind that keeps the `authorize_connector` handoff. */
-export declare function authorizationFailure(error: unknown): error is ConnectorCallError;
-/**
- * The authorization verdict `request`'s own 401 answer was mapped to, as
- * {@link vendorRefusal} recorded it. Undefined when nothing mapped that
- * answer, such as a body past the ceiling.
- */
-export declare function unauthorizedAnswer(request: ProviderRequest): ConnectorCallError | undefined;
-/**
- * A renewal answered `request`'s own 401 (a refresh, a login, a fresh token
- * minted) with `fresh`, a credential other than `sent`, the one the request
- * carried: that 401 no longer needs the operator's recovery (Q8). It names
- * the one request it answered and never marks another. A renewal that hands
- * back the credential the request already sent (an earlier recovery reused)
- * renewed nothing.
- */
-export declare function renewedAfterUnauthorized(request: ProviderRequest | undefined, sent: string, fresh: string): void;
-export declare function refusalRequest(error: unknown): ProviderRequest | undefined;
-export declare function knownProviderFailure<T>(error: T): T;
-export declare function isKnownProviderFailure(error: unknown): boolean;
-/** Withdraw a verdict that does not hold for the call that reports it. */
-export declare function forgetProviderFailure(error: object): void;
-/** Preserve internal verdicts and resend advice through redaction and provider recovery wording. */
-export declare function carryProviderFailure<T>(from: unknown, to: T): T;
-/** Mark a verdict that already accounts for a write's 401 in its own words. */
-export declare function explainedUnauthorizedVerdict<T>(error: T): T;
-export declare function explainsUnauthorized(error: unknown): boolean;
-/** Mark a verdict the Q8 decision made, final for every step after it. */
-export declare function settledWrite<T>(error: T): T;
-export declare function isSettledWrite(error: unknown): boolean;
-export {};

package/dist/provider-call.d.ts

@@ -1,112 +0,0 @@
-import { type ProviderRequest, type CallTool } from "./provider-call-facts.js";
-import type { ConnectorContext } from "./types.js";
-export interface ProviderCall {
-    requests: ProviderRequest[];
-    classification?: "read" | "write" | undefined;
-    /** The handler settled: its outcome may be reported, so nothing more leaves. */
-    closed: boolean;
-    /** The calls of api() boundaries entered beneath this one's handler. */
-    nested: ProviderCall[];
-    /** The call whose handler entered this one; undefined for the outermost. */
-    parent?: ProviderCall;
-}
-export interface LogicalCall {
-    target: object;
-    entered: CallTool;
-    boundaries: object[];
-    /** Every resource request dispatched under it, once per dispatch, from any ledger. */
-    sent: ProviderRequest[];
-    /** Auxiliary GET/HEAD dispatches without method overrides, apart from resource writes and auth POSTs. */
-    auxiliaryReads: ProviderRequest[];
-    /** A kit auxiliary declared as a read dispatched without physical read proof. */
-    nonReadAuxiliaryDispatched: boolean;
-}
-export declare function providerCallContext(ctx: ConnectorContext, classification?: "read" | "write"): ConnectorContext;
-/** Whether `ctx`'s call was entered by another api() boundary's handler. */
-export declare function nestedProviderCall(ctx: ConnectorContext): boolean;
-export declare function providerRequests(ctx: ConnectorContext): readonly ProviderRequest[] | undefined;
-/**
- * Every request the ledgers of api() boundaries nested beneath `ctx`'s call
- * recorded, at any depth: an inner call's 401 still decides the outer's
- * write (Q8), whatever the outer handler made of the inner's failure.
- */
-export declare function nestedProviderRequests(ctx: ConnectorContext): ProviderRequest[];
-/**
- * End the call's ledger before its outcome is decided. A request still in
- * flight already counts as dispatched; one that has not left yet (a sibling
- * still reading its credential, say) is refused by {@link dispatchProviderRequest}
- * and never leaves after the failure is reported.
- */
-export declare function closeProviderCall(ctx: ConnectorContext): void;
-/**
- * Refuse every request after its request scope ends, before credential reads
- * and again immediately before dispatch. Resource requests also require an
- * open call. Auxiliary requests (token mints, lookups) may outlive that call,
- * but never their request.
- */
-export declare function assertProviderCallOpen(ctx: ConnectorContext, provider: string, auxiliary: boolean): void;
-/** Record that a request leaves now; synchronous with the send that follows it. */
-export declare function dispatchProviderRequest(ctx: ConnectorContext | undefined, request: ProviderRequest, headers?: HeadersInit, method?: string | undefined): void;
-export declare function recordingFetch<T extends object>(send: T): T;
-export declare function isRecordingFetch(send: object | undefined): boolean;
-export declare function handoffProviderRequest(init: RequestInit, request: ProviderRequest): void;
-export declare function takeProviderHandoff(init: RequestInit): ProviderRequest | undefined;
-export declare function bindProviderResponse(response: object, request: ProviderRequest, owner: ProviderRequest | undefined): void;
-export declare function responseProviderRequest(response: object, owner: ProviderRequest): ProviderRequest | undefined;
-export declare function providerRequest(ctx: ConnectorContext, auxiliary: boolean, provider: string, sent?: {
-    method?: string;
-    key?: string;
-    classification?: "read" | "write";
-}): ProviderRequest;
-/**
- * The invocation opens one logical call on the context it hands a connector,
- * naming the exact object and `callTool` function it is about to invoke.
- */
-export declare function openLogicalCall(ctx: ConnectorContext, target: object, entered: CallTool): LogicalCall;
-/**
- * An api() or remoteMcp() boundary was entered under `ctx`'s logical call.
- * `boundary` is the object it was built as, from its own closure, never `this`.
- */
-export declare function enterProviderBoundary(ctx: ConnectorContext, boundary: object): void;
-/**
- * Whether a failure's known mark holds for its whole logical call (INV-9).
- * A boundary marks a write known only when every request it dispatched is
- * proven unapplied, so the mark stands when that boundary owned the call
- * ({@link ownsLogicalCall}) and at most one boundary was entered. A wrapper
- * that composed several calls, or could send around them, never inherits an
- * inner verdict.
- */
-export declare function knownCallFailure(call: LogicalCall | undefined, error: unknown): boolean;
-/**
- * Positive proof that a complete tracked call dispatched only auxiliaries,
- * including a recorded resource read (positive GET/HEAD evidence). An
- * authentication POST alone is not evidence of that call's resource work:
- * token mints can be shared with callers whose ledgers did not send them.
- * An empty resource ledger is not this proof: even a declared api() entry
- * can report a timeout and recovery facts without recording any dispatch.
- * Keep those calls conservative rather than inferring an auxiliary failure
- * from the absence of a resource request. Wrappers and untracked boundaries
- * cannot borrow an inner call's observations.
- */
-export declare function onlyAuxiliaryRequests(call: LogicalCall | undefined): boolean;
-/**
- * Whether reusing `key` with the exact original arguments cannot repeat any
- * write of `ctx`'s logical call, the one basis for key-reuse advice (INV-9).
- * It holds only when the call entered exactly one boundary, which owned it
- * and tracks every request, and sent exactly one write, carrying `key`. A
- * request counts as a read only with positive classification and a recorded
- * GET or HEAD ({@link readRequest}). An inner request's key never speaks for a composite,
- * a wrapper, a second write, or an earlier unrelated request.
- */
-export declare function keyProtectsCall(call: LogicalCall | undefined, key: string | undefined): boolean;
-/** Positive read evidence, with GET/HEAD as #902's additional conservative bound. */
-export declare function readRequest(request: Pick<ProviderRequest, "classification" | "method">, headers?: HeadersInit): boolean;
-export declare function providerFetch(ctx: ConnectorContext, provider: string, auxiliary: boolean, send: typeof fetch): typeof fetch;
-/** Whether an invocation opened the logical call `ctx` belongs to; it then settles Q8 itself. */
-export declare function inLogicalCall(ctx: object): boolean;
-/**
- * Every resource request dispatched under `ctx`'s logical call, from any
- * ledger, nested ones included; undefined outside one.
- */
-export declare function logicalCallRequests(ctx: object | undefined): readonly ProviderRequest[] | undefined;
-export { recordProviderResponse, tracksEveryRequest, tracksRequests, delegatesEachCall, providerBoundary, refusedStatus, vendorRefusal, authorizationFailure, unauthorizedAnswer, renewedAfterUnauthorized, refusalRequest, knownProviderFailure, isKnownProviderFailure, forgetProviderFailure, explainedUnauthorizedVerdict, explainsUnauthorized, settledWrite, isSettledWrite, type ProviderRequest, } from "./provider-call-facts.js";