@zackbart/connecta 0.37.0 → 0.38.0

package/dist/operator-record.d.ts

@@ -8,7 +8,7 @@ type FailureStep = "MCP handshake" | "tools/list" | "tools/call" | "resources/re
  */
 export declare const OAUTH_ERROR_CODES: ReadonlySet<string>;
 /** Inbound denial facts, never identity text or provider diagnostics. */
-export type AuthDenialReason = "authentication_abandoned_saturated" | "authentication_busy" | "authentication_failed" | "authentication_unreachable" | "authorization_header_invalid" | "token_type_mismatch" | "oauth_verification_failed" | "oauth_client_not_allowed" | "oauth_binding_mismatch" | "session_origin_mismatch" | "token_identity_mismatch" | "organization_membership_denied" | "organization_lookup_failed" | "organization_lookup_busy" | "user_missing" | "email_lookup_failed" | "verified_email_invalid" | "email_domain_denied" | "gate_denied" | "gate_failed" | "not_maintainer" | "pool_not_declared" | "not_pool_member";
+export type AuthDenialReason = "authentication_abandoned_saturated" | "authentication_busy" | "authentication_failed" | "authentication_provider_missing" | "authentication_unreachable" | "access_context_missing" | "access_context_unavailable" | "access_audience_invalid" | "access_identity_unavailable" | "access_authorization_header_rejected" | "authorization_header_invalid" | "token_type_mismatch" | "oauth_verification_failed" | "oauth_client_not_allowed" | "oauth_binding_mismatch" | "session_origin_mismatch" | "token_identity_mismatch" | "organization_membership_denied" | "organization_lookup_failed" | "organization_lookup_busy" | "user_missing" | "email_lookup_failed" | "verified_email_invalid" | "email_domain_denied" | "gate_denied" | "gate_failed" | "not_maintainer" | "pool_not_declared" | "not_pool_member";
 /**
  * Name `ctor`'s instances `label` in records and fixed text. Call once, at
  * module scope, beside the class. An error whose prototype chain reaches no
@@ -25,6 +25,8 @@ export declare function labelErrorClass(ctor: {
 export declare function errorLabel(failure: unknown): string | undefined;
 /** Facts connecta derived about a failure where it saw it. */
 export interface FailureFacts {
+    /** Inbound refusal classification attached to its Response, never its body. */
+    reason?: AuthDenialReason;
     step?: FailureStep;
     /** Scheme, host, and port of the request that failed. */
     origin?: string;
@@ -40,6 +42,8 @@ export declare function carryFailureFacts<T>(from: unknown, to: T): T;
 /** What a failure record may be about. Only these fields are read. */
 export interface FailureSubject {
     reason?: AuthDenialReason;
+    accessContext?: boolean;
+    authorizationHeader?: "absent" | "bearer" | "invalid";
     /** A registered connector's id. */
     connector?: string;
     /**
@@ -62,6 +66,8 @@ declare const recordBrand: unique symbol;
 export interface FailureRecord {
     readonly [recordBrand]: true;
     readonly reason?: AuthDenialReason;
+    readonly accessContext?: boolean;
+    readonly authorizationHeader?: "absent" | "bearer" | "invalid";
     readonly connector?: string;
     readonly tool?: string;
     readonly source?: string;
@@ -104,7 +110,7 @@ export declare function failureRecord(subject: FailureSubject, failure?: unknown
  * The events an operator log reports failures as. Closed: a new one is a
  * reviewed line here, never a string assembled at the call site.
  */
-export type FailureEvent = "Authentication admission refused" | "Authentication released after its pending work became unreachable" | "negotiation cache read failed" | "negotiation cache write failed" | "pool tool grant is unreachable" | "call failed" | "input schema unusable; arguments are not validated" | "catalog read failed" | "catalog persistence failed" | "catalog invalidation failed" | "catalog refresh observation failed" | "catalog refresh failed; serving stale catalog" | "deferred catalog refresh failed" | "deferred catalog refresh could not attach to the runtime" | "catalog drift check failed" | "schema digest check failed; serving digested reviews as writes" | "credential shape read failed" | "credential test failed" | "credential test threw" | "session termination refused or failed; the downstream session may remain until its provider timeout" | "activity record failed" | "catalog drift record failed" | "activity read failed" | "OAuth start failed" | "OAuth disconnect failed" | "OAuth callback verifyState threw; no authorization code was exchanged" | "OAuth callback handoff could not be consumed; no authorization code was exchanged" | "MCP default endpoint request denied" | "MCP pool request denied" | "MCP agent endpoint request denied" | "OAuth error callback consent could not be consumed; no authorization code was exchanged" | "MCP handler error" | "operator status" | "operator agent slots read failed" | "result paging unavailable" | "native catalog unavailable" | "native name collision" | "native tools/list refused a pool over the 1,000-tool native cap" | "request failed" | "Clerk request denied" | "Clerk authentication failed";
+export type FailureEvent = "Authentication admission refused" | "Cloudflare Access verification unavailable" | "operator_refused" | "Authentication released after its pending work became unreachable" | "negotiation cache read failed" | "negotiation cache write failed" | "pool tool grant is unreachable" | "call failed" | "input schema unusable; arguments are not validated" | "catalog read failed" | "catalog persistence failed" | "catalog invalidation failed" | "catalog refresh observation failed" | "catalog refresh failed; serving stale catalog" | "deferred catalog refresh failed" | "deferred catalog refresh could not attach to the runtime" | "catalog drift check failed" | "schema digest check failed; serving digested reviews as writes" | "credential shape read failed" | "credential test failed" | "credential test threw" | "session termination refused or failed; the downstream session may remain until its provider timeout" | "activity record failed" | "catalog drift record failed" | "activity read failed" | "OAuth start failed" | "OAuth disconnect failed" | "OAuth callback verifyState threw; no authorization code was exchanged" | "OAuth callback handoff could not be consumed; no authorization code was exchanged" | "MCP default endpoint request denied" | "MCP pool request denied" | "MCP agent endpoint request denied" | "OAuth error callback consent could not be consumed; no authorization code was exchanged" | "MCP handler error" | "operator status" | "operator agent slots read failed" | "result paging unavailable" | "native catalog unavailable" | "native name collision" | "native tools/list refused a pool over the 1,000-tool native cap" | "request failed" | "Clerk request denied" | "Clerk authentication failed";
 /**
  * Log one failure as `[connecta] <event>` and its record. A record
  * `failureRecord` did not build is replaced, whatever its shape, by a fixed

package/dist/operator-record.js

@@ -1,52 +1,4 @@
-// What an operator may read about a failure: log records and status text.
-// Web-API only — no node: imports here.
-//
-// Inbound identity-provider text never enters operator logs or status, even
-// when it fits a grammar. Activity retains its separate typed actor fields.
-//
-// Threat model. INV-6 here covers records of calls and failures: logs,
-// activity rows, status and statusFor, health, doctor output, and any native
-// runtime output connecta triggers (workerd's console). Text a downstream
-// server, HTTP API, or client authored, and anything derived from it, never
-// reaches one as arbitrary text. Self-declared client name/version facts in
-// activity use the bounded ASCII grammars in activityClientFact; invalid values are
-// absent at recording, SQL write/read, and operator UI boundaries. Client
-// capabilities and other metadata are never recorded. Every typed field
-// connecta records is checked against a closed set or a grammar. Operator-
-// authored code (custom connectors, plugin `status()`, decorators) is trusted
-// to follow the contract, and connecta still checks
-// the typed fields it records from it; deliberately adversarial operator code
-// is out of scope.
-//
-// Catalog metadata a connector serves is configuration the operator chose to
-// load, and agents already see it: a tool name that fits MCP's tool-name
-// grammar, a description, and input and output schemas may appear in the
-// authenticated operator page's catalog views, and such a name may be
-// logged. A name outside the grammar is withheld everywhere operator-facing,
-// the page included. Names containing C0, DEL, or C1 are dropped at catalog
-// intake; spaces and non-ASCII names remain callable with withheld records.
-//
-// INV-6 says logs carry no arguments, results, code, or raw downstream error
-// text. Filtering errors where they arise kept missing sources: a validator's
-// diagnostic, a stream's TypeError, a JSON-RPC error the agent may see. So the
-// rule is enforced here, at the sink. A failure reaches an operator only as
-// the fields of a `FailureRecord`, which `failureRecord` alone builds: each
-// one copied from an explicit list, checked against a constant table or a
-// grammar, and never taken from an error's message, cause, stack, data,
-// nested errors, or name. `logFailure` writes nothing else, and every status
-// message about a failure comes from `describeFailure`
-// (test/operator-record-sources.node.test.ts holds src/ to that).
-//
-// Provenance is by identity, never by shape. Text that merely looks like
-// connecta's (an error named like one of its classes, a status sentence
-// shaped like a record) carries no weight: a class label comes from the
-// prototype chain, a status message from the status object connecta built.
-//
-// Agent-facing results are a different surface with a different rule: a
-// downstream's own answer to a call may reach the agent that made it (see
-// documentation/architecture.md, "Errors and records"). Core's sent-secrets
-// boundary removes credentials used by the upstream request from those answers, including
-// allowed diagnostics, tool results and nested error causes/data (INV-5).
+// Payload-free operator failure records. See documentation/architecture.md, "Errors and records".
 import { carryProviderFailure } from "./provider-call-facts.js";
 import { followRedactedCopies, keepErrorName } from "./redaction-identity.js";
 import { classificationCode, ConnectorCallError, NETWORK_ERROR_CODES, WithheldTextError, } from "./errors.js";
@@ -98,14 +50,26 @@ const SOURCES = new Set([
     "resume_execution",
 ]);
 const MODES = new Set(["continue", "restart"]);
-const STATUS_STATES = new Set(["ok", "auth_required", "credential_required", "error"]);
+const STATUS_STATES = new Set([
+    "ok",
+    "per_caller",
+    "auth_required",
+    "credential_required",
+    "error",
+]);
 /** A status state, or `failed` for a status that could not be read at all. */
 const STATES = new Set([...STATUS_STATES, "failed"]);
 const AUTH_DENIAL_REASONS = new Set([
     "authentication_abandoned_saturated",
     "authentication_busy",
     "authentication_failed",
+    "authentication_provider_missing",
     "authentication_unreachable",
+    "access_context_missing",
+    "access_context_unavailable",
+    "access_audience_invalid",
+    "access_identity_unavailable",
+    "access_authorization_header_rejected",
     "authorization_header_invalid",
     "token_type_mismatch",
     "oauth_verification_failed",
@@ -126,6 +90,7 @@ const AUTH_DENIAL_REASONS = new Set([
     "pool_not_declared",
     "not_pool_member",
 ]);
+const AUTHORIZATION_HEADER_KINDS = new Set(["absent", "bearer", "invalid"]);
 /** The registry's connector id grammar (src/registry.ts). */
 const CONNECTOR_ID_RE = /^[a-z0-9_-]{1,64}$/;
 /** MCP's tool name grammar (SEP-986). */
@@ -222,6 +187,7 @@ function checkedFacts(facts) {
     if (!facts)
         return {};
     return {
+        ...defined("reason", member(facts.reason, AUTH_DENIAL_REASONS)),
         ...defined("step", member(facts.step, STEPS)),
         ...defined("origin", origin(facts.origin)),
         ...defined("httpStatus", httpStatus(facts.httpStatus)),
@@ -279,6 +245,8 @@ function checkedSubject(subject) {
     const tool = subject.tool;
     return {
         ...defined("reason", member(subject.reason, AUTH_DENIAL_REASONS)),
+        ...defined("accessContext", typeof subject.accessContext === "boolean" ? subject.accessContext : undefined),
+        ...defined("authorizationHeader", member(subject.authorizationHeader, AUTHORIZATION_HEADER_KINDS)),
         ...defined("connector", connectorId(subject.connector)),
         ...("tool" in subject
             ? { tool: tool === null || typeof tool !== "object" ? UNLISTED_TOOL : recordedToolName(tool) }

package/dist/operator-ui/contract.d.ts

@@ -26,7 +26,7 @@ export interface OperatorConnectorOverlay {
     /** Latest visible call in the bounded activity window, or null when unknown. */
     lastCall: OperatorLastCall | null;
 }
-/** Whole connector access, or exact tool grants. `requireReadOnly` is always false since guarded grants were removed (#837). */
+/** Whole connector access, or exact tool grants. `requireReadOnly` is always false since guarded grants were removed. */
 export interface OperatorGrant {
     connectorId: string;
     tools: "all" | Array<{
@@ -193,7 +193,9 @@ export interface OperatorUiContractV2 {
     connectors: OperatorMemberConnector[];
     you: {
         interactive: boolean;
+        /** Opaque admitted identity partition; never an authorization credential. */
+        viewerKey: string;
     };
 }
-/** The operator contract `GET /ui/api/config` serves; schema version 1 was removed (#837). */
+/** The operator contract `GET /ui/api/config` serves; schema version 1 was removed. */
 export type OperatorUiContract = OperatorUiContractV2;