@zackbart/connecta 0.37.1 → 0.39.0

package/dist/providers/tithely/api.js

@@ -1,4 +1,6 @@
-// Tithe.ly's giving API (v1) as a kit vendor (decision 0010): the operations,
+import { Routes, routePhrases } from "../../agent-routes.js";
+import { asRecord, asArray } from "../_shared/json.js";
+// Tithe.ly's giving API (v1) as a kit vendor: the operations,
 // what its statuses mean, its credential, its in-band refusal, the probe, and
 // the value-safety review. Facts from the per-operation reference at
 // https://docs.tithe.ly/reference/introduction, each marked where it is
@@ -388,9 +390,10 @@ function keyPairProblem(values) {
 /** Operator-held Basic keys, resolved per request; a mismatched pair is refused before anything leaves. */
 export const authenticate = Effect.gen(function* () {
     const values = yield* (yield* Credentials).values.pipe(Effect.mapError((error) => new Refusal({ error })));
+    const routes = yield* Routes;
     const pair = keyPairProblem(values);
     if (typeof pair === "string") {
-        return yield* failed(new ConnectorCallError("auth_required", `${pair} Call authorize_connector for recovery options; an operator adds the keys on this connection in the operator UI.`));
+        return yield* failed(new ConnectorCallError("auth_required", `${pair} ${routePhrases(routes).authorizeFor("recovery options")}; an operator adds the keys on this connection in the operator UI.`));
     }
     return { Authorization: `Basic ${btoa(`${pair.publicKey}:${pair.privateKey}`)}` };
 });
@@ -509,12 +512,6 @@ export function tithelySafety(sensitiveFields) {
 }
 // --- Shared readers ------------------------------------------------------------------
 const failed = (error) => Effect.fail(new Refusal({ error }));
-export function asRecord(value) {
-    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-export function asArray(value) {
-    return Array.isArray(value) ? value : [];
-}
 export function text(value) {
     return typeof value === "string" && value !== "" ? value : undefined;
 }

package/dist/providers/tithely/index.js

@@ -1,6 +1,7 @@
+import { readOnlyNotice } from "../_shared/guide.js";
 import { skill } from "./skill.generated.js";
 /**
- * Tithe.ly's giving API (v1) on the provider kit (decision 0010). No SDK
+ * Tithe.ly's giving API (v1) on the provider kit. No SDK
  * exists to depend on, and none would be welcome: this is a payments API, and
  * every tool was chosen and written, not generated (decision record 0001:
  * hand-authored tools). The vendor lives in `api.ts` and the tools in
@@ -67,7 +68,7 @@ function usageGuide(options) {
             sensitiveFields(options) === "return"
                 ? "This connection returns organizations' payout bank and legal-contact details through tithely_api_read; the named reads still omit them."
                 : "This connection withholds organizations' payout bank and legal-contact details from every result.",
-            ...(options.readOnly === true ? ["This connection is read-only: every write is refused."] : []),
+            ...readOnlyNotice(options.readOnly === true),
             ...(options.defaultPageSize !== undefined
                 ? [`List tools return ${options.defaultPageSize} rows by default on this connection.`]
                 : []),

package/dist/providers/tithely/skill.generated.js

@@ -1,5 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "## Giving data is pastoral\n\nDonor names, emails, addresses, and gift amounts are pastoral data. Reduce\ninside `execute_code`: page, filter, and total there, and return the\naggregate (sums by fund, month, or donor count), not donor rows, unless the\ntask needs named people.\n\n## Ids and joins\n\n- Ids carry their kind: `org_` organization, `user_` donor account, `ch_`\n  charge, `rc_` recurring gift, `pm_` payment method. Read them from the list\n  tools; never guess one.\n- Tithe.ly lists charges and recurring gifts only for one organization or one\n  donor, so pass `organizationId` or `accountId`.\n- A charge carries its donor's name and email, its organization's name, and\n  its payment method, so most joins need no second read.\n- `list_accounts` covers every account these keys can see; `scope: \"api\"`\n  narrows it to accounts created through this API.\n- The named reads project Tithe.ly's records. A field a projection omits, such\n  as an account's phone and postal address, comes back from `tithely_api_read`\n  on that record's path.\n\n## Money, dates and funds\n\n- A fund is a Tithe.ly giving type: `giving_type` in Tithe.ly's records,\n  `fund` in projections.\n- Projections give amounts as integer `…Cents` and dates as ISO 8601 UTC\n  `…At`. Tithe.ly's own records, from `tithely_api_read`, keep string cents\n  and Unix seconds.\n- `depositedAt` may be `\"pending\"`. There is no deposits resource: net amount\n  and fees live on each charge.\n- A charge a recurring gift produced has `recurring: true`; a one-time gift\n  has `recurring: false`.\n\n## Writes\n\n- Every write moves money or changes a donor's records. Bodies are form\n  fields in integer cents and Unix seconds.\n- `POST /refunds/{charge_id}` refunds a whole charge.\n  `DELETE /recurring/{recurring_id}` stops future charges and refunds nothing.\n- Card and bank tokens, which `POST /charge-once` and `POST /payment-methods`\n  need, come only from Tithely.js in a donor's browser. An agent cannot\n  create one.\n- Tithe.ly reports most refusals as HTTP 200 with `status: \"fail\"` and a\n  reason but no code. They arrive as `connector_call_failed`; read the reason\n  before deciding what to do next.\n\n## Not available\n\nOnly Tithe.ly's API v1 is reachable; its undocumented v2 is not.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `list_accounts`, `list_charges`, `list_organizations`, `list_payment_methods`, `list_recurring_charges`, `tithely_api_details`, `tithely_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 25, at most 99). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `tithely_api_search` finds this API's operations and reads no account data, `tithely_api_details` shows one operation's contract, and `tithely_api_read` calls a reviewed read. `tithely_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. An unknown id, or one these credentials cannot reach, fails as `connector_call_failed`; this API does not tell the two apart. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "content": "## Giving data is pastoral\n\nDonor names, emails, addresses, and gift amounts are pastoral data. Reduce\ninside `execute_code`: page, filter, and total there, and return the\naggregate (sums by fund, month, or donor count), not donor rows, unless the\ntask needs named people.\n\n## Ids and joins\n\n- Ids carry their kind: `org_` organization, `user_` donor account, `ch_`\n  charge, `rc_` recurring gift, `pm_` payment method. Read them from the list\n  tools; never guess one.\n- Tithe.ly lists charges and recurring gifts only for one organization or one\n  donor, so pass `organizationId` or `accountId`.\n- A charge carries its donor's name and email, its organization's name, and\n  its payment method, so most joins need no second read.\n- `list_accounts` covers every account these keys can see; `scope: \"api\"`\n  narrows it to accounts created through this API.\n- The named reads project Tithe.ly's records. A field a projection omits, such\n  as an account's phone and postal address, comes back from `tithely_api_read`\n  on that record's path.\n\n## Money, dates and funds\n\n- A fund is a Tithe.ly giving type: `giving_type` in Tithe.ly's records,\n  `fund` in projections.\n- Projections give amounts as integer `…Cents` and dates as ISO 8601 UTC\n  `…At`. Tithe.ly's own records, from `tithely_api_read`, keep string cents\n  and Unix seconds.\n- `depositedAt` may be `\"pending\"`. There is no deposits resource: net amount\n  and fees live on each charge.\n- A charge a recurring gift produced has `recurring: true`; a one-time gift\n  has `recurring: false`.\n\n## Writes\n\n- Every write moves money or changes a donor's records. Bodies are form\n  fields in integer cents and Unix seconds.\n- `POST /refunds/{charge_id}` refunds a whole charge.\n  `DELETE /recurring/{recurring_id}` stops future charges and refunds nothing.\n- Card and bank tokens, which `POST /charge-once` and `POST /payment-methods`\n  need, come only from Tithely.js in a donor's browser. An agent cannot\n  create one.\n- Tithe.ly reports most refusals as HTTP 200 with `status: \"fail\"` and a\n  reason but no code. They arrive as `connector_call_failed`; read the reason\n  before deciding what to do next.\n\n## Not available\n\nOnly Tithe.ly's API v1 is reachable; its undocumented v2 is not.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `list_accounts`, `list_charges`, `list_organizations`, `list_payment_methods`, `list_recurring_charges`, `tithely_api_details`, `tithely_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 25, at most 99). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `tithely_api_search` finds this API's operations and reads no account data, `tithely_api_details` shows one operation's contract, and `tithely_api_read` calls a reviewed read. Details' `response.fields` promises selection only; `withheld` hints are incomplete, and absence never means safe or readable. `tithely_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. An unknown id, or one these credentials cannot reach, fails as `connector_call_failed`; this API does not tell the two apart. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
     "instructionsHeading": "Account instructions"
 };

package/dist/providers/tithely/tools.js

@@ -1,8 +1,10 @@
-// Tithe.ly's curated tools on the provider kit (decision 0010) and their
+import { compact as compactDefined } from "../_shared/json.js";
+import { asArray, asRecord } from "../_shared/json.js";
+// Tithe.ly's curated tools on the provider kit and their
 // projections. Decision 0011's step 2: standard lists ({ items, page } with
 // limit, cursor and fields), fields on every named read, and no `raw`: what a
 // projection drops stays reachable through the standard hatch, which the kit
-// builds from `api.ts`'s index and verdicts (decision 0014). Each named read
+// builds from `api.ts`'s index and verdicts. Each named read
 // earns its place against the hatch with paging Tithe.ly cannot report
 // (lookahead), units (cents, ISO dates), joins (donor, organization and
 // payment method inline) or reconciliation of a known id after a write.
@@ -13,7 +15,7 @@ import { Refusal } from "../../http/errors.js";
 import { Integer } from "../../http/json-schema.js";
 import { lookahead } from "../../http/paging.js";
 import { get as getTool, list } from "../../http/tools.js";
-import { asArray, asRecord, entity, getCharge, getRecurring, listAccounts, listAllAccounts, listCharges, listOrganizations, listPaymentMethods, listRecurring, MAX_PAGE_SIZE, PAYOUT_CURRENCY, text, } from "./api.js";
+import { entity, getCharge, getRecurring, listAccounts, listAllAccounts, listCharges, listOrganizations, listPaymentMethods, listRecurring, MAX_PAGE_SIZE, PAYOUT_CURRENCY, text, } from "./api.js";
 // --- Schemas ---------------------------------------------------------------------
 const Id = Schema.String.check(Schema.isMinLength(1));
 const Text = Schema.optionalKey(Schema.String);
@@ -267,7 +269,7 @@ function seconds(value, name) {
     return Effect.succeed(Math.floor(parsed / 1000));
 }
 function compact(value) {
-    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+    return compactDefined(value);
 }
 /** Integer cents from Tithe.ly's string-or-number amounts. */
 function cents(value) {
@@ -325,7 +327,7 @@ function projectOrganization(value) {
     return compact({
         organizationId: text(organization["organization_id"]),
         name: text(organization["name"]),
-        // The giving widget id embeds Tithe.ly's giving form; the step-2 eval showed agents need it (decision 0014).
+        // The giving widget id embeds Tithe.ly's giving form; the step-2 eval showed agents need it.
         widgetId: text(organization["widget_id"]),
         ownerAccountId: text(organization["account_id"]),
         website: text(organization["website"]),

package/dist/providers/vercel/api.js

@@ -1,3 +1,4 @@
+import { isRecord } from "../_shared/json.js";
 // Vercel's pinned contract, authentication, failures and value-safety boundary.
 import { Effect, Schema } from "effect";
 import { ConnectorCallError } from "../../errors.js";
@@ -24,9 +25,6 @@ const READ_POSTS = [
     ["POST", "/v1/registrar/domains/search", "Searches domain availability and pricing; buys nothing."],
     ["POST", "/v8/artifacts", "Reads Remote Cache metadata for a list of artifact hashes; uploads nothing."],
 ];
-export function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 export function record(value) {
     return isRecord(value) ? value : {};
 }
@@ -36,9 +34,6 @@ export function text(value) {
 export function invalid(message) {
     throw new ConnectorCallError("invalid_args", message);
 }
-export function compact(value) {
-    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
-}
 function truthy(value) {
     return value === true || value === 1 || (typeof value === "string" && /^(?:1|true)$/i.test(value.trim()));
 }
@@ -461,7 +456,7 @@ export function transformGuide(guide, options) {
     const base = Object.values(VERCEL_VERDICTS).filter((verdict) => verdict === "refuse").length;
     const total = vercelIndex.ops.filter((op) => VERCEL_VERDICTS[`${op.method} ${op.path}`] === "refuse" ||
         PIN_DISCOVERY_REFUSALS[`${op.method} ${op.path}`] !== undefined).length;
-    const sentence = `${base} operations are refused by design; use \`vercel_api_details\` with the method and path to inspect the original operation summary and its separate refusal.`;
+    const sentence = `${base} operations are refused by design; use \`vercel_api_details\` with the method and path to see each summary and refusal,`;
     const lines = guide.content.split("\n");
     const targets = lines.flatMap((line, position) => line.startsWith("- **Hatch:** `vercel_api_search` ") && line.includes(sentence) ? [position] : []);
     const position = targets[0];

package/dist/providers/vercel/lib/pin.js

@@ -4,7 +4,7 @@ import { ConnectorCallError } from "../../../errors.js";
 import { Refusal } from "../../../http/errors.js";
 import { Budget } from "../../../http/services.js";
 import { checked } from "../../_shared/rest/kit.js";
-export const MAX_PIN_LOOKUPS = 8;
+const MAX_PIN_LOOKUPS = 8;
 export const PIN_WRITE_STEPS = Object.freeze({
     write: "once",
     lookup1: "once",

package/dist/providers/vercel/safety.js

@@ -214,7 +214,7 @@ const absent = {
 //
 // Residual risk: a secret a person typed into a free-text
 // name, description, log line, or identifier is out of scope.
-// Embedded URL verdict (#812): reviewed paths + global signing parameters.
+// Embedded URL verdict: reviewed paths + global signing parameters.
 // Evidence: pinned index/candidates sha256:5a702fd2dc76 identify deployment
 // reads/creation/listing, build events and runtime logs; the operation/path
 // list below scans errorMessage, deployments.errorMessage, payload.text/text

package/dist/providers/vercel/skill.generated.js

@@ -1,5 +1,5 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "## Projects, deployments and domains\n\nResolve a team by slug, a project by name, and deployments by the observed\nproject id. Team ids start with `team_`, project ids with `prj_`, and deployment\nids with `dpl_`. A deployment hostname and a deployment id identify the same\ndeployment; an alias can later point to a different deployment.\n\nSome project paths accept a project name, but a deployment list's projectId\nfilter requires the observed `prj_` id. Resolve the name before listing its\ndeployments; an empty result for a guessed name does not prove absence.\nComplete each identifier lookup before starting the reads that depend on it.\n\n<!-- when: unpinned -->\nThe configured team is a routing default, not a restriction. Explicit teamId\nor slug selects another team the token can reach; teamId: null selects personal\nscope. Vercel token permissions determine access. Prefer an explicit team when\njoining resources across several calls.\n<!-- end -->\n\n<!-- when: pinned -->\nThe deployment confines this connection to one team. A supplied team slug must\nbelong to that team; personal scope and foreign teams are refused. Project and\ndeployment references require ownership reads. Global/account and transfer\noperations without a verifiable team boundary remain unavailable. A team list\nreturns only the pinned team.\n<!-- end -->\n\nRead deployment state before its build events. Runtime logs diagnose requests\nafter a deployment built; build logs explain a failed build. Narrow time windows\nbefore raising collection limits. Generic reads refuse live follow streams;\nuse the bounded build/runtime readers. Deployment timestamps are milliseconds.\n\nProject domains and deployment aliases are different joins: a project domain\nbelongs to the project, while an alias identifies its assigned deployment.\nRead a pending domain's verification instructions before changing DNS.\n\n## Environment changes\n\nResolve environment-variable ids using metadata, including target, branch and\ncustom environment. A key can have distinct production and preview values.\nExisting values cannot be retrieved. Supply new values only when the task asks\nfor a change; confirm the returned id and metadata.\n\nEnvironment changes apply to future deployments. A new deployment is a separate\nwrite. Promoting an existing deployment does not rebuild it or update embedded\nenvironment values. After an uncertain update, reconcile observable metadata\nsuch as id, targets and comment; reading metadata cannot verify a secret value.\n\n## Explicit files and credentials\n\nDeployment files can reference previously uploaded digests. File uploads accept\nexplicit bytes and never read a path on the agent's machine. Decrypted-value,\ncredential-minting, protection-bypass-link, signing and domain move-out operations\nare refused; use Vercel's dashboard for those workflows.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `list_teams`, `vercel_api_details`, `vercel_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. For `vercel_api_read`, put it in `query[page.param]` or `body[page.param]`, as `page.in` specifies. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 20, at most 100). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `vercel_api_search` finds this API's operations and reads no account data, `vercel_api_details` shows one operation's contract, and `vercel_api_read` calls a reviewed read. `vercel_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 29 operations are refused by design; use `vercel_api_details` with the method and path to inspect the original operation summary and its separate refusal. Use details for refused methods outside the read/write call schemas; those methods remain unavailable.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
+    "content": "## Projects, deployments and domains\n\nResolve a team by slug, a project by name, and deployments by the observed\nproject id. Team ids start with `team_`, project ids with `prj_`, and deployment\nids with `dpl_`. A deployment hostname and a deployment id identify the same\ndeployment; an alias can later point to a different deployment.\n\nSome project paths accept a project name, but a deployment list's projectId\nfilter requires the observed `prj_` id. Resolve the name before listing its\ndeployments; an empty result for a guessed name does not prove absence.\nComplete each identifier lookup before starting the reads that depend on it.\n\n<!-- when: unpinned -->\nThe configured team is a routing default, not a restriction. Explicit teamId\nor slug selects another team the token can reach; teamId: null selects personal\nscope. Vercel token permissions determine access. Prefer an explicit team when\njoining resources across several calls.\n<!-- end -->\n\n<!-- when: pinned -->\nThe deployment confines this connection to one team. A supplied team slug must\nbelong to that team; personal scope and foreign teams are refused. Project and\ndeployment references require ownership reads. Global/account and transfer\noperations without a verifiable team boundary remain unavailable. A team list\nreturns only the pinned team.\n<!-- end -->\n\nRead deployment state before its build events. Runtime logs diagnose requests\nafter a deployment built; build logs explain a failed build. Narrow time windows\nbefore raising collection limits. Generic reads refuse live follow streams;\nuse the bounded build/runtime readers. Deployment timestamps are milliseconds.\n\nProject domains and deployment aliases are different joins: a project domain\nbelongs to the project, while an alias identifies its assigned deployment.\nRead a pending domain's verification instructions before changing DNS.\n\n## Environment changes\n\nResolve environment-variable ids using metadata, including target, branch and\ncustom environment. A key can have distinct production and preview values.\nExisting values cannot be retrieved. Supply new values only when the task asks\nfor a change; confirm the returned id and metadata.\n\nEnvironment changes apply to future deployments. A new deployment is a separate\nwrite. Promoting an existing deployment does not rebuild it or update embedded\nenvironment values. After an uncertain update, reconcile observable metadata\nsuch as id, targets and comment; reading metadata cannot verify a secret value.\n\n## Explicit files and credentials\n\nDeployment files can reference previously uploaded digests. File uploads accept\nexplicit bytes and never read a path on the agent's machine. Decrypted-value,\ncredential-minting, protection-bypass-link, signing and domain move-out operations\nare refused; use Vercel's dashboard for those workflows.\n\n## Conventions\n\n- **Paging:** while `page.hasMore` is true, continue with `page.nextCursor` unchanged. For `list_teams`, `vercel_api_details`, `vercel_api_search`, pass it as the top-level `cursor`; omit raw paging anchors on continuations. For `vercel_api_read`, put it in `query[page.param]` or `body[page.param]`, as `page.in` specifies. Keep the original method, path, filters, page size, fields and headers. Paged `list_*` and `search_*` reads take `limit` (default 20, at most 100). The last page has no `nextCursor`. If `page.hasMore` is true without a cursor, the data is incomplete and continuation was withheld. When approaching execute_code's per-program call limit, return page.nextCursor before the call that would exceed it and continue in the next program; don't restart.\n- **Results:** `fields` narrows a read's result to the dot paths you name. `truncated` lists the dot paths a result cut for size; the ids that fetch what was cut stay in the result.\n- **Hatch:** `vercel_api_search` finds this API's operations and reads no account data, `vercel_api_details` shows one operation's contract, and `vercel_api_read` calls a reviewed read. Details' `response.fields` promises selection only; `withheld` hints are incomplete, and absence never means safe or readable. `vercel_api_write` calls a reviewed write; the host may ask the user to confirm it. An operation without a reviewed verdict is refused. 29 operations are refused by design; use `vercel_api_details` with the method and path to see each summary and refusal, even for methods outside the read/write schemas.\n- **Writes:** a write is sent once and never retried. When its outcome is unknown, read the target before repeating it. Writes take no idempotency key.\n- **Errors:** codes come from the vendor's statuses and error facts, never its prose. `not_found` means the record does not exist; this API tells absence from a permission gap. It documents no conflict.\n- **Withheld values:** a value withheld for safety reads `\"[redacted]\"`. Writes refuse whole marker values and withheld links; longer prose may mention the marker. Paths and queries refuse any containment.",
     "instructionsHeading": "Account instructions"
 };

package/dist/providers/vercel/tools.js

@@ -1,15 +1,16 @@
+import { compact, isRecord } from "../_shared/json.js";
 // Curated Vercel metadata and bounded logs through kit-owned call services.
 import { Effect, Schema } from "effect";
 import { ConnectorCallError } from "../../errors.js";
 import { Refusal } from "../../http/errors.js";
 import { read, write, list } from "../../http/tools.js";
-import { fieldsProblem, selectFields } from "../../http/fields.js";
+import { fieldsContract, selectFields } from "../../http/fields.js";
 import { vercelPage } from "../../http/hatch-paging.js";
 import { schema, typedParams } from "../_shared/rest/kit.js";
 import { refuseWithheldUpload } from "../_shared/rest/value-safety.js";
 import { rowStop } from "./lib/logs.js";
 import { checked } from "../_shared/rest/kit.js";
-import { admit, compact, defaultTeam, isRecord, invalid, named, queryOf, queryPairs, record, reviewedCode, restCall, text, vercelIndex, refuse, checkServer, } from "./api.js";
+import { admit, defaultTeam, invalid, named, queryOf, queryPairs, record, reviewedCode, restCall, text, vercelIndex, refuse, checkServer, } from "./api.js";
 import { pinOptions, readPinnedTeam, PIN_WRITE_STEPS } from "./lib/pin.js";
 const MAX_LOG_BYTES = 1024 * 1024;
 const MAX_LOG_TEXT = 4_000;
@@ -65,6 +66,7 @@ const ENV_SCHEMA = {
     },
     required: ["id", "key", "type"],
 };
+const ENV_FIELDS = fieldsContract("item", ENV_SCHEMA, "Values cannot be restored.");
 /** Deliberately omits `value`, even though redaction already removed it. */
 function envMetadata(value) {
     const variable = record(value);
@@ -157,7 +159,7 @@ export function vercelTools({ connection, options, }) {
                     type: "array",
                     maxItems: 50,
                     items: { type: "string", minLength: 1, maxLength: 200 },
-                    description: "Dot paths to keep in each metadata item; values cannot be restored.",
+                    description: ENV_FIELDS.description,
                 },
             }, ["projectId"]),
             outputSchema: {
@@ -170,7 +172,7 @@ export function vercelTools({ connection, options, }) {
             },
             run: (args) => Effect.gen(function* () {
                 const fields = args["fields"];
-                const problem = fieldsProblem(fields, new Set(Object.keys(ENV_SCHEMA.properties)), "an environment metadata item");
+                const problem = ENV_FIELDS.problem(fields);
                 if (problem)
                     throw problem;
                 const { data } = yield* send("GET", `/v10/projects/${segment(args["projectId"])}/env`, {

package/dist/redaction-marker.js

@@ -7,7 +7,7 @@ export const REDACTED = "[redacted]";
  * secrets from every value of a vendor body before result safety reads it, so a rule that decides
  * on a value (a type discriminator, a record's label or type, a URL's scheme or parameter names,
  * a Content-Type) can find the placeholder where the vendor wrote what the rule matches.
- * Such a decision takes its most protective outcome (#703).
+ * Such a decision takes its most protective outcome.
  */
 export function redactionAltered(value) {
     return typeof value === "string" && value.includes(REDACTED);
@@ -92,7 +92,7 @@ function credentialUnit(code) {
 }
 /**
  * The text right after the placeholder at `at` that may be the rest of a credential whose public
- * prefix redaction took (#703): up to the first unit `ends` accepts, reading later placeholders
+ * prefix redaction took: up to the first unit `ends` accepts, reading later placeholders
  * whole so none is split. Redaction can take `sk_live_`, `whsec_`, `Bearer `, or a signing
  * parameter's name and `=`, leaving what follows; with that prefix known, any remainder rebuilds
  * the credential, however short or encoded, so `readable` holds whenever it carries any base64 or

package/dist/registry.d.ts

@@ -71,8 +71,10 @@ export interface RegistryOptions {
         maxStashBytes?: number;
         maxStashEntries?: number;
     } | undefined;
+    /** Route names every context carries unless a call names its own; meta by default. */
+    routes?: import("./types.js").AgentRouteNames | undefined;
 }
-export type ConnectorOperationOptions = Pick<ConnectorContext, "signal" | "timeoutMs" | "defer">;
+export type ConnectorOperationOptions = Pick<ConnectorContext, "signal" | "timeoutMs" | "defer" | "routes">;
 /**
  * The registry surface a per-connection MCP server consumes: every meta-tool
  * (`src/meta-tools.ts`) and the `execute_code` sandbox bridge (`src/execute.ts`)
@@ -84,6 +86,7 @@ export type ConnectorOperationOptions = Pick<ConnectorContext, "signal" | "timeo
  */
 /** Host-admitted identity and endpoint bindings for result paging. */
 export interface ResultIdentity {
+    pool: string | null;
     subject: string | null;
     principal: string | null;
     endpoint: string;
@@ -124,8 +127,11 @@ export interface RegistryView {
     recheckResultAccess(dependencies: readonly ProgramResultDependency[], classification: "read" | "write", signal?: AbortSignal): Promise<boolean>;
     /** Reserve deployment-wide capacity before writing a paging envelope's chunks. */
     stashResult(id: string, chunks: readonly string[], ttlSeconds: number): Promise<boolean>;
-    /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
-    credentialDriftFor(id: string): Promise<string | undefined>;
+    /**
+     * Local declared-vs-stored credential mismatch, with no downstream I/O. With
+     * `requestScope`, the read joins that request's read memo.
+     */
+    credentialDriftFor(id: string, requestScope?: object): Promise<string | undefined>;
     /** Value-free shape learned from successful calls, never a provider declaration. */
     observedOutputSchema(connectorId: string, definition: ToolDef): ToolDef["outputSchema"] | undefined;
     /** Passively learn one successful unwrapped result; failures stay isolated. */
@@ -240,7 +246,7 @@ export declare class Registry implements RegistryView {
      *
      * `chunks[n]` lands on `resultKeys.chunk(id, n)` inside `partition` — the
      * layout connecta.result reads back, so a page fetches only the chunks it covers
-     * instead of the whole stored result (issue #540). Chunking is a read-cost
+     * instead of the whole stored result. Chunking is a read-cost
      * decision, not a capacity one: however many keys an envelope occupies, it
      * is one stash entry charged its total ASCII length.
      *
@@ -287,7 +293,7 @@ export declare class Registry implements RegistryView {
     describeStaticTools(id: string): ToolDef[] | undefined;
     private validateClassification;
     getTools(id: string, baseUrl: string, requestScope?: object, callOptions?: ConnectorOperationOptions, scope?: RegistryScope): Promise<ToolDef[]>;
-    credentialDriftFor(id: string): Promise<string | undefined>;
+    credentialDriftFor(id: string, requestScope?: object): Promise<string | undefined>;
     /** Age of a complete cache entry; reads never refresh it. */
     catalogAgeMs(id: string): number | null;
     /** Pure lookup shared by status probes and operator catalog refreshes. */

package/dist/registry.js

@@ -1,3 +1,6 @@
+import { wrapViewCredentials } from "./runtime/call.js";
+import { META_ROUTES } from "./agent-routes.js";
+import { sha256Hex } from "./bytes.js";
 import { catalogRevision } from "./catalog-revision.js";
 import { authCall, authInvoke } from "./auth/native.js";
 import { Clock, Duration, Effect, Random } from "effect";
@@ -18,12 +21,16 @@ import { boundedStatus, failureRecord, failureStatus, logFailure, ownStatus } fr
 import { ObservedOutputSchemas } from "./result-shapes.js";
 import { ContinuationBinding, OperationCredentials, ContinuationStorage, operationView, setViewService, duringViewEffect, } from "./runtime/call.js";
 import { hasNativeStorage, registerNativeStorage } from "./runtime/native-storage.js";
+import { observeStorageWrites } from "./runtime/request-reads.js";
+import { attachStorageDigestKey } from "./storage-digest.js";
+import { requestReads } from "./runtime/request-scope.js";
+import { credentialReads } from "./credential-reads.js";
 import { provideRegistryPrograms, registryEdgeProgram, registryProgram } from "./runtime/registry.js";
 import { causeError, runEdge } from "./runtime/run.js";
 import { Storage } from "./runtime/services.js";
 import { SharedRead } from "./runtime/shared-read.js";
-import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageSet, storageList, } from "./runtime/storage.js";
-import { redactCatalog, sentSecretsFor, sentSecretsForRequest, trackCredentialReads } from "./sent-secrets.js";
+import { runOnPartition, storageCompareAndSet, storageDelete, storageGet, storageGetMany, storageSet, storageList, } from "./runtime/storage.js";
+import { redactCatalog, sentSecretsFor, sentSecretsForRequest } from "./sent-secrets.js";
 import { GUIDE_SUMMARY_LENGTH, normalizeGuideSummary } from "./skills.js";
 import { jsonCodec, OAUTH_HANDOFF_TTL_SECONDS, oauthHandoffKeys, resultKeys, scopes, stashExpiryKeys, stashLedgerKeys, } from "./storage/keys.js";
 import { assertStaticToolNames, hasControlCharacters } from "./tool-name.js";
@@ -103,12 +110,14 @@ function namespaced(storage, prefix) {
         list: async (keyPrefix) => (await storage.list(prefix + keyPrefix)).map((key) => key.slice(prefix.length)),
         compareAndSet: (k, expected, next, o) => storage.compareAndSet(prefix + k, expected, next, o),
     };
+    observeStorageWrites(edge, { storage, prefix });
     return hasNativeStorage(storage)
         ? registerNativeStorage(edge, {
             // Select against the underlying current methods at dispatch. A
             // namespace created during a decoration regains the native path when
             // that decoration is restored, without capturing stale capabilities.
             get: (key) => storageGet(prefix + key).pipe(Effect.provideService(Storage, storage)),
+            getMany: (keys) => storageGetMany(keys.map((key) => prefix + key)).pipe(Effect.provideService(Storage, storage)),
             set: (key, value, options) => storageSet(prefix + key, value, options).pipe(Effect.provideService(Storage, storage)),
             delete: (key) => storageDelete(prefix + key).pipe(Effect.provideService(Storage, storage)),
             list: (keyPrefix) => storageList(prefix + keyPrefix).pipe(Effect.provideService(Storage, storage), Effect.map((keys) => keys.map((key) => key.slice(prefix.length)))),
@@ -232,10 +241,6 @@ function swapStashLedger(plan) {
         }).pipe(Effect.catch(() => Effect.succeed({ status: "exhausted" })));
     });
 }
-async function sha256Hex(value) {
-    const bytes = new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value)));
-    return [...bytes].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-}
 /**
  * Holds the connector set, resolves addresses, and coalesces tool listings
  * within one request. Remote MCP clients own persisted response caching. Connector failures are isolated: a broken
@@ -461,8 +466,12 @@ export class Registry {
         let credentialProgram;
         if (this.opts.credentialVault && credentialConfig) {
             const vault = this.opts.credentialVault;
+            // The credential a call sends: always read fresh. It records what it
+            // saw in the request's memo, so a later status or detail read in the
+            // same request is never older than what was sent.
+            const fresh = credentialReads(vault, requestReads(requestScope), true);
             credentialProgram = Effect.tryPromise({
-                try: () => vault.getAll(id, this.opts.credentialOwner),
+                try: () => fresh.getAll(id, this.opts.credentialOwner),
                 catch: (error) => error,
             }).pipe(Effect.flatMap((values) => {
                 const shape = storedCredentialShape(credentialConfig, values);
@@ -487,6 +496,7 @@ export class Registry {
             ...(this.opts.oauthClientName !== undefined ? { oauthClientName: this.opts.oauthClientName } : {}),
             ...(credentialAccess ? { credential: credentialAccess } : {}),
             requestScope,
+            routes: this.opts.routes ?? META_ROUTES,
             ...callOptions,
         }, scope?.caller);
         setViewService(context, OperationCredentials, credentialProgram);
@@ -502,7 +512,11 @@ export class Registry {
             storage: this.opts.catalogStorage ?? this.opts.storage,
             partition: this.catalogPartition(scope),
             credentialRevision: () => catalogRevision(this.opts.credentialVault),
-            sharedPartition: JSON.stringify([baseUrl, this.opts.publicUrl ?? null, scope?.caller?.pool ?? null]),
+            sharedPartition: JSON.stringify([
+                baseUrl,
+                this.opts.publicUrl ?? null,
+                (scope?.caller ?? scope?.operatorCaller)?.pool ?? null,
+            ]),
             defaultTtlMs: (this.opts.toolCacheTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogTtlSeconds) * 1000,
             minTtlMs: (this.opts.catalogMinTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogMinTtlSeconds) * 1000,
             maxTtlMs: (this.opts.catalogMaxTtlSeconds ?? CONFIG_DEFAULTS.discovery.catalogMaxTtlSeconds) * 1000,
@@ -517,8 +531,9 @@ export class Registry {
                 }
                 : {}),
         });
+        attachStorageDigestKey(context, this.opts.credentialVault);
         sentSecretsFor(context);
-        trackCredentialReads(context);
+        wrapViewCredentials(context);
         attachOAuthPartition(context, this.oauthPartition);
         // Downstream OAuth state is sealed under the vault key, bound to this
         // connector and owner. The sealer rides beside the context, not on it.
@@ -581,7 +596,7 @@ export class Registry {
      *
      * `chunks[n]` lands on `resultKeys.chunk(id, n)` inside `partition` — the
      * layout connecta.result reads back, so a page fetches only the chunks it covers
-     * instead of the whole stored result (issue #540). Chunking is a read-cost
+     * instead of the whole stored result. Chunking is a read-cost
      * decision, not a capacity one: however many keys an envelope occupies, it
      * is one stash entry charged its total ASCII length.
      *
@@ -603,7 +618,7 @@ export class Registry {
      * connector's namespace. Backs connecta.result.
      */
     resultIdentity() {
-        return { subject: null, principal: null, endpoint: "/mcp", origin: null };
+        return { pool: null, subject: null, principal: null, endpoint: "/mcp", origin: null };
     }
     recheckResultAccess(_dependencies, _classification, _signal) {
         return Promise.resolve(true);
@@ -765,8 +780,8 @@ export class Registry {
     getTools(id, baseUrl, requestScope, callOptions = {}, scope) {
         return runEdge(registryEdgeProgram(Registry.prototype, this, "getTools", id, baseUrl, requestScope, callOptions, scope));
     }
-    credentialDriftFor(id) {
-        return runEdge(registryEdgeProgram(Registry.prototype, this, "credentialDriftFor", id));
+    credentialDriftFor(id, requestScope) {
+        return runEdge(registryEdgeProgram(Registry.prototype, this, "credentialDriftFor", id, requestScope));
     }
     /** Age of a complete cache entry; reads never refresh it. */
     catalogAgeMs(id) {
@@ -946,13 +961,16 @@ export class Registry {
                     return yield* load.join(signal);
                 }));
             }),
-            credentialDriftFor: (self, id) => Effect.gen(function* () {
+            credentialDriftFor: (self, id, requestScope) => Effect.gen(function* () {
                 const credential = self.connectors.get(id)?.credential;
                 const vault = self.opts.credentialVault;
                 if (!credential || !vault)
                     return undefined;
+                // Memoized per request: drift only labels a status or detail view.
+                // A dispatch reads its credential fresh (contextFor).
+                const reader = requestScope ? credentialReads(vault, requestReads(requestScope)) : vault;
                 return yield* Effect.tryPromise({
-                    try: () => vault.getAll(id, self.opts.credentialOwner),
+                    try: () => reader.getAll(id, self.opts.credentialOwner),
                     catch: (error) => error,
                 }).pipe(Effect.map((values) => {
                     const shape = storedCredentialShape(credential, values);
@@ -970,8 +988,13 @@ export class Registry {
                 const withObservations = (status) => self.withCatalogObservations(id, baseUrl, status, scope);
                 return duringViewEffect(ctx, () => Effect.gen(function* () {
                     if (connector.credential) {
+                        // Memoized per request: this read only picks the status shown.
+                        // The probe that follows reads the credential it sends fresh.
+                        const vault = self.opts.credentialVault;
                         const values = yield* Effect.tryPromise({
-                            try: () => self.opts.credentialVault?.getAll(id, self.opts.credentialOwner) ?? Promise.resolve(null),
+                            try: () => vault
+                                ? credentialReads(vault, requestReads(requestScope)).getAll(id, self.opts.credentialOwner)
+                                : Promise.resolve(null),
                             catch: (error) => error,
                         });
                         const shape = storedCredentialShape(connector.credential, values);
@@ -1082,6 +1105,7 @@ class ScopedRegistryView {
         return {
             subject: this.scope.subjectKey ?? null,
             principal: this.scope.principalKey ?? null,
+            pool: this.scope.caller?.pool ?? null,
             endpoint: this.scope.endpoint ?? "/mcp",
             origin: this.scope.origin ?? null,
         };
@@ -1092,8 +1116,8 @@ class ScopedRegistryView {
     resultsStorage() {
         return this.scope.subjectKey ? this.root.scopedStorage(this.scope.subjectKey) : this.root.resultsStorage();
     }
-    credentialDriftFor(id) {
-        return runEdge(registryEdgeProgram(ScopedRegistryView.prototype, this, "credentialDriftFor", id));
+    credentialDriftFor(id, requestScope) {
+        return runEdge(registryEdgeProgram(ScopedRegistryView.prototype, this, "credentialDriftFor", id, requestScope));
     }
     observedOutputSchema(connectorId, definition) {
         return this.registryFor(connectorId)?.observedOutputSchema(connectorId, definition);
@@ -1149,9 +1173,11 @@ class ScopedRegistryView {
                 }
                 return carryCatalogFreshness(tools, visible);
             }),
-            credentialDriftFor: (self, id) => Effect.suspend(() => {
+            credentialDriftFor: (self, id, requestScope) => Effect.suspend(() => {
                 const registry = self.registryFor(id);
-                return registry ? registryProgram(registry, "credentialDriftFor", id) : Effect.succeed(undefined);
+                return registry
+                    ? registryProgram(registry, "credentialDriftFor", id, requestScope)
+                    : Effect.succeed(undefined);
             }),
             statusFor: (self, ...args) => Effect.suspend(() => {
                 const registry = self.registryFor(args[0]);

package/dist/request-principal.js

@@ -1,4 +1,4 @@
-// The admitted principal a request-auth resolver may receive (#1103).
+// The admitted principal a request-auth resolver may receive.
 //
 // Only the caller core attached from the admitting authorization counts
 // (`callerOf`, see connector-caller.ts). No argument, program or header can

package/dist/request-state.js

@@ -1,3 +1,4 @@
+import { sha256Hex } from "./bytes.js";
 import { ProtocolError, INVALID_PARAMS } from "@modelcontextprotocol/server";
 export const REQUEST_STATE_TTL_MS = 10 * 60_000;
 export const MAX_INPUT_ROUNDS = 3;
@@ -16,6 +17,5 @@ export function canonicalState(value) {
         : item);
 }
 export async function requestDigest(tool, args) {
-    const bytes = new TextEncoder().encode(canonicalState({ tool, args }));
-    return Array.from(new Uint8Array(await crypto.subtle.digest("SHA-256", bytes)), (byte) => byte.toString(16).padStart(2, "0")).join("");
+    return sha256Hex(canonicalState({ tool, args }));
 }

package/dist/routes/access-tokens.js

@@ -67,7 +67,7 @@ export async function routeAccessTokens(context, manager) {
     const admin = await authorizeUiIdentity(request, baseUrl, opts.config.auth, "access token management", context.runtimeContext, opts.config.logger);
     if (!admin.ok)
         return admin.response;
-    // Interactive maintainers alone manage agent tokens (#837); anyone else
+    // Interactive maintainers alone manage agent tokens; anyone else
     // gets the same private 404 every operator route gives them.
     if (!managesAgentTokens(opts, admin) || !admin.identity.principal) {
         return privateJson({ error: "not found" }, { status: 404 });

package/dist/routes/activity-disclosure.js

@@ -6,7 +6,7 @@ function activityToolVisible(access, event) {
 }
 /**
  * One disclosure rule for the timeline and the UI's last-call overlay. Only
- * maintainers read activity (#837), and only after the optional
+ * maintainers read activity, and only after the optional
  * read gate. They may see other principals' shared-connector history,
  * including request IDs, client name/version, and actor kind/id/namespace, on
  * plain /mcp and in every declared pool, within the tools that pool declares.

package/dist/routes/connect.js

@@ -88,7 +88,7 @@ async function connect(context) {
     if (!authz.ok) {
         // Access sign-in is enforced at the edge. Clerk needs its own sign-in page.
         // The sign-in page returns to this link, which then sends a maintainer on
-        // to the operator UI. Pool members cannot use that UI yet (#837), so
+        // to the operator UI. Pool members cannot use that UI yet, so
         // signing in there would strand them.
         if (authz.response.status === 401 &&
             authorizationCredential(request).kind === "absent" &&
@@ -107,7 +107,7 @@ async function connect(context) {
     if (authz.principalKey !== handoff.principal || !mayManageConnector(opts, authz, connector)) {
         return refuse("Sign in as the user who requested this connection and has permission to manage it.");
     }
-    // The operator UI serves maintainers only until member views ship (#837).
+    // The operator UI serves maintainers only until member views ship.
     // A member's OAuth link starts here directly, as it does without a UI.
     const viaUi = Boolean(opts.config.ui) && admitsMaintainer(opts, authz);
     if (!connector.startAuth) {