@zackbart/connecta 0.6.0 → 0.6.1

package/src/credential-health.ts

@@ -15,6 +15,7 @@
 // There is no background daemon and no long-lived timer, so Workers and Node run
 // the same code.
 
+import { credentialTestRule } from "./credentials.js";
 import type { CredentialVault } from "./credentials.js";
 import { DEFAULT_PROBE_TIMEOUT_MS, normalizeTimeoutMs, withTimeout } from "./timeout.js";
 import type {
@@ -48,8 +49,9 @@ export interface CredentialHealthRecord {
  *   through an explicit `ids` request, and reported rather than dropped so a
  *   typo in a scheduled check is visible instead of silent.
  * - `not_checkable` — it stores no credential connecta manages, or exposes no
- *   usable way to ask: neither `status()` nor a credential test hook that fits
- *   the stored value's shape.
+ *   usable way to ask: neither `status()` nor a credential test hook the
+ *   declared credential shape can use (`credentialTestRule`), against a value
+ *   actually stored under it.
  * - `no_credential` — checkable, but nothing is stored yet: there is no
  *   credential whose liveness could be in question, and probing would start an
  *   OAuth flow nobody asked for.
@@ -342,40 +344,54 @@ export interface CredentialCheckOptions {
  * to be asked about: an operator-managed `credential`, or a stored downstream
  * grant it reports via `hasStoredCredential`. A static-token connector stores
  * nothing here and is never probed on a timer.
+ *
+ * Whether a test hook counts is `credentialTestRule`'s call, not this function's
+ * — the same rule /ui's Test button and the credential API read (issue #55), so
+ * a credential the operator cannot test by hand is not one a sweep tests behind
+ * their back. A connector whose only hook cannot test its declared shape is
+ * checkable only if it also implements `status()`.
  */
 export function isCheckableConnector(connector: Connector): boolean {
   const hasCredentialStore = Boolean(
     connector.credential || connector.hasStoredCredential,
   );
   const canAsk = Boolean(
-    (connector.credential &&
-      (connector.testCredentials || connector.testCredential)) ||
-      connector.status,
+    credentialTestRule(connector).mode !== null || connector.status,
   );
   return hasCredentialStore && canAsk;
 }
 
 /**
- * The credential test that fits the STORED value's shape, or undefined.
+ * The credential test the connector's DECLARED shape selects, bound to what is
+ * actually stored — or undefined when there is no honest question to put.
  *
  * `isCheckableConnector` answers the static question ("could this connector be
- * asked at all"); this answers it against what is actually in the vault. The gap
- * that matters is a connector with named fields but only the single-value
- * `testCredential` hook: handing it `values.value` — the reserved single-value
- * field, absent here — would test the empty string and record a confident
- * `auth_required` about a credential nothing examined. The credential API
- * refuses that same shape with a 409 rather than testing it; here the connector
- * is skipped rather than given an invented verdict.
+ * asked at all"); this answers it against the vault. The hook itself is picked
+ * by `credentialTestRule` (src/credentials.ts, issue #55), the one rule /ui's
+ * `testable` flag and `POST /ui/credentials/<id>/test` also read: named
+ * `credential.fields` are tested as a set by `testCredentials`, a single-value
+ * `credential` by `testCredential` on the vault's reserved `value` field, and
+ * the other hook is never substituted. Substituting it is what a sweep must not
+ * do quietly — handing `testCredential` a `values.value` that named fields never
+ * wrote would test the empty string and record a confident `auth_required` about
+ * a credential nothing examined, and handing `testCredentials` the reserved
+ * `{ value }` map would call a hook with a shape its connector never declared.
+ * Either way the connector is skipped (`not_checkable`) rather than given an
+ * invented verdict, and `createConnecta` already warned about the mismatch at
+ * construction.
  */
 function testHookFor(
   connector: Connector,
   values: ConnectorCredentialValues | null,
 ): ((ctx: ConnectorContext) => Promise<CredentialTestResult>) | undefined {
   if (!values) return undefined;
-  if (connector.testCredentials) {
+  const { mode } = credentialTestRule(connector);
+  if (mode === "multiple") {
     return (ctx) => connector.testCredentials!(values, ctx);
   }
-  if (connector.testCredential && typeof values.value === "string") {
+  // A single-value shape with nothing under the reserved field is still nothing
+  // to test, so the stored value gets the last word even when the rule fits.
+  if (mode === "single" && typeof values.value === "string") {
     return (ctx) => connector.testCredential!(values.value, ctx);
   }
   return undefined;
@@ -639,9 +655,10 @@ export class CredentialHealthChecker {
   }
 
   /**
-   * `isCheckableConnector` re-asked against what is actually stored: a hook that
-   * fits the value's shape (see {@link testHookFor}), or a `status()` to fall
-   * back on. Neither ⇒ there is no honest question to put to this connector.
+   * `isCheckableConnector` re-asked against what is actually stored: the hook
+   * the declared shape selects, bound to a value that fits it (see
+   * {@link testHookFor}), or a `status()` to fall back on. Neither ⇒ there is no
+   * honest question to put to this connector.
    */
   private canAsk(
     connector: Connector,

package/src/credentials.ts

@@ -1,4 +1,8 @@
-import type { ConnectorCredentialValues, KVStorage } from "./types.js";
+import type {
+  Connector,
+  ConnectorCredentialValues,
+  KVStorage,
+} from "./types.js";
 
 const KEY_BYTES = 32;
 const IV_BYTES = 12;
@@ -35,6 +39,72 @@ export interface CredentialMetadata {
   fields?: Record<string, CredentialFieldMetadata>;
 }
 
+/** Which hook a testable credential is checked with. */
+export type CredentialTestMode = "single" | "multiple";
+
+/** A declared credential shape whose only test hook cannot test it. */
+export interface CredentialTestMismatch {
+  /** The shape the connector declared. */
+  shape: CredentialTestMode;
+  /** The hook it implements, which that shape cannot use. */
+  hook: "testCredential" | "testCredentials";
+}
+
+export interface CredentialTestRule {
+  /** The hook to call, or null when this credential cannot be tested at all. */
+  mode: CredentialTestMode | null;
+  /** Set only when the sole implemented hook is the one the shape cannot use. */
+  mismatch?: CredentialTestMismatch;
+}
+
+/**
+ * The one rule deciding whether a connector's credential can be tested — read
+ * by /ui's `testable` flag, by the `POST /ui/credentials/<id>/test` route when
+ * it picks a hook, and by the construction-time mismatch warning, so those
+ * three cannot drift apart.
+ *
+ * The declared credential *shape* selects the hook: named `credential.fields`
+ * are tested as a set by `testCredentials`, a single-value `credential` by
+ * `testCredential` on the vault's reserved `value` field. The other hook is
+ * never substituted — it would be handed a shape the connector never declared —
+ * so a connector implementing only the mismatched hook is not testable, and
+ * says so at construction rather than under an operator's click.
+ */
+export function credentialTestRule(
+  connector: Pick<
+    Connector,
+    "credential" | "testCredential" | "testCredentials"
+  >,
+): CredentialTestRule {
+  if (!connector.credential) return { mode: null };
+  if (connector.credential.fields?.length) {
+    if (connector.testCredentials) return { mode: "multiple" };
+    return connector.testCredential
+      ? { mode: null, mismatch: { shape: "multiple", hook: "testCredential" } }
+      : { mode: null };
+  }
+  if (connector.testCredential) return { mode: "single" };
+  return connector.testCredentials
+    ? { mode: null, mismatch: { shape: "single", hook: "testCredentials" } }
+    : { mode: null };
+}
+
+/**
+ * One clause naming a mismatch, shared by the startup warning and the test
+ * route's 400 so an operator reads the same explanation in both places.
+ */
+export function describeCredentialTestMismatch(
+  mismatch: CredentialTestMismatch,
+): string {
+  return mismatch.shape === "multiple"
+    ? "it declares named credential fields, which only " +
+        "`testCredentials(values, ctx)` can test, but implements " +
+        "`testCredential`"
+    : "it declares a single-value credential, which only " +
+        "`testCredential(value, ctx)` can test, but implements " +
+        "`testCredentials`";
+}
+
 function storageKey(connectorId: string): string {
   return `conn:${connectorId}:credential:v1`;
 }

package/src/index.ts

@@ -1,4 +1,8 @@
-import { CredentialVault } from "./credentials.js";
+import {
+  CredentialVault,
+  credentialTestRule,
+  describeCredentialTestMismatch,
+} from "./credentials.js";
 import { Registry } from "./registry.js";
 import { createFetchHandler } from "./server.js";
 import { droppedBrandingUrls, droppedUiAuthUrls } from "./ui.js";
@@ -222,7 +226,8 @@ function normalizeAuth(auth: ConnectaConfig["auth"]): InboundAuth[] {
 /**
  * One-time construction warnings for deployment shapes that run fine but are
  * usually unintended. Warning-only — never throws and never changes behavior;
- * each condition emits at most one `logger.warn`. Iterates connectors once.
+ * each deployment-wide condition emits at most one `logger.warn`, and each
+ * per-connector condition at most one per connector it names.
  */
 function warnInsecureConfig(
   config: ConnectaConfig,
@@ -330,20 +335,41 @@ function warnInsecureConfig(
 
   // /ui renders exactly one provider's browser sign-in config — the first that
   // offers one, which is the same `find` the /ui route performs — and that
-  // provider's frontendApiUrl becomes the loader's `<script src>`. Gate-or-drop
-  // like a branding href: rendering omits the loader for a rejected value and
-  // the dashboard then reports that Clerk could not load, a confusing symptom
-  // without this line naming the cause. Checking only the rendered provider
-  // keeps the claim true — a later provider's uiAuth never reaches the page, so
-  // there is nothing there to warn about.
+  // provider's URLs reach the browser: frontendApiUrl as the loader's
+  // `<script src>`, signInUrl/signUpUrl as the addresses ClerkJS navigates to.
+  // Gate-or-drop like a branding href: rendering drops a rejected value and the
+  // dashboard then either reports that Clerk could not load or quietly signs in
+  // through Clerk's defaults — both confusing symptoms without this line naming
+  // the cause. Checking only the rendered provider keeps the claim true — a
+  // later provider's uiAuth never reaches the page, so there is nothing there
+  // to warn about.
   const uiAuthProvider = inboundAuth.find((provider) => provider.uiAuth);
   const droppedUiAuth = droppedUiAuthUrls(uiAuthProvider?.uiAuth);
   if (uiAuthProvider && droppedUiAuth.length > 0) {
     logger.warn(
       `[connecta] inbound auth provider "${uiAuthProvider.kind}" had ` +
-        `${droppedUiAuth.join(", ")} dropped: the browser sign-in loader is ` +
-        "fetched from this origin, so it must be an absolute https URL. /ui " +
-        "renders without the loader and cannot start a sign-in.",
+        `${droppedUiAuth.join(", ")} dropped: every uiAuth URL reaches the ` +
+        "browser — as the sign-in loader's source, or as a place Clerk sends " +
+        "the operator — so each must be an absolute https URL. A dropped " +
+        "value reaches no part of the page: without frontendApiUrl /ui renders " +
+        "no loader and cannot start a sign-in, and without signInUrl/signUpUrl " +
+        "it signs in through Clerk's defaults.",
+    );
+  }
+
+  // A credential test hook that cannot test the declared credential shape.
+  // The shape picks the hook (see `credentialTestRule`) and the other one is
+  // never substituted, so the connector is simply not testable: /ui offers no
+  // Test action and the route answers 400. Without this line the only way to
+  // discover the mistake is to click a button that isn't there.
+  for (const connector of config.connectors) {
+    const { mismatch } = credentialTestRule(connector);
+    if (!mismatch) continue;
+    logger.warn(
+      `[connecta] connector "${connector.id}" cannot test its credential: ` +
+        `${describeCredentialTestMismatch(mismatch)}. /ui offers no Test ` +
+        `action and POST /ui/credentials/${connector.id}/test answers 400 ` +
+        "until the matching hook is implemented.",
     );
   }
 

package/src/server.ts

@@ -10,6 +10,10 @@ import type {
   ActivityStore,
 } from "./activity.js";
 import { InvalidActivityCursorError } from "./activity.js";
+import {
+  credentialTestRule,
+  describeCredentialTestMismatch,
+} from "./credentials.js";
 import type { CredentialVault } from "./credentials.js";
 import { ScopedRegistry, type Registry, type RegistryView } from "./registry.js";
 import {
@@ -546,16 +550,25 @@ async function handleCredentialRequest(
     if (request.method !== "POST") {
       return privateJson({ error: "method not allowed" }, { status: 405 });
     }
-    if (!connector.testCredential && !connector.testCredentials) {
+    // The declared credential shape picks the hook — the same single rule /ui
+    // asks for its Test affordance, so a shown button always reaches a hook
+    // that reads the shape the credential was stored in.
+    const rule = credentialTestRule(connector);
+    if (!rule.mode) {
       return privateJson(
-        { error: "this connector does not support credential testing" },
+        {
+          error: rule.mismatch
+            ? "this connector cannot test its credential: " +
+              describeCredentialTestMismatch(rule.mismatch)
+            : "this connector does not support credential testing",
+        },
         { status: 400 },
       );
     }
     try {
       const ctx = opts.registry.contextFor(connectorId, baseUrl);
       let result;
-      if (connector.testCredentials) {
+      if (rule.mode === "multiple") {
         const values = await opts.credentialVault.getAll(connectorId);
         if (!values) {
           return privateJson(
@@ -563,7 +576,7 @@ async function handleCredentialRequest(
             { status: 409 },
           );
         }
-        result = await connector.testCredentials(values, ctx);
+        result = await connector.testCredentials!(values, ctx);
       } else {
         const value = await opts.credentialVault.get(connectorId);
         if (!value) {

package/src/skills.ts

@@ -235,12 +235,12 @@ export function resolveSkill(
     return {
       found: false,
       message: connectorGuide(bare)
-        ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available: ${available()}.`
+        ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available skills: ${available()}.`
         : `Connector "${name}" has no usage guide. Available skills: ${available()}.`,
     };
   }
   return {
     found: false,
-    message: `Unknown skill "${name}". Available: ${available()}.`,
+    message: `Unknown skill "${name}". Available skills: ${available()}.`,
   };
 }

package/src/types.ts

@@ -316,7 +316,18 @@ export type UiAuthConfig = {
    * warning.
    */
   frontendApiUrl: string;
+  /**
+   * Hosted Account Portal sign-in address, handed to `Clerk.load`. **Must be an
+   * absolute `https:` URL** — the same gate `frontendApiUrl` passes, because
+   * this value is where Clerk *navigates* the operator's browser. An Account
+   * Portal address is always https, so the stricter gate costs nothing real: a
+   * value that fails it (a `javascript:`/`data:` payload, a cleartext `http:`
+   * address, a relative path) reaches no part of the page, `/ui` signs in
+   * through Clerk's default instead, and `createConnecta` names the drop in a
+   * startup warning.
+   */
   signInUrl?: string;
+  /** Hosted Account Portal sign-up address. Gated exactly like `signInUrl`. */
   signUpUrl?: string;
 };
 

package/src/ui.ts

@@ -1,3 +1,4 @@
+import { credentialTestRule } from "./credentials.js";
 import type { CredentialVault } from "./credentials.js";
 import type { Registry } from "./registry.js";
 import type { ConnectaBranding, UiAuthConfig } from "./types.js";
@@ -66,6 +67,20 @@ export function resolveBranding(
   };
 }
 
+/**
+ * Whether the operator meant to supply a value here — the question every
+ * dropped-URL warning asks before naming a field, and one definition so the
+ * branding and `uiAuth` warnings cannot answer it differently. A non-string
+ * counts as set: the intent was there and is exactly what the warning reports
+ * on. A blank or whitespace-only string does not; that is indistinguishable
+ * from leaving the field alone, and both take the default silently.
+ */
+function isSetUrlValue(value: unknown): boolean {
+  return typeof value === "string"
+    ? trimmedString(value) !== undefined
+    : value !== undefined && value !== null;
+}
+
 /**
  * Names of the branding URLs the operator set that failed their gate and were
  * replaced by a default. Lives beside the gates so the startup warning cannot
@@ -75,17 +90,15 @@ export function resolveBranding(
 export function droppedBrandingUrls(branding?: ConnectaBranding): string[] {
   if (!branding) return [];
   const resolved = resolveBranding(branding);
-  // A non-string still counts as "set": the operator meant to supply a URL, and
-  // that intent is exactly what the warning reports on. A blank string does not.
-  const isSet = (value: unknown) =>
-    typeof value === "string"
-      ? trimmedString(value) !== undefined
-      : value !== undefined && value !== null;
   const faviconHref = branding.favicon?.href;
   return [
-    ...(isSet(branding.productUrl) && !resolved.productUrl ? ["productUrl"] : []),
-    ...(isSet(branding.ownerUrl) && !resolved.ownerUrl ? ["ownerUrl"] : []),
-    ...(isSet(faviconHref) &&
+    ...(isSetUrlValue(branding.productUrl) && !resolved.productUrl
+      ? ["productUrl"]
+      : []),
+    ...(isSetUrlValue(branding.ownerUrl) && !resolved.ownerUrl
+      ? ["ownerUrl"]
+      : []),
+    ...(isSetUrlValue(faviconHref) &&
     trimmedString(faviconHref) !== resolved.faviconHref
       ? ["favicon.href"]
       : []),
@@ -159,20 +172,26 @@ export function isSafeIconHref(href: unknown): boolean {
 }
 
 /**
- * True only for an absolute `https:` URL — the gate for `uiAuth.frontendApiUrl`,
- * the last operator-config value that lands in a URL-valued HTML position (the
- * `<script src>` of `/ui`'s sign-in loader). `javascript:` in a `src` does not
- * execute, so this closes a hole in the *invariant* rather than a live vector:
- * every operator value reaching an `href`/`src` is validated, with no exception
- * left to remember.
+ * True only for an absolute `https:` URL — the gate every `uiAuth` URL passes:
+ * `frontendApiUrl`, which becomes the `<script src>` of `/ui`'s sign-in loader,
+ * and `signInUrl`/`signUpUrl`, which ClerkJS uses as *navigation targets* when
+ * the operator signs in. With those three gated, no operator-config value
+ * reaches the browser in a URL position — attribute or navigation — without
+ * validation, and there is no exception left to remember.
  *
- * Stricter than `isSafeHttpUrl` on purpose. There is no `http:` carve-out and no
- * loopback carve-out, because nobody types this value: the shipped Clerk adapter
- * derives it from the publishable key and Clerk's Frontend API is always https.
- * A cleartext script source on the dashboard would be a downgrade even where a
- * browser's mixed-content rules had not already blocked it.
+ * Stricter than `isSafeHttpUrl` on purpose: no `http:` carve-out, no loopback
+ * carve-out, and no relative form. Nobody types `frontendApiUrl` — the shipped
+ * Clerk adapter derives it from the publishable key, and Clerk's Frontend API is
+ * always https — and a cleartext script source on the dashboard would be a
+ * downgrade even where a browser's mixed-content rules had not already blocked
+ * it. `signInUrl`/`signUpUrl` *are* typed by the operator, but what belongs
+ * there is a hosted Account Portal address (`https://accounts.<domain>` or
+ * `https://<slug>.accounts.dev`), which is https as well; `http:` would carry a
+ * sign-in over cleartext, and a path relative to this origin is meaningless
+ * because this server hosts no sign-in page of its own. So the looser gate would
+ * buy nothing real, and the same strictness holds for all three.
  */
-export function isSafeScriptSrcUrl(url: unknown): boolean {
+export function isSafeHttpsUrl(url: unknown): boolean {
   if (typeof url !== "string") return false;
   try {
     return new URL(url).protocol === "https:";
@@ -186,14 +205,31 @@ export function isSafeScriptSrcUrl(url: unknown): boolean {
  * gate. Lives beside the gate for the same reason `droppedBrandingUrls` does: the
  * startup warning cannot then drift from what rendering actually drops. Every
  * field is read defensively rather than trusted, because a custom `InboundAuth`
- * is untyped at a JS call site — `isSafeScriptSrcUrl` takes `unknown`, and a
+ * is untyped at a JS call site — `isSafeHttpsUrl` takes `unknown`, and a
  * `uiAuth` that is not the clerk shape is reported as nothing to warn about.
+ *
+ * `frontendApiUrl` is required, so anything that fails its gate is a drop.
+ * `signInUrl` and `signUpUrl` are optional, so only a value the operator
+ * *supplied* and the gate then rejected is worth a warning — an unset field
+ * took no default away from anyone. `isSetUrlValue` decides that, the same way
+ * and for the same reasons it decides it for the branding URLs: a warning that
+ * fires for one and not the other would be reporting on the field rather than
+ * on the operator's intent. Rendering is not consulted for this: it drops on
+ * the gate alone, and a blank string fails that gate too — it is simply not
+ * *reported*, because a blank is indistinguishable from leaving the field
+ * alone.
  */
 export function droppedUiAuthUrls(uiAuth?: UiAuthConfig): string[] {
   if (!uiAuth || uiAuth.kind !== "clerk") return [];
-  return isSafeScriptSrcUrl(uiAuth.frontendApiUrl)
-    ? []
-    : ["uiAuth.frontendApiUrl"];
+  return [
+    ...(isSafeHttpsUrl(uiAuth.frontendApiUrl) ? [] : ["uiAuth.frontendApiUrl"]),
+    ...(isSetUrlValue(uiAuth.signInUrl) && !isSafeHttpsUrl(uiAuth.signInUrl)
+      ? ["uiAuth.signInUrl"]
+      : []),
+    ...(isSetUrlValue(uiAuth.signUpUrl) && !isSafeHttpsUrl(uiAuth.signUpUrl)
+      ? ["uiAuth.signUpUrl"]
+      : []),
+  ];
 }
 
 export interface UiTool {
@@ -328,6 +364,10 @@ export async function buildUiData(
       }
       let credential: UiConnector["credential"];
       if (c.credential && credentialVault) {
+        // One rule, shared with the test route: only the hook matching the
+        // declared credential shape can run, so the button is offered only
+        // where a click can succeed (src/credentials.ts).
+        const testable = credentialTestRule(c).mode !== null;
         const credentialFields = (
           metadata?: Awaited<ReturnType<CredentialVault["metadata"]>>,
         ) =>
@@ -374,7 +414,7 @@ export async function buildUiData(
                   updatedAt: metadata.updatedAt,
                 }
               : {}),
-            testable: Boolean(c.testCredential || c.testCredentials),
+            testable,
           };
         } catch {
           const fields = credentialFields();
@@ -389,7 +429,7 @@ export async function buildUiData(
             ...(fields?.length ? { fields } : {}),
             configured: false,
             removable: true,
-            testable: Boolean(c.testCredential || c.testCredentials),
+            testable,
             error: "Stored credential could not be read.",
           };
         }
@@ -457,19 +497,26 @@ export function renderUiHtml(
   // the same fallback-and-warn posture the branding URLs take, with the drop
   // named in a startup warning (see `droppedUiAuthUrls`).
   const clerkScriptOrigin =
-    clerk && isSafeScriptSrcUrl(clerk.frontendApiUrl)
+    clerk && isSafeHttpsUrl(clerk.frontendApiUrl)
       ? clerk.frontendApiUrl
       : undefined;
   // Enumerated field by field, because this object is serialized into the page's
   // inline script: a rejected frontendApiUrl must not reach the document through
-  // `AUTH` after being kept out of the `<script src>`.
+  // `AUTH` after being kept out of the `<script src>`, and a rejected
+  // signInUrl/signUpUrl — which `AUTH` is the only path into the page for — must
+  // not reach it at all. Dropping one leaves the key absent, so `Clerk.load`
+  // falls back to its own default the same way it does for an unset value.
   const auth = clerk
     ? {
         kind: clerk.kind,
         publishableKey: clerk.publishableKey,
         ...(clerkScriptOrigin ? { frontendApiUrl: clerkScriptOrigin } : {}),
-        ...(clerk.signInUrl ? { signInUrl: clerk.signInUrl } : {}),
-        ...(clerk.signUpUrl ? { signUpUrl: clerk.signUpUrl } : {}),
+        ...(isSafeHttpsUrl(clerk.signInUrl)
+          ? { signInUrl: clerk.signInUrl }
+          : {}),
+        ...(isSafeHttpsUrl(clerk.signUpUrl)
+          ? { signUpUrl: clerk.signUpUrl }
+          : {}),
       }
     : (uiAuth ?? { kind: "bearer" as const });
   const brand = resolveBranding(branding);

package/src/version.ts

@@ -4,4 +4,4 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.6.0";
+export const CONNECTA_VERSION = "0.6.1";