@zackbart/connecta 0.7.9 → 0.8.1

package/dist/routes/shared.js

@@ -0,0 +1,140 @@
+import { operatorPageForPath } from "../ui.js";
+export function msg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+export function privateJson(body, init = {}) {
+    const headers = new Headers(init.headers);
+    headers.set("Content-Type", "application/json");
+    headers.set("Cache-Control", "no-store");
+    headers.set("Referrer-Policy", "no-referrer");
+    return new Response(JSON.stringify(body), { ...init, headers });
+}
+const MAX_LOGGED_VALUE_LENGTH = 64;
+/**
+ * Bounded, escaped form of a caller-influenced value (an identity id or OAuth
+ * callback connector id) for the operator log. Goes
+ * through JSON.stringify so a caller-controlled newline or control character
+ * cannot forge a log line, plus a hand-rolled escape for U+2028/U+2029, which
+ * JSON.stringify leaves raw even though a log reader treats them as line
+ * terminators. Truncated to a small shared cap so an oversized value cannot
+ * flood the log either.
+ */
+export function loggableValue(requested) {
+    const bounded = requested.slice(0, MAX_LOGGED_VALUE_LENGTH);
+    const escaped = JSON.stringify(bounded).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
+    return escaped + (bounded.length < requested.length ? " (truncated)" : "");
+}
+const ACTIVITY_ACTOR_NAMESPACE_RE = /^[\x21-\x7e]{1,256}$/;
+export function activityActorNamespace(provider) {
+    return typeof provider.activityActorNamespace === "string" &&
+        ACTIVITY_ACTOR_NAMESPACE_RE.test(provider.activityActorNamespace)
+        ? provider.activityActorNamespace
+        : undefined;
+}
+export async function authorize(request, baseUrl, auth) {
+    if (auth.length === 0) {
+        return { ok: true, actor: { kind: "anonymous" } };
+    }
+    let lastResponse = null;
+    for (const provider of auth) {
+        const result = await provider.authorize(request, baseUrl);
+        if (result.ok) {
+            const subjectId = result.subjectId ?? result.userId;
+            const actorNamespace = activityActorNamespace(provider);
+            return {
+                ok: true,
+                actor: {
+                    kind: provider.kind,
+                    ...(subjectId ? { id: subjectId } : {}),
+                    ...(subjectId && actorNamespace
+                        ? { namespace: actorNamespace }
+                        : {}),
+                },
+                ...(result.userId && provider.uiAuth?.kind === "clerk"
+                    ? { uiAdminEligible: true }
+                    : {}),
+            };
+        }
+        lastResponse = result.response;
+    }
+    return {
+        ok: false,
+        response: lastResponse ??
+            new Response(JSON.stringify({ error: "unauthorized" }), {
+                status: 401,
+                headers: {
+                    "Content-Type": "application/json",
+                    "WWW-Authenticate": "Bearer",
+                },
+            }),
+    };
+}
+export async function authorizeUiAdmin(request, baseUrl, auth, purpose = "credential management") {
+    // Operator mutation is intentionally narrower than /mcp and /ui/data: only
+    // an interactive Clerk provider may admit it. A static bearer token is useful
+    // for headless tool calls but must not become a deployment-admin key.
+    //
+    // Every Clerk provider gets a turn, the way the /mcp gate does. Stopping at
+    // the first would make admission depend on config order: a failed gate or
+    // missing user may simply mean a later provider is the one meant to admit.
+    // The last refusal is returned if none do.
+    const providers = auth.filter((candidate) => candidate.uiAuth?.kind === "clerk");
+    if (providers.length === 0) {
+        return {
+            ok: false,
+            response: privateJson({ error: `${purpose} requires Clerk authentication` }, { status: 403 }),
+        };
+    }
+    let lastResponse = null;
+    for (const provider of providers) {
+        const result = await provider.authorize(request, baseUrl);
+        if (!result.ok) {
+            lastResponse = result.response;
+            continue;
+        }
+        if (!result.userId) {
+            lastResponse = privateJson({ error: "authenticated user required" }, { status: 403 });
+            continue;
+        }
+        return { ok: true, userId: result.userId };
+    }
+    return {
+        ok: false,
+        response: lastResponse ??
+            privateJson({ error: "forbidden" }, { status: 403 }),
+    };
+}
+export function isSameOrigin(request, baseUrl) {
+    const origin = request.headers.get("origin");
+    if (!origin)
+        return false;
+    try {
+        return new URL(origin).origin === new URL(baseUrl).origin;
+    }
+    catch {
+        return false;
+    }
+}
+export function withSecurityHeaders(response, requestUrl, path) {
+    const headers = new Headers(response.headers);
+    headers.set("X-Content-Type-Options", "nosniff");
+    headers.set("Referrer-Policy", "no-referrer");
+    if (requestUrl.protocol === "https:") {
+        headers.set("Strict-Transport-Security", "max-age=31536000");
+    }
+    if (operatorPageForPath(path) || path === "/ui") {
+        // Operator HTML responses ship their own nonce-based script CSP (which
+        // already includes frame-ancestors 'none'); only fall back to the
+        // framing-only directive when no CSP is present (for example redirects).
+        if (!headers.has("Content-Security-Policy")) {
+            headers.set("Content-Security-Policy", "frame-ancestors 'none'");
+        }
+        headers.set("X-Frame-Options", "DENY");
+    }
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+//# sourceMappingURL=shared.js.map

package/dist/routes/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AA4C/C,MAAM,UAAU,GAAG,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,IAAa,EACb,OAAqB,EAAE;IAEvB,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,2BAA2B,GAAG,sBAAsB,CAAC;AAE3D,MAAM,UAAU,sBAAsB,CACpC,QAAqB;IAErB,OAAO,OAAO,QAAQ,CAAC,sBAAsB,KAAK,QAAQ;QACxD,2BAA2B,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QACjE,CAAC,CAAC,QAAQ,CAAC,sBAAsB;QACjC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAgB,EAChB,OAAe,EACf,IAAmB;IAUnB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC;YACpD,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvC,GAAG,CAAC,SAAS,IAAI,cAAc;wBAC7B,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE;wBAC/B,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO;oBACpD,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;oBAC3B,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;gBACtD,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,kBAAkB,EAAE,QAAQ;iBAC7B;aACF,CAAC;KACL,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,OAAe,EACf,IAAmB,EACnB,OAAO,GAAG,uBAAuB;IAEjC,2EAA2E;IAC3E,8EAA8E;IAC9E,sEAAsE;IACtE,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,2EAA2E;IAC3E,2CAA2C;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAC3B,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,KAAK,OAAO,CAClD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,WAAW,CACnB,EAAE,KAAK,EAAE,GAAG,OAAO,gCAAgC,EAAE,EACrD,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB;SACF,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,GAAoB,IAAI,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,YAAY,GAAG,WAAW,CACxB,EAAE,KAAK,EAAE,6BAA6B,EAAE,EACxC,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAC;YACF,SAAS;QACX,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,YAAY;YACZ,WAAW,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,OAAe;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAkB,EAClB,UAAe,EACf,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QAChD,uEAAuE;QACvE,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,wBAAwB,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE;QACjC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,OAAO;KACR,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/ui.d.ts

@@ -0,0 +1,3 @@
+import { type RouteContext } from "./shared.js";
+export declare function routeUi(context: RouteContext): Promise<Response | null>;
+//# sourceMappingURL=ui.d.ts.map

package/dist/routes/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAuCrB,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAyF1B"}

package/dist/routes/ui.js

@@ -0,0 +1,116 @@
+import { CONNECTA_FAVICON_ICO } from "../favicon.js";
+import { buildUiData, CONNECTA_FAVICON_SVG, credentialManagementCapability, operatorPageForPath, renderUiHtml, } from "../ui.js";
+import { authorize, privateJson, } from "./shared.js";
+/**
+ * Headers that make an operator-supplied favicon body inert on this origin.
+ * The SVG route is the sharp one: `image/svg+xml` is an *active* content type,
+ * so a `<script>` inside a branding SVG would run on the deployment origin the
+ * moment anyone navigated straight to `/favicon.svg` — strictly more powerful
+ * than the `favicon.href` vector the branding gates close, because the payload
+ * is same-origin. Neutralizing the response rather than inspecting the body
+ * keeps every valid static SVG (the built-in mark included) byte-identical:
+ *
+ * - `sandbox` (no tokens ⇒ every restriction) drops the document into an opaque
+ *   origin with scripting off, so even a script that ran would have nothing to
+ *   reach.
+ * - `default-src 'none'` denies script, network, and framing outright.
+ * - `style-src 'unsafe-inline'` is the single allowance: the default mark styles
+ *   itself inline to follow the OS colour scheme, and CSS cannot script.
+ * - `nosniff` keeps the declared type authoritative in both directions — an SVG
+ *   can never be re-read as HTML, and `.ico` bytes can never be re-read as SVG.
+ *
+ * `.ico` bodies are deliberately in scope: they are inert bytes rather than
+ * active content, so they are still served verbatim, but they carry the same
+ * headers so the invariant is "every favicon route is neutralized" rather than
+ * "whichever route got attention".
+ */
+const INERT_ICON_HEADERS = {
+    "Content-Security-Policy": "default-src 'none'; style-src 'unsafe-inline'; sandbox",
+    "X-Content-Type-Options": "nosniff",
+};
+/** Per-request base64 nonce for an operator shell's scripts (Node 20+ and Workers). */
+function uiScriptNonce() {
+    const bytes = crypto.getRandomValues(new Uint8Array(16));
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+export async function routeUi(context) {
+    const { request, url, path, baseUrl, opts, defer } = context;
+    if (request.method === "GET" && path === "/favicon.svg") {
+        return new Response(opts.branding?.favicon?.svg ?? CONNECTA_FAVICON_SVG, {
+            headers: {
+                "Content-Type": "image/svg+xml",
+                "Cache-Control": "public, max-age=86400",
+                ...INERT_ICON_HEADERS,
+            },
+        });
+    }
+    if (request.method === "GET" && path === "/favicon.ico") {
+        return new Response(opts.branding?.favicon?.ico ?? CONNECTA_FAVICON_ICO, {
+            headers: {
+                "Content-Type": "image/x-icon",
+                "Cache-Control": "public, max-age=86400",
+                ...INERT_ICON_HEADERS,
+            },
+        });
+    }
+    if (path === "/ui") {
+        if (request.method !== "GET") {
+            return privateJson({ error: "method not allowed" }, { status: 405 });
+        }
+        const target = new URL(`/${url.search}`, baseUrl);
+        return new Response(null, {
+            status: 308,
+            headers: { Location: target.toString() },
+        });
+    }
+    const operatorPage = operatorPageForPath(path);
+    if (operatorPage) {
+        if (request.method !== "GET" && request.method !== "HEAD") {
+            return privateJson({ error: "method not allowed" }, { status: 405 });
+        }
+        // Open shell — carries no operator data; everything comes from the
+        // authenticated /ui/* APIs after the browser establishes a session.
+        const uiAuth = opts.auth.find((provider) => provider.uiAuth)?.uiAuth;
+        const mcpUrl = new URL("/mcp", baseUrl).toString();
+        // Nonce the page's inline script (and the Clerk loader). 'strict-dynamic'
+        // lets scripts the nonced Clerk loader injects at runtime execute; the
+        // https:/'unsafe-inline' fallbacks are ignored by CSP3 browsers that
+        // honour the nonce and only cover legacy ones. No default-src, so Clerk's
+        // style/font/network needs and the page's inline <style> stay unrestricted
+        // — only script execution, the XSS sink, is gated.
+        const nonce = uiScriptNonce();
+        return new Response(request.method === "HEAD"
+            ? null
+            : renderUiHtml(uiAuth, mcpUrl, opts.branding, nonce, operatorPage), {
+            status: 200,
+            headers: {
+                "Content-Type": "text/html; charset=utf-8",
+                "Content-Security-Policy": `script-src 'nonce-${nonce}' 'strict-dynamic' https: 'unsafe-inline'; ` +
+                    "object-src 'none'; base-uri 'none'; frame-ancestors 'none'",
+                "X-Content-Type-Options": "nosniff",
+            },
+        });
+    }
+    if (path !== "/ui/data")
+        return null;
+    const authz = await authorize(request, baseUrl, opts.auth);
+    if (!authz.ok)
+        return authz.response;
+    const eligibleClerkOperator = authz.uiAdminEligible === true;
+    const credentialManagement = credentialManagementCapability({
+        eligibleClerkOperator,
+        hasCredentialSlots: opts.registry
+            .listConnectors()
+            .some((connector) => Boolean(connector.credential)),
+        hasCredentialVault: Boolean(opts.credentialVault),
+    });
+    const data = await buildUiData(opts.registry, baseUrl, opts.serverInfo, 
+    // The static headless bearer may read connector health, but only a
+    // Clerk-authenticated operator receives credential metadata.
+    eligibleClerkOperator ? opts.credentialVault : undefined, Boolean(opts.activity?.list), credentialManagement, defer, eligibleClerkOperator, opts.discoveryConcurrency);
+    return privateJson(data);
+}
+//# sourceMappingURL=ui.js.map

package/dist/routes/ui.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../../src/routes/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACL,WAAW,EACX,oBAAoB,EACpB,8BAA8B,EAC9B,mBAAmB,EACnB,YAAY,GACb,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,SAAS,EACT,WAAW,GAEZ,MAAM,aAAa,CAAC;AAErB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,kBAAkB,GAAG;IACzB,yBAAyB,EACvB,wDAAwD;IAC1D,wBAAwB,EAAE,SAAS;CACpC,CAAC;AAEF,uFAAuF;AACvF,SAAS,aAAa;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAqB;IAErB,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,eAAe;gBAC/B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QACxD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,IAAI,oBAAoB,EAAE;YACvE,OAAO,EAAE;gBACP,cAAc,EAAE,cAAc;gBAC9B,eAAe,EAAE,uBAAuB;gBACxC,GAAG,kBAAkB;aACtB;SACF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1D,OAAO,WAAW,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnD,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;QAC9B,OAAO,IAAI,QAAQ,CACjB,OAAO,CAAC,MAAM,KAAK,MAAM;YACvB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,EACpE;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,yBAAyB,EACvB,qBAAqB,KAAK,6CAA6C;oBACvE,4DAA4D;gBAC9D,wBAAwB,EAAE,SAAS;aACpC;SACF,CACF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC;IAC7D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;QAC1D,qBAAqB;QACrB,kBAAkB,EAAE,IAAI,CAAC,QAAQ;aAC9B,cAAc,EAAE;aAChB,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACrD,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC;KAClD,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,WAAW,CAC5B,IAAI,CAAC,QAAQ,EACb,OAAO,EACP,IAAI,CAAC,UAAU;IACf,mEAAmE;IACnE,6DAA6D;IAC7D,qBAAqB,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,EACxD,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC5B,oBAAoB,EACpB,KAAK,EACL,qBAAqB,EACrB,IAAI,CAAC,oBAAoB,CAC1B,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC"}

package/dist/server.d.ts

@@ -1,42 +1,11 @@
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { ActivityReadGate, ActivityStore } from "./activity.js";
-import type { CredentialVault } from "./credentials.js";
-import { type Registry } from "./registry.js";
-import { type Toolkit } from "./toolkits.js";
-import type { ConnectaBranding, Executor, InboundAuth, Logger } from "./types.js";
-import { type AdmissionController } from "./executor-admission.js";
-export interface ServerOptions {
-    registry: Registry;
-    auth: InboundAuth[];
-    publicUrl?: string;
-    serverInfo: ConstructorParameters<typeof McpServer>[0];
-    logger: Logger;
-    activity?: ActivityStore;
-    activityReadGate?: ActivityReadGate;
-    activityDeploymentId?: string;
-    deploymentInfo?: Record<string, unknown>;
-    /** Deadline for call_tool/batch_call calls that pass no timeoutMs. Off when unset. */
-    defaultToolTimeoutMs?: number;
-    /** Per-connector deadline for the list/search/describe probe fan-out. Default 30_000. */
-    probeTimeoutMs?: number;
-    /** When set, the execute_code meta-tool is registered on top of the nine. */
-    executor?: Executor;
-    /** Global FIFO boundary for all non-preflight `/mcp` requests. */
-    requestAdmission: AdmissionController;
-    /** Encrypted connector-credential storage backing the Credentials page. */
-    credentialVault?: CredentialVault;
-    /** Optional browser UI and OAuth result-page labels. */
-    branding?: ConnectaBranding;
-    /**
-     * Validated named scopes, selected per connection with `?toolkit=<name>` on
-     * `/mcp`. Omit (or leave empty) and every connection sees the full registry.
-     */
-    toolkits?: ReadonlyMap<string, Toolkit>;
-}
-/** Build the Web-standard fetch handler that serves connecta. */
+import { type RuntimeExecutionContext, type ServerOptions } from "./routes/shared.js";
+export type { ServerOptions } from "./routes/shared.js";
+/**
+ * Build the Web-standard fetch handler.
+ *
+ * Route ordering is the contract: private mutation routes precede wildcard
+ * OPTIONS, every built-in precedes connector-owned routes, and the security
+ * wrapper is applied to every response.
+ */
 export declare function createFetchHandler(opts: ServerOptions): (request: Request, runtimeContext?: RuntimeExecutionContext) => Promise<Response>;
-interface RuntimeExecutionContext {
-    waitUntil(promise: Promise<unknown>): void;
-}
-export {};
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAKpE,OAAO,KAAK,EAGV,gBAAgB,EAGhB,aAAa,EACd,MAAM,eAAe,CAAC;AAOvB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAkB,KAAK,QAAQ,EAAqB,MAAM,eAAe,CAAC;AACjF,OAAO,EAGL,KAAK,OAAO,EACb,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAKV,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,MAAM,EAEP,MAAM,YAAY,CAAC;AAEpB,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,yBAAyB,CAAC;AAoDjC,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,QAAQ,CAAC;IACnB,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAGnB,UAAU,EAAE,qBAAqB,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,sFAAsF;IACtF,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,yFAAyF;IACzF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,kEAAkE;IAClE,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,2EAA2E;IAC3E,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,wDAAwD;IACxD,QAAQ,CAAC,EAAE,gBAAgB,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AA2wCD,iEAAiE;AACjE,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,CA+arB;AAED,UAAU,uBAAuB;IAC/B,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;CAC5C"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,aAAa,EACnB,MAAM,oBAAoB,CAAC;AAG5B,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,aAAa,GAClB,CACD,OAAO,EAAE,OAAO,EAChB,cAAc,CAAC,EAAE,uBAAuB,KACrC,OAAO,CAAC,QAAQ,CAAC,CA+JrB"}