@zackbart/connecta 0.8.0 → 0.9.0

package/src/registry.ts

@@ -11,13 +11,6 @@ import {
   type CredentialVault,
 } from "./credentials.js";
 import { ConnectorCallError } from "./errors.js";
-import {
-  CredentialHealthChecker,
-  type CredentialCheckOptions,
-  type CredentialCheckResult,
-  type CredentialHealthConfig,
-  type CredentialHealthRecord,
-} from "./credential-health.js";
 import {
   ConnectorCallAdmissionController,
   type CallAdmissionPermit,
@@ -34,17 +27,31 @@ import {
   MAX_SERIALIZED_CATALOG_BYTES,
 } from "./catalog-limits.js";
 import { mapSettledWithConcurrency } from "./concurrency.js";
-import type { DeferredWork } from "./connector-scope.js";
-import { splitAddress, type Toolkit } from "./toolkits.js";
 
 const ID_RE = /^[a-z0-9_-]+$/;
 const DEFAULT_TTL_SECONDS = 300;
 const DEFAULT_STALE_SECONDS = 3600;
 const CATALOG_CHUNK_TTL_GRACE_SECONDS = 300;
 const DEFAULT_MAX_RESULT_BYTES = 50_000;
+const encoder = new TextEncoder();
 /** Independent final-envelope boundary for `batch_call`. */
 const DEFAULT_MAX_BATCH_RESULT_BYTES = 100_000;
 
+/**
+ * Split `"<connectorId>.<toolName>"` on the first dot. Connector ids contain
+ * no dots, so a downstream tool name may.
+ */
+function splitAddress(
+  address: string,
+): { connectorId: string; toolName: string } | null {
+  const dot = address.indexOf(".");
+  if (dot <= 0 || dot === address.length - 1) return null;
+  return {
+    connectorId: address.slice(0, dot),
+    toolName: address.slice(dot + 1),
+  };
+}
+
 /**
  * Smallest accepted inline-result cap. One byte is pathological but harmless:
  * `alignEndToCharBoundary` widens a window narrower than the codepoint at the
@@ -132,17 +139,9 @@ export interface HealthObservation {
 }
 
 /**
- * Recent real-call outcomes per connector, as observed by ONE view.
- *
- * The deployment keeps one log, and each toolkit keeps its own. That split is a
- * scope boundary, not bookkeeping: `lastError` is a downstream error string
- * that routinely names the tool that failed, and `list_connectors` returns the
- * observation verbatim. Sharing one log would let a toolkit read back the tools
- * and failures of a sibling toolkit through a connector they happen to share —
- * and let a sibling's failures flip this view's reported status. A scoped view
- * reads back only the calls it made itself.
+ * Recent real-call outcomes per connector.
  */
-export class HealthLog {
+class HealthLog {
   private readonly observations = new Map<string, HealthObservation>();
 
   recordSuccess(id: string, latencyMs: number): void {
@@ -192,8 +191,6 @@ export interface RegistryOptions {
    * of bytes >= 1; anything else warns and falls back to 100_000.
    */
   maxBatchResultBytes?: number;
-  /** Tuning for the credential liveness checks (issue #24). */
-  credentialHealth?: CredentialHealthConfig;
 }
 
 function namespaced(storage: KVStorage, prefix: string): KVStorage {
@@ -208,34 +205,6 @@ function msg(err: unknown): string {
   return err instanceof Error ? err.message : String(err);
 }
 
-/** WHATWG TextEncoder byte length without allocating another full buffer. */
-function utf8ByteLength(value: string): number {
-  let bytes = 0;
-  for (let index = 0; index < value.length; index++) {
-    const code = value.charCodeAt(index);
-    if (code <= 0x7f) {
-      bytes++;
-    } else if (code <= 0x7ff) {
-      bytes += 2;
-    } else if (
-      code >= 0xd800 &&
-      code <= 0xdbff &&
-      index + 1 < value.length
-    ) {
-      const next = value.charCodeAt(index + 1);
-      if (next >= 0xdc00 && next <= 0xdfff) {
-        bytes += 4;
-        index++;
-      } else {
-        bytes += 3;
-      }
-    } else {
-      bytes += 3;
-    }
-  }
-  return bytes;
-}
-
 export type ConnectorOperationOptions = Pick<
   ConnectorContext,
   "signal" | "timeoutMs"
@@ -246,12 +215,9 @@ export type ConnectorOperationOptions = Pick<
  * (`src/meta-tools.ts`) and the `execute_code` sandbox bridge (`src/execute.ts`)
  * is typed against THIS, never against the concrete `Registry`.
  *
- * That indirection is the toolkit boundary (issue #22): a scoped connection is
- * handed a `ScopedRegistry` instead of the registry, and every meta-tool
- * inherits the scope from one place. Reaching for a registry method that isn't
- * here is a compile error, and adding one here is a compile error until
- * `ScopedRegistry` filters it — so a new meta-tool cannot quietly step around
- * the boundary.
+ * The read-only seam remains useful even without scoped views: meta-tools can
+ * consume registry behavior without depending on the concrete implementation
+ * or its construction-only methods.
  */
 export interface RegistryView {
   /** Deployment-wide result-size cap threaded to the meta-tools. */
@@ -282,10 +248,7 @@ export interface RegistryView {
     requestScope?: object,
     callOptions?: ConnectorOperationOptions,
   ): ConnectorContext;
-  /**
-   * Acquire the connector's shared downstream-call permit. Scoped views
-   * delegate to the base registry so every toolkit contends on the same pool.
-   */
+  /** Acquire the connector's shared downstream-call permit. */
   admitCall(
     id: string,
     input: { toolName: string; args: unknown; signal?: AbortSignal },
@@ -295,15 +258,9 @@ export interface RegistryView {
   recordFailure(id: string, latencyMs: number, error: unknown): void;
   healthFor(id: string): HealthObservation | undefined;
   hasObservedSuccess(id: string): boolean;
-  /** When ANY view last saw a successful call to `id`, deployment-wide. */
   observedSuccessAt(id: string): string | undefined;
-  /** Last credential-liveness verdict for `id`. Cached; no downstream I/O. */
-  credentialHealthFor(id: string): Promise<CredentialHealthRecord | undefined>;
-  /** Store a liveness verdict a live status check just produced. */
-  recordCredentialHealth(
-    id: string,
-    record: CredentialHealthRecord,
-  ): Promise<void>;
+  /** Local declared-vs-stored credential mismatch, with no downstream I/O. */
+  credentialDriftFor(id: string): Promise<string | undefined>;
   statusFor(
     id: string,
     baseUrl: string,
@@ -344,8 +301,6 @@ export class Registry implements RegistryView {
   readonly maxResultBytes: number;
   /** Final batch envelope cap threaded to the meta-tools. */
   readonly maxBatchResultBytes: number;
-  /** Proactive liveness checks over stored downstream credentials (issue #24). */
-  private readonly credentialHealth: CredentialHealthChecker;
 
   constructor(
     connectors: Connector[],
@@ -387,20 +342,6 @@ export class Registry implements RegistryView {
       opts.maxResultBytes,
       opts.maxBatchResultBytes,
     );
-    this.credentialHealth = new CredentialHealthChecker(
-      {
-        listConnectors: () => this.listConnectors(),
-        getConnector: (id) => this.getConnector(id),
-        contextFor: (id, baseUrl, requestScope) =>
-          this.contextFor(id, baseUrl, requestScope),
-        storage: opts.storage,
-        logger: opts.logger,
-        ...(opts.credentialVault !== undefined
-          ? { credentialVault: opts.credentialVault }
-          : {}),
-      },
-      opts.credentialHealth,
-    );
   }
 
   /**
@@ -740,7 +681,7 @@ export class Registry implements RegistryView {
         );
         return null;
       }
-      const byteLength = utf8ByteLength(chunk);
+      const byteLength = encoder.encode(chunk).byteLength;
       chunkBytes += byteLength;
       if (
         byteLength > MAX_CATALOG_CHUNK_BYTES ||
@@ -1089,83 +1030,30 @@ export class Registry implements RegistryView {
     return this.health.get(id);
   }
 
-  /**
-   * Whether ANY view of this deployment has seen a successful call to `id` —
-   * a bare boolean, never the observation. Connector liveness (reachable,
-   * credentials still valid) is a deployment-level fact, not a per-view one, so
-   * `list_connectors` may classify a connector as ok/unknown from it. The
-   * observation itself — `lastError` above all, which names the tool that
-   * failed — stays strictly per view.
-   */
+  /** Whether this deployment has seen a successful call to `id`. */
   hasObservedSuccess(id: string): boolean {
     return this.observedSuccessAt(id) !== undefined;
   }
 
-  /**
-   * The timestamp behind `hasObservedSuccess`, on the same deployment-wide
-   * terms and for the same reason: it says only *when* the connector last
-   * answered, never what was called or what failed. Credential health reads it
-   * to decide whether a failed verdict has been overtaken by real traffic.
-   */
+  /** The timestamp behind `hasObservedSuccess`. */
   observedSuccessAt(id: string): string | undefined {
     return this.health.get(id)?.lastSuccessAt;
   }
 
-  /**
-   * The last credential-liveness verdict for `id` — the layer that lets a cached
-   * status read report `auth_required` before a real call discovers it. Read
-   * from storage (mirrored in memory for a few seconds) rather than held in
-   * memory alone, because on Workers the isolate that ran the check is usually
-   * not the isolate answering this read.
-   */
-  credentialHealthFor(id: string): Promise<CredentialHealthRecord | undefined> {
-    return this.credentialHealth.healthFor(id);
-  }
-
-  recordCredentialHealth(
-    id: string,
-    record: CredentialHealthRecord,
-  ): Promise<void> {
-    return this.credentialHealth.record(id, record);
-  }
-
-  /**
-   * Check stored downstream credentials now and return one outcome per
-   * connector considered. THE operator-facing entry point behind
-   * `Connecta.checkCredentials()`: wire it to a Worker cron trigger or a Node
-   * interval. Never rejects; connectors checked recently are reported as
-   * `fresh` unless `force` is set.
-   */
-  checkCredentialHealth(
-    baseUrl: string,
-    opts?: CredentialCheckOptions,
-    defer?: DeferredWork,
-  ): Promise<CredentialCheckResult[]> {
-    return this.credentialHealth.check(baseUrl, opts, defer);
-  }
-
-  /**
-   * The traffic-triggered sweep: a promise for the caller to defer (Workers:
-   * `ctx.waitUntil`), or `undefined` when nothing is due — which is the common
-   * case and costs no I/O. Called by the server after an authenticated request;
-   * the checker owns the rate limiting.
-   */
-  sweepCredentialHealthIfDue(
-    baseUrl: string,
-    defer?: DeferredWork,
-  ): Promise<CredentialCheckResult[]> | undefined {
-    return this.credentialHealth.sweepIfDue(baseUrl, defer);
-  }
-
-  /**
-   * Drop a connector's liveness verdict, because its credential just changed
-   * under us (OAuth callback completed, credential stored or removed on
-   * /credentials). A
-   * stale `auth_required` must not outlive the re-authorization that fixed it —
-   * that is the difference between recovery working and needing a restart.
-   */
-  clearCredentialHealth(id: string): Promise<void> {
-    return this.credentialHealth.clear(id);
+  async credentialDriftFor(id: string): Promise<string | undefined> {
+    const credential = this.connectors.get(id)?.credential;
+    const vault = this.opts.credentialVault;
+    if (!credential || !vault) return undefined;
+    try {
+      const values = await vault.getAll(id);
+      const shape = storedCredentialShape(credential, values);
+      return shape.state === "mismatch" ? shape.message : undefined;
+    } catch (error) {
+      this.opts.logger.warn(
+        `[connecta] connector "${id}" credential shape read failed: ${msg(error)}`,
+      );
+      return undefined;
+    }
   }
 
   /** Best-effort connector status for list_connectors. */
@@ -1193,291 +1081,33 @@ export class Registry implements RegistryView {
     }
   }
 
-  /** Drop a connector's cached tool list (e.g. after auth completes). */
-  invalidate(id: string): void {
-    this.advanceCatalogGeneration(id);
-    this.cache.delete(id);
-    this.invalidated.add(id);
-    if (this.persistToolCatalog) {
-      void this.enqueueCatalogMutation(id, async () => {
-        try {
-          await this.deleteCatalog(id);
-        } catch (err) {
-          this.opts.logger.warn(
-            `[connecta] connector "${id}" catalog invalidation failed: ${msg(err)}`,
-          );
-        }
-      });
-    }
-  }
-
-  /** Drop both in-memory and persisted tool catalogs. */
-  async invalidateStored(id: string): Promise<void> {
+  private markCatalogInvalid(id: string): void {
     this.advanceCatalogGeneration(id);
     this.cache.delete(id);
     this.invalidated.add(id);
-    if (this.persistToolCatalog) {
-      await this.enqueueCatalogMutation(id, async () => {
-        try {
-          await this.deleteCatalog(id);
-        } catch (err) {
-          this.opts.logger.warn(
-            `[connecta] connector "${id}" catalog invalidation failed: ${msg(err)}`,
-          );
-        }
-      });
-    }
-  }
-}
-
-/**
- * Per-toolkit HealthLogs, keyed by registry and then by toolkit name.
- *
- * Module-scoped rather than a `Registry` member on purpose: `Registry`'s type
- * is part of the public API surface (`Connecta.registry`), and this is internal
- * factoring only `ScopedRegistry` may touch. The WeakMap keeps the logs alive
- * exactly as long as their registry, and the inner map is bounded by the
- * number of configured toolkits.
- */
-const toolkitHealthLogs = new WeakMap<Registry, Map<string, HealthLog>>();
-
-/** The long-lived log one toolkit records into; created on first use. */
-function toolkitHealthLog(base: Registry, toolkitName: string): HealthLog {
-  let logs = toolkitHealthLogs.get(base);
-  if (!logs) {
-    logs = new Map<string, HealthLog>();
-    toolkitHealthLogs.set(base, logs);
-  }
-  let log = logs.get(toolkitName);
-  if (!log) {
-    log = new HealthLog();
-    logs.set(toolkitName, log);
-  }
-  return log;
-}
-
-/**
- * THE toolkit enforcement point (issue #22).
- *
- * A filtered VIEW of one long-lived `Registry`: same connectors, same tool
- * caches, same health — narrowed to the connectors and tool addresses one
- * toolkit selects. `serveMcp` builds it once per scoped connection and hands it
- * to `registerMetaTools`/`registerExecuteTool`, so `list_connectors`,
- * `search_tools`, `describe_tools`, `call_tool`, `call_destructive_tool`,
- * `batch_call`, `authorize_connector`, `get_result`, `skills`, and the
- * `execute_code` host bridge all inherit the boundary from here instead of
- * re-implementing nine checks.
- *
- * Two invariants make it reviewable:
- *
- * 1. **Indistinguishability.** Out-of-scope input fails through the SAME code
- *    path, with the same error class and message, as input naming something
- *    that does not exist at all. An out-of-scope CONNECTOR disappears from
- *    `resolveAddress`/`getConnector` (→ `Unknown address` / `Unknown
- *    connector`); an out-of-scope TOOL disappears from the catalog this view
- *    returns (→ `Unknown tool "<t>" on connector "<c>"`), which is exactly the
- *    error a misspelled tool name already produced. Scoping deliberately does
- *    NOT reject at `resolveAddress` for tools: that would answer with the
- *    connector-level message and make "hidden here" distinguishable from
- *    "never existed".
- * 2. **It filters views, never state.** Every read delegates to the shared
- *    registry and filters the returned array, so the tool cache, the persisted
- *    catalog, and the health map stay whole and shared across scopes.
- */
-export class ScopedRegistry implements RegistryView {
-  /** This toolkit's own health observations — see HealthLog. */
-  private readonly health: HealthLog;
-
-  constructor(
-    private readonly base: Registry,
-    private readonly toolkit: Toolkit,
-  ) {
-    this.health = toolkitHealthLog(base, toolkit.name);
-  }
-
-  get maxResultBytes(): number {
-    return this.base.maxResultBytes;
   }
 
-  get maxBatchResultBytes(): number {
-    return this.base.maxBatchResultBytes;
-  }
-
-  /** In scope AND actually registered. */
-  private visible(id: string): boolean {
-    return (
-      this.toolkit.hasConnector(id) && this.base.getConnector(id) !== undefined
-    );
-  }
-
-  /** Byte-identical to what the unscoped registry throws for an unknown id. */
-  private unknownConnector(id: string): Error {
-    return new Error(`Unknown connector "${id}"`);
-  }
-
-  private inScopeTools(id: string, tools: ToolDef[]): ToolDef[] {
-    return tools.filter((tool) => this.toolkit.hasTool(id, tool.name));
-  }
-
-  listConnectors(): Connector[] {
-    return this.base
-      .listConnectors()
-      .filter((connector) => this.toolkit.hasConnector(connector.id));
-  }
-
-  getConnector(id: string): Connector | undefined {
-    return this.visible(id) ? this.base.getConnector(id) : undefined;
-  }
-
-  resolveAddress(
-    address: string,
-  ): { connector: Connector; toolName: string } | null {
-    const resolved = this.base.resolveAddress(address);
-    if (!resolved) return null;
-    // Connector-level only — see invariant 1 above.
-    return this.toolkit.hasConnector(resolved.connector.id) ? resolved : null;
-  }
-
-  async getTools(
-    id: string,
-    baseUrl: string,
-    requestScope?: object,
-    callOptions: ConnectorOperationOptions = {},
-  ): Promise<ToolDef[]> {
-    if (!this.visible(id)) throw this.unknownConnector(id);
-    return this.inScopeTools(
-      id,
-      await this.base.getTools(id, baseUrl, requestScope, callOptions),
-    );
-  }
-
-  async refreshTools(
-    id: string,
-    baseUrl: string,
-    requestScope?: object,
-    callOptions: ConnectorOperationOptions = {},
-  ): Promise<ToolDef[]> {
-    if (!this.visible(id)) throw this.unknownConnector(id);
-    return this.inScopeTools(
-      id,
-      await this.base.refreshTools(id, baseUrl, requestScope, callOptions),
-    );
-  }
-
-  peekTools(id: string): ToolDef[] | undefined {
-    if (!this.visible(id)) return undefined;
-    const tools = this.base.peekTools(id);
-    return tools ? this.inScopeTools(id, tools) : undefined;
-  }
-
-  contextFor(
-    id: string,
-    baseUrl: string,
-    requestScope: object = {},
-    callOptions: ConnectorOperationOptions = {},
-  ): ConnectorContext {
-    // Unreachable through the meta-tools (they resolve first), so a throw here
-    // is a loud backstop rather than a silent grant of connector storage and
-    // credentials to a scope that may not see the connector.
-    if (!this.visible(id)) throw this.unknownConnector(id);
-    return this.base.contextFor(id, baseUrl, requestScope, callOptions);
-  }
-
-  admitCall(
-    id: string,
-    input: { toolName: string; args: unknown; signal?: AbortSignal },
-  ): Promise<CallAdmissionPermit> {
-    if (!this.visible(id)) return Promise.reject(this.unknownConnector(id));
-    return this.base.admitCall(id, input);
-  }
-
-  /**
-   * Stashed oversized results are bound to the scope that produced them: a
-   * scoped session cannot page a result it could not have produced, and an id
-   * from another scope reads back as the ordinary "Unknown or expired result
-   * id". Unscoped sessions keep the historical `results:` prefix untouched.
-   */
-  resultsStorage(): KVStorage {
-    return namespaced(
-      this.base.resultsStorage(),
-      `toolkit:${this.toolkit.name}:`,
-    );
-  }
-
-  // Outcomes are recorded twice on purpose: the deployment-wide log keeps the
-  // operator surfaces complete, while the toolkit's own log is the ONLY one
-  // this view reads back — so `list_connectors` here never reports a sibling
-  // toolkit's failures, or the tool names their error strings carry.
-  recordSuccess(id: string, latencyMs: number): void {
-    if (!this.visible(id)) return;
-    this.base.recordSuccess(id, latencyMs);
-    this.health.recordSuccess(id, latencyMs);
-  }
-
-  recordFailure(id: string, latencyMs: number, error: unknown): void {
-    if (!this.visible(id)) return;
-    this.base.recordFailure(id, latencyMs, error);
-    this.health.recordFailure(id, latencyMs, error);
-  }
-
-  healthFor(id: string): HealthObservation | undefined {
-    return this.visible(id) ? this.health.get(id) : undefined;
-  }
-
-  /**
-   * Deliberately NOT per view: whether the connector has ever answered is a
-   * fact about the connector, not about a team's traffic, and withholding it
-   * would report every remote connector as "unknown" to a scoped session that
-   * has not called it yet. It carries no tool name, error text, or count — the
-   * per-view isolation of those, above, is unchanged.
-   */
-  hasObservedSuccess(id: string): boolean {
-    return this.visible(id) ? this.base.hasObservedSuccess(id) : false;
-  }
-
-  /** Deployment-wide for the same reason as `hasObservedSuccess` above. */
-  observedSuccessAt(id: string): string | undefined {
-    return this.visible(id) ? this.base.observedSuccessAt(id) : undefined;
-  }
-
-  /**
-   * Also deliberately NOT per view, for the same reason as
-   * `hasObservedSuccess`: whether the credential connecta stores for a connector
-   * still works is a fact about the deployment's credential, not about a team's
-   * traffic. Withholding it would leave a scoped session unable to see that the
-   * connector it shares needs re-authorization. The verdict carries the
-   * connector's own connector-level reason — never a tool name — so the per-view
-   * isolation of `lastError` above is unchanged.
-   */
-  credentialHealthFor(id: string): Promise<CredentialHealthRecord | undefined> {
-    return this.visible(id)
-      ? this.base.credentialHealthFor(id)
-      : Promise.resolve(undefined);
-  }
-
-  async recordCredentialHealth(
-    id: string,
-    record: CredentialHealthRecord,
-  ): Promise<void> {
-    if (!this.visible(id)) return;
-    await this.base.recordCredentialHealth(id, record);
+  private deleteStoredCatalog(id: string): Promise<void> {
+    return this.enqueueCatalogMutation(id, async () => {
+      try {
+        await this.deleteCatalog(id);
+      } catch (err) {
+        this.opts.logger.warn(
+          `[connecta] connector "${id}" catalog invalidation failed: ${msg(err)}`,
+        );
+      }
+    });
   }
 
-  async statusFor(
-    id: string,
-    baseUrl: string,
-    requestScope: object = {},
-    callOptions: { signal?: AbortSignal; timeoutMs?: number } = {},
-  ): Promise<ConnectorStatus> {
-    // Same shape the unscoped registry returns for an unregistered id.
-    if (!this.visible(id)) {
-      return { state: "error", message: "Unknown connector" };
-    }
-    return this.base.statusFor(id, baseUrl, requestScope, callOptions);
+  /** Drop a connector's cached tool list (e.g. after auth completes). */
+  invalidate(id: string): void {
+    this.markCatalogInvalid(id);
+    if (this.persistToolCatalog) void this.deleteStoredCatalog(id);
   }
 
+  /** Drop both in-memory and persisted tool catalogs. */
   async invalidateStored(id: string): Promise<void> {
-    if (!this.visible(id)) return;
-    await this.base.invalidateStored(id);
+    this.markCatalogInvalid(id);
+    if (this.persistToolCatalog) await this.deleteStoredCatalog(id);
   }
 }

package/src/retired-toolkits.ts

@@ -0,0 +1,14 @@
+const hasOwn = (value: object, key: PropertyKey): boolean =>
+  Object.prototype.hasOwnProperty.call(value, key);
+
+/** Fail loudly when JavaScript callers pass the retired audience-scoping keys. */
+export function assertNoRetiredToolkitOptions(
+  source: string,
+  options: object,
+): void {
+  if (!hasOwn(options, "toolkits") && !hasOwn(options, "unscoped")) return;
+  throw new Error(
+    `${source} options \`toolkits\` and \`unscoped\` were removed in issue ` +
+      "#178. Deploy one connecta instance per audience instead; see ethos.md.",
+  );
+}

package/src/routes/activity.ts

@@ -8,9 +8,7 @@ import type { InboundAuth } from "../types.js";
 import {
   activityActorNamespace,
   authorize,
-  isToolkitRestricted,
   privateJson,
-  restrictedOperatorSurface,
   type RouteContext,
 } from "./shared.js";
 
@@ -176,11 +174,8 @@ export async function routeActivity(
   if (request.method !== "GET") {
     return privateJson({ error: "method not allowed" }, { status: 405 });
   }
-  const authz = await authorize(request, baseUrl, opts.auth, opts.logger);
+  const authz = await authorize(request, baseUrl, opts.auth);
   if (!authz.ok) return authz.response;
-  if (isToolkitRestricted(authz.toolkitBinding)) {
-    return restrictedOperatorSurface();
-  }
   if (
     opts.activityReadGate &&
     !(await opts.activityReadGate(authz.actor))

package/src/routes/credentials.ts

@@ -138,7 +138,6 @@ async function handleCredentialRequest(
     request,
     baseUrl,
     opts.auth,
-    opts.logger,
   );
   if (!admin.ok) return admin.response;
 
@@ -193,13 +192,6 @@ async function handleCredentialRequest(
               storedValues.value!,
               ctx,
             );
-      // The operator just ran the very check the liveness sweep runs; record it
-      // so cached status surfaces agree with what the operator page showed.
-      await opts.registry.recordCredentialHealth(connectorId, {
-        state: result.ok ? "ok" : "auth_required",
-        checkedAt: new Date().toISOString(),
-        ...(result.message ? { message: result.message } : {}),
-      });
       return privateJson(result);
     } catch (err) {
       return privateJson({ ok: false, message: msg(err) });
@@ -226,9 +218,6 @@ async function handleCredentialRequest(
               admin.userId,
             );
       await opts.registry.invalidateStored(connectorId);
-      // The credential the last verdict judged is gone; judging its replacement
-      // is the next check's job, not this one's.
-      await opts.registry.clearCredentialHealth(connectorId);
       return privateJson({ credential: metadata });
     } catch (err) {
       return privateJson({ error: msg(err) }, { status: 400 });
@@ -237,7 +226,6 @@ async function handleCredentialRequest(
   if (request.method === "DELETE") {
     await opts.credentialVault.delete(connectorId);
     await opts.registry.invalidateStored(connectorId);
-    await opts.registry.clearCredentialHealth(connectorId);
     return new Response(null, {
       status: 204,
       headers: {