[connectors] Connector framework — registry, auth, grants, scopes, tool bridge
A typed connector abstraction so a new integration is declared once, not built as bespoke routes.
Do
Connector { id, label, auth: 'oauth'|'token'|'app', scopes: {read, write}, grantModel: 'user'|'instance-resource', tools: ToolDef[] } in a registry.- Auth adapter reuses
lib/connector-oauth.ts + user_api_keys (refresh tokens, envelope-encrypted) + github-app.ts for the App model. A connectorClient(env, provider, {userId, instanceId}) mints the access token and enforces scope.
- Grants reuse
instance_connector_grants (0044) generalized beyond folders (resource_type: folder|repo|spreadsheet|…). requireConnectorGrant gates every tool call to granted resources.
- Connector → tools bridge: a connector's tools auto-register in the tool registry; they're offered to an agent only when (a) declared in
capabilities.tools, (b) the subscriber has connected the provider, and (c) a grant exists (for instance-resource connectors).
- Per-instance enablement UI (console): connect provider → grant resource(s) → the connector's tools light up for that instance.
Acceptance
Depends on the tool-registry issue. Part of the connector/tool framework epic.
[connectors] Connector framework — registry, auth, grants, scopes, tool bridge
A typed connector abstraction so a new integration is declared once, not built as bespoke routes.
Do
Connector { id, label, auth: 'oauth'|'token'|'app', scopes: {read, write}, grantModel: 'user'|'instance-resource', tools: ToolDef[] }in a registry.lib/connector-oauth.ts+user_api_keys(refresh tokens, envelope-encrypted) +github-app.tsfor the App model. AconnectorClient(env, provider, {userId, instanceId})mints the access token and enforces scope.instance_connector_grants(0044) generalized beyond folders (resource_type: folder|repo|spreadsheet|…).requireConnectorGrantgates every tool call to granted resources.capabilities.tools, (b) the subscriber has connected the provider, and (c) a grant exists (for instance-resource connectors).Acceptance
{auth, scopes, grantModel, tools}— no bespoke routes.connectorClient; scope + grant enforced centrally; parameterized + audited.Depends on the tool-registry issue. Part of the connector/tool framework epic.