@zackbart/connecta 0.1.0

package/dist/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,WAAW;KACrB;CACO,CAAC"}

package/dist/storage/file.d.ts

@@ -0,0 +1,8 @@
+import type { KVStorage } from "../types.js";
+/**
+ * JSON-file-backed KVStorage for Node. Loads once, persists on every write via
+ * a temp-file + rename (atomic-ish). Only reachable via the "@zackbart/connecta/node"
+ * subpath so the main entry stays Workers-clean.
+ */
+export declare function fileStorage(path: string): KVStorage;
+//# sourceMappingURL=file.d.ts.map

package/dist/storage/file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.d.ts","sourceRoot":"","sources":["../../src/storage/file.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAyCnD"}

package/dist/storage/file.js

@@ -0,0 +1,53 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, } from "node:fs";
+import { dirname } from "node:path";
+/**
+ * JSON-file-backed KVStorage for Node. Loads once, persists on every write via
+ * a temp-file + rename (atomic-ish). Only reachable via the "@zackbart/connecta/node"
+ * subpath so the main entry stays Workers-clean.
+ */
+export function fileStorage(path) {
+    let data = {};
+    if (existsSync(path)) {
+        try {
+            data = JSON.parse(readFileSync(path, "utf8"));
+        }
+        catch {
+            data = {};
+        }
+    }
+    const persist = () => {
+        const dir = dirname(path);
+        if (dir)
+            mkdirSync(dir, { recursive: true });
+        const tmp = `${path}.tmp`;
+        writeFileSync(tmp, JSON.stringify(data));
+        renameSync(tmp, path);
+    };
+    const fresh = (key) => {
+        const e = data[key];
+        if (!e)
+            return null;
+        if (e.exp && Date.now() > e.exp) {
+            delete data[key];
+            return null;
+        }
+        return e;
+    };
+    return {
+        async get(key) {
+            return fresh(key)?.value ?? null;
+        },
+        async set(key, value, opts) {
+            data[key] = {
+                value,
+                exp: opts?.ttlSeconds ? Date.now() + opts.ttlSeconds * 1000 : undefined,
+            };
+            persist();
+        },
+        async delete(key) {
+            delete data[key];
+            persist();
+        },
+    };
+}
+//# sourceMappingURL=file.js.map

package/dist/storage/file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/storage/file.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQpC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,GAA0B,EAAE,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0B,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;QAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,GAAW,EAAgB,EAAE;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI;YACxB,IAAI,CAAC,GAAG,CAAC,GAAG;gBACV,KAAK;gBACL,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;aACxE,CAAC;YACF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/storage/memory.d.ts

@@ -0,0 +1,4 @@
+import type { KVStorage } from "../types.js";
+/** In-memory KV store with expiry. The default for dev and Node. */
+export declare function memoryStorage(): KVStorage;
+//# sourceMappingURL=memory.d.ts.map

package/dist/storage/memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.d.ts","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAO7C,oEAAoE;AACpE,wBAAgB,aAAa,IAAI,SAAS,CAyBzC"}

package/dist/storage/memory.js

@@ -0,0 +1,29 @@
+/** In-memory KV store with expiry. The default for dev and Node. */
+export function memoryStorage() {
+    const map = new Map();
+    const fresh = (key) => {
+        const e = map.get(key);
+        if (!e)
+            return null;
+        if (e.exp && Date.now() > e.exp) {
+            map.delete(key);
+            return null;
+        }
+        return e;
+    };
+    return {
+        async get(key) {
+            return fresh(key)?.value ?? null;
+        },
+        async set(key, value, opts) {
+            map.set(key, {
+                value,
+                exp: opts?.ttlSeconds ? Date.now() + opts.ttlSeconds * 1000 : undefined,
+            });
+        },
+        async delete(key) {
+            map.delete(key);
+        },
+    };
+}
+//# sourceMappingURL=memory.js.map

package/dist/storage/memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory.js","sourceRoot":"","sources":["../../src/storage/memory.ts"],"names":[],"mappings":"AAOA,oEAAoE;AACpE,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAiB,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,GAAW,EAAgB,EAAE;QAC1C,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,OAAO,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;gBACX,KAAK;gBACL,GAAG,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;aACxE,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,219 @@
+/** A JSON Schema object describing a tool's input. */
+export type JsonSchema = Record<string, unknown>;
+/** Minimal key/value store — the only state connecta needs. */
+export interface KVStorage {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, opts?: {
+        ttlSeconds?: number;
+    }): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+export interface Logger {
+    debug(...args: unknown[]): void;
+    info(...args: unknown[]): void;
+    warn(...args: unknown[]): void;
+    error(...args: unknown[]): void;
+}
+export interface ToolDef {
+    name: string;
+    description?: string;
+    inputSchema?: JsonSchema;
+    /** Optional JSON Schema describing the tool's structured result. */
+    outputSchema?: JsonSchema;
+    /**
+     * Standard MCP tool behavior hints plus provider-specific extensions.
+     * Connecta fails closed: only readOnlyHint === true (without a contradictory
+     * destructiveHint) may use call_tool, batch_call, or execute_code. Every
+     * other tool must cross the call_destructive_tool approval boundary.
+     */
+    annotations?: ToolAnnotations;
+}
+export interface ToolAnnotations extends Record<string, unknown> {
+    title?: string;
+    readOnlyHint?: boolean;
+    destructiveHint?: boolean;
+    idempotentHint?: boolean;
+    openWorldHint?: boolean;
+}
+export type ConnectorCredentialValues = Record<string, string>;
+/** Read-only access to the credentials assigned to one connector. */
+export interface ConnectorCredentialAccess {
+    /**
+     * Returns one decrypted field. Omitting `field` preserves the original
+     * single-credential behavior and reads the reserved `value` field.
+     */
+    get(field?: string): Promise<string | null>;
+    /** Returns every decrypted field, or null when nothing is configured. */
+    getAll(): Promise<ConnectorCredentialValues | null>;
+}
+/** Operator-facing description of one named credential field. */
+export interface ConnectorCredentialFieldConfig {
+    /** Stable field name used by connector code and the credential API. */
+    name: string;
+    /** Short field label, e.g. "Account email". */
+    label: string;
+    /** Plain-language guidance shown in /ui. Never include the credential itself. */
+    description?: string;
+    /** Input placeholder, e.g. "you@example.com". */
+    placeholder?: string;
+    /** Browser input type. Defaults to password. */
+    inputType?: "email" | "password" | "text";
+}
+/** Operator-facing description of the credential set a connector needs. */
+export interface ConnectorCredentialConfig {
+    /** Short group or field label, e.g. "API token" or "Service credentials". */
+    label: string;
+    /** Plain-language guidance shown in /ui. Never include the credential itself. */
+    description?: string;
+    /** Password-field placeholder, e.g. "Paste API token". */
+    placeholder?: string;
+    /**
+     * Named fields for multi-value authentication. Omit to retain the original
+     * one-secret credential behavior.
+     */
+    fields?: ConnectorCredentialFieldConfig[];
+}
+export interface CredentialTestResult {
+    ok: boolean;
+    message?: string;
+}
+export interface ConnectorContext {
+    /** Storage namespaced to this connector. */
+    storage: KVStorage;
+    logger: Logger;
+    /** Public base URL of this deployment (origin), used for OAuth callbacks. */
+    baseUrl: string;
+    /**
+     * Read-only access to this connector's operator-managed credential. Present
+     * only when the connector declares `credential` and the deployment configures
+     * `credentialEncryptionKey`.
+     */
+    credential?: ConnectorCredentialAccess;
+    /**
+     * Identity shared by connector calls that belong to one inbound request.
+     * Connectors may use it to reuse request-safe resources within that request,
+     * but must never retain I/O resources beyond the scope's lifetime.
+     *
+     * Optional for custom/test contexts; the context object itself is the scope
+     * when omitted.
+     */
+    requestScope?: object;
+    /** Best-effort cancellation signal for this individual tool call. */
+    signal?: AbortSignal;
+    /** Requested tool-call deadline in milliseconds. */
+    timeoutMs?: number;
+}
+export type ConnectorStatusState = "ok" | "auth_required" | "error";
+export interface ConnectorStatus {
+    state: ConnectorStatusState;
+    /** When state === "auth_required", the URL the operator should open. */
+    authorizationUrl?: string;
+    message?: string;
+}
+/** The whole plugin contract — the one open seam. */
+export interface Connector {
+    id: string;
+    /** Human-readable display name; the stable `id` remains the tool-address prefix. */
+    title?: string;
+    /** How call_tool wraps results. "mcp" passes the content array through; anything else is JSON-wrapped. */
+    kind?: "mcp" | "api";
+    description?: string;
+    /** Optional operator-managed credential slot rendered inside this connector's /ui card. */
+    credential?: ConnectorCredentialConfig;
+    /** Optional server-side check used by /ui's Test action. */
+    testCredential?(value: string, ctx: ConnectorContext): Promise<CredentialTestResult>;
+    /** Optional multi-field credential check used by /ui's Test action. */
+    testCredentials?(values: ConnectorCredentialValues, ctx: ConnectorContext): Promise<CredentialTestResult>;
+    /**
+     * Statically-known tool defs, exposed by in-code connectors (`api()`) for
+     * startup convention checks. Remote connectors omit this — their tools are
+     * fetched lazily over the network and are not known at construction time.
+     */
+    staticTools?: ToolDef[];
+    listTools(ctx: ConnectorContext): Promise<ToolDef[]>;
+    callTool(name: string, args: unknown, ctx: ConnectorContext): Promise<unknown>;
+    /** Optional connector-level health/auth status for list_connectors. */
+    status?(ctx: ConnectorContext): Promise<ConnectorStatus>;
+    /**
+     * Optional: start (or with force, restart from scratch) a downstream OAuth
+     * flow (called by authorize_connector). Present only on connectors that use
+     * downstream OAuth. Returns the resulting status — "auth_required" with an
+     * authorizationUrl when there is a URL to open, "ok" when already authorized.
+     */
+    startAuth?(ctx: ConnectorContext, opts?: {
+        force?: boolean;
+    }): Promise<ConnectorStatus>;
+    /**
+     * Optional: verify the OAuth `state` returned to /oauth/callback/<id> against
+     * the value this connector generated when it started the flow. Present only
+     * on downstream-OAuth connectors. The callback MUST reject before finishAuth
+     * when this returns false — otherwise anyone holding the pending URL could
+     * complete consent with their own account.
+     */
+    verifyState?(state: string | null, ctx: ConnectorContext): Promise<boolean>;
+    /** Optional: complete a downstream OAuth flow (called by /oauth/callback/<id>). */
+    finishAuth?(code: string, ctx: ConnectorContext): Promise<void>;
+}
+/** Result of one sandboxed code execution. */
+export interface ExecuteResult {
+    result: unknown;
+    error?: string;
+    logs?: string[];
+}
+/** A named group of host functions exposed to sandboxed code as a global. */
+export interface ExecutorProvider {
+    name: string;
+    fns: Record<string, (...args: unknown[]) => Promise<unknown>>;
+}
+/**
+ * Runs model-written JavaScript in a sandbox where the ONLY capabilities are
+ * the provider functions — no network, filesystem, env, or timers. Structurally
+ * compatible with `DynamicWorkerExecutor` from `@cloudflare/codemode` (Workers);
+ * `quickJsExecutor()` from "@zackbart/connecta/quickjs" is the Node implementation.
+ * NEVER back this with an unsandboxed eval — the code is untrusted.
+ */
+export interface Executor {
+    execute(code: string, providers: ExecutorProvider[]): Promise<ExecuteResult>;
+}
+/** Result of an inbound-auth check. */
+export type AuthResult = {
+    ok: true;
+    userId?: string;
+    subjectId?: string;
+} | {
+    ok: false;
+    response: Response;
+};
+/** Public browser-auth configuration exposed to connecta's status UI. */
+export type UiAuthConfig = {
+    kind: "clerk";
+    publishableKey: string;
+    frontendApiUrl: string;
+    signInUrl?: string;
+    signUpUrl?: string;
+};
+/** Optional labels used by Connecta's browser UI and OAuth result pages. */
+export interface ConnectaBranding {
+    /** Product label. Defaults to "Connecta". */
+    productName?: string;
+    /** Organization or owner shown beside the product label. */
+    ownerName?: string;
+    /** Optional link for the organization or owner label. */
+    ownerUrl?: string;
+    /** Status-dashboard introduction. */
+    description?: string;
+}
+/** An inbound authentication provider (bearer token, Clerk, ...). */
+export interface InboundAuth {
+    kind: string;
+    /**
+     * Optional browser sign-in configuration. When present, `/ui` uses this
+     * provider instead of asking the operator to paste a static bearer secret.
+     */
+    uiAuth?: UiAuthConfig;
+    /** Serve/short-circuit .well-known + OPTIONS. Return null when not handled. */
+    handleMetadata?(request: Request, baseUrl: string): Response | null | Promise<Response | null>;
+    /** Attempt to authorize a request. */
+    authorize(request: Request, baseUrl: string): AuthResult | Promise<AuthResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,sDAAsD;AACtD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEjD,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,UAAU,CAAC;IACzB,oEAAoE;IACpE,YAAY,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,eAAe,CAAC;CAC/B;AAED,MAAM,WAAW,eAAgB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE/D,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5C,yEAAyE;IACzE,MAAM,IAAI,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAAC;CACrD;AAED,iEAAiE;AACjE,MAAM,WAAW,8BAA8B;IAC7C,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gDAAgD;IAChD,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;CAC3C;AAED,2EAA2E;AAC3E,MAAM,WAAW,yBAAyB;IACxC,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,MAAM,CAAC,EAAE,8BAA8B,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4CAA4C;IAC5C,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,oDAAoD;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,oBAAoB,GAAG,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;AAEpE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,wEAAwE;IACxE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qDAAqD;AACrD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0GAA0G;IAC1G,IAAI,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,yBAAyB,CAAC;IACvC,4DAA4D;IAC5D,cAAc,CAAC,CACb,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC,uEAAuE;IACvE,eAAe,CAAC,CACd,MAAM,EAAE,yBAAyB,EACjC,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACjC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,SAAS,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,QAAQ,CACN,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,gBAAgB,GACpB,OAAO,CAAC,OAAO,CAAC,CAAC;IACpB,uEAAuE;IACvE,MAAM,CAAC,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACzD;;;;;OAKG;IACH,SAAS,CAAC,CACR,GAAG,EAAE,gBAAgB,EACrB,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GACzB,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,mFAAmF;IACnF,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACjE;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,QAAQ;IACvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9E;AAED,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEtC,yEAAyE;AACzE,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4DAA4D;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,+EAA+E;IAC/E,cAAc,CAAC,CACb,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC9C,sCAAsC;IACtC,SAAS,CACP,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,MAAM,GACd,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACrC"}

package/dist/types.js

@@ -0,0 +1,3 @@
+// Core contracts for connecta. Web-API only — no node: imports here.
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,qEAAqE"}

package/dist/ui.d.ts

@@ -0,0 +1,91 @@
+import type { CredentialVault } from "./credentials.js";
+import type { Registry } from "./registry.js";
+import type { ConnectaBranding, UiAuthConfig } from "./types.js";
+/** Connecta's default monochrome "C" mark. */
+export declare const CONNECTA_FAVICON_SVG = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 32 32\">\n  <style>\n    .fg { fill: #000 }\n    @media (prefers-color-scheme: dark) { .fg { fill: #fff } }\n  </style>\n  <path class=\"fg\" d=\"M27 9.4A13 13 0 1 0 27 22.6l-4.4-2.5a8 8 0 1 1 0-8.2z\"/>\n</svg>";
+interface ResolvedBranding {
+    productName: string;
+    ownerName?: string;
+    ownerUrl?: string;
+    description: string;
+}
+export declare function resolveBranding(branding?: ConnectaBranding): ResolvedBranding;
+/**
+ * True only for absolute `http:`/`https:` URLs. Downstream connectors control
+ * their `authorizationUrl`, so a hostile/misconfigured one could hand back a
+ * `javascript:` (or other) scheme; gate it before it can become an href.
+ */
+export declare function isSafeHttpUrl(url: unknown): boolean;
+export interface UiTool {
+    name: string;
+    address: string;
+    description?: string;
+}
+export interface UiConnector {
+    id: string;
+    title?: string;
+    description?: string;
+    status: "ok" | "auth_required" | "error";
+    message?: string;
+    authorizationUrl?: string;
+    toolCount: number;
+    tools: UiTool[];
+    credential?: {
+        label: string;
+        description?: string;
+        placeholder?: string;
+        fields?: Array<{
+            name: string;
+            label: string;
+            description?: string;
+            placeholder?: string;
+            inputType: "email" | "password" | "text";
+            configured: boolean;
+            lastFour?: string;
+            updatedAt?: string;
+        }>;
+        configured: boolean;
+        /** A stored value exists and may be deleted even if it cannot be decrypted. */
+        removable?: boolean;
+        lastFour?: string;
+        updatedAt?: string;
+        testable: boolean;
+        error?: string;
+    };
+}
+export interface UiData {
+    serverInfo: {
+        name: string;
+        version: string;
+    };
+    connectors: UiConnector[];
+    activityEnabled: boolean;
+}
+export interface FilteredUiConnector {
+    connector: UiConnector;
+    tools: UiTool[];
+}
+/**
+ * Filter by connector identity/description or tool name/description. A
+ * connector-level match stays visible even when it currently exposes no tools
+ * (for example while authorization is required).
+ */
+export declare function filterUiConnectors(connectors: UiConnector[], query: string): FilteredUiConnector[];
+/**
+ * Build the read-only status payload served at `/ui/data`. Broken connectors are
+ * isolated: they surface status "error" with an empty tool list rather than
+ * failing the whole payload.
+ */
+export declare function buildUiData(registry: Registry, baseUrl: string, serverInfo: {
+    name: string;
+    version: string;
+}, credentialVault?: CredentialVault, activityEnabled?: boolean): Promise<UiData>;
+/**
+ * The `/ui` shell carries no connector data: everything comes client-side from
+ * the auth-gated `/ui/data`. A configured Clerk provider gives operators a
+ * normal sign-in flow and a short-lived session token; bearer-only deployments
+ * retain the manual-token fallback.
+ */
+export declare function renderUiHtml(uiAuth?: UiAuthConfig, mcpUrl?: string, branding?: ConnectaBranding): string;
+export {};
+//# sourceMappingURL=ui.d.ts.map

package/dist/ui.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEjE,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,gRAM1B,CAAC;AAER,UAAU,gBAAgB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CAalB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQnD;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,UAAU,EAAE,OAAO,CAAC;QACpB,+EAA+E;QAC/E,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EAAE,EACzB,KAAK,EAAE,MAAM,GACZ,mBAAmB,EAAE,CAuBvB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,CAAC,EAAE,eAAe,EACjC,eAAe,UAAQ,GACtB,OAAO,CAAC,MAAM,CAAC,CA4GjB;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,MAAM,SAAS,EACf,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,MAAM,CAu0BR"}