@zackbart/connecta 0.15.0 → 0.16.0

package/templates/node/.env.example

@@ -1,5 +1,42 @@
-# Required. Use a long random value and keep it out of source control.
-CONNECTA_TOKEN=replace-me
+# Required, and deliberately empty. Both Compose and src/index.ts refuse to
+# start while it is, so a copied .env cannot become a running deployment on a
+# placeholder printed in this template. Use a long random value and keep it out
+# of source control:
+#   node -e "console.log(crypto.randomBytes(32).toString('base64url'))"
+CONNECTA_TOKEN=
 
-# Optional. Defaults to 8787.
+# Optional. Defaults to 8787. Compose publishes this port on the host too.
 PORT=8787
+
+# Optional. The origin this deployment answers on, once it answers on more
+# than this machine: downstream OAuth calls back to
+# <PUBLIC_URL>/oauth/callback/<connectorId>. Defaults to http://localhost:<PORT>.
+PUBLIC_URL=
+
+# Optional. Where fileStorage keeps downstream-OAuth tokens and catalogs.
+# Defaults to ./.connecta-state.json locally and /data/connecta-state.json in
+# the container — keep the container path under /data so state lands on the
+# named volume and survives a rebuild.
+CONNECTA_STATE_FILE=
+
+# --- Operator surface ---------------------------------------------------
+# Each of these is read only once the matching block in src/index.ts is
+# uncommented. Setting one on its own changes nothing.
+
+# Operator sign-in with Clerk. Only a signed-in operator may write a credential
+# or issue an access token; the bearer above is a client key, not an admin key.
+# Also run `npm install @clerk/backend` — it is an optional peer.
+CLERK_PUBLISHABLE_KEY=
+CLERK_SECRET_KEY=
+
+# Credential vault. Base64-encoded 32-byte AES key encrypting the values an
+# operator saves at /credentials. Generate one with:
+#   node -e "console.log(crypto.randomBytes(32).toString('base64'))"
+# Keep it here or in a secret store — never in the state file it protects, and
+# never in source control. Losing it makes stored credentials unreadable.
+CONNECTA_CREDENTIAL_KEY=
+
+# Payload-free activity history. Defaults to ./.connecta-activity.jsonl locally
+# and /data/connecta-activity.jsonl in the container — same reasoning as the
+# state file: keep it under /data so history survives a rebuild.
+CONNECTA_ACTIVITY_FILE=

package/templates/node/AGENTS.md

@@ -6,13 +6,23 @@ This repository is deployment configuration, not a copy of Connecta itself.
 - Keep `executor: quickJsExecutor()` for the prescribed seven-tool code-first
   surface.
 - Keep credentials in environment variables or an external secret store.
-  Never commit `.env`, `.connecta-state.json`, tokens, or credential values.
+  Never commit `.env`, `.connecta-state.json`, `.connecta-activity.jsonl`,
+  tokens, or credential values.
 - Add application logic only inside deliberate `api()` connector handlers.
   Do not copy or modify Connecta package internals here.
 - Prefer `api()` when the agent must see an exact reviewed capability surface;
   `remoteMcp()` follows the downstream server's evolving tool catalog.
+- The operator surface — Clerk sign-in, credential vault, access tokens,
+  activity — ships as commented blocks in `src/index.ts`. Enable one by
+  uncommenting it and setting the variables it names in `.env`, never by
+  inventing a parallel configuration path. `README.md` § "Turn on the operator
+  surface" is the walkthrough; `src/file-activity.ts` is the deployment-owned
+  activity store the activity block wires.
 - Run `npm run typecheck` after configuration changes. With the server running,
   run `CONNECTA_TOKEN=... npm run doctor` before calling setup complete.
+- `Dockerfile` and `docker-compose.yml` containerize *this* source; they are
+  the same deployment, not a second one. Configuration belongs in `.env` and
+  `src/index.ts`, never in a divergent container entrypoint.
 
 Do not add alternate entrypoints, policy layers, generated connector catalogs,
 or runtime connector registration. Keep the deployment small enough to review

package/templates/node/Dockerfile

@@ -0,0 +1,49 @@
+# This deployment, containerized. The build context is this directory: the
+# image installs @zackbart/connecta from the registry exactly like any other
+# consumer, so nothing here depends on the Connecta repository.
+#
+#   docker compose up -d --build
+FROM node:22-slim
+
+WORKDIR /app
+
+# `connecta init` deliberately leaves no lockfile — it rewrites the Connecta
+# version pin, and a lockfile shipped in the template would already disagree
+# with it. Without one the build resolves the pin itself, which is fine but not
+# reproducible. Run `npm install` on the host and commit the `package-lock.json`
+# it writes: the build context then carries it and every later build takes the
+# `npm ci` path. A lockfile written inside this layer stays inside the image.
+# Dev dependencies stay in: tsx runs src/index.ts directly, so the deployment
+# you review is the deployment that runs.
+COPY package.json package-lock.json* ./
+RUN if [ -f package-lock.json ]; then \
+      npm ci --include=dev; \
+    else \
+      npm install --include=dev --no-audit --no-fund; \
+    fi
+
+COPY tsconfig.json ./
+COPY src ./src
+
+# State lives on a mounted volume. The image owns the mount point so a fresh
+# named volume inherits an owner the non-root user can actually write to.
+RUN mkdir -p /data && chown -R node:node /data /app
+USER node
+
+ENV NODE_ENV=production
+ENV PORT=8787
+ENV CONNECTA_STATE_FILE=/data/connecta-state.json
+# Read only once the activity block in src/index.ts is uncommented; defaulted
+# here so history lands on the volume rather than inside the container layer.
+ENV CONNECTA_ACTIVITY_FILE=/data/connecta-activity.jsonl
+EXPOSE 8787
+
+# /health is always open, so the probe never carries the bearer token and
+# never leaves the container.
+HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
+  CMD node -e "fetch('http://127.0.0.1:'+(process.env.PORT||8787)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+
+# `node --import tsx` keeps Node itself in the foreground: no wrapper process
+# swallows SIGTERM, so `docker compose down` stops the server promptly and the
+# QuickJS children go with it.
+CMD ["node", "--import", "tsx", "src/index.ts"]

package/templates/node/README.md

@@ -1,6 +1,7 @@
 # Connecta deployment
 
-This is the prescribed small Node deployment. Install and run it:
+This is the prescribed Node deployment — the only one. It runs locally from
+source and, unchanged, as a container. Install and run it:
 
 ```sh
 npm install
@@ -10,12 +11,107 @@ CONNECTA_TOKEN=dev-token npm start
 Then point an MCP client at `http://localhost:8787/mcp` with
 `Authorization: Bearer dev-token`.
 
+## Run it in Docker
+
+Same source, same configuration, one long-lived service:
+
+```sh
+cp .env.example .env
+# edit .env — set CONNECTA_TOKEN to a long random value
+
+docker compose up -d --build
+```
+
+`CONNECTA_TOKEN` ships empty on purpose: `up` fails on it until you set it,
+rather than starting a deployment whose bearer is a value published in this
+template. Everything else in `.env.example` has a working default.
+
+Compose reads `.env`, publishes `PORT` (8787 by default), and keeps state on
+the named volume `connecta-state`, mounted at `/data`. `docker compose down`
+stops the service and keeps state; `down -v` wipes it. `/health` is always
+open, so the container's health probe never carries the bearer token.
+
+A build with no lockfile in the context resolves the pinned Connecta version
+itself, and a lockfile npm writes inside the image never reaches this project.
+So commit the `package-lock.json` that the `npm install` above wrote on this
+machine: from then on the build context carries it and every build takes the
+reproducible `npm ci` path.
+
+## Turn on the operator surface
+
+Out of the box this deployment serves the seven-tool MCP surface and a
+read-only operator UI: open `http://localhost:8787/`, paste the bearer, and you
+get Connections. The other three pages are configuration away, and each one is
+a commented block in `src/index.ts` — uncomment it, set the variables it names
+in `.env`, restart. Do them in this order; the last two lean on the first, and
+Credentials wants one thing more than a block, called out in step 2.
+
+**1. Operator sign-in (Clerk).** A bearer token is a client key. It may call
+tools and read connector status, but it may not write a credential or issue an
+access token — that would make one shared secret a deployment-admin key. An
+interactive identity is what unlocks the actionable half:
+
+```sh
+npm install @clerk/backend    # optional peer; it does not install with Connecta
+```
+
+Set `CLERK_PUBLISHABLE_KEY` and `CLERK_SECRET_KEY`, uncomment the `clerkAuth`
+import, the two `process.env.CLERK_*` reads, and the `clerkAuth({ … })` entry in
+`auth`. Enable Dynamic Client Registration on the Clerk instance (OAuth
+Applications → DCR) if MCP clients should sign in through it too, and set
+`PUBLIC_URL` first — Clerk redirects back to it.
+
+**2. Credential vault.** Uncomment `credentials` and set
+`CONNECTA_CREDENTIAL_KEY` to a base64 32-byte AES key:
+
+```sh
+node -e "console.log(crypto.randomBytes(32).toString('base64'))"
+```
+
+Every connector that declares a `credential` slot then becomes editable at
+`/credentials`, with values encrypted in the state file. The shipped `time`
+connector declares none — telling the time needs no secret — so the key alone
+leaves the page hidden, which is the honest state for a page with nothing on
+it. Add `credential: { label: "API token" }` to an `api()` connector (the
+commented shape is in `src/index.ts`) and read it in a handler with
+`await ctx.credential?.get()`, or use a provider connector such as `notion()`,
+which declares its own; Credentials appears for a signed-in operator on the
+next restart. Keep the key anywhere
+except that file — it is the only thing standing between a copied state file
+and the secrets in it — and note that losing it makes stored values
+unreadable. A saved replacement takes effect on the next call; nothing
+restarts, and the deployment never probes a credential to see whether it still
+works. It fails at use, loudly, and the agent is routed to `/credentials`.
+
+**3. Access tokens.** Uncomment `accessTokens: {}`. A signed-in operator can
+then mint named, revocable Bearer tokens at `/tokens` for header-capable
+clients that will not do OAuth. Secrets are shown once and only their hashes
+are stored, so a lost token is reissued, never recovered.
+
+**4. Activity.** Uncomment the `activity` block and the `fileActivityStore`
+import. `/activity` then answers with who called what, when, how long it took,
+and whether it worked — never arguments, results, generated code, or raw error
+messages, because the store is never handed one. `src/file-activity.ts` is
+yours: it appends a line per call and rewrites the log down to the newest 5,000
+events once it runs a slack window past that, so the file holds a few hundred
+more than the ceiling between rewrites rather than being rewritten on every
+call. That is a retention policy chosen for a single container and worth
+revisiting for anything busier. In Docker the log lands on the same volume as
+the state file.
+
+None of this changes what agents can reach. Operator pages manage the
+authentication material behind capabilities this file already declares; the
+connector set, the tool catalog, and its annotations are `src/index.ts`'s
+business and stay that way.
+
 ## Deployment contract
 
 - Edit `src/index.ts` for connectors, auth, storage, and the public URL.
 - Keep the required `executor: quickJsExecutor()` configuration; a deployment
   without an executor refuses to boot.
 - Keep secrets in environment variables or an external secret store.
+- Set `PUBLIC_URL` once this deployment is reachable from somewhere other than
+  this machine: downstream OAuth calls back to it.
 - Add application code only inside deliberate `api()` connector handlers.
 - Do not copy Connecta package internals into this deployment.
 - `AGENTS.md` is the canonical convention file; `CLAUDE.md` points to it.
@@ -24,7 +120,7 @@ Verify a change with:
 
 ```sh
 npm run typecheck
-# In another terminal, while npm start is running:
+# In another terminal, while the server is running (npm start or compose):
 CONNECTA_TOKEN=dev-token npm run doctor
 ```
 
@@ -32,3 +128,22 @@ Doctor checks health, the executor, and the exact prescribed seven-tool
 model-facing surface by running a harmless sandbox program. It reads the bearer
 from `CONNECTA_TOKEN`; it never accepts the secret as a command-line argument.
 Remote URLs must use HTTPS.
+
+A fully-wired deployment reports exactly the same line as a bare one —
+connector count, QuickJS executed, seven tools, plus any catalog drift:
+
+```text
+Connecta doctor passed: 1 connector(s), QuickJS executed, prescribed seven-tool surface.
+```
+
+`QuickJS` is this deployment's sandbox, reported by the deployment itself —
+swap the executor and doctor names the one that actually ran the program.
+
+That is deliberate. Doctor holds a bearer, and a bearer learns the model-facing
+surface, not the deployment's configuration topology: whether this deployment
+issues access tokens or keeps a credential vault is operator data, and a client
+key is not an operator. Confirm the operator surface the way an operator will —
+sign in at `/` and check that the pages you turned on are there: Tokens and
+Activity once their blocks are uncommented, and Credentials once the vault has
+a connector credential slot to show. The nav lists a page only when this
+deployment can serve it, so an absent page is a report, not a fault.

package/templates/node/docker-compose.yml

@@ -0,0 +1,39 @@
+# One service, no database: state is the fileStorage JSON on a named volume.
+#
+#   cp .env.example .env    # then set CONNECTA_TOKEN
+#   docker compose up -d --build
+#
+# Compose reads `.env` from this directory, so one file configures both the
+# build and the container.
+
+services:
+  connecta:
+    build: .
+    # An init process reaps the QuickJS children a program leaves behind.
+    init: true
+    ports:
+      - "${PORT:-8787}:${PORT:-8787}"
+    environment:
+      # Refuse to start without inbound auth — the same rule src/index.ts
+      # enforces, stated early enough that `up` fails before the build.
+      CONNECTA_TOKEN: ${CONNECTA_TOKEN:?set CONNECTA_TOKEN in .env}
+      PORT: ${PORT:-8787}
+      # Downstream OAuth calls back to this origin. Unset is fine until this
+      # deployment is reachable from somewhere other than this machine.
+      PUBLIC_URL: ${PUBLIC_URL:-}
+      # Keep the state file under /data so it lands on the volume below.
+      CONNECTA_STATE_FILE: ${CONNECTA_STATE_FILE:-/data/connecta-state.json}
+      # Operator surface. Passed through so the matching blocks in
+      # src/index.ts work in the container the moment they are uncommented;
+      # until then these are unread. The activity log joins the state file on
+      # the volume for the same reason it does.
+      CLERK_PUBLISHABLE_KEY: ${CLERK_PUBLISHABLE_KEY:-}
+      CLERK_SECRET_KEY: ${CLERK_SECRET_KEY:-}
+      CONNECTA_CREDENTIAL_KEY: ${CONNECTA_CREDENTIAL_KEY:-}
+      CONNECTA_ACTIVITY_FILE: ${CONNECTA_ACTIVITY_FILE:-/data/connecta-activity.jsonl}
+    volumes:
+      - connecta-state:/data
+    restart: unless-stopped
+
+volumes:
+  connecta-state:

package/templates/node/package.json

@@ -12,7 +12,7 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@zackbart/connecta": "0.15.0",
+    "@zackbart/connecta": "0.16.0",
     "quickjs-emscripten": "0.32.0"
   },
   "devDependencies": {

package/templates/node/src/file-activity.ts

@@ -0,0 +1,182 @@
+/**
+ * Payload-free tool activity, kept in a JSON-lines file beside the state file.
+ *
+ * Deployment-owned on purpose: Connecta ships the `ActivityStore` contract, not
+ * a backend, because retention is a decision only the operator can make. This
+ * is the Node counterpart of the Worker example's D1 store, sized for one
+ * container rather than a fleet — a write appends one line, and the log is
+ * bounded by a count of events instead of by age, so nothing has to be
+ * scheduled.
+ *
+ * Nothing wires it by default. `src/index.ts` carries the commented lines that
+ * turn it on; README.md § "Turn on the operator surface" explains why they are
+ * commented.
+ */
+import {
+  appendFileSync,
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+import type {
+  ActivityPage,
+  ActivityStore,
+  ToolCallActivityEvent,
+} from "@zackbart/connecta";
+import { InvalidActivityCursorError } from "@zackbart/connecta";
+
+/**
+ * Events allowed past `maxEvents` before the log is rewritten. Trimming on the
+ * write that first crosses the ceiling would rewrite the whole file on every
+ * call from then on; this pays that cost once per slack window instead.
+ */
+const COMPACTION_SLACK = 500;
+
+export interface FileActivityOptions {
+  /** Newest events retained after a compaction. Default 5,000. */
+  maxEvents?: number;
+}
+
+/** Newest first, with the id breaking ties inside a millisecond. */
+function newestFirst(
+  a: ToolCallActivityEvent,
+  b: ToolCallActivityEvent,
+): number {
+  const byTime = Date.parse(b.occurredAt) - Date.parse(a.occurredAt);
+  return byTime !== 0 ? byTime : b.id.localeCompare(a.id);
+}
+
+function encodeCursor(event: ToolCallActivityEvent): string {
+  return Buffer.from(`${Date.parse(event.occurredAt)}:${event.id}`).toString(
+    "base64",
+  );
+}
+
+function decodeCursor(value: string): { occurredAtMs: number; id: string } {
+  const decoded = Buffer.from(value, "base64").toString("utf8");
+  const separator = decoded.indexOf(":");
+  const occurredAtMs = Number(decoded.slice(0, separator));
+  const id = decoded.slice(separator + 1);
+  if (separator < 1 || !Number.isSafeInteger(occurredAtMs) || !id) {
+    throw new InvalidActivityCursorError();
+  }
+  return { occurredAtMs, id };
+}
+
+/** Strictly older than the cursor position, in the order above. */
+function isBefore(
+  event: ToolCallActivityEvent,
+  position: { occurredAtMs: number; id: string },
+): boolean {
+  const occurredAtMs = Date.parse(event.occurredAt);
+  if (occurredAtMs !== position.occurredAtMs) {
+    return occurredAtMs < position.occurredAtMs;
+  }
+  return event.id.localeCompare(position.id) < 0;
+}
+
+/**
+ * One append-only record per completed downstream call. Events carry no
+ * arguments, results, generated code, or raw error messages — the store never
+ * has a payload to leak. Writes are best-effort by contract: a throw here is
+ * logged by Connecta and never reaches the tool result.
+ */
+export function fileActivityStore(
+  path: string,
+  opts: FileActivityOptions = {},
+): ActivityStore {
+  const maxEvents = Math.max(1, Math.trunc(opts.maxEvents ?? 5_000));
+  // Activity records who called what, so it is owner-only like the state file.
+  const tighten = () => {
+    try {
+      chmodSync(path, 0o600);
+    } catch {
+      // Non-POSIX filesystem or a race on the file — leave the mode as-is.
+    }
+  };
+  let events: ToolCallActivityEvent[] = [];
+  // Damage found at load that the file itself still carries: a dropped line, or
+  // a last line with no newline after it. Both are repaired by rewriting the
+  // file from what parsed, because the alternative is appending onto a
+  // fragment and losing the *next* event too — one that never had anything
+  // wrong with it.
+  let repairNeeded = false;
+  if (existsSync(path)) {
+    tighten();
+    // A half-written trailing line is the normal cost of an append log, and
+    // one unreadable line is not a reason to lose the history above it. Unlike
+    // the state file there is nothing irreplaceable here — this is a record of
+    // calls that already happened — so damaged lines are dropped, loudly.
+    const raw = readFileSync(path, "utf8");
+    const lines = raw.split("\n").filter(Boolean);
+    let dropped = 0;
+    for (const line of lines) {
+      try {
+        events.push(JSON.parse(line) as ToolCallActivityEvent);
+      } catch {
+        dropped += 1;
+      }
+    }
+    if (dropped > 0) {
+      console.error(
+        `[connecta] activity log ${path}: dropped ${dropped} unreadable ` +
+          `line(s) of ${lines.length}.`,
+      );
+    }
+    repairNeeded = dropped > 0 || (raw.length > 0 && !raw.endsWith("\n"));
+  }
+  const ensureDirectory = () => {
+    const dir = dirname(path);
+    if (dir) mkdirSync(dir, { recursive: true, mode: 0o700 });
+  };
+  const compact = () => {
+    events = [...events].sort(newestFirst).slice(0, maxEvents);
+    ensureDirectory();
+    const tmp = `${path}.tmp`;
+    // 0o600 on the temp file; the rename preserves it, so the live log is
+    // never briefly world-readable.
+    writeFileSync(
+      tmp,
+      events.map((event) => `${JSON.stringify(event)}\n`).join(""),
+      { mode: 0o600 },
+    );
+    renameSync(tmp, path);
+    tighten();
+  };
+  // Repair before the first append rather than at the next restart: the
+  // fragment is on disk until something rewrites the file, and an append onto
+  // it corrupts a good event into an unreadable line.
+  if (repairNeeded) compact();
+  return {
+    record(event) {
+      events.push(event);
+      if (events.length > maxEvents + COMPACTION_SLACK) {
+        compact();
+        return;
+      }
+      ensureDirectory();
+      appendFileSync(path, `${JSON.stringify(event)}\n`, { mode: 0o600 });
+      tighten();
+    },
+
+    async list({ cursor, limit }): Promise<ActivityPage> {
+      const boundedLimit = Math.min(100, Math.max(1, Math.trunc(limit)));
+      const position = cursor ? decodeCursor(cursor) : undefined;
+      const ordered = [...events]
+        .sort(newestFirst)
+        .filter((event) => !position || isBefore(event, position));
+      const visible = ordered.slice(0, boundedLimit);
+      const last = visible.at(-1);
+      return {
+        events: visible,
+        ...(ordered.length > visible.length && last
+          ? { nextCursor: encodeCursor(last) }
+          : {}),
+      };
+    },
+  };
+}

package/templates/node/src/index.ts

@@ -4,10 +4,30 @@
  * Keep this file as deployment configuration: connectors, authentication,
  * storage, and public origin. Add application logic only inside deliberate
  * api() connector handlers.
+ *
+ * The operator surface — sign-in, credential vault, access tokens, activity —
+ * ships here as commented configuration, because each half needs a secret or a
+ * retention decision this file cannot make for you. Uncomment the block you
+ * want; README.md § "Turn on the operator surface" walks through all four.
+ *
+ * Environment (see .env.example):
+ *   CONNECTA_TOKEN           required inbound bearer token
+ *   PORT                     listen port (default 8787)
+ *   PUBLIC_URL               public origin; downstream OAuth calls back to it
+ *   CONNECTA_STATE_FILE      fileStorage path (the container points it at /data)
+ *   CLERK_PUBLISHABLE_KEY    operator sign-in, once the Clerk block is on
+ *   CLERK_SECRET_KEY         operator sign-in, once the Clerk block is on
+ *   CONNECTA_CREDENTIAL_KEY  vault key, once the credentials block is on
+ *   CONNECTA_ACTIVITY_FILE   activity log, once the activity block is on
  */
 import { api, bearerToken, createConnecta } from "@zackbart/connecta";
 import { fileStorage, listen } from "@zackbart/connecta/node";
 import { quickJsExecutor } from "@zackbart/connecta/quickjs";
+// Operator sign-in. Needs `npm install @clerk/backend` — it is an optional
+// peer, so it does not install with Connecta.
+// import { clerkAuth } from "@zackbart/connecta/auth/clerk";
+// Payload-free activity history, kept beside the state file.
+// import { fileActivityStore } from "./file-activity.js";
 
 const token = process.env.CONNECTA_TOKEN;
 if (!token) {
@@ -16,16 +36,72 @@ if (!token) {
   );
 }
 const port = Number(process.env.PORT ?? 8787);
+// Empty is unset: an untouched `.env` passes through Compose as "", and an
+// empty state path or public origin is worse than the local default.
+const stateFile = process.env.CONNECTA_STATE_FILE || "./.connecta-state.json";
+const publicUrl = process.env.PUBLIC_URL || `http://localhost:${port}`;
+
+// Operator sign-in. A bearer token is a client key: it may call tools and read
+// connector status, but only a Clerk-authenticated operator may write a
+// credential or issue an access token. Without this block the operator pages
+// still render — an operator pastes the bearer to read them — and Credentials
+// and Tokens stay read-only.
+// const clerkPublishableKey = process.env.CLERK_PUBLISHABLE_KEY;
+// const clerkSecretKey = process.env.CLERK_SECRET_KEY;
+// if (!clerkPublishableKey || !clerkSecretKey) {
+//   throw new Error(
+//     "Operator sign-in needs CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY.",
+//   );
+// }
 
 const connecta = createConnecta({
-  storage: fileStorage("./.connecta-state.json"),
-  auth: bearerToken(token, { subjectId: "operator" }),
-  publicUrl: `http://localhost:${port}`,
+  storage: fileStorage(stateFile),
+  auth: [
+    bearerToken(token, { subjectId: "operator" }),
+    // clerkAuth({
+    //   publishableKey: clerkPublishableKey,
+    //   secretKey: clerkSecretKey,
+    //   publicUrl,
+    //   // Restrict who may sign in — or use `gate` for anything a domain
+    //   // cannot express. Absent, every authenticated Clerk user is admitted.
+    //   // allowedDomains: ["acme.com"],
+    // }),
+  ],
+  publicUrl,
   // Required: model-written programs run in a bounded QuickJS child.
   executor: quickJsExecutor(),
+  // Credential vault. A connector that declares a `credential` slot becomes
+  // editable at /credentials, and its value is encrypted in the state file
+  // with this key — so keep the key out of that file and out of source:
+  //   node -e "console.log(crypto.randomBytes(32).toString('base64'))"
+  // Rotating a credential takes effect on the next call; no restart.
+  // credentials: { encryptionKey: process.env.CONNECTA_CREDENTIAL_KEY },
+  //
+  // Named, revocable Bearer tokens for MCP clients, issued at /tokens by a
+  // signed-in operator. Secrets are shown once; only their hashes are stored.
+  // Requires the Clerk block above — there is nobody to authorize issuance
+  // otherwise.
+  // accessTokens: {},
+  //
+  // Payload-free activity history at /activity: who called what, when, how
+  // long it took, and whether it worked. Never arguments, results, generated
+  // code, or raw error messages. Commented because retention is yours to
+  // choose — see src/file-activity.ts.
+  // activity: {
+  //   store: fileActivityStore(
+  //     process.env.CONNECTA_ACTIVITY_FILE || "./.connecta-activity.jsonl",
+  //   ),
+  //   deploymentId: "production",
+  // },
   connectors: [
     api("time", {
       description: "Time — current timestamp",
+      // /credentials lists connectors, not deployments: the page stays hidden
+      // until at least one connector declares a slot, vault or no vault. A
+      // connector that needs an operator-managed secret adds one here —
+      //   credential: { label: "API token" },
+      // — and reads it inside a handler with `await ctx.credential?.get()`.
+      // Telling the time needs no secret, so this one declares nothing.
       tools: [
         {
           name: "get_now",
@@ -40,4 +116,4 @@ const connecta = createConnecta({
 });
 
 listen(connecta, port);
-console.log(`connecta listening on http://localhost:${port}/mcp`);
+console.log(`connecta listening on port ${port}; MCP at ${publicUrl}/mcp`);

package/dist/access-tokens.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-tokens.d.ts","sourceRoot":"","sources":["../src/access-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAc,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA6BrE,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,mBAAmB,CAAC;CAClC;AAyGD;;;;GAIG;AACH,qBAAa,kBAAkB;IAK3B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGhB,OAAO,EAAE,SAAS,EACnC,OAAO,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAO;YAgCxB,IAAI;IAKZ,IAAI,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IActC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAoCrE,MAAM,CACV,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAQhC,MAAM,CACV,EAAE,EAAE,MAAM,EACV,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAexB,SAAS;CAgBxB"}

package/dist/access-tokens.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access-tokens.js","sourceRoot":"","sources":["../src/access-tokens.ts"],"names":[],"mappings":"AAEA,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAgClC,SAAS,SAAS,CAAC,EAAU;IAC3B,OAAO,GAAG,aAAa,GAAG,EAAE,EAAE,CAAC;AACjC,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAiB;IACzC,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC;SAChB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB;IACnC,OAAO,CAAC,GAAG,KAAK,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAa;IACpC,OAAO,UAAU,CACf,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,4BAA4B,mBAAmB,aAAa,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QAC5D,IACE,KAAK,CAAC,OAAO,KAAK,CAAC;YACnB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YAC5B,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;YACxC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;YACrC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC5B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;YACtC,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC5B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,KAA0B,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QACtD,OAAO,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;YACxD,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9B,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAyB;IACzC,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,YAAY;IACnB,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EAAE;YAChE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,QAAQ;aAC7B;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IAKV;IAJV,IAAI,CAAc;IACV,SAAS,CAAS;IAEnC,YACmB,OAAkB,EACnC,UAAkC,EAAE;QADnB,YAAO,GAAP,OAAO,CAAW;QAGnC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;QAC1D,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC;YAC5B,SAAS,GAAG,CAAC;YACb,SAAS,GAAG,qBAAqB,EACjC,CAAC;YACD,MAAM,IAAI,KAAK,CACb,2DAA2D,qBAAqB,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG;YACV,IAAI,EAAE,cAAc;YACpB,sBAAsB,EAAE,2BAA2B;YACnD,kBAAkB,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE;gBAC/B,IAAI,CAAC;oBACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC;gBACrC,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YACD,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAChD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,EAAU;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,aAAa,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxC,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvC,CAAC,CAAC,CACH,CAAC;QACF,OAAO,OAAO;aACX,MAAM,CAAC,CAAC,MAAM,EAA+B,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aACtD,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAa,EAAE,SAAiB;QAC3C,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,8CAA8C,IAAI,CAAC,SAAS,uBAAuB,CACpF,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACxE,MAAM,KAAK,GAAG,YAAY,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,MAAM,GAAsB;YAChC,OAAO,EAAE,CAAC;YACV,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,cAAc;YACpB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;SACV,CAAC;QACF,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,SAAS,CAAC,IAAI,CAAC,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAwB,CAAC,CACpE,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,IAAa;QAEb,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,SAAiB;QAEjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,wEAAwE;YACxE,kEAAkE;YAClE,kDAAkD;YAClD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC5C,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,OAAgB;QACtC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,YAAY,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,SAAS;YAAE,OAAO,YAAY,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,YAAY,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7D,OAAO,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;IAC5C,CAAC;CACF"}

package/dist/activity.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAqBzC,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,uBAAuB,GAMvB,YAAY,GACZ,cAAc,CAAC;AAEnB,MAAM,MAAM,eAAe,GACvB,SAAS,GACT,OAAO,GACP,SAAS,GACT,WAAW,CAAC;AAEhB,MAAM,MAAM,aAAa,GACrB,gBAAgB,GAChB,cAAc,GACd,qBAAqB,GACrB,eAAe,GACf,kBAAkB,CAAC;AAEvB,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,aAAa,GAAG,SAAS,CAiB3B;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,CAAC,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,0EAA0E;AAC1E,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACtD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG;IACrE,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,KAAK,EAAE,qBAAqB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5D;AAED,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,aAAc,SAAQ,YAAY;IACjD,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,iFAAiF;AACjF,qBAAa,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,SAAgC;;CAK9C;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,aAAa,KACjB,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,qBAAqB,EACnB,aAAa,GACb,UAAU,GACV,SAAS,GACT,QAAQ,GACR,SAAS,GACT,YAAY,GACZ,UAAU,GACV,WAAW,GACX,UAAU,CACb,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,sBAAsB,GAAG,SAAS,EAC3C,KAAK,EAAE,kBAAkB,GACxB,IAAI,CAsCN"}

package/dist/activity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../src/activity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;;;;;;;;GAaG;AACH,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,0CAA0C;AAC1C,MAAM,0BAA0B,GAAG,uBAAuB,GAAG,CAAC,GAAG,CAAC,CAAC;AA0BnE,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAClC,IAAwB;IAExB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc,CAAC;QACpB,KAAK,sBAAsB;YACzB,OAAO,gBAAgB,CAAC;QAC1B,KAAK,cAAc;YACjB,OAAO,cAAc,CAAC;QACxB,KAAK,oCAAoC;YACvC,OAAO,qBAAqB,CAAC;QAC/B,KAAK,eAAe;YAClB,OAAO,eAAe,CAAC;QACzB,KAAK,kBAAkB;YACrB,OAAO,kBAAkB,CAAC;QAC5B;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAoFD,iFAAiF;AACjF,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,IAAI,GAAG,4BAA4B,CAAC;IAE7C;QACE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnC,CAAC;CACF;AA8BD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAA2C,EAC3C,KAAyB;IAEzB,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,yEAAyE;IACzE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,oBAAoB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,KAAK,GAA0B;QACnC,aAAa,EAAE,CAAC;QAChB,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;QACvB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE,uBAAuB,CAAC;QACxE,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC;QAClE,OAAO,EAAE,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,0BAA0B,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACjD,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;QACnC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO;QACzC,GAAG,CAAC,OAAO,CAAC,YAAY;YACtB,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IACF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAQ,MAA2B,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACtD,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/apps-shell.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"apps-shell.d.ts","sourceRoot":"","sources":["../src/apps-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,gCAAgC,CAAC;AAErE,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAEhE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,gBAAgB,CAAC;AAEjD,gEAAgE;AAChE,eAAO,MAAM,kBAAkB,+BAA+B,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,07ZAsUjC,CAAC"}