@zackbart/connecta 0.28.1 → 0.29.0

package/dist/operator-ui/view.js

@@ -1,16 +1,37 @@
-/** Pages the nav lists. A single artifact is reached from the library, not the nav. */
+/**
+ * Everything the operator app knows, and every rule for changing it, with no
+ * DOM in sight. The components render this and nothing else, so the questions
+ * that matter — what a page shows while it loads, what an identity change
+ * erases, whether a value may become an href — are answered by functions a test
+ * can call directly rather than by reading rendered markup back out of a
+ * browser.
+ */
+const REGISTRATION_LABELS = {
+    cimd: "Client metadata document (CIMD)",
+    dcr: "Dynamic registration (DCR)",
+    static: "Pre-registered client",
+};
+export function registrationPathLabel(path) {
+    return REGISTRATION_LABELS[path];
+}
+/** Pages the nav lists. */
 export const OPERATOR_PAGES = [
+    "overview",
     "connections",
-    "tokens",
+    "tools",
+    "access",
     "activity",
-    "artifacts",
+    "config",
 ];
 export const PAGE_META = {
+    overview: { path: "/", label: "Overview" },
+    connector: { path: "/connectors", label: "Connector" },
+    tools: { path: "/tools", label: "Tools" },
+    access: { path: "/access", label: "Access" },
+    config: { path: "/config", label: "Config" },
     tokens: { path: "/tokens", label: "Access tokens" },
-    connections: { path: "/", label: "Connections" },
+    connections: { path: "/connectors", label: "Connectors" },
     activity: { path: "/activity", label: "Activity" },
-    artifacts: { path: "/artifacts", label: "Artifacts" },
-    artifact: { path: "/artifacts", label: "Artifact" },
 };
 /**
  * What each page is for, in one line under its heading — on the gate as well
@@ -21,46 +42,20 @@ export function pageDescription(page, productDescription) {
     if (page === "activity") {
         return "Every connector tool call, by who made it and how it ended. Arguments and results are never stored.";
     }
-    if (isArtifactPage(page)) {
-        return "Pages agents published for the team. Each one keeps every version.";
-    }
     return productDescription;
 }
 /** What the gate says while the session is checked, page by page. */
-export function checkingCopy(page) {
-    if (page === "artifact")
-        return "Loading artifact…";
-    if (page === "artifacts")
-        return "Loading artifacts…";
+export function checkingCopy() {
     return "Checking your session…";
 }
 export function pageForPath(path) {
-    if (path.startsWith("/artifacts/"))
-        return "artifact";
+    if (/^\/connectors\/[a-z0-9_-]+$/.test(path))
+        return "connector";
+    if (path === "/tokens")
+        return "tokens";
     const match = OPERATOR_PAGES.find((page) => PAGE_META[page].path === path);
     return match ?? "connections";
 }
-/** Artifact pages load their own data and never ask `/ui/data` whether to open. */
-export function isArtifactPage(page) {
-    return page === "artifacts" || page === "artifact";
-}
-/**
- * Where a viewer's frame gets its page: `/artifacts/<id>` or a snapshot,
- * `/artifacts/<id>/v/<version>?d=<name>:<version>…`, mapped to its API call.
- */
-export function artifactViewRequest(pathname, search) {
-    const match = /^\/artifacts\/([a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?)(?:\/v\/(\d{1,9}))?$/.exec(pathname);
-    if (!match?.[1])
-        return undefined;
-    const params = new URLSearchParams();
-    if (match[2]) {
-        params.set("v", match[2]);
-        for (const pin of new URLSearchParams(search).getAll("d"))
-            params.append("d", pin);
-    }
-    const query = params.toString();
-    return `/artifacts/_api/view/${match[1]}${query ? `?${query}` : ""}`;
-}
 export function info(message) {
     return { message, tone: "info" };
 }
@@ -78,6 +73,8 @@ const REFUSED_COPY = {
  */
 export function oauthDoneNotice(action, answer, opened = true) {
     if (action === "oauth_disconnect") {
+        if (answer?.code === "oauth_revocation_failed")
+            return info("Disconnected locally. Provider revocation could not be confirmed. Revoke the grant in the provider's console.");
         return info("Disconnected. Connect again whenever you are ready.");
     }
     if (answer?.state === "ok")
@@ -100,8 +97,7 @@ export function credentialTestNotice(connectorId, answer) {
  * checked, not trusted.
  */
 export function refusedNotice(action, connectorId, problem) {
-    if (action === "credential_test" &&
-        (problem === "credential_required" || problem === "credential_mismatch")) {
+    if (action === "credential_test" && (problem === "credential_required" || problem === "credential_mismatch")) {
         return failure(PROBLEM_COPY[problem], { kind: problem, connectorId });
     }
     return failure(REFUSED_COPY[action], {
@@ -166,18 +162,14 @@ export function loadFailureCopy(failure, productName) {
     };
 }
 /** A collection page's load failure: fixed words, whatever the route said. */
-export function collectionFailureCopy(collection, facts, productName) {
+export function collectionFailureCopy(_collection, facts, productName) {
     if (facts.kind === "network") {
         return `Couldn't reach ${productName}. Check your connection, then retry.`;
     }
     if (facts.kind === "session")
         return "Your session has ended. Sign in again to see this page.";
     if (facts.kind === "forbidden" || facts.status === 404) {
-        if (collection === "artifact")
-            return "There is no artifact here, or this identity can't open it.";
-        return collection === "activity"
-            ? "Activity isn't available to this identity."
-            : "Artifacts aren't available to this identity.";
+        return "Activity isn't available to this identity.";
     }
     return "The deployment answered with an error. Retry in a moment; if it keeps failing, the deployment's log has the reason.";
 }
@@ -226,6 +218,9 @@ export function initialState(page) {
 function identityScopedState() {
     return {
         data: null,
+        contract: null,
+        contractPhase: "idle",
+        health: "loading",
         connectorFilter: "",
         oauthNotice: null,
         oauthNoticeFor: null,
@@ -248,13 +243,6 @@ function identityScopedState() {
         activityEvents: [],
         activityCursor: null,
         activitySearch: "",
-        artifactPhase: "idle",
-        artifactNotice: null,
-        artifactRows: [],
-        artifactCursor: null,
-        artifactQuery: "",
-        artifactArchived: false,
-        artifactView: null,
     };
 }
 /**
@@ -310,117 +298,22 @@ export function connectorStatusLabel(status, problem) {
         return "Loading details";
     if (status === "ok")
         return "Connected";
+    if (status === "credential_required")
+        return "Credential needed";
     if (status === "auth_required") {
         return problem === "credential_required" ? "Credential needed" : "Authorization needed";
     }
     return "Unavailable";
 }
-export function toolCountLabel(count) {
-    return `${count} ${count === 1 ? "tool" : "tools"}`;
-}
 export function connectorStatusTone(status) {
     if (status === "ok")
         return "ok";
-    if (status === "auth_required")
+    if (status === "auth_required" || status === "credential_required")
         return "warn";
     if (status === "loading")
         return "neutral";
     return "danger";
 }
-export function summarizeConnectors(connectors) {
-    const summary = {
-        total: connectors.length,
-        connected: 0,
-        attention: 0,
-        credentials: 0,
-        unavailable: 0,
-        loading: 0,
-        tools: 0,
-        drifting: 0,
-    };
-    for (const connector of connectors) {
-        if (connector.status === "ok")
-            summary.connected += 1;
-        else if (connector.status === "auth_required") {
-            if (connector.problem === "credential_required")
-                summary.credentials += 1;
-            else
-                summary.attention += 1;
-        }
-        else if (connector.status === "loading")
-            summary.loading += 1;
-        else
-            summary.unavailable += 1;
-        summary.tools += connector.toolCount || 0;
-        if (driftState(connector.catalogDrift) === "warning")
-            summary.drifting += 1;
-    }
-    return summary;
-}
-/**
- * The one line above the list. Connected and tool counts are always present;
- * the two counts an operator may have to act on appear only when they are not
- * zero, so a healthy deployment stays short.
- */
-export function connectorSummaryParts(summary) {
-    // Nothing has answered yet: "0 connected · 0 tools" would be a claim, and
-    // a false one.
-    if (summary.total > 0 && summary.loading === summary.total) {
-        return [
-            {
-                text: `Checking ${summary.total} connector${summary.total === 1 ? "" : "s"}…`,
-                tone: "neutral",
-            },
-        ];
-    }
-    return [
-        { text: `${summary.connected} connected`, tone: "neutral" },
-        ...(summary.attention
-            ? [
-                {
-                    text: `${summary.attention} need${summary.attention === 1 ? "s" : ""} authorization`,
-                    tone: "warn",
-                },
-            ]
-            : []),
-        ...(summary.credentials
-            ? [
-                {
-                    text: `${summary.credentials} need${summary.credentials === 1 ? "s" : ""} a credential`,
-                    tone: "warn",
-                },
-            ]
-            : []),
-        ...(summary.unavailable
-            ? [{ text: `${summary.unavailable} unavailable`, tone: "danger" }]
-            : []),
-        { text: toolCountLabel(summary.tools), tone: "neutral" },
-        ...(summary.loading
-            ? [{ text: `${summary.loading} still loading`, tone: "neutral" }]
-            : []),
-    ];
-}
-/**
- * The badge for each call path, keyed by the server's classification so each
- * state is a row here rather than a branch in a component.
- */
-export const TOOL_SAFETY_BADGE = {
-    runs_in_programs: {
-        label: "runs in programs",
-        tone: "ok",
-        title: "Explicitly read-only: execute_code programs may call it without asking.",
-    },
-    exempt: {
-        label: "exempt from approval",
-        tone: "neutral",
-        title: "Not read-only, but this deployment's config lets programs call it without asking. Each call still counts against the write budget and appears in activity; call_tool still refuses it.",
-    },
-    needs_approval: {
-        label: "asks for approval",
-        tone: "warn",
-        title: "Not explicitly read-only: programs refuse it, and it runs through call_destructive_tool, where the host asks first.",
-    },
-};
 /**
  * What the page says about a connector that is not usable, one fixed sentence
  * per problem kind the server classified. This is the only account of a
@@ -439,7 +332,7 @@ const PROBLEM_COPY = {
     catalog_failed: "Connected, but its tool catalog could not be loaded, so none of its tools are served.",
 };
 export function problemCopy(problem) {
-    return problem ? PROBLEM_COPY[problem] ?? null : null;
+    return problem ? (PROBLEM_COPY[problem] ?? null) : null;
 }
 /**
  * A problem someone can fix by authorizing is a warning, matching the amber
@@ -447,16 +340,10 @@ export function problemCopy(problem) {
  * error. The two used to share the red box, so the row contradicted itself.
  */
 export function problemTone(problem) {
-    return problem === "oauth_required" ||
-        problem === "credential_required" ||
-        problem === "auth_required"
+    return problem === "oauth_required" || problem === "credential_required" || problem === "auth_required"
         ? "warn"
         : "danger";
 }
-/** Who owns this connector's downstream credentials, in two words. */
-export function authScopeLabel(scope) {
-    return scope === "personal" ? "personal auth" : "shared auth";
-}
 /**
  * What this identity may do with a connector, in one line. Being able to use it
  * is implied by seeing it at all, so the sentence covers authentication, which
@@ -472,7 +359,7 @@ export function permissionLabel(connector) {
     return "Authentication for this connection is managed by your deployment.";
 }
 /**
- * The four categories, in the order an operator should read them: what the
+ * The categories, in the order an operator should read them: what the
  * deployment refuses to call, what it can no longer call, what contradicts a
  * vetted verdict, and what changed shape underneath a reviewed schema. Counts
  * only — a name or a schema on this path would be the payload leak the whole
@@ -483,8 +370,9 @@ const DRIFT_CATEGORIES = [
     { key: "unservedTools", label: "Unserved" },
     { key: "annotationConflicts", label: "Annotation conflicts" },
     { key: "schemaChanges", label: "Schema changes" },
+    { key: "droppedTools", label: "Dropped tool names" },
 ];
-export function driftTotal(drift) {
+function driftTotal(drift) {
     if (!drift)
         return 0;
     return DRIFT_CATEGORIES.reduce((sum, { key }) => sum + (drift[key] || 0), 0);
@@ -498,7 +386,7 @@ export function driftState(drift) {
 export function driftCounts(drift) {
     if (!drift)
         return [];
-    return DRIFT_CATEGORIES.map(({ key, label }) => ({
+    return DRIFT_CATEGORIES.filter(({ key }) => key !== "droppedTools" || drift.droppedTools !== undefined).map(({ key, label }) => ({
         key,
         label,
         count: drift[key] || 0,
@@ -595,7 +483,9 @@ function activityMatches(event, query) {
         activityOutcomeBadge(event.outcome).label,
         activityDetail(event),
         actorKindLabel(event.actor?.kind),
-    ].some((value) => String(value ?? "").toLowerCase().includes(q));
+    ].some((value) => String(value ?? "")
+        .toLowerCase()
+        .includes(q));
 }
 export function filterActivity(events, query) {
     return events.filter((event) => activityMatches(event, query));
@@ -604,20 +494,15 @@ export function filterActivity(events, query) {
 export function activitySummary(events) {
     if (events.length === 0)
         return "";
-    const tools = new Set(events.map((event) => event.address)).size;
-    return `${events.length} loaded call${events.length === 1 ? "" : "s"} · ${tools} tool${tools === 1 ? "" : "s"}`;
+    const calls = events.filter((event) => event.kind !== "catalog_drift");
+    const changes = events.length - calls.length;
+    const tools = new Set(calls.map((event) => event.address)).size;
+    return `${calls.length} loaded call${calls.length === 1 ? "" : "s"} · ${tools} tool${tools === 1 ? "" : "s"}${changes ? ` · ${changes} catalog change${changes === 1 ? "" : "s"}` : ""}`;
 }
 // A pause and an approval are neither success nor failure: each gets its own
 // class, and the stylesheet paints neither as an error. Nothing has emitted
 // either since issue #672 removed program pauses, but older rows carry them.
-const ACTIVITY_OUTCOMES = [
-    "success",
-    "error",
-    "timeout",
-    "cancelled",
-    "paused",
-    "approved",
-];
+const ACTIVITY_OUTCOMES = ["success", "error", "timeout", "cancelled", "paused", "approved"];
 export function activityOutcomeClass(outcome) {
     return ACTIVITY_OUTCOMES.includes(outcome) ? outcome : "error";
 }
@@ -665,6 +550,8 @@ function reasonLabel(code) {
 }
 /** The one-line detail under an address: where it ran, retries, and why it stalled. */
 export function activityDetail(event) {
+    if (event.kind === "catalog_drift")
+        return "Catalog changed";
     const parts = [SOURCE_LABELS[event.source] ?? event.source];
     if (event.approval === "tool")
         parts.push("approved for the rest of the run");
@@ -672,23 +559,13 @@ export function activityDetail(event) {
         parts.push("approved for this call");
     if (event.attempts > 1)
         parts.push(`${event.attempts} attempts`);
-    const reasons = [event.friction, event.errorCode]
-        .filter((code) => Boolean(code))
-        .map(reasonLabel);
+    const reasons = [event.friction, event.errorCode].filter((code) => Boolean(code)).map(reasonLabel);
     // The friction class and the code often say the same thing in two
     // vocabularies ("auth_required" twice); once is enough.
     for (const reason of new Set(reasons))
         parts.push(reason);
     return parts.join(" · ");
 }
-/**
- * An artifact's last refresh, when it is worth a badge. Only a failure is: a
- * success is what "Current data" already says, and a superseded run is
- * nobody's concern.
- */
-export function artifactRefreshBadge(last) {
-    return last?.status === "failed" ? { label: "Refresh failed", tone: "danger" } : null;
-}
 /**
  * A stored credential that cannot be used, by cause. The payload's `error`
  * beside it is not shown: it can carry a vault's own words.
@@ -704,12 +581,8 @@ export function credentialProblemCopy(problem) {
 export function credentialStateLabel(credential) {
     if (!credential.configured)
         return "not configured";
-    const masked = credential.fields?.length
-        ? "configured"
-        : `configured · ••••${credential.lastFour ?? ""}`;
-    return credential.updatedAt
-        ? `${masked} · updated ${formatDate(credential.updatedAt)}`
-        : masked;
+    const masked = credential.fields?.length ? "configured" : `configured · ••••${credential.lastFour ?? ""}`;
+    return credential.updatedAt ? `${masked} · updated ${formatDate(credential.updatedAt)}` : masked;
 }
 /** Gate copy for each browser-auth shape, so the sign-in state is never a blank page. */
 export function gateCopy(kind, signedIn) {

package/dist/page-styles.js

@@ -1,7 +1,6 @@
 // Generated by scripts/build-operator-ui.mjs. Do not edit.
-// Source: src/operator-ui/tokens.css and src/operator-ui/page.css, which the
-// operator UI's browser.css imports too, so every page reads one token layer.
+// Source: src/operator-ui/tokens.css and src/operator-ui/page.css.
 /** Custom properties and both palettes; styles no element. */
-export const TOKENS_CSS = ":root{color-scheme:light;--accent: #2f5fe0;--radius: 10px;--sans: ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--bg: #f6f7f9;--surface: #ffffff;--surface-2: #f1f3f6;--border: #e2e5ea;--border-strong: #cdd2da;--text: #131820;--muted: #5b6472;--ok: #12734a;--warn: #9a5b06;--danger: #bb3226;--on-accent: #ffffff;--link: var(--accent);--tint: color-mix(in srgb, var(--accent) 8%, var(--surface));--shell: 68rem;--pad: 1.25rem;--gap: 1rem}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--bg: #0d1016;--surface: #151a21;--surface-2: #1c222c;--border: #262d39;--border-strong: #38414f;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}}html[data-scheme=dark]{--bg: #0d1016;--surface: #151a21;--surface-2: #1c222c;--border: #262d39;--border-strong: #38414f;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}";
+export const TOKENS_CSS = ":root{color-scheme:light;--accent: #5263e8;--radius: 6px;--sans: \"Inter Variable\", ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--bg: #ffffff;--surface: #ffffff;--surface-2: #f7f8fa;--border: #e8eaee;--border-strong: #cdd2da;--text: #20232b;--muted: #69707e;--ok: #12734a;--warn: #9a5b06;--danger: #bb3226;--on-accent: #ffffff;--link: var(--accent);--tint: color-mix(in srgb, var(--accent) 8%, var(--surface));--shell: 68rem;--pad: 1.25rem;--gap: 1rem;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-6: 1.5rem;--space-8: 2rem;--text-xs: .75rem;--text-sm: .8125rem;--text-base: .875rem;--sidebar-width: 14rem}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--bg: #111216;--surface: #18191e;--surface-2: #202127;--border: #2a2b33;--border-strong: #3b3d48;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}}html[data-scheme=dark]{--bg: #111216;--surface: #18191e;--surface-2: #202127;--border: #2a2b33;--border-strong: #3b3d48;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}";
 /** Base typography, the shell, masthead, buttons, badges, and messages. */
 export const PAGE_CSS = "*{box-sizing:border-box}html{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:16px;line-height:1.5;-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh}:is(h1,h2,h3,p,ul,ol){margin:0;padding:0}:is(h1,h2,h3){font-weight:600;line-height:1.3}h1{font-size:1.5rem;letter-spacing:-.01em}h2{font-size:1rem}:is(ul,ol){list-style:none}a{color:var(--link);text-decoration-thickness:1px;text-underline-offset:2px}button,input{font:inherit}:is(a,button,input,summary):focus-visible{border-radius:calc(var(--radius) / 2);outline:2px solid var(--link);outline-offset:2px}.skip-link{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);left:var(--pad);padding:.5rem .75rem;position:fixed;top:-4rem;z-index:10}.skip-link:focus{top:var(--pad)}.shell{margin:0 auto;max-width:var(--shell);padding-left:var(--pad);padding-right:var(--pad)}.cap,.meta{color:var(--muted);font-size:.875rem}.mono{font-family:var(--mono);font-size:.8125rem}.visually-hidden{clip-path:inset(50%);height:1px;overflow:hidden;position:absolute;white-space:nowrap;width:1px}.masthead{align-items:center;background:var(--surface);border-bottom:1px solid var(--border);display:flex;gap:var(--gap);justify-content:space-between;max-width:none;padding-bottom:.75rem;padding-top:.75rem;position:sticky;top:0;z-index:5}.masthead-inner{align-items:center;display:flex;gap:var(--gap);justify-content:space-between;margin:0 auto;max-width:var(--shell);width:100%}.mast-nav,.mast-actions,.page-nav,.session-actions{align-items:center;display:flex;flex-wrap:wrap;gap:.25rem}.mast-nav,.mast-actions{gap:var(--gap)}.navlink{background:none;border:0;border-radius:calc(var(--radius) - 2px);color:var(--muted);cursor:pointer;font-size:.9375rem;padding:.35rem .6rem;text-decoration:none}.navlink:hover{background:var(--surface-2);color:var(--text)}.navlink[aria-current=page]{background:var(--tint);color:var(--link);font-weight:500}.brand,.product{padding-left:0;padding-right:0;text-decoration:none}.brand{color:var(--text);font-weight:600}.brand:hover,.product:hover{background:none}.product{color:var(--muted)}.page{padding-bottom:4rem;padding-top:2rem}.lead{margin-bottom:1.5rem}.lead-copy{color:var(--muted);display:grid;gap:.5rem;margin-top:.35rem}.lead-copy p{max-width:60ch}.btn{background:var(--surface);border:1px solid var(--border-strong);border-radius:calc(var(--radius) - 2px);color:var(--text);cursor:pointer;display:inline-flex;align-items:center;font-size:.875rem;gap:.35rem;padding:.35rem .7rem;text-decoration:none;white-space:nowrap}.btn:hover{background:var(--surface-2)}.btn:disabled{cursor:not-allowed;opacity:.55}.btn.primary{background:var(--accent);border-color:var(--accent);color:var(--on-accent)}.btn.primary:hover{background:color-mix(in srgb,var(--accent) 88%,black)}.btn.danger{color:var(--danger)}.btn.danger:hover{background:color-mix(in srgb,var(--danger) 10%,var(--surface))}.btn.quiet{background:none;border-color:var(--border);color:var(--muted)}.btn.quiet:hover{background:var(--surface-2);color:var(--text)}.badge{align-items:center;background:var(--surface-2);border-radius:999px;color:var(--muted);display:inline-flex;font-size:.75rem;gap:.3rem;line-height:1.6;padding:.1rem .5rem;white-space:nowrap}.badge.ok{background:color-mix(in srgb,var(--ok) 12%,var(--surface));color:var(--ok)}.badge.warn{background:color-mix(in srgb,var(--warn) 14%,var(--surface));color:var(--warn)}.badge.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.badge.accent{background:var(--tint);color:var(--link)}.msg{background:color-mix(in srgb,var(--danger) 8%,var(--surface));border:1px solid color-mix(in srgb,var(--danger) 28%,var(--surface));border-radius:calc(var(--radius) - 2px);color:var(--danger);font-size:.875rem;padding:.5rem .75rem}.status-page{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);display:grid;gap:.75rem;margin:1.5rem auto 0;max-width:34rem;padding:1.5rem}.status-head{align-items:center;display:flex;gap:.6rem}.status-mark{align-items:center;background:var(--surface-2);border-radius:50%;color:var(--muted);display:inline-flex;flex:none;height:2rem;justify-content:center;width:2rem}.status-mark svg{height:1.25rem;width:1.25rem}.status-mark.ok{background:color-mix(in srgb,var(--ok) 14%,var(--surface));color:var(--ok)}.status-mark.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.status-label{color:var(--muted);font-size:.875rem;font-weight:600}.status-label.ok{color:var(--ok)}.status-label.danger{color:var(--danger)}.status-page h1{overflow-wrap:anywhere}.status-copy{color:var(--muted)}.status-actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:.25rem}.status-details{border-top:1px solid var(--border);color:var(--muted);font-size:.875rem;margin-top:.25rem;padding-top:.75rem}.status-details>summary{cursor:pointer;width:fit-content}.status-details>p{margin-top:.5rem}.status-details pre{background:var(--surface-2);border:1px solid var(--border);border-radius:calc(var(--radius) / 2);color:var(--text);font-family:var(--mono);font-size:.75rem;line-height:1.55;margin:.5rem 0 0;max-height:18rem;overflow:auto;overflow-wrap:anywhere;padding:.5rem .6rem;white-space:pre-wrap}@media(max-width:40rem){:root{--pad: 1rem}.status-page{margin-top:0;padding:1.25rem var(--pad)}}";

package/dist/program-source.js

@@ -14,8 +14,20 @@ const WORD = /[\w$\\\u0080-\uffff]/;
  * Any other word is an identifier or a literal, which a `/` divides.
  */
 const REGEX_AFTER_WORD = new Set([
-    "await", "case", "delete", "do", "else", "in", "instanceof", "new", "of",
-    "return", "throw", "typeof", "void", "yield",
+    "await",
+    "case",
+    "delete",
+    "do",
+    "else",
+    "in",
+    "instanceof",
+    "new",
+    "of",
+    "return",
+    "throw",
+    "typeof",
+    "void",
+    "yield",
 ]);
 /**
  * Remove the statement terminators after a program's arrow expression:

package/dist/{exempt-writes.js → program-writes.js}

@@ -1,17 +1,10 @@
-// The writes a program may send: config-exempt ones (#566), and nothing else.
-//
-// Every other write a program attempts is refused
-// `destructive_tool_requires_approval` before it is validated or sent (E4),
-// so the host's prompt on `call_destructive_tool` stays the only approval.
-// An exempt write is still a write, though, and it gets what a write needs:
-// its own budget, a dispatch the run waits for rather than aborts, and a
-// result that never hides a write whose outcome is unknown.
-//
-// Web-API only, like everything reachable from the root entry.
+// Budget and outcome accounting for writes dispatched by trusted programs.
+// Await each dispatched write once; never conceal an unknown outcome.
+import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Effect } from "effect";
 import { jsonResult } from "./meta-tools.js";
 /** Writes one program may send (`execute.maxWrites`), unless configured. */
-export const DEFAULT_MAX_WRITES = 10;
+export const DEFAULT_MAX_WRITES = CONFIG_DEFAULTS.execute.maxWrites;
 /**
  * Whether a write landed, as far as anyone can know.
  *
@@ -20,9 +13,9 @@ export const DEFAULT_MAX_WRITES = 10;
  * not sending it could leave it undone. That is a dispatched call that timed
  * out, was cancelled, found the service unavailable, or failed any way that
  * is not a verdict. A refusal code (`REFUSALS`) or a downstream tool's own
- * `isError` is an answer, so it is `failed`, except that an `isError` whose text
- * classifies as a timeout is a gateway reporting that it gave up, and stays
- * unknown. A call that was never dispatched is `failed`: nothing was sent.
+ * `isError` is an answer, so it is `failed`. Response text does not decide
+ * whether an outcome is unknown. A call that was never dispatched is
+ * `failed`: nothing was sent.
  * `result_processing_failed` means the downstream call completed.
  */
 export function classifyWriteOutcome(outcome) {
@@ -51,6 +44,8 @@ export function classifyWriteOutcome(outcome) {
  */
 const REFUSALS = new Set([
     "auth_required",
+    "downstream_oauth_required",
+    "provider_permission_denied",
     "invalid_args",
     "not_found",
     "rate_limited",
@@ -59,7 +54,7 @@ const REFUSALS = new Set([
 ]);
 /** What a dispatched write's outcome says about whether it landed. */
 export function writeStateOf(outcome) {
-    return classifyWriteOutcome(outcome.ok
+    const state = classifyWriteOutcome(outcome.ok
         ? { ok: true, dispatched: outcome.dispatched }
         : {
             ok: false,
@@ -67,19 +62,44 @@ export function writeStateOf(outcome) {
             error: outcome.error,
             ...(outcome.answered !== undefined ? { answered: outcome.answered } : {}),
         });
+    return state === "unknown" && !outcome.ok && outcome.error.uncertainCall
+        ? {
+            state,
+            uncertainCall: outcome.error.uncertainCall,
+            ...(outcome.error.details?.stage !== undefined
+                ? {
+                    deadline: {
+                        ...(outcome.error.details.operation !== undefined
+                            ? { operation: outcome.error.details.operation }
+                            : {}),
+                        stage: outcome.error.details.stage,
+                        ...(outcome.error.details.elapsedMs !== undefined
+                            ? { elapsedMs: outcome.error.details.elapsedMs }
+                            : {}),
+                        ...(outcome.error.details.deadlineMs !== undefined
+                            ? { deadlineMs: outcome.error.details.deadlineMs }
+                            : {}),
+                    },
+                }
+                : {}),
+        }
+        : state;
 }
 /**
- * The exempt writes one program sends. The play closes this when the
+ * The trusted-pool writes one program sends. The play closes this when the
  * program settles — a write that reaches the gate after is not sent — and
  * drains what is on the wire before the run's scope aborts it, so the write
  * finishes and its activity says how it did. The result never hides a write
  * whose outcome is unknown, and a program that fails after writing reports
  * the counts.
  */
-export class ExemptWrites {
+export class ProgramWrites {
     closed = false;
     inFlight = new Set();
     states = [];
+    uncertainCalls = [];
+    uncertainCallsTruncated = false;
+    deadlines = [];
     /** Whether the program has settled: a write gated now is not sent. */
     get isClosed() {
         return this.closed;
@@ -95,10 +115,19 @@ export class ExemptWrites {
         });
         this.inFlight.add(settled);
         let recorded = false;
-        return (state) => {
+        return (completion) => {
             if (recorded)
                 return;
             recorded = true;
+            const state = typeof completion === "string" ? completion : completion.state;
+            if (typeof completion !== "string") {
+                if (this.uncertainCalls.length < 10)
+                    this.uncertainCalls.push(completion.uncertainCall);
+                else
+                    this.uncertainCallsTruncated = true;
+                if (completion.deadline && this.deadlines.length < 10)
+                    this.deadlines.push(completion.deadline);
+            }
             this.states.push(state);
             this.inFlight.delete(settled);
             done();
@@ -124,6 +153,14 @@ export class ExemptWrites {
                 code: "write_outcome_unknown",
                 message: "A write this program sent has no known outcome, so that is the result rather than what the program returned. It will not be sent again. Check its target before doing anything that depends on it.",
                 retryable: false,
+                ...(this.deadlines.length > 0 ? { details: this.deadlines[0] } : {}),
+                ...(this.deadlines.length > 1 ? { timeouts: this.deadlines } : {}),
+                ...(this.uncertainCalls.length === 1
+                    ? { uncertainCall: this.uncertainCalls[0] }
+                    : this.uncertainCalls.length > 1
+                        ? { uncertainCalls: this.uncertainCalls }
+                        : {}),
+                ...(this.uncertainCallsTruncated ? { uncertainCallsTruncated: true } : {}),
                 writes,
             });
         }