@zackbart/connecta 0.31.0 → 0.33.0

package/dist/operator-ui/member-page.js

@@ -0,0 +1,112 @@
+import { connectorStatusLabel, connectorStatusTone } from "./view.js";
+/**
+ * Whether the member's own partition holds a credential, read from `actions`
+ * alone (P6b): `clear` is listed only when a value is stored. Connection
+ * state says whether it works, never whether it exists.
+ */
+function credentialStored(manage) {
+    return manage.actions.includes("clear");
+}
+function controlsFor(manage, connection) {
+    const can = (action) => (manage.kind === "none" ? false : manage.actions.includes(action));
+    if (manage.kind === "oauth") {
+        const connected = connection.state === "ok";
+        const controls = [];
+        if (!connected && can("connect")) {
+            controls.push({ kind: "connect", label: connection.state === "auth_required" ? "Connect" : "Reconnect" });
+        }
+        if (connected && can("restart"))
+            controls.push({ kind: "restart", label: "Reconnect" });
+        if (connection.state !== "auth_required" && can("disconnect")) {
+            controls.push({ kind: "disconnect", label: "Disconnect" });
+        }
+        return controls;
+    }
+    if (manage.kind === "credential") {
+        // `save` without `clear`: nothing stored yet. `test` is listed only for a stored value.
+        const stored = credentialStored(manage);
+        return [
+            ...(can("save")
+                ? [{ kind: "save", label: stored ? "Replace" : "Add credential" }]
+                : []),
+            ...(can("test") ? [{ kind: "test", label: "Test" }] : []),
+            ...(can("clear") ? [{ kind: "clear", label: "Clear" }] : []),
+        ];
+    }
+    return [];
+}
+function summaryFor(manage, connection) {
+    if (manage.kind === "credential") {
+        if (!credentialStored(manage)) {
+            return manage.actions.includes("save") ? "Add your credential to use its tools." : "No credential saved.";
+        }
+        if (connection.problem === "credential_mismatch")
+            return "Your saved credential no longer fits. Replace it.";
+        return connection.state === "ok" ? "Your credential is saved." : "Your credential is saved, but it isn't working.";
+    }
+    if (connection.state === "ok")
+        return "Connected with your account.";
+    if (connection.state === "auth_required") {
+        return manage.kind === "oauth" && manage.actions.includes("connect")
+            ? "Not connected. Its tools won't work for you until you connect."
+            : "Not connected.";
+    }
+    return "Unavailable right now.";
+}
+const toolCount = (connector) => connector.tools.length;
+export function memberPage(contract) {
+    if (contract?.role !== "member")
+        return { endpoints: [], accounts: [], shared: [] };
+    return {
+        endpoints: contract.pools.map((pool) => ({ pool: pool.name, path: pool.humanPath })),
+        accounts: contract.connectors
+            .filter((connector) => connector.authScope === "personal")
+            .map((connector) => {
+            const connection = connector.connection ?? { state: "auth_required" };
+            return {
+                id: connector.id,
+                title: connector.title || connector.id,
+                toolCount: toolCount(connector),
+                badge: connector.connection
+                    ? {
+                        label: connectorStatusLabel(connection.state, connection.problem),
+                        tone: connectorStatusTone(connection.state),
+                    }
+                    : null,
+                summary: summaryFor(connector.manage, connection),
+                manage: connector.manage,
+                controls: controlsFor(connector.manage, connection),
+            };
+        }),
+        // Names and counts only: a shared connector's state is not the member's to see.
+        shared: contract.connectors
+            .filter((connector) => connector.authScope === "shared")
+            .map((connector) => ({
+            id: connector.id,
+            title: connector.title || connector.id,
+            toolCount: toolCount(connector),
+        })),
+    };
+}
+export function toolCountLabel(count) {
+    return `${count} ${count === 1 ? "tool" : "tools"}`;
+}
+/** The in-page question before a member's action that takes something away. */
+export function memberConfirmCopy(action, name) {
+    if (action === "oauth_restart") {
+        return {
+            question: `Reconnect ${name}? Your current connection stops working until you finish authorizing in the new tab.`,
+            confirm: "Reconnect",
+        };
+    }
+    if (action === "oauth_disconnect") {
+        return {
+            question: `Disconnect your ${name} account? Its tools stop working for you until you connect again.`,
+            confirm: "Disconnect",
+        };
+    }
+    return {
+        question: `Clear your ${name} credential? Its tools stop working for you until you add one again.`,
+        confirm: "Clear",
+    };
+}

package/dist/operator-ui/model.d.ts

@@ -1,6 +1,7 @@
-import type { OperatorConnectorOverlay, OperatorTool, OperatorUiContract, OperatorViewer } from "./contract.js";
+import type { ConnectaConfigDescription } from "../describe-config.js";
+import type { OperatorConnectorOverlay, OperatorTool } from "./contract.js";
 import type { CatalogAccessObservation, CatalogDriftReport, ResourceTemplateRefusalCode } from "../types.js";
-/** Tool verdicts, independent of the selected pool's trust. */
+/** Tool verdicts, independent of whether the selected pool is read-only. */
 export type UiToolSafety = "runs_in_programs" | "needs_approval";
 export interface UiTool extends Pick<OperatorTool, "name" | "address" | "description"> {
     /** Absent only in payloads older than the field; the page then shows no badge. */
@@ -28,7 +29,8 @@ interface UiCredentialField {
     description?: string;
     placeholder?: string;
     inputType: "email" | "password" | "text";
-    configured: boolean;
+    /** null when metadata could not be read. */
+    configured: boolean | null;
     lastFour?: string;
     updatedAt?: string;
 }
@@ -37,7 +39,8 @@ interface UiCredential {
     description?: string;
     placeholder?: string;
     fields?: UiCredentialField[];
-    configured: boolean;
+    /** null when metadata could not be read. */
+    configured: boolean | null;
     /** A stored value exists and may be deleted even if it cannot be decrypted. */
     removable?: boolean;
     lastFour?: string;
@@ -60,7 +63,12 @@ export interface UiConnector {
     title?: string;
     description?: string;
     status: "loading" | OperatorConnectorOverlay["status"];
-    permissions?: Omit<OperatorViewer["permissions"]["connectors"][number], "id">;
+    /** What this maintainer may do with the connector. */
+    permissions?: {
+        use: boolean;
+        manageSharedAuth: boolean;
+        connectPersonal: boolean;
+    };
     /**
      * Why this connector is not usable, when it is not. See `UiProblem`. The
      * only failure detail the payload carries; the status message behind it is
@@ -91,9 +99,9 @@ export interface UiConnector {
 export type CredentialManagementCapability = "available" | "requires_operator" | "vault_not_configured" | "no_slots";
 export interface UiData {
     accessTokenManagement?: "available" | "requires_operator";
-    serverInfo: Pick<OperatorUiContract["config"]["server"], "name" | "version">;
+    serverInfo: Pick<ConnectaConfigDescription["server"], "name" | "version">;
     /** Version of the installed @zackbart/connecta package. */
-    connectaVersion: OperatorUiContract["config"]["connectaVersion"];
+    connectaVersion: ConnectaConfigDescription["connectaVersion"];
     connectors: UiConnector[];
     activityEnabled: boolean;
     credentialManagement: CredentialManagementCapability;

package/dist/operator-ui/view.d.ts

@@ -1,7 +1,8 @@
-import type { OperatorUiContract } from "./contract.js";
+import type { OperatorRole, OperatorUiContractV2 } from "./contract.js";
 import type { CatalogDriftReport } from "../types.js";
 import type { CredentialManagementCapability, UiConnector, UiData, UiProblem } from "./model.js";
 import type { FixPromptKind } from "./fix-prompts.js";
+import type { AgentSlot } from "./agents.js";
 export declare function registrationPathLabel(path: NonNullable<UiConnector["registrationPath"]>): string;
 /**
  * A connector's source column: the maintained provider with the
@@ -12,19 +13,26 @@ export declare function connectorSourceLabel(source: {
     kind: string;
     provider?: string;
 }): string;
-export type OperatorPage = "overview" | "tools" | "access" | "config" | "connector" | "tokens" | "connections" | "activity";
-/** Pages the nav lists. */
+export type OperatorPage = "endpoints" | "settings" | "connector" | "tokens" | "connections" | "activity";
+/** Pages the nav lists, in dashboard order. */
 export declare const OPERATOR_PAGES: readonly OperatorPage[];
 export declare const PAGE_META: Readonly<Record<OperatorPage, {
     path: string;
     label: string;
 }>>;
+/** Legacy links remain valid, with the browser replacing their URL. */
+export declare function canonicalOperatorPath(path: string): string;
 /**
  * What each page is for, in one line under its heading — on the gate as well
  * as once signed in, so the page an operator lands on reads the same before
  * and after the session is checked.
  */
 export declare function pageDescription(page: OperatorPage, productDescription: string): string;
+/**
+ * Signed in, but neither a maintainer nor a member of any endpoint: who to
+ * ask, and that this is not an error to retry.
+ */
+export declare function noAccessCopy(kind: string, productName: string): string;
 /** What the gate says while the session is checked, page by page. */
 export declare function checkingCopy(): string;
 export declare function pageForPath(path: string): OperatorPage;
@@ -83,12 +91,16 @@ export declare function failure(message: string, fix?: NoticeFix): Notice;
  *   mutation that is a permission, not an expired session, so it stays inline.
  * - `network` — the browser could not reach the deployment at all.
  * - `refused` — the route answered, and said no.
+ * - `stale` — never sent: what the action was checked against changed before
+ *   dispatch (a refreshed slot list or member contract).
  */
-export type RequestFailureKind = "session" | "forbidden" | "network" | "refused";
+export type RequestFailureKind = "session" | "forbidden" | "network" | "refused" | "stale";
 export interface RequestFailureFacts {
     kind: RequestFailureKind;
     status?: number | undefined;
     problem?: unknown;
+    /** A refusal's machine `code` from a closed set, such as `slot_changed`; checked, never shown. */
+    code?: unknown;
 }
 /**
  * What the notices for an OAuth action and a credential Test say. Each of
@@ -121,6 +133,8 @@ export declare function credentialTestNotice(connectorId: string, answer: {
  * checked, not trusted.
  */
 export declare function refusedNotice(action: DownstreamAction, connectorId: string, problem?: unknown): Notice;
+/** An action whose permission or target changed before it was sent. */
+export declare const STALE_COPY = "This changed before the request was sent, so nothing was sent. Check it and try again.";
 /**
  * Every row action's failure, in one voice. The page's own failures — a
  * lapsed session, a denied identity, a dropped connection — read the same for
@@ -133,7 +147,7 @@ export declare function actionFailedNotice(action: RowAction, connectorId: strin
  * server's `connector_unavailable` and keeps its own copy and fix prompt;
  * these two have nothing for a coding agent to fix.
  */
-export type ConnectorLoadFailure = "session" | "network";
+export type ConnectorLoadFailure = "session" | "network" | "unavailable";
 export declare function connectorLoadFailureCopy(failure: ConnectorLoadFailure, productName: string): string;
 /** The signed-in page's answer when `/ui/data` could not be read. */
 export declare function loadFailureCopy(failure: "server" | "network", productName: string): {
@@ -158,20 +172,27 @@ export declare function confirmCopy(action: PendingConfirm["action"], name: stri
  * page fetch again after an identity change.
  */
 type LoadPhase = "idle" | "loading" | "ready" | "error";
-export interface UiAccessToken {
-    id: string;
-    name: string;
-    tokenPrefix: string;
-    createdAt: string;
-    revokedAt?: string;
-}
 export declare function accessTokenUnavailableCopy(capability?: string): string;
 export interface OperatorState {
     tokenPhase: LoadPhase;
     tokenNotice: Notice | null;
-    tokens: UiAccessToken[];
+    /** One slot per declared agent, from `/ui/access-tokens`. */
+    tokens: AgentSlot[];
+    /** A just-issued secret, shown once in its dialog and dropped when that closes. */
     createdToken: string | null;
-    tokenRenaming: string | null;
+    /** The agent `createdToken` belongs to. */
+    createdTokenFor: string | null;
+    /** A rotation or revocation waiting on its in-row confirmation. */
+    tokenConfirm: {
+        name: string;
+        action: "rotate" | "revoke";
+    } | null;
+    /**
+     * Agents whose last token operation ended with an unknown outcome (503,
+     * 499, or a dropped connection). Their actions stay off until a slot list
+     * read that started after the failure succeeds.
+     */
+    unresolvedSlots: string[];
     tokenBusy: boolean;
     page: OperatorPage;
     /**
@@ -180,11 +201,17 @@ export interface OperatorState {
      * the fence that keeps one identity's data off another identity's screen.
      */
     generation: number;
-    /** `loading` until the first /ui/data answer decides gated or ready. */
-    session: "loading" | "gated" | "ready";
+    /**
+     * `loading` until `/ui/api/config` answers (and, for a maintainer,
+     * `/ui/data` too). `denied` is signed in as someone who is neither a
+     * maintainer nor a pool member.
+     */
+    session: "loading" | "gated" | "ready" | "denied";
     gate: Notice | null;
     /** True while a signed-in operator's /ui/data is in flight. */
     refreshing: boolean;
+    /** A bounded admission recovery is pending; Retry can supersede it. */
+    recoveryPending: boolean;
     /**
      * Why the last /ui/data read failed when the session itself was not the
      * reason: the page stays signed in, with its chrome, and offers a retry.
@@ -204,7 +231,14 @@ export interface OperatorState {
      */
     focusIfLost: string | null;
     data: UiData | null;
-    contract: OperatorUiContract | null;
+    /** Operator contract v2, for either role; null until `/ui/api/config` answers. */
+    contract: OperatorUiContractV2 | null;
+    /**
+     * The role the last good contract confirmed. It outlives a failed refresh
+     * that clears `contract`, so the next answer with a different role is
+     * still recognized as a different viewer. Only an identity reset clears it.
+     */
+    role: OperatorRole | null;
     contractPhase: LoadPhase;
     health: "loading" | "ok" | "unavailable";
     connectorFilter: string;
@@ -218,6 +252,11 @@ export interface OperatorState {
      * new tab: its row offers the link instead of the button.
      */
     oauthBlocked: string | null;
+    /**
+     * The authorization link the route returned for `oauthBlocked`. A member has
+     * no `/ui/data` connector to keep it on, so it is held here.
+     */
+    oauthBlockedUrl: string | null;
     /** A row action waiting for its in-page confirmation. */
     confirming: PendingConfirm | null;
     /** Connectors whose details failed on this side of the deployment. */
@@ -235,6 +274,31 @@ export interface OperatorState {
     activityCursor: string | null;
     activitySearch: string;
 }
+/** Who the contract says this viewer is, or null before it loads. */
+export declare function operatorRole(state: Pick<OperatorState, "contract">): OperatorRole | null;
+/**
+ * The role pages and navigation render for. The contract's, or, while a
+ * refresh that failed has left no contract on screen, maintainer when the
+ * last good contract confirmed one and that maintainer's data is still here:
+ * their page stays mounted on its own retry state instead of being torn down
+ * mid-recovery. Never a request's permission; the store sends maintainer
+ * reads only while the contract itself says maintainer.
+ */
+export declare function displayRole(state: Pick<OperatorState, "contract" | "role" | "data">): OperatorRole | null;
+/**
+ * A confirmed maintainer's page is mounted without a contract behind it: a
+ * refresh failed, or its read ran past the deadline. The shell shows one
+ * recovery banner with Retry above whichever page is open, and that page is
+ * stale until a contract confirms the role again.
+ */
+export declare function contractRecovering(state: Pick<OperatorState, "contract" | "role" | "data">): boolean;
+/**
+ * Whether Activity is open to this viewer: maintainers only, on a deployment
+ * that records history. Members always read "forbidden".
+ */
+export declare function activityReadable(state: Pick<OperatorState, "contract" | "data">): boolean;
+/** The contract's half of `activityReadable`: a maintainer, on a deployment that records. */
+export declare function activityAllowed(state: Pick<OperatorState, "contract">): boolean;
 export declare function initialState(page: OperatorPage): OperatorState;
 /**
  * Drop to the gate and forget the previous operator. Bumping the generation is
@@ -254,7 +318,7 @@ export declare function credentialUnavailableCopy(capability?: CredentialManagem
  */
 export declare function connectorStatusLabel(status: string, problem?: UiProblem): string;
 /** The tone a status carries wherever it is rendered as a badge or a tile. */
-export type Tone = "ok" | "warn" | "danger" | "neutral";
+export type Tone = "ok" | "warn" | "danger" | "neutral" | "accent";
 export declare function connectorStatusTone(status: string): Tone;
 export declare function problemCopy(problem: UiProblem | undefined): string | null;
 /**
@@ -322,7 +386,8 @@ export declare function activityDetail(event: UiActivityEvent): string;
  */
 export declare function credentialProblemCopy(problem: string | undefined): string;
 export declare function credentialStateLabel(credential: {
-    configured: boolean;
+    configured: boolean | null;
+    problem?: string;
     fields?: unknown[];
     lastFour?: string;
     updatedAt?: string;

package/dist/operator-ui/view.js

@@ -25,25 +25,20 @@ export function connectorSourceLabel(source) {
     const implementation = source.kind === "remote-mcp" ? "hosted MCP" : source.kind === "api" ? "REST" : source.kind;
     return `${source.provider} · ${implementation}`;
 }
-/** Pages the nav lists. */
-export const OPERATOR_PAGES = [
-    "overview",
-    "connections",
-    "tools",
-    "access",
-    "activity",
-    "config",
-];
+/** Pages the nav lists, in dashboard order. */
+export const OPERATOR_PAGES = ["endpoints", "connections", "activity", "tokens", "settings"];
 export const PAGE_META = {
-    overview: { path: "/", label: "Overview" },
+    endpoints: { path: "/", label: "Endpoints" },
     connector: { path: "/connectors", label: "Connector" },
-    tools: { path: "/tools", label: "Tools" },
-    access: { path: "/access", label: "Access" },
-    config: { path: "/config", label: "Config" },
-    tokens: { path: "/tokens", label: "Access tokens" },
+    settings: { path: "/settings", label: "Settings" },
+    tokens: { path: "/tokens", label: "Tokens" },
     connections: { path: "/connectors", label: "Connectors" },
     activity: { path: "/activity", label: "Activity" },
 };
+/** Legacy links remain valid, with the browser replacing their URL. */
+export function canonicalOperatorPath(path) {
+    return { "/access": "/", "/tools": "/connectors", "/config": "/settings" }[path] ?? path;
+}
 /**
  * What each page is for, in one line under its heading — on the gate as well
  * as once signed in, so the page an operator lands on reads the same before
@@ -55,6 +50,18 @@ export function pageDescription(page, productDescription) {
     }
     return productDescription;
 }
+/**
+ * Signed in, but neither a maintainer nor a member of any endpoint: who to
+ * ask, and that this is not an error to retry.
+ */
+export function noAccessCopy(kind, productName) {
+    const who = kind === "clerk"
+        ? "This account is signed in"
+        : kind === "cloudflare-access"
+            ? "Cloudflare Access signed you in"
+            : "This token is valid";
+    return `${who}, but it isn't a maintainer or a member of any endpoint on ${productName}. Ask a maintainer of this deployment to add you to an endpoint, then reload.`;
+}
 /** What the gate says while the session is checked, page by page. */
 export function checkingCopy() {
     return "Checking your session…";
@@ -64,7 +71,7 @@ export function pageForPath(path) {
         return "connector";
     if (path === "/tokens")
         return "tokens";
-    const match = OPERATOR_PAGES.find((page) => PAGE_META[page].path === path);
+    const match = OPERATOR_PAGES.find((page) => PAGE_META[page].path === canonicalOperatorPath(path));
     return match ?? "connections";
 }
 export function info(message) {
@@ -138,6 +145,8 @@ function credentialRefusedCopy(action, status, problem) {
     }
     return `The credential wasn't ${verb}. Try again; if it keeps failing, the deployment's log has the reason.`;
 }
+/** An action whose permission or target changed before it was sent. */
+export const STALE_COPY = "This changed before the request was sent, so nothing was sent. Check it and try again.";
 /**
  * Every row action's failure, in one voice. The page's own failures — a
  * lapsed session, a denied identity, a dropped connection — read the same for
@@ -153,14 +162,18 @@ export function actionFailedNotice(action, connectorId, facts, productName) {
     if (facts.kind === "network") {
         return failure(`Couldn't reach ${productName}. Check your connection and try again.`);
     }
+    if (facts.kind === "stale")
+        return failure(STALE_COPY);
     if (action === "credential_save" || action === "credential_remove") {
         return failure(credentialRefusedCopy(action, facts.status, facts.problem));
     }
     return refusedNotice(action, connectorId, facts.problem);
 }
 export function connectorLoadFailureCopy(failure, productName) {
+    if (failure === "unavailable")
+        return "Session identity is temporarily unavailable. Retry this connection.";
     return failure === "session"
-        ? "Your session wasn't accepted while loading this connector. Sign in again to see its status."
+        ? "Your session wasn't accepted while loading this connector. Retry to check again. Sign in again if the session keeps failing."
         : `Couldn't reach ${productName} to load this connector. Check your connection, then refresh it.`;
 }
 /** The signed-in page's answer when `/ui/data` could not be read. */
@@ -208,6 +221,46 @@ export function accessTokenUnavailableCopy(capability) {
         ? "Access tokens are not configured for this deployment."
         : "Token management requires an interactive sign-in and explicit permission.";
 }
+/** Who the contract says this viewer is, or null before it loads. */
+export function operatorRole(state) {
+    return state.contract?.role ?? null;
+}
+/**
+ * The role pages and navigation render for. The contract's, or, while a
+ * refresh that failed has left no contract on screen, maintainer when the
+ * last good contract confirmed one and that maintainer's data is still here:
+ * their page stays mounted on its own retry state instead of being torn down
+ * mid-recovery. Never a request's permission; the store sends maintainer
+ * reads only while the contract itself says maintainer.
+ */
+export function displayRole(state) {
+    if (state.contract)
+        return state.contract.role;
+    return state.role === "maintainer" && state.data ? "maintainer" : null;
+}
+/**
+ * A confirmed maintainer's page is mounted without a contract behind it: a
+ * refresh failed, or its read ran past the deadline. The shell shows one
+ * recovery banner with Retry above whichever page is open, and that page is
+ * stale until a contract confirms the role again.
+ */
+export function contractRecovering(state) {
+    return !state.contract && displayRole(state) === "maintainer";
+}
+/**
+ * Whether Activity is open to this viewer: maintainers only, on a deployment
+ * that records history. Members always read "forbidden".
+ */
+export function activityReadable(state) {
+    return Boolean(state.data?.activityEnabled) && activityAllowed(state);
+}
+/** The contract's half of `activityReadable`: a maintainer, on a deployment that records. */
+export function activityAllowed(state) {
+    const contract = state.contract;
+    return (contract?.role === "maintainer" &&
+        contract.live.activity !== "forbidden" &&
+        contract.live.activity !== "unconfigured");
+}
 export function initialState(page) {
     return {
         page,
@@ -228,8 +281,10 @@ export function initialState(page) {
  */
 function identityScopedState() {
     return {
+        recoveryPending: false,
         data: null,
         contract: null,
+        role: null,
         contractPhase: "idle",
         health: "loading",
         connectorFilter: "",
@@ -237,6 +292,7 @@ function identityScopedState() {
         oauthNoticeFor: null,
         oauthBusy: null,
         oauthBlocked: null,
+        oauthBlockedUrl: null,
         confirming: null,
         connectorFailures: {},
         credentialNotice: null,
@@ -247,7 +303,9 @@ function identityScopedState() {
         tokenNotice: null,
         tokens: [],
         createdToken: null,
-        tokenRenaming: null,
+        createdTokenFor: null,
+        tokenConfirm: null,
+        unresolvedSlots: [],
         tokenBusy: false,
         activityPhase: "idle",
         activityNotice: null,
@@ -283,7 +341,8 @@ export function withPage(state, page) {
         ...state,
         page,
         createdToken: null,
-        tokenRenaming: null,
+        createdTokenFor: null,
+        tokenConfirm: null,
         tokenNotice: null,
         credentialEditing: null,
         credentialNotice: null,
@@ -551,6 +610,7 @@ const REASON_LABELS = {
     invalid_args: "arguments didn't match the schema",
     destructive_reroute: "needed host approval",
     destructive_tool_requires_approval: "needed host approval",
+    read_only_endpoint: "endpoint is read-only",
     approval_required: "needed approval",
     auth_required: "needed authorization",
     result_too_large: "result too large to return inline",
@@ -585,20 +645,22 @@ export function credentialProblemCopy(problem) {
     if (problem === "credential_mismatch")
         return PROBLEM_COPY.credential_mismatch;
     if (problem === "credential_unreadable") {
-        return "The stored credential can't be read, so it can't be used. Replace it, or remove it and add a new one.";
+        return "Credential status is unavailable. Retry the status check before replacing or removing the credential.";
     }
     return "The stored credential can't be used. Replace it, or remove it and add a new one.";
 }
 export function credentialStateLabel(credential) {
+    if (credential.configured === null || credential.problem === "credential_unreadable")
+        return "unavailable";
     if (!credential.configured)
         return "not configured";
-    const masked = credential.fields?.length ? "configured" : `configured · ••••${credential.lastFour ?? ""}`;
+    const masked = "configured";
     return credential.updatedAt ? `${masked} · updated ${formatDate(credential.updatedAt)}` : masked;
 }
 /** Gate copy for each browser-auth shape, so the sign-in state is never a blank page. */
 export function gateCopy(kind, signedIn) {
     if (kind === "cloudflare-access") {
-        return "Cloudflare Access admitted this browser, but the current identity cannot open deployment-wide operator pages.";
+        return "Checking Cloudflare Access identity failed. Retry to check whether this browser can open operator pages.";
     }
     if (kind !== "clerk") {
         return "Paste an operator bearer token to open this page. Nothing is requested until you do.";

package/dist/page-styles.js

@@ -1,6 +1,6 @@
 // Generated by scripts/build-operator-ui.mjs. Do not edit.
 // Source: src/operator-ui/tokens.css and src/operator-ui/page.css.
 /** Custom properties and both palettes; styles no element. */
-export const TOKENS_CSS = ":root{color-scheme:light;--accent: #5263e8;--radius: 6px;--sans: \"Inter Variable\", ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--bg: #ffffff;--surface: #ffffff;--surface-2: #f7f8fa;--border: #e8eaee;--border-strong: #cdd2da;--text: #20232b;--muted: #69707e;--ok: #12734a;--warn: #9a5b06;--danger: #bb3226;--on-accent: #ffffff;--link: var(--accent);--tint: color-mix(in srgb, var(--accent) 8%, var(--surface));--shell: 68rem;--pad: 1.25rem;--gap: 1rem;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-6: 1.5rem;--space-8: 2rem;--text-xs: .75rem;--text-sm: .8125rem;--text-base: .875rem;--sidebar-width: 14rem}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--bg: #111216;--surface: #18191e;--surface-2: #202127;--border: #2a2b33;--border-strong: #3b3d48;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}}html[data-scheme=dark]{--bg: #111216;--surface: #18191e;--surface-2: #202127;--border: #2a2b33;--border-strong: #3b3d48;--text: #e6eaf1;--muted: #97a1b2;--ok: #4cc48c;--warn: #e2a33f;--danger: #f4776c;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}";
+export const TOKENS_CSS = ":root{color-scheme:light;--default-accent: #171717;--accent: var(--default-accent);--radius: 8px;--sans: \"Geist Sans\", ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: \"Geist Mono\", ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--bg: #fafafa;--surface: #ffffff;--surface-2: #f5f5f5;--border: #eaeaea;--border-strong: #d4d4d4;--text: #171717;--muted: #666666;--ok: #0a7d33;--warn: #a35200;--danger: #d8242c;--on-accent: #ffffff;--link: var(--accent);--blue: #0060df;--tint: color-mix(in srgb, var(--accent) 8%, var(--surface));--shell: 68rem;--pad: 1.25rem;--gap: 1rem;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-6: 1.5rem;--space-8: 2rem;--text-xs: .75rem;--text-sm: .8125rem;--text-base: .875rem}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--default-accent: #ededed;--on-accent: #171717;--blue: #70b3ff;--bg: #0a0a0a;--surface: #111111;--surface-2: #1a1a1a;--border: #2e2e2e;--border-strong: #454545;--text: #ededed;--muted: #a1a1a1;--ok: #4cce83;--warn: #f5b85a;--danger: #ff777f;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}}html[data-scheme=dark]{--default-accent: #ededed;--on-accent: #171717;--blue: #70b3ff;--bg: #0a0a0a;--surface: #111111;--surface-2: #1a1a1a;--border: #2e2e2e;--border-strong: #454545;--text: #ededed;--muted: #a1a1a1;--ok: #4cce83;--warn: #f5b85a;--danger: #ff777f;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}";
 /** Base typography, the shell, masthead, buttons, badges, and messages. */
 export const PAGE_CSS = "*{box-sizing:border-box}html{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:16px;line-height:1.5;-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh}:is(h1,h2,h3,p,ul,ol){margin:0;padding:0}:is(h1,h2,h3){font-weight:600;line-height:1.3}h1{font-size:1.5rem;letter-spacing:-.01em}h2{font-size:1rem}:is(ul,ol){list-style:none}a{color:var(--link);text-decoration-thickness:1px;text-underline-offset:2px}button,input{font:inherit}:is(a,button,input,summary):focus-visible{border-radius:calc(var(--radius) / 2);outline:2px solid var(--link);outline-offset:2px}.skip-link{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);left:var(--pad);padding:.5rem .75rem;position:fixed;top:-4rem;z-index:10}.skip-link:focus{top:var(--pad)}.shell{margin:0 auto;max-width:var(--shell);padding-left:var(--pad);padding-right:var(--pad)}.cap,.meta{color:var(--muted);font-size:.875rem}.mono{font-family:var(--mono);font-size:.8125rem}.visually-hidden{clip-path:inset(50%);height:1px;overflow:hidden;position:absolute;white-space:nowrap;width:1px}.masthead{align-items:center;background:var(--surface);border-bottom:1px solid var(--border);display:flex;gap:var(--gap);justify-content:space-between;max-width:none;padding-bottom:.75rem;padding-top:.75rem;position:sticky;top:0;z-index:5}.masthead-inner{align-items:center;display:flex;gap:var(--gap);justify-content:space-between;margin:0 auto;max-width:var(--shell);width:100%}.mast-nav,.mast-actions,.page-nav,.session-actions{align-items:center;display:flex;flex-wrap:wrap;gap:.25rem}.mast-nav,.mast-actions{gap:var(--gap)}.navlink{background:none;border:0;border-radius:calc(var(--radius) - 2px);color:var(--muted);cursor:pointer;font-size:.9375rem;padding:.35rem .6rem;text-decoration:none}.navlink:hover{background:var(--surface-2);color:var(--text)}.navlink[aria-current=page]{background:var(--tint);color:var(--link);font-weight:500}.brand,.product{padding-left:0;padding-right:0;text-decoration:none}.brand{color:var(--text);font-weight:600}.brand:hover,.product:hover{background:none}.product{color:var(--muted)}.page{padding-bottom:4rem;padding-top:2rem}.lead{margin-bottom:1.5rem}.lead-copy{color:var(--muted);display:grid;gap:.5rem;margin-top:.35rem}.lead-copy p{max-width:60ch}.btn{background:var(--surface);border:1px solid var(--border-strong);border-radius:calc(var(--radius) - 2px);color:var(--text);cursor:pointer;display:inline-flex;align-items:center;font-size:.875rem;gap:.35rem;padding:.35rem .7rem;text-decoration:none;white-space:nowrap}.btn:hover{background:var(--surface-2)}.btn:disabled{cursor:not-allowed;opacity:.55}.btn.primary{background:var(--accent);border-color:var(--accent);color:var(--on-accent)}.btn.primary:hover{background:color-mix(in srgb,var(--accent) 88%,black)}.btn.danger{color:var(--danger)}.btn.danger:hover{background:color-mix(in srgb,var(--danger) 10%,var(--surface))}.btn.quiet{background:none;border-color:var(--border);color:var(--muted)}.btn.quiet:hover{background:var(--surface-2);color:var(--text)}.badge{align-items:center;background:var(--surface-2);border-radius:999px;color:var(--muted);display:inline-flex;font-size:.75rem;gap:.3rem;line-height:1.6;padding:.1rem .5rem;white-space:nowrap}.badge.ok{background:color-mix(in srgb,var(--ok) 12%,var(--surface));color:var(--ok)}.badge.warn{background:color-mix(in srgb,var(--warn) 14%,var(--surface));color:var(--warn)}.badge.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.badge.accent{background:var(--tint);color:var(--link)}.msg{background:color-mix(in srgb,var(--danger) 8%,var(--surface));border:1px solid color-mix(in srgb,var(--danger) 28%,var(--surface));border-radius:calc(var(--radius) - 2px);color:var(--danger);font-size:.875rem;padding:.5rem .75rem}.status-page{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);display:grid;gap:.75rem;margin:1.5rem auto 0;max-width:34rem;padding:1.5rem}.status-head{align-items:center;display:flex;gap:.6rem}.status-mark{align-items:center;background:var(--surface-2);border-radius:50%;color:var(--muted);display:inline-flex;flex:none;height:2rem;justify-content:center;width:2rem}.status-mark svg{height:1.25rem;width:1.25rem}.status-mark.ok{background:color-mix(in srgb,var(--ok) 14%,var(--surface));color:var(--ok)}.status-mark.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.status-label{color:var(--muted);font-size:.875rem;font-weight:600}.status-label.ok{color:var(--ok)}.status-label.danger{color:var(--danger)}.status-page h1{overflow-wrap:anywhere}.status-copy{color:var(--muted)}.status-actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:.25rem}.status-details{border-top:1px solid var(--border);color:var(--muted);font-size:.875rem;margin-top:.25rem;padding-top:.75rem}.status-details>summary{cursor:pointer;width:fit-content}.status-details>p{margin-top:.5rem}.status-details pre{background:var(--surface-2);border:1px solid var(--border);border-radius:calc(var(--radius) / 2);color:var(--text);font-family:var(--mono);font-size:.75rem;line-height:1.55;margin:.5rem 0 0;max-height:18rem;overflow:auto;overflow-wrap:anywhere;padding:.5rem .6rem;white-space:pre-wrap}@media(max-width:40rem){:root{--pad: 1rem}.status-page{margin-top:0;padding:1.25rem var(--pad)}}";

package/dist/program-writes.js

@@ -1,4 +1,4 @@
-// Budget and outcome accounting for writes dispatched by trusted programs.
+// Budget and outcome accounting for writes dispatched by programs on writable endpoints.
 // Await each dispatched write once; never conceal an unknown outcome.
 import { CONFIG_DEFAULTS } from "./config-defaults.js";
 import { Effect } from "effect";
@@ -41,7 +41,7 @@ export function writeStateOf(outcome) {
         : state;
 }
 /**
- * The trusted-pool writes one program sends. The play closes this when the
+ * The writes one program sends. The play closes this when the
  * program settles — a write that reaches the gate after is not sent — and
  * drains what is on the wire before the run's scope aborts it, so the write
  * finishes and its activity says how it did. The result never hides a write