@zackbart/connecta 0.33.0 → 0.34.1

package/dist/operator-ui/view.js

@@ -14,21 +14,18 @@ const REGISTRATION_LABELS = {
 export function registrationPathLabel(path) {
     return REGISTRATION_LABELS[path];
 }
-/**
- * A connector's source column: the maintained provider with the
- * implementation it uses, since a dual provider's `auth` selects either the
- * vendor's hosted MCP server or Connecta's REST connector.
- */
-export function connectorSourceLabel(source) {
-    if (!source.provider)
-        return source.kind;
-    const implementation = source.kind === "remote-mcp" ? "hosted MCP" : source.kind === "api" ? "REST" : source.kind;
-    return `${source.provider} · ${implementation}`;
-}
 /** Pages the nav lists, in dashboard order. */
-export const OPERATOR_PAGES = ["endpoints", "connections", "activity", "tokens", "settings"];
+export const OPERATOR_PAGES = [
+    "overview",
+    "endpoints",
+    "connections",
+    "activity",
+    "tokens",
+    "settings",
+];
 export const PAGE_META = {
-    endpoints: { path: "/", label: "Endpoints" },
+    overview: { path: "/", label: "Overview" },
+    endpoints: { path: "/endpoints", label: "Endpoints" },
     connector: { path: "/connectors", label: "Connector" },
     settings: { path: "/settings", label: "Settings" },
     tokens: { path: "/tokens", label: "Tokens" },
@@ -37,7 +34,8 @@ export const PAGE_META = {
 };
 /** Legacy links remain valid, with the browser replacing their URL. */
 export function canonicalOperatorPath(path) {
-    return { "/access": "/", "/tools": "/connectors", "/config": "/settings" }[path] ?? path;
+    return ({ "/access": "/endpoints", "/tools": "/connectors", "/config": "/settings" }[path] ??
+        path);
 }
 /**
  * What each page is for, in one line under its heading — on the gate as well
@@ -46,7 +44,7 @@ export function canonicalOperatorPath(path) {
  */
 export function pageDescription(page, productDescription) {
     if (page === "activity") {
-        return "Every connector tool call, by who made it and how it ended. Arguments and results are never stored.";
+        return "Tool calls by caller and result. Arguments and results are not stored.";
     }
     return productDescription;
 }
@@ -55,12 +53,8 @@ export function pageDescription(page, productDescription) {
  * ask, and that this is not an error to retry.
  */
 export function noAccessCopy(kind, productName) {
-    const who = kind === "clerk"
-        ? "This account is signed in"
-        : kind === "cloudflare-access"
-            ? "Cloudflare Access signed you in"
-            : "This token is valid";
-    return `${who}, but it isn't a maintainer or a member of any endpoint on ${productName}. Ask a maintainer of this deployment to add you to an endpoint, then reload.`;
+    const who = kind === "clerk" ? "This account" : kind === "cloudflare-access" ? "This Cloudflare Access identity" : "This token";
+    return `${who} has no access to ${productName}. Ask a maintainer to add you to an endpoint, then reload.`;
 }
 /** What the gate says while the session is checked, page by page. */
 export function checkingCopy() {
@@ -81,8 +75,8 @@ export function failure(message, fix) {
     return fix ? { message, tone: "error", fix } : { message, tone: "error" };
 }
 const REFUSED_COPY = {
-    oauth_disconnect: "Disconnect didn't finish. If the service refused it, the deployment's log has its reply.",
-    oauth_reconnect: "Authorization couldn't start. If the service refused it, the deployment's log has its reply.",
+    oauth_disconnect: "Disconnect failed. The deployment log has the reason.",
+    oauth_reconnect: "Authorization couldn't start. The deployment log has the reason.",
     credential_test: "The credential test couldn't run.",
 };
 /**
@@ -92,20 +86,21 @@ const REFUSED_COPY = {
 export function oauthDoneNotice(action, answer, opened = true) {
     if (action === "oauth_disconnect") {
         if (answer?.code === "oauth_revocation_failed")
-            return info("Disconnected locally. Provider revocation could not be confirmed. Revoke the grant in the provider's console.");
-        return info("Disconnected. Connect again whenever you are ready.");
+            return info("Disconnected here. Revoke the grant in the provider's console too.");
+        return info("Disconnected.");
     }
     if (answer?.state === "ok")
         return info("Connected.");
-    return info(opened
-        ? "Finish authorizing in the new tab. This page updates when you come back."
-        : "Your browser blocked the new tab. Open the authorization page from the link here.");
+    return info(opened ? "Finish in the new tab." : "The new tab was blocked. Open the link here.");
 }
 /** A credential Test's result. `ok` is the only part of the answer it reads. */
 export function credentialTestNotice(connectorId, answer) {
     return answer?.ok === true
         ? info("Credential is valid.")
-        : failure("Credential test failed: the service rejected the stored credential, or the test couldn't reach it. The deployment's log has the service's reply.", { kind: "credential_test_failed", connectorId });
+        : failure("Credential test failed. The deployment log has the reason.", {
+            kind: "credential_test_failed",
+            connectorId,
+        });
 }
 /**
  * A route that refused one of these actions. A credential Test that found
@@ -134,19 +129,19 @@ function credentialRefusedCopy(action, status, problem) {
     const verb = action === "credential_save" ? "saved" : "removed";
     if (status === 400 || status === 413 || status === 415) {
         return action === "credential_save"
-            ? "The credential wasn't saved: a value is empty or not in the expected format. Check it and save again."
-            : "The credential wasn't removed. Refresh the page and try again.";
+            ? "Not saved. A value is empty or in the wrong format."
+            : "Not removed. Refresh and try again.";
     }
     if (status === 404) {
-        return "This connector no longer has a credential slot. Refresh the page to see its current setup.";
+        return "This connector no longer has a credential slot. Refresh the page.";
     }
     if (status === 503) {
-        return `Credential storage isn't configured on this deployment, so nothing was ${verb}.`;
+        return `No credential storage is configured, so nothing was ${verb}.`;
     }
-    return `The credential wasn't ${verb}. Try again; if it keeps failing, the deployment's log has the reason.`;
+    return `Not ${verb}. Try again, or check the deployment log.`;
 }
 /** An action whose permission or target changed before it was sent. */
-export const STALE_COPY = "This changed before the request was sent, so nothing was sent. Check it and try again.";
+export const STALE_COPY = "This changed before sending, so nothing was sent. Try again.";
 /**
  * Every row action's failure, in one voice. The page's own failures — a
  * lapsed session, a denied identity, a dropped connection — read the same for
@@ -154,13 +149,13 @@ export const STALE_COPY = "This changed before the request was sent, so nothing
  */
 export function actionFailedNotice(action, connectorId, facts, productName) {
     if (facts.kind === "session") {
-        return failure("Your session has ended. Sign in again, then retry.");
+        return failure("Session ended. Sign in again.");
     }
     if (facts.kind === "forbidden") {
-        return failure("You don't have permission to change this connection's authentication.");
+        return failure("You can't change this connection's authentication.");
     }
     if (facts.kind === "network") {
-        return failure(`Couldn't reach ${productName}. Check your connection and try again.`);
+        return failure(`Couldn't reach ${productName}. Try again.`);
     }
     if (facts.kind === "stale")
         return failure(STALE_COPY);
@@ -171,55 +166,55 @@ export function actionFailedNotice(action, connectorId, facts, productName) {
 }
 export function connectorLoadFailureCopy(failure, productName) {
     if (failure === "unavailable")
-        return "Session identity is temporarily unavailable. Retry this connection.";
+        return "Session identity is unavailable. Retry.";
     return failure === "session"
-        ? "Your session wasn't accepted while loading this connector. Retry to check again. Sign in again if the session keeps failing."
-        : `Couldn't reach ${productName} to load this connector. Check your connection, then refresh it.`;
+        ? "Session not accepted. Retry, or sign in again."
+        : `Couldn't reach ${productName}. Refresh to retry.`;
 }
 /** The signed-in page's answer when `/ui/data` could not be read. */
 export function loadFailureCopy(failure, productName) {
     return {
         title: `Couldn't reach ${productName}`,
         body: failure === "network"
-            ? "Your browser couldn't connect. Check your connection, then retry."
-            : "The deployment answered with an error. Retry in a moment; if it keeps failing, the deployment's log has the reason.",
+            ? "Your browser couldn't connect. Retry."
+            : "The deployment returned an error. Retry, or check its log.",
     };
 }
 /** A collection page's load failure: fixed words, whatever the route said. */
 export function collectionFailureCopy(_collection, facts, productName) {
     if (facts.kind === "network") {
-        return `Couldn't reach ${productName}. Check your connection, then retry.`;
+        return `Couldn't reach ${productName}. Retry.`;
     }
     if (facts.kind === "session")
-        return "Your session has ended. Sign in again to see this page.";
+        return "Session ended. Sign in again.";
     if (facts.kind === "forbidden" || facts.status === 404) {
-        return "Activity isn't available to this identity.";
+        return "Activity isn't available to you.";
     }
-    return "The deployment answered with an error. Retry in a moment; if it keeps failing, the deployment's log has the reason.";
+    return "The deployment returned an error. Retry, or check its log.";
 }
 /** The confirm's question, naming the connector by its title. */
 export function confirmCopy(action, name) {
     if (action === "oauth_disconnect") {
         return {
-            question: `Disconnect ${name}? Its stored grant and any pending authorization are removed, and its tools stop working until it is connected again.`,
+            question: `Disconnect ${name}? Its tools stop working until you connect again.`,
             confirm: "Disconnect",
         };
     }
     if (action === "oauth_restart") {
         return {
-            question: `Reconnect ${name}? Its current grant stops working until you finish authorizing in the new tab.`,
+            question: `Reconnect ${name}? It stops working until you finish in the new tab.`,
             confirm: "Reconnect",
         };
     }
     return {
-        question: `Remove ${name}'s credential? The connector stops authenticating until a replacement is added.`,
+        question: `Remove ${name}'s credential? Its tools stop working until you add a new one.`,
         confirm: "Remove",
     };
 }
 export function accessTokenUnavailableCopy(capability) {
     return capability === undefined
-        ? "Access tokens are not configured for this deployment."
-        : "Token management requires an interactive sign-in and explicit permission.";
+        ? "Agent tokens aren't configured."
+        : "Managing tokens needs an interactive sign-in with permission.";
 }
 /** Who the contract says this viewer is, or null before it loads. */
 export function operatorRole(state) {
@@ -352,12 +347,12 @@ export function withPage(state, page) {
 }
 export function credentialUnavailableCopy(capability) {
     if (capability === "no_slots") {
-        return "No connectors declare operator-managed credential slots. Connector credentials remain configuration-as-code until a slot is declared.";
+        return "No connector declares a credential slot. Credentials stay in code.";
     }
     if (capability === "vault_not_configured") {
-        return "Credential storage is not configured. Configure a vault before managing connector credentials here.";
+        return "No credential vault is configured.";
     }
-    return "Credential management requires an interactive user. Bearer-authenticated sessions can inspect connections but cannot manage stored credentials.";
+    return "Managing credentials needs an interactive sign-in. A bearer token can only view them.";
 }
 /**
  * The status badge. An auth-needed connector is named by what it needs, so a
@@ -394,12 +389,12 @@ export function connectorStatusTone(status) {
  * the same kind.
  */
 const PROBLEM_COPY = {
-    connector_unavailable: "Unavailable: its status check or catalog load failed, or did not finish in time. The deployment's log has the downstream error.",
-    oauth_required: "Needs OAuth authorization: no grant is stored, or the stored grant expired or was revoked.",
-    credential_required: "Needs a credential: nothing usable is stored in its credential slot.",
-    auth_required: "Needs authorization. Its secret lives in deployment configuration, not on this page.",
-    credential_mismatch: "The stored credential does not match the fields this connector declares, so it cannot be used.",
-    catalog_failed: "Connected, but its tool catalog could not be loaded, so none of its tools are served.",
+    connector_unavailable: "Unavailable. Its status check or catalog load failed or timed out. The deployment log has the error.",
+    oauth_required: "Needs OAuth authorization. No grant is stored, or it expired or was revoked.",
+    credential_required: "Needs a credential. Nothing usable is stored.",
+    auth_required: "Needs authorization. Its secret is set in deployment config, not here.",
+    credential_mismatch: "The stored credential doesn't match this connector's fields.",
+    catalog_failed: "Connected, but its catalog failed to load, so no tools are served.",
 };
 export function problemCopy(problem) {
     return problem ? (PROBLEM_COPY[problem] ?? null) : null;
@@ -414,19 +409,41 @@ export function problemTone(problem) {
         ? "warn"
         : "danger";
 }
+const PROBLEM_LABEL = {
+    connector_unavailable: "Unavailable",
+    oauth_required: "Authorization needed",
+    credential_required: "Credential needed",
+    auth_required: "Authorization needed",
+    credential_mismatch: "Credential mismatch",
+    catalog_failed: "Catalog failed",
+};
+function problemAction(problem) {
+    if (problem === "credential_mismatch")
+        return "Replace key";
+    return problemTone(problem) === "warn" ? "Connect" : "Inspect";
+}
 /**
- * What this identity may do with a connector, in one line. Being able to use it
- * is implied by seeing it at all, so the sentence covers authentication, which
- * is the part that differs between operators.
+ * The verdict the Connectors list, the Overview, Endpoints and a connector's
+ * page all show. The server's problem code comes first, then a failed detail
+ * read on this page, then a non-ok status. Catalog drift is informational. A problem
+ * outranks the status, so a connector whose catalog failed is never
+ * "Connected". A failed read marks its connector `connector_unavailable` in
+ * the store, so that one code beside a failed read is the page's own and
+ * reads "Couldn't load" instead of blaming the downstream.
  */
-export function permissionLabel(connector) {
-    if (connector.permissions?.manageSharedAuth) {
-        return "You can manage shared authentication for this connection.";
+export function connectorVerdict(live, signals = {}) {
+    if (live.problem && !(signals.failed && live.problem === "connector_unavailable")) {
+        return { tone: problemTone(live.problem), label: PROBLEM_LABEL[live.problem], action: problemAction(live.problem) };
     }
-    if (connector.permissions?.connectPersonal) {
-        return "You can connect your own account to this connection.";
+    if (signals.failed)
+        return { tone: "warn", label: "Couldn't load", action: "Inspect" };
+    if (live.status === "loading")
+        return { tone: "neutral", label: connectorStatusLabel(live.status), action: null };
+    if (live.status !== "ok") {
+        const tone = connectorStatusTone(live.status) === "warn" ? "warn" : "danger";
+        return { tone, label: connectorStatusLabel(live.status), action: tone === "warn" ? "Connect" : "Inspect" };
     }
-    return "Authentication for this connection is managed by your deployment.";
+    return { tone: "ok", label: "Connected", action: null };
 }
 /**
  * The categories, in the order an operator should read them: what the
@@ -450,7 +467,15 @@ function driftTotal(drift) {
 export function driftState(drift) {
     if (!drift)
         return "unavailable";
-    return driftTotal(drift) > 0 ? "warning" : "clean";
+    if (driftTotal(drift) > 0)
+        return "warning";
+    if (drift.reviewedBaseline !== true ||
+        drift.verification !== "complete" ||
+        !drift.schemaCoverage ||
+        drift.schemaCoverage.unpinned > 0 ||
+        drift.schemaCoverage.pinned === 0)
+        return "unavailable";
+    return "clean";
 }
 /** Every category with its count, so a clean report still shows its zeros. */
 export function driftCounts(drift) {
@@ -464,16 +489,28 @@ export function driftCounts(drift) {
 }
 /** One line naming the state and when it was observed. Never what drifted. */
 export function driftSummary(drift) {
-    const state = driftState(drift);
-    if (state === "unavailable") {
-        return "No catalog refresh observed yet in this runtime.";
-    }
-    const observed = formatDate(drift?.observedAt);
+    if (!drift)
+        return "No catalog refresh yet.";
+    const observed = formatDate(drift.observedAt);
     const when = observed ? ` · observed ${observed}` : "";
-    if (state === "clean")
-        return `Matches the reviewed manifest${when}`;
     const total = driftTotal(drift);
-    return `${total} difference${total === 1 ? "" : "s"} from the reviewed manifest${when}`;
+    const difference = total
+        ? `${total} difference${total === 1 ? "" : "s"}${drift.reviewedBaseline === false ? "" : " from the reviewed manifest"} · `
+        : "";
+    if (drift.reviewedBaseline === false)
+        return `${difference}No reviewed baseline${when}`;
+    if (drift.verification === "unavailable")
+        return `${difference}Schema verification unavailable${when}`;
+    const coverage = drift.schemaCoverage;
+    if (!coverage || coverage.pinned === 0)
+        return `${difference}Schemas not pinned${when}`;
+    if (coverage.unpinned > 0)
+        return `${difference}Partial schema coverage (${coverage.pinned} pinned, ${coverage.unpinned} not pinned)${when}`;
+    if (driftState(drift) === "clean")
+        return `Matches the reviewed manifest${when}`;
+    if (!total)
+        return `Schema verification unavailable${when}`;
+    return `${difference.replace(/ · $/, "")}${when}`;
 }
 /**
  * Only http/https may become a clickable href — the browser half of the gate
@@ -508,6 +545,7 @@ const ACTOR_KINDS = {
     bearer: "Bearer token",
     "cloudflare-access": "Cloudflare Access",
     anonymous: "Anonymous",
+    access_token: "Agent token",
 };
 /** How a caller signed in, as a person reads it. An unknown kind is shown as sent. */
 function actorKindLabel(kind) {
@@ -565,9 +603,10 @@ export function activitySummary(events) {
     if (events.length === 0)
         return "";
     const calls = events.filter((event) => event.kind !== "catalog_drift");
+    const failed = calls.filter((event) => ["error", "timeout"].includes(activityOutcomeClass(event.outcome))).length;
     const changes = events.length - calls.length;
     const tools = new Set(calls.map((event) => event.address)).size;
-    return `${calls.length} loaded call${calls.length === 1 ? "" : "s"} · ${tools} tool${tools === 1 ? "" : "s"}${changes ? ` · ${changes} catalog change${changes === 1 ? "" : "s"}` : ""}`;
+    return `${calls.length} loaded call${calls.length === 1 ? "" : "s"} · ${failed} failed · ${tools} tool${tools === 1 ? "" : "s"}${changes ? ` · ${changes} catalog change${changes === 1 ? "" : "s"}` : ""}`;
 }
 // A pause and an approval are neither success nor failure: each gets its own
 // class, and the stylesheet paints neither as an error. Nothing has emitted
@@ -613,12 +652,17 @@ const REASON_LABELS = {
     read_only_endpoint: "endpoint is read-only",
     approval_required: "needed approval",
     auth_required: "needed authorization",
-    result_too_large: "result too large to return inline",
+    result_too_large: "result too large",
     timeout: "timed out",
 };
 function reasonLabel(code) {
     return REASON_LABELS[code] ?? code.replaceAll("_", " ");
 }
+/** Why a call stalled or failed, in words; "" when nothing was recorded. */
+export function activityReason(event) {
+    const reasons = [event.friction, event.errorCode].filter((code) => Boolean(code)).map(reasonLabel);
+    return [...new Set(reasons)].join(" · ");
+}
 /** The one-line detail under an address: where it ran, retries, and why it stalled. */
 export function activityDetail(event) {
     if (event.kind === "catalog_drift")
@@ -645,27 +689,17 @@ export function credentialProblemCopy(problem) {
     if (problem === "credential_mismatch")
         return PROBLEM_COPY.credential_mismatch;
     if (problem === "credential_unreadable") {
-        return "Credential status is unavailable. Retry the status check before replacing or removing the credential.";
+        return "Credential status is unavailable. Retry before replacing or removing it.";
     }
-    return "The stored credential can't be used. Replace it, or remove it and add a new one.";
-}
-export function credentialStateLabel(credential) {
-    if (credential.configured === null || credential.problem === "credential_unreadable")
-        return "unavailable";
-    if (!credential.configured)
-        return "not configured";
-    const masked = "configured";
-    return credential.updatedAt ? `${masked} · updated ${formatDate(credential.updatedAt)}` : masked;
+    return "The stored credential can't be used. Replace it.";
 }
 /** Gate copy for each browser-auth shape, so the sign-in state is never a blank page. */
 export function gateCopy(kind, signedIn) {
     if (kind === "cloudflare-access") {
-        return "Checking Cloudflare Access identity failed. Retry to check whether this browser can open operator pages.";
+        return "Couldn't check your Cloudflare Access identity. Retry.";
     }
     if (kind !== "clerk") {
-        return "Paste an operator bearer token to open this page. Nothing is requested until you do.";
+        return "Paste an operator token.";
     }
-    return signedIn
-        ? "Signed in with Clerk, but this account cannot open deployment-wide operator pages."
-        : "Sign in with Clerk to open this operator page.";
+    return signedIn ? "This Clerk account can't open operator pages." : "Sign in with Clerk.";
 }

package/dist/page-styles.js

@@ -1,6 +1,8 @@
 // Generated by scripts/build-operator-ui.mjs. Do not edit.
-// Source: src/operator-ui/tokens.css and src/operator-ui/page.css.
+// Source: src/operator-ui/tokens.css, src/operator-ui/page.css, and the hashed font assets.
 /** Custom properties and both palettes; styles no element. */
-export const TOKENS_CSS = ":root{color-scheme:light;--default-accent: #171717;--accent: var(--default-accent);--radius: 8px;--sans: \"Geist Sans\", ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: \"Geist Mono\", ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--bg: #fafafa;--surface: #ffffff;--surface-2: #f5f5f5;--border: #eaeaea;--border-strong: #d4d4d4;--text: #171717;--muted: #666666;--ok: #0a7d33;--warn: #a35200;--danger: #d8242c;--on-accent: #ffffff;--link: var(--accent);--blue: #0060df;--tint: color-mix(in srgb, var(--accent) 8%, var(--surface));--shell: 68rem;--pad: 1.25rem;--gap: 1rem;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-6: 1.5rem;--space-8: 2rem;--text-xs: .75rem;--text-sm: .8125rem;--text-base: .875rem}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--default-accent: #ededed;--on-accent: #171717;--blue: #70b3ff;--bg: #0a0a0a;--surface: #111111;--surface-2: #1a1a1a;--border: #2e2e2e;--border-strong: #454545;--text: #ededed;--muted: #a1a1a1;--ok: #4cce83;--warn: #f5b85a;--danger: #ff777f;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}}html[data-scheme=dark]{--default-accent: #ededed;--on-accent: #171717;--blue: #70b3ff;--bg: #0a0a0a;--surface: #111111;--surface-2: #1a1a1a;--border: #2e2e2e;--border-strong: #454545;--text: #ededed;--muted: #a1a1a1;--ok: #4cce83;--warn: #f5b85a;--danger: #ff777f;--link: color-mix(in srgb, var(--accent) 55%, #ffffff);--tint: color-mix(in srgb, var(--accent) 16%, var(--surface))}";
+export const TOKENS_CSS = ":root{color-scheme:light;--sans: \"Hanken Grotesk\", ui-sans-serif, system-ui, -apple-system, \"Segoe UI\", Roboto, \"Helvetica Neue\", Arial, sans-serif;--mono: \"JetBrains Mono\", ui-monospace, \"SF Mono\", Menlo, Monaco, \"Cascadia Code\", Consolas, monospace;--text-2xs: .6875rem;--text-xs: .78125rem;--text-sm: .84375rem;--text-base: .9375rem;--text-md: 1.0625rem;--text-lg: 1.125rem;--text-xl: 1.25rem;--text-2xl: 1.75rem;--text-3xl: 2.125rem;--weight-medium: 500;--weight-semibold: 620;--weight-bold: 700;--space-1: .25rem;--space-2: .5rem;--space-3: .75rem;--space-4: 1rem;--space-5: 1.25rem;--space-6: 1.5rem;--space-8: 2rem;--space-10: 2.5rem;--shell: 73.75rem;--pad: 1.5rem;--gap: 1rem;--topbar: 3.875rem;--radius: 14px;--radius-md: min(var(--radius), max(calc(var(--radius) - 4px), 2px));--radius-sm: min(var(--radius), max(calc(var(--radius) - 7px), 2px));--radius-pill: 999px;--bg: #f6f4ef;--surface: #ffffff;--surface-2: #fbfaf7;--sunk: #f0ede6;--hover: #f5f2ec;--line: #e9e4da;--line-strong: #dcd5c8;--line-field: #938b7d;--text: #1d1a16;--text-2: #5c564c;--text-3: #756e61;--scrim: rgb(20 16 8 / .38);--avatar-fill: var(--text);--avatar-ink: var(--bg);--default-accent: #4c44e0;--accent: var(--default-accent);--accent-strong: color-mix(in srgb, var(--accent) 84%, #000000);--accent-soft: color-mix(in srgb, var(--accent) 9%, var(--surface));--accent-line: color-mix(in srgb, var(--accent) 26%, var(--surface));--on-accent: var(--custom-on-accent, #ffffff);--link: var(--accent);--ok: #16774b;--ok-soft: #e4f3ea;--ok-line: #bfe2cd;--warn: #9a5800;--warn-soft: #fcf0da;--warn-line: #f1d7a6;--danger: #bc3a27;--danger-soft: #fbe8e4;--danger-line: #f2c5bc;--shadow-1: 0 1px 2px rgb(40 30 10 / .05), 0 1px 1px rgb(40 30 10 / .03);--shadow-2: 0 1px 2px rgb(40 30 10 / .04), 0 6px 20px -6px rgb(40 30 10 / .1);--shadow-3: 0 24px 60px -16px rgb(30 20 0 / .28), 0 2px 6px rgb(30 20 0 / .06)}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){color-scheme:dark}}html[data-scheme=dark]{color-scheme:dark}@media(prefers-color-scheme:dark){html:not([data-scheme=light]){--bg: #12110f;--surface: #1b1a17;--surface-2: #1f1d1a;--sunk: #16150f;--hover: #24221e;--line: #2c2925;--line-strong: #3a3631;--line-field: #757064;--text: #f3efe7;--text-2: #b5aea2;--text-3: #8a8378;--scrim: rgb(0 0 0 / .6);--avatar-fill: #34312c;--avatar-ink: #e9e4da;--default-accent: #8c86ff;--accent-strong: color-mix(in srgb, var(--accent) 80%, #ffffff);--accent-soft: color-mix(in srgb, var(--accent) 17%, var(--surface));--accent-line: color-mix(in srgb, var(--accent) 38%, var(--surface));--on-accent: var(--custom-on-accent, #0f0e1f);--link: var(--custom-accent-text, color-mix(in srgb, var(--accent) 80%, #ffffff));--ok: #5bd08f;--ok-soft: #173326;--ok-line: #24513a;--warn: #f0b354;--warn-soft: #352812;--warn-line: #5a4319;--danger: #ff8a75;--danger-soft: #3a1c16;--danger-line: #5e2c22;--shadow-1: 0 1px 2px rgb(0 0 0 / .4);--shadow-2: 0 1px 2px rgb(0 0 0 / .3), 0 8px 24px -8px rgb(0 0 0 / .5);--shadow-3: 0 30px 80px -20px rgb(0 0 0 / .7)}}html[data-scheme=dark]{--bg: #12110f;--surface: #1b1a17;--surface-2: #1f1d1a;--sunk: #16150f;--hover: #24221e;--line: #2c2925;--line-strong: #3a3631;--line-field: #757064;--text: #f3efe7;--text-2: #b5aea2;--text-3: #8a8378;--scrim: rgb(0 0 0 / .6);--avatar-fill: #34312c;--avatar-ink: #e9e4da;--default-accent: #8c86ff;--accent-strong: color-mix(in srgb, var(--accent) 80%, #ffffff);--accent-soft: color-mix(in srgb, var(--accent) 17%, var(--surface));--accent-line: color-mix(in srgb, var(--accent) 38%, var(--surface));--on-accent: var(--custom-on-accent, #0f0e1f);--link: var(--custom-accent-text, color-mix(in srgb, var(--accent) 80%, #ffffff));--ok: #5bd08f;--ok-soft: #173326;--ok-line: #24513a;--warn: #f0b354;--warn-soft: #352812;--warn-line: #5a4319;--danger: #ff8a75;--danger-soft: #3a1c16;--danger-line: #5e2c22;--shadow-1: 0 1px 2px rgb(0 0 0 / .4);--shadow-2: 0 1px 2px rgb(0 0 0 / .3), 0 8px 24px -8px rgb(0 0 0 / .5);--shadow-3: 0 30px 80px -20px rgb(0 0 0 / .7)}";
 /** Base typography, the shell, masthead, buttons, badges, and messages. */
-export const PAGE_CSS = "*{box-sizing:border-box}html{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:16px;line-height:1.5;-webkit-font-smoothing:antialiased}body{margin:0;min-height:100vh}:is(h1,h2,h3,p,ul,ol){margin:0;padding:0}:is(h1,h2,h3){font-weight:600;line-height:1.3}h1{font-size:1.5rem;letter-spacing:-.01em}h2{font-size:1rem}:is(ul,ol){list-style:none}a{color:var(--link);text-decoration-thickness:1px;text-underline-offset:2px}button,input{font:inherit}:is(a,button,input,summary):focus-visible{border-radius:calc(var(--radius) / 2);outline:2px solid var(--link);outline-offset:2px}.skip-link{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);left:var(--pad);padding:.5rem .75rem;position:fixed;top:-4rem;z-index:10}.skip-link:focus{top:var(--pad)}.shell{margin:0 auto;max-width:var(--shell);padding-left:var(--pad);padding-right:var(--pad)}.cap,.meta{color:var(--muted);font-size:.875rem}.mono{font-family:var(--mono);font-size:.8125rem}.visually-hidden{clip-path:inset(50%);height:1px;overflow:hidden;position:absolute;white-space:nowrap;width:1px}.masthead{align-items:center;background:var(--surface);border-bottom:1px solid var(--border);display:flex;gap:var(--gap);justify-content:space-between;max-width:none;padding-bottom:.75rem;padding-top:.75rem;position:sticky;top:0;z-index:5}.masthead-inner{align-items:center;display:flex;gap:var(--gap);justify-content:space-between;margin:0 auto;max-width:var(--shell);width:100%}.mast-nav,.mast-actions,.page-nav,.session-actions{align-items:center;display:flex;flex-wrap:wrap;gap:.25rem}.mast-nav,.mast-actions{gap:var(--gap)}.navlink{background:none;border:0;border-radius:calc(var(--radius) - 2px);color:var(--muted);cursor:pointer;font-size:.9375rem;padding:.35rem .6rem;text-decoration:none}.navlink:hover{background:var(--surface-2);color:var(--text)}.navlink[aria-current=page]{background:var(--tint);color:var(--link);font-weight:500}.brand,.product{padding-left:0;padding-right:0;text-decoration:none}.brand{color:var(--text);font-weight:600}.brand:hover,.product:hover{background:none}.product{color:var(--muted)}.page{padding-bottom:4rem;padding-top:2rem}.lead{margin-bottom:1.5rem}.lead-copy{color:var(--muted);display:grid;gap:.5rem;margin-top:.35rem}.lead-copy p{max-width:60ch}.btn{background:var(--surface);border:1px solid var(--border-strong);border-radius:calc(var(--radius) - 2px);color:var(--text);cursor:pointer;display:inline-flex;align-items:center;font-size:.875rem;gap:.35rem;padding:.35rem .7rem;text-decoration:none;white-space:nowrap}.btn:hover{background:var(--surface-2)}.btn:disabled{cursor:not-allowed;opacity:.55}.btn.primary{background:var(--accent);border-color:var(--accent);color:var(--on-accent)}.btn.primary:hover{background:color-mix(in srgb,var(--accent) 88%,black)}.btn.danger{color:var(--danger)}.btn.danger:hover{background:color-mix(in srgb,var(--danger) 10%,var(--surface))}.btn.quiet{background:none;border-color:var(--border);color:var(--muted)}.btn.quiet:hover{background:var(--surface-2);color:var(--text)}.badge{align-items:center;background:var(--surface-2);border-radius:999px;color:var(--muted);display:inline-flex;font-size:.75rem;gap:.3rem;line-height:1.6;padding:.1rem .5rem;white-space:nowrap}.badge.ok{background:color-mix(in srgb,var(--ok) 12%,var(--surface));color:var(--ok)}.badge.warn{background:color-mix(in srgb,var(--warn) 14%,var(--surface));color:var(--warn)}.badge.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.badge.accent{background:var(--tint);color:var(--link)}.msg{background:color-mix(in srgb,var(--danger) 8%,var(--surface));border:1px solid color-mix(in srgb,var(--danger) 28%,var(--surface));border-radius:calc(var(--radius) - 2px);color:var(--danger);font-size:.875rem;padding:.5rem .75rem}.status-page{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);display:grid;gap:.75rem;margin:1.5rem auto 0;max-width:34rem;padding:1.5rem}.status-head{align-items:center;display:flex;gap:.6rem}.status-mark{align-items:center;background:var(--surface-2);border-radius:50%;color:var(--muted);display:inline-flex;flex:none;height:2rem;justify-content:center;width:2rem}.status-mark svg{height:1.25rem;width:1.25rem}.status-mark.ok{background:color-mix(in srgb,var(--ok) 14%,var(--surface));color:var(--ok)}.status-mark.danger{background:color-mix(in srgb,var(--danger) 12%,var(--surface));color:var(--danger)}.status-label{color:var(--muted);font-size:.875rem;font-weight:600}.status-label.ok{color:var(--ok)}.status-label.danger{color:var(--danger)}.status-page h1{overflow-wrap:anywhere}.status-copy{color:var(--muted)}.status-actions{display:flex;flex-wrap:wrap;gap:.5rem;margin-top:.25rem}.status-details{border-top:1px solid var(--border);color:var(--muted);font-size:.875rem;margin-top:.25rem;padding-top:.75rem}.status-details>summary{cursor:pointer;width:fit-content}.status-details>p{margin-top:.5rem}.status-details pre{background:var(--surface-2);border:1px solid var(--border);border-radius:calc(var(--radius) / 2);color:var(--text);font-family:var(--mono);font-size:.75rem;line-height:1.55;margin:.5rem 0 0;max-height:18rem;overflow:auto;overflow-wrap:anywhere;padding:.5rem .6rem;white-space:pre-wrap}@media(max-width:40rem){:root{--pad: 1rem}.status-page{margin-top:0;padding:1.25rem var(--pad)}}";
+export const PAGE_CSS = "*{box-sizing:border-box}html{background:var(--bg);color:var(--text);font-family:var(--sans);font-size:16px;line-height:1.55;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;text-rendering:optimizeLegibility}body{background:var(--bg);font-size:var(--text-base);letter-spacing:-.005em;margin:0;min-height:100vh}:is(h1,h2,h3,p,ul,ol){margin:0;padding:0}:is(h1,h2,h3){font-weight:var(--weight-semibold);line-height:1.25}h1{font-size:var(--text-3xl);font-weight:var(--weight-bold);letter-spacing:-.03em;line-height:1.12}h2{font-size:var(--text-lg);letter-spacing:-.015em}h3{font-size:var(--text-base);letter-spacing:-.01em}:is(ul,ol){list-style:none}a{color:var(--link);text-decoration-thickness:1px;text-underline-offset:3px}button,input,select,textarea{color:inherit;font:inherit;letter-spacing:inherit}code,pre,kbd{font-family:var(--mono);letter-spacing:0}::selection{background:var(--accent-soft)}:is(a,button,input,select,textarea,summary,[tabindex]):focus-visible{border-radius:var(--radius-sm);outline:2px solid var(--link);outline-offset:2px}.skip-link{background:var(--surface);border:1px solid var(--line);border-radius:var(--radius-md);box-shadow:var(--shadow-2);color:var(--text);font-weight:var(--weight-semibold);left:var(--pad);padding:.5rem .875rem;position:fixed;text-decoration:none;top:-4rem;z-index:60}.skip-link:focus{top:.75rem}.shell{margin:0 auto;max-width:var(--shell);padding-left:var(--pad);padding-right:var(--pad)}.cap,.meta{color:var(--text-2);font-size:var(--text-sm)}.cap{color:var(--text-3);font-size:var(--text-xs);font-weight:var(--weight-semibold);letter-spacing:.08em;text-transform:uppercase}.mono{font-family:var(--mono);font-size:.86em}.visually-hidden{clip-path:inset(50%);height:1px;overflow:hidden;position:absolute;white-space:nowrap;width:1px}.masthead{backdrop-filter:saturate(1.4) blur(14px);background:color-mix(in srgb,var(--bg) 84%,transparent);border-bottom:1px solid var(--line);position:sticky;top:0;z-index:30}.masthead.shell{max-width:none}.masthead-inner{align-items:center;display:flex;gap:var(--space-4);margin:0 auto;max-width:calc(var(--shell) - 2 * var(--pad));min-height:var(--topbar);width:100%}.mast-nav{align-items:center;display:flex;gap:var(--space-2);min-width:0}.brand-mark{border-radius:var(--radius-sm);display:block;flex:none;height:1.625rem;margin-right:.125rem;object-fit:contain;width:1.625rem}span.brand-mark{background:conic-gradient(from 45deg,var(--text) 0 90deg,transparent 0),radial-gradient(circle closest-side,transparent 0 34%,var(--bg) 38% 58.5%,transparent 62.5%),var(--text)}.navlink{background:none;border:0;border-radius:var(--radius-md);color:var(--text-2);cursor:pointer;font-size:var(--text-base);font-weight:var(--weight-medium);padding:.4375rem .75rem;text-decoration:none}.navlink:hover{background:var(--hover);color:var(--text)}.brand,.product{font-size:var(--text-base);overflow-wrap:anywhere;padding-left:0;padding-right:0;text-decoration:none}.brand{color:var(--text);font-size:1rem;font-weight:var(--weight-bold);letter-spacing:-.02em}.brand:hover,.product:hover{background:none}.product{color:var(--text-2);font-weight:var(--weight-medium)}.product:before{color:var(--line-strong);content:\"/\";font-weight:400;margin-right:.5rem}.page{padding-bottom:6rem;padding-top:var(--space-10)}.lead{margin-bottom:var(--space-8)}.lead-copy{color:var(--text-2);display:grid;font-size:var(--text-md);gap:var(--space-2);margin-top:var(--space-2)}.lead-copy p{max-width:60ch}.btn{align-items:center;background:var(--surface);border:1px solid var(--line-strong);border-radius:var(--radius-md);box-shadow:var(--shadow-1);color:var(--text);cursor:pointer;display:inline-flex;font-size:var(--text-sm);font-weight:var(--weight-semibold);gap:.4375rem;justify-content:center;line-height:1.2;min-height:2.25rem;padding:.375rem .875rem;text-decoration:none;transition:background-color .15s,border-color .15s,color .15s;white-space:nowrap}.btn:hover{background:var(--hover)}.btn:active{translate:0 1px}.btn:disabled{cursor:not-allowed;opacity:.5;translate:none}.btn.primary{background:var(--accent);border-color:var(--accent);box-shadow:0 1px 2px color-mix(in srgb,var(--accent) 30%,transparent),inset 0 1px #ffffff24;color:var(--on-accent)}.btn.primary:hover{background:var(--accent-strong);border-color:var(--accent-strong)}.btn.danger{border-color:var(--danger-line);color:var(--danger)}.btn.danger:hover{background:var(--danger-soft)}.btn.quiet{background:transparent;border-color:transparent;box-shadow:none;color:var(--text-2)}.btn.quiet:hover{background:var(--hover);color:var(--text)}.badge{align-items:center;background:var(--sunk);border-radius:var(--radius-pill);color:var(--text-2);display:inline-flex;font-size:var(--text-xs);font-weight:var(--weight-semibold);gap:.375rem;line-height:1.2;min-height:1.5rem;padding:.125rem .5625rem;white-space:nowrap}.badge.ok{background:var(--ok-soft);color:var(--ok)}.badge.warn{background:var(--warn-soft);color:var(--warn)}.badge.danger{background:var(--danger-soft);color:var(--danger)}.badge.accent{background:var(--accent-soft);color:var(--link)}.msg{background:var(--danger-soft);border:1px solid var(--danger-line);border-radius:var(--radius-md);color:var(--text);font-size:var(--text-sm);padding:.75rem 1rem}.msg.warn{background:var(--warn-soft);border-color:var(--warn-line)}.status-page{background:var(--surface);border:1px solid var(--line);border-radius:min(calc(var(--radius) + 4px),calc(var(--radius) * 2));box-shadow:var(--shadow-2);display:grid;gap:var(--space-3);margin:8vh auto 0;max-width:30rem;padding:var(--space-8)}.status-head{align-items:center;display:flex;gap:.625rem}.status-mark{align-items:center;background:var(--sunk);border-radius:var(--radius-md);color:var(--text-2);display:inline-flex;flex:none;height:2.25rem;justify-content:center;width:2.25rem}.status-mark svg{height:1.25rem;width:1.25rem}.status-mark.ok{background:var(--ok-soft);color:var(--ok)}.status-mark.danger{background:var(--danger-soft);color:var(--danger)}.status-label{color:var(--text-3);font-size:var(--text-xs);font-weight:var(--weight-semibold);letter-spacing:.08em;text-transform:uppercase}.status-label.ok{color:var(--ok)}.status-label.danger{color:var(--danger)}.status-page h1{font-size:var(--text-2xl);overflow-wrap:anywhere}.status-page h1+p,.status-copy{color:var(--text-2)}.status-actions{display:flex;flex-wrap:wrap;gap:var(--space-2);margin-top:var(--space-2)}.status-details{border-top:1px solid var(--line);color:var(--text-2);font-size:var(--text-sm);margin-top:var(--space-2);padding-top:var(--space-4)}.status-details>summary{align-items:center;cursor:pointer;display:flex;font-weight:var(--weight-semibold);gap:.5rem;list-style:none;width:fit-content}.status-details>summary::-webkit-details-marker{display:none}.status-details>summary:before{border-bottom:1.5px solid currentColor;border-right:1.5px solid currentColor;content:\"\";height:.375rem;rotate:-45deg;transition:rotate .15s;width:.375rem}.status-details[open]>summary:before{rotate:45deg}.status-details>p{margin-top:var(--space-2)}.status-details pre{background:var(--sunk);border:1px solid var(--line);border-radius:var(--radius-md);color:var(--text-2);font-size:var(--text-xs);line-height:1.6;margin:var(--space-2) 0 0;max-height:18rem;overflow:auto;overflow-wrap:anywhere;padding:.75rem .875rem;white-space:pre-wrap}@media(max-width:51.25rem){:root{--pad: 1rem}h1{font-size:var(--text-2xl)}.page{padding-top:var(--space-8)}.status-page{margin-top:var(--space-4);padding:var(--space-6) var(--space-5)}}";
+/** The operator fonts' hashed paths, which only a deployment with the UI serves. */
+export const PAGE_FONTS = [{ "family": "Hanken Grotesk", "weight": "100 900", "path": "/ui/assets/hanken-grotesk-latin-wght-normal-ZZ3K7K5Y.woff2" }, { "family": "JetBrains Mono", "weight": "100 800", "path": "/ui/assets/jetbrains-mono-latin-wght-normal-VBS632QH.woff2" }];

package/dist/provider.d.ts

@@ -19,6 +19,8 @@ export interface ProviderOptions {
     authScope?: "shared" | "personal";
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     /** Optional per-runtime downstream call-admission policy. */
     callAdmission?: ConnectorCallAdmissionPolicy;
 }
@@ -82,8 +84,11 @@ export declare const CALL_ADMISSION: Omit<Field<unknown, ConnectorCallAdmissionP
     parse(value: unknown, path: string): ConnectorCallAdmissionPolicy;
     readonly shape: typeof admissionPolicy.shape;
 };
+/** Validate the common connector policy before a deployment can serve. */
+export declare const READ_ONLY: Field<boolean, boolean | undefined, true>;
 /** Options every maintained provider shares. */
 export declare const PROVIDER_COMMON: {
+    readOnly: Field<boolean, boolean | undefined, true>;
     callAdmission: Omit<Field<unknown, ConnectorCallAdmissionPolicy | undefined, true>, "parse"> & {
         parse(value: unknown, path: string): ConnectorCallAdmissionPolicy;
         readonly shape: typeof admissionPolicy.shape;
@@ -129,7 +134,7 @@ export interface ProviderContext {
      * Common connector options the deployment set, and only those, ready to
      * spread into `remoteMcp()` or `api()` options.
      */
-    readonly connectorOptions: Readonly<Pick<ProviderOptions, "authScope" | "maxResultBytes" | "callAdmission">>;
+    readonly connectorOptions: Readonly<Pick<ProviderOptions, "authScope" | "maxResultBytes" | "callAdmission" | "readOnly">>;
     /**
      * Render the maintained skill with this connection's context and the
      * deployment's instructions. Instructions are appended; they never replace

package/dist/provider.js

@@ -50,9 +50,17 @@ export const CALL_ADMISSION = {
         return policy;
     },
 };
+/** Validate the common connector policy before a deployment can serve. */
+export const READ_ONLY = opaque({
+    check(value, path) {
+        if (typeof value !== "boolean")
+            throw new ConfigError(`${path} must be a boolean.`);
+    },
+});
 /** Options every maintained provider shares. */
 export const PROVIDER_COMMON = {
     ...keys("title", "authScope", "purpose", "instructions", "maxResultBytes"),
+    readOnly: READ_ONLY,
     callAdmission: CALL_ADMISSION,
 };
 const PROVIDER_NAME = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
@@ -127,6 +135,7 @@ export function defineProvider(definition) {
         const connector = frozen.create(id, resolved, {
             ...(frozen.classify !== undefined ? { classify: frozen.classify } : {}),
             connectorOptions: {
+                ...(options.readOnly !== undefined ? { readOnly: options.readOnly } : {}),
                 ...(options.authScope !== undefined ? { authScope: options.authScope } : {}),
                 ...(options.maxResultBytes !== undefined ? { maxResultBytes: options.maxResultBytes } : {}),
                 ...(options.callAdmission !== undefined ? { callAdmission: options.callAdmission } : {}),
@@ -178,6 +187,8 @@ function asProvider(provider, shape, id, options, build) {
     let connector;
     try {
         options = assertKnownOptions(options, `${factory}(${JSON.stringify(id)})`, shape);
+        if (options?.readOnly !== undefined)
+            READ_ONLY.parse(options.readOnly, `${factory}(${JSON.stringify(id)}).readOnly`);
         const admission = options == null ? undefined : options.callAdmission;
         if (admission !== undefined)
             CALL_ADMISSION.parse(admission, `${factory}(${JSON.stringify(id)}).callAdmission`);
@@ -188,12 +199,18 @@ function asProvider(provider, shape, id, options, build) {
     }
     const describe = connector.describe?.bind(connector);
     const ownDescribe = Object.getOwnPropertyDescriptor(connector, "describe");
+    const ownReadOnly = Object.getOwnPropertyDescriptor(connector, "readOnly");
     // Keep the receiver of prototype methods (including private fields). When
     // the description cannot be replaced, inherit the whole connector instead
     // of copying it: decorators may inherit their id, methods, and review.
-    const stamped = Object.isExtensible(connector) && (!ownDescribe || ownDescribe.configurable)
+    const stamped = Object.isExtensible(connector) &&
+        (!ownDescribe || ownDescribe.configurable) &&
+        (options.readOnly === undefined || !ownReadOnly || ownReadOnly.configurable)
         ? connector
         : Object.create(connector);
+    if (options.readOnly !== undefined) {
+        Object.defineProperty(stamped, "readOnly", { value: options.readOnly, enumerable: true, configurable: true });
+    }
     Object.defineProperty(stamped, "describe", {
         configurable: true,
         enumerable: false,

package/dist/providers/_shared/google/workspace.d.ts

@@ -12,8 +12,10 @@
  * Workspace address, and the provider reads the identity core attached beside
  * the context. An agent, which has no Workspace account, acts instead as the
  * `owner` of the pool it came through, which core copies from that pool's
- * config beside the identity; the mapping never sees an agent, and an agent
- * in a pool without an owner fails `auth_required` (decisions/0006). A fixed
+ * config beside the identity; the mapping never sees an agent. In a pool
+ * without an owner the connector is absent for agents (core's scoped
+ * registry view hides it), and this provider still fails `auth_required` if
+ * one reaches it anyway (decisions/0006). A fixed
  * `subject` address is every caller's, owners aside. No tool argument,
  * header, or program can name the subject — every product's base URL is
  * confined beneath `users/me`, or its product's equivalent, so the token's
@@ -61,7 +63,7 @@ export type { GoogleServiceAccount } from "./service-account.js";
  * for a caller who has none — that call then fails closed. It is never called
  * for an open deployment's anonymous requests, for a call no request
  * admitted, or for an agent: an agent acts as the `owner` of the pool it
- * came through, and fails closed in a pool without one. It may be async, for
+ * came through, and never sees the connector in a pool without one. It may be async, for
  * a directory lookup (a Clerk user id to an email, say), and receives the
  * call's cancellation signal for that; it runs once per tool call and should
  * cache what it fetches. A string is one fixed account for every caller who
@@ -98,6 +100,8 @@ export interface GoogleWorkspaceOptions {
     callAdmission?: ConnectorCallAdmissionPolicy;
     /** Connector-specific inline result limit; omit to inherit the deployment. */
     maxResultBytes?: number;
+    /** Serve only read-classified tools on every endpoint. Defaults to false. */
+    readOnly?: boolean;
     /** API base override for a proxy or test double. */
     baseUrl?: string;
 }
@@ -142,10 +146,11 @@ export declare const GOOGLE_WORKSPACE_OPTIONS: import("../../../config-schema.js
         };
         instructions: import("../../../config-schema.js").Field<unknown, unknown, true>;
         title: import("../../../config-schema.js").Field<unknown, unknown, true>;
+        readOnly: import("../../../config-schema.js").Field<unknown, unknown, true>;
         maxResultBytes: import("../../../config-schema.js").Field<unknown, unknown, true>;
         purpose: import("../../../config-schema.js").Field<unknown, unknown, true>;
-        baseUrl: import("../../../config-schema.js").Field<unknown, unknown, true>;
         subject: import("../../../config-schema.js").Field<unknown, unknown, true>;
+        baseUrl: import("../../../config-schema.js").Field<unknown, unknown, true>;
     };
 };
 /** The checked, construction-time half of {@link GoogleWorkspaceOptions}. */