@zackbart/connecta 0.4.1 → 0.6.0

package/dist/skills.d.ts

@@ -1,8 +1,59 @@
+import type { Connector } from "./types.js";
 export declare const CONNECTA_INSTRUCTIONS = "Connecta exposes many integrations behind meta-tools. When an address is unknown, start with search_tools and includeSchemas=\"compact\"; use describe_tools only when that schema is insufficient. Use call_tool for one explicitly read-only call, batch_call for 2\u201310 independent explicitly read-only calls, and execute_code (when available) only for dependent read-only steps, loops, joins, or reducing large results. Unannotated, write-capable, and destructive tools must use call_destructive_tool individually. Use authorize_connector only after auth_required and get_result only for truncated results. For the detailed workflow, call skills({ name: \"usage\" }) once per task.";
-export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, have the operator complete consent, then confirm with `list_connectors`.\n\nUse `list_connectors({ probe: false })` for a fast inventory. Use `probe: true` only when diagnosing live health or authorization.\n\n## Code mode\n\nUse code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nDo not use code mode for one straightforward call, for independent calls already handled by `batch_call`, or for any tool not explicitly annotated `readOnlyHint: true`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.\n\n## Examples\n\nThese addresses are illustrative; always use the exact address returned by `search_tools`.\n\nSingle call:\n```json\n{ \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" }, \"resultMode\": \"value\" }\n```\n\nIndependent calls:\n```json\n{ \"calls\": [\n  { \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" } },\n  { \"address\": \"billing.list_invoices\", \"args\": { \"status\": \"open\" } }\n] }\n```\n\nDependent code with reduction:\n```js\nasync () => {\n  const accounts = await crm.search_accounts({ query: \"renewal\" });\n  const details = await Promise.all(\n    accounts.results.slice(0, 5).map((account) =>\n      crm.get_account({ id: account.id })\n    )\n  );\n  return details.map(({ id, name, status }) => ({ id, name, status }));\n}\n```\n";
+export declare const USAGE_SKILL = "# Connecta usage\n\n## Choose the smallest execution tool\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, have the operator complete consent, then confirm with `list_connectors`.\n\nUse `list_connectors({ probe: false })` for a fast inventory. Use `probe: true` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as `auth_required` (with `credentialCheck` and the URL to open), so trust it and authorize up front rather than probing to confirm.\n\n## Code mode\n\nUse code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nDo not use code mode for one straightforward call, for independent calls already handled by `batch_call`, or for any tool not explicitly annotated `readOnlyHint: true`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.\n\n## Examples\n\nThese addresses are illustrative; always use the exact address returned by `search_tools`.\n\nSingle call:\n```json\n{ \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" }, \"resultMode\": \"value\" }\n```\n\nIndependent calls:\n```json\n{ \"calls\": [\n  { \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" } },\n  { \"address\": \"billing.list_invoices\", \"args\": { \"status\": \"open\" } }\n] }\n```\n\nDependent code with reduction:\n```js\nasync () => {\n  const accounts = await crm.search_accounts({ query: \"renewal\" });\n  const details = await Promise.all(\n    accounts.results.slice(0, 5).map((account) =>\n      crm.get_account({ id: account.id })\n    )\n  );\n  return details.map(({ id, name, status }) => ({ id, name, status }));\n}\n```\n";
+/**
+ * Appended to USAGE_SKILL only when the deployment actually has at least one
+ * connector guide. A deployment with none — every deployment that has not
+ * adopted the feature — keeps the base guide byte-for-byte, rather than paying
+ * context for an instruction to fetch guides that do not exist.
+ */
+export declare const CONNECTOR_GUIDES_SECTION = "\n## Per-connector guides\n\nSome connectors here ship their own usage guide \u2014 preferred tools, address quirks, pagination conventions, rate-limit etiquette, query patterns. `skills({})` lists each one as `connector:<connectorId>`; fetch it with `skills({ name: \"connector:<connectorId>\" })`. `search_tools` and `describe_tools` set `guide` on matches whose connector has one. Read a connector's guide before working with it for the first time in a task.\n";
+/** True when at least one of `connectors` carries a usage guide. */
+export declare function hasConnectorGuides(connectors: readonly Connector[]): boolean;
+/** The built-in usage guide, plus the guides section when there is one to point at. */
+export declare function usageSkill(connectors: readonly Connector[]): string;
 export declare const AVAILABLE_SKILLS: readonly [{
     readonly name: "usage";
     readonly description: "How to choose among Connecta discovery, direct, batch, destructive, and code-mode tools.";
-    readonly content: "# Connecta usage\n\n## Choose the smallest execution tool\n\n- Unknown address: `search_tools({ query, includeSchemas: \"compact\" })`.\n- Schema still unclear: `describe_tools({ addresses: [...] })`.\n- One explicitly read-only call: `call_tool`.\n- Two to ten independent explicitly read-only calls: `batch_call`.\n- Dependent read-only calls, loops, joins, branching, or large-result reduction: `execute_code` when available.\n- Any unannotated, write-capable, or destructive call: `call_destructive_tool`, individually and only after reviewing its schema and consequences.\n- Truncated result: retry with `fields` when possible; otherwise page it with `get_result`.\n- `auth_required`: use `authorize_connector`, have the operator complete consent, then confirm with `list_connectors`.\n\nUse `list_connectors({ probe: false })` for a fast inventory. Use `probe: true` only when diagnosing live health or authorization.\n\n## Code mode\n\nUse code mode when a later call depends on an earlier result, when joining across connectors, or when filtering or aggregating data in the sandbox will substantially shrink the response. Use `Promise.all` or `connecta.batch` for independent calls inside one execution.\n\nDo not use code mode for one straightforward call, for independent calls already handled by `batch_call`, or for any tool not explicitly annotated `readOnlyHint: true`. Code mode has a bounded host-call budget and per-call deadline. Return only the reduced value the agent needs; do not return a large upstream payload unchanged.\n\n## Examples\n\nThese addresses are illustrative; always use the exact address returned by `search_tools`.\n\nSingle call:\n```json\n{ \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" }, \"resultMode\": \"value\" }\n```\n\nIndependent calls:\n```json\n{ \"calls\": [\n  { \"address\": \"crm.get_account\", \"args\": { \"id\": \"acct_123\" } },\n  { \"address\": \"billing.list_invoices\", \"args\": { \"status\": \"open\" } }\n] }\n```\n\nDependent code with reduction:\n```js\nasync () => {\n  const accounts = await crm.search_accounts({ query: \"renewal\" });\n  const details = await Promise.all(\n    accounts.results.slice(0, 5).map((account) =>\n      crm.get_account({ id: account.id })\n    )\n  );\n  return details.map(({ id, name, status }) => ({ id, name, status }));\n}\n```\n";
+    readonly content: typeof usageSkill;
 }];
+/**
+ * Namespace for operator-authored per-connector guides. Built-in skill names
+ * are bare identifiers and never contain ":", so `connector:<id>` cannot
+ * collide with one — not even when a connector's id is literally "usage".
+ * The prefixed form is the ONLY way to reach a connector guide: a bare
+ * connector id is never resolved, so nothing shadows anything silently.
+ */
+export declare const CONNECTOR_SKILL_PREFIX = "connector:";
+/** The skill name that fetches `connector`'s guide. */
+export declare function connectorSkillName(connectorId: string): string;
+/** The connector's guide, or undefined when it declares none (or a blank one). */
+export declare function connectorGuide(connector: Connector): string | undefined;
+export interface SkillListing {
+    name: string;
+    description: string;
+}
+/**
+ * Every fetchable skill: the built-in guides plus one entry per connector that
+ * carries a usage guide. Derived from the connector list passed in — the single
+ * place guide visibility is decided. The `skills` meta-tool passes its
+ * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
+ * only in-scope guides, and `resolveSkill` below reports an out-of-scope
+ * `connector:<id>` exactly as it reports an unknown connector.
+ */
+export declare function listSkills(connectors: readonly Connector[]): SkillListing[];
+export type SkillLookup = {
+    found: true;
+    content: string;
+} | {
+    found: false;
+    message: string;
+};
+/**
+ * Resolve one skill name. Built-in names match exactly; connector guides are
+ * reachable only through the `connector:` prefix. Every miss — unknown name,
+ * unknown connector, connector without a guide — is an explicit error, never a
+ * silent fallback to the generic guide.
+ */
+export declare function resolveSkill(name: string, connectors: readonly Connector[]): SkillLookup;
 //# sourceMappingURL=skills.d.ts.map

package/dist/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,qBAAqB,+qBACmoB,CAAC;AAEtqB,eAAO,MAAM,WAAW,wzEAkDvB,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;EAOnB,CAAC"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,eAAO,MAAM,qBAAqB,+qBACmoB,CAAC;AAEtqB,eAAO,MAAM,WAAW,4hFAkDvB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,odAIpC,CAAC;AAEF,oEAAoE;AACpE,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,OAAO,CAI5E;AAED,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAInE;AAED,eAAO,MAAM,gBAAgB;;;;EAOnB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,eAAe,CAAC;AAEnD,uDAAuD;AACvD,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAGvE;AAwDD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,EAAE,SAAS,SAAS,EAAE,GAAG,YAAY,EAAE,CAc3E;AAED,MAAM,MAAM,WAAW,GACrB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvE;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAsCb"}

package/dist/skills.js

@@ -12,7 +12,7 @@ export const USAGE_SKILL = `# Connecta usage
 - Truncated result: retry with \`fields\` when possible; otherwise page it with \`get_result\`.
 - \`auth_required\`: use \`authorize_connector\`, have the operator complete consent, then confirm with \`list_connectors\`.
 
-Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization.
+Use \`list_connectors({ probe: false })\` for a fast inventory. Use \`probe: true\` only when diagnosing live health or authorization. The fast inventory already reports a connector whose stored credential failed a proactive check as \`auth_required\` (with \`credentialCheck\` and the URL to open), so trust it and authorize up front rather than probing to confirm.
 
 ## Code mode
 
@@ -50,11 +50,171 @@ async () => {
 }
 \`\`\`
 `;
+/**
+ * Appended to USAGE_SKILL only when the deployment actually has at least one
+ * connector guide. A deployment with none — every deployment that has not
+ * adopted the feature — keeps the base guide byte-for-byte, rather than paying
+ * context for an instruction to fetch guides that do not exist.
+ */
+export const CONNECTOR_GUIDES_SECTION = `
+## Per-connector guides
+
+Some connectors here ship their own usage guide — preferred tools, address quirks, pagination conventions, rate-limit etiquette, query patterns. \`skills({})\` lists each one as \`connector:<connectorId>\`; fetch it with \`skills({ name: "connector:<connectorId>" })\`. \`search_tools\` and \`describe_tools\` set \`guide\` on matches whose connector has one. Read a connector's guide before working with it for the first time in a task.
+`;
+/** True when at least one of `connectors` carries a usage guide. */
+export function hasConnectorGuides(connectors) {
+    return connectors.some((connector) => connectorGuide(connector) !== undefined);
+}
+/** The built-in usage guide, plus the guides section when there is one to point at. */
+export function usageSkill(connectors) {
+    return hasConnectorGuides(connectors)
+        ? USAGE_SKILL + CONNECTOR_GUIDES_SECTION
+        : USAGE_SKILL;
+}
 export const AVAILABLE_SKILLS = [
     {
         name: "usage",
         description: "How to choose among Connecta discovery, direct, batch, destructive, and code-mode tools.",
-        content: USAGE_SKILL,
+        content: usageSkill,
     },
 ];
+/**
+ * Namespace for operator-authored per-connector guides. Built-in skill names
+ * are bare identifiers and never contain ":", so `connector:<id>` cannot
+ * collide with one — not even when a connector's id is literally "usage".
+ * The prefixed form is the ONLY way to reach a connector guide: a bare
+ * connector id is never resolved, so nothing shadows anything silently.
+ */
+export const CONNECTOR_SKILL_PREFIX = "connector:";
+/** The skill name that fetches `connector`'s guide. */
+export function connectorSkillName(connectorId) {
+    return `${CONNECTOR_SKILL_PREFIX}${connectorId}`;
+}
+/** The connector's guide, or undefined when it declares none (or a blank one). */
+export function connectorGuide(connector) {
+    const guide = connector.usageGuide;
+    return guide && guide.trim() !== "" ? guide : undefined;
+}
+const SUMMARY_LENGTH = 120;
+/** A `---`/`***`/`___` rule, which also opens and closes YAML frontmatter. */
+const RULE_RE = /^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/;
+/** A fenced code block's delimiter. */
+const FENCE_RE = /^\s*(?:```|~~~)/;
+/**
+ * Markup that carries no summary text of its own: horizontal rules, HTML
+ * comments, and table rows. Skipped so a guide that opens with one is
+ * summarized by its first real line instead of by punctuation.
+ */
+const NOT_SUMMARY_RE = /^\s*(?:<!--|\|)|^\s*(?:-{3,}|\*{3,}|_{3,})\s*$/;
+/** Drop a leading YAML frontmatter block — metadata, not summary text. */
+function withoutFrontmatter(lines) {
+    let start = 0;
+    while (start < lines.length && lines[start].trim() === "")
+        start++;
+    if (start >= lines.length || !RULE_RE.test(lines[start]))
+        return lines;
+    const close = lines.findIndex((line, i) => i > start && RULE_RE.test(line));
+    return close === -1 ? lines : lines.slice(close + 1);
+}
+/**
+ * One line describing a guide, for the cheap list view: the guide's first
+ * meaningful line (heading marks and list bullets stripped), falling back to
+ * the connector's own description when the guide opens with nothing but
+ * markup.
+ */
+function summarizeGuide(connector, guide) {
+    let inFence = false;
+    for (const raw of withoutFrontmatter(guide.split("\n"))) {
+        if (FENCE_RE.test(raw)) {
+            inFence = !inFence;
+            continue;
+        }
+        if (inFence)
+            continue;
+        if (raw.trim() === "" || NOT_SUMMARY_RE.test(raw))
+            continue;
+        const line = raw
+            // `\s*` (not `\s+`) so a bare `#` strips to nothing and is skipped, and
+            // an unspaced `#Heading` is still read as a heading.
+            .replace(/^\s*#{1,6}\s*/, "")
+            .replace(/^\s*[-*+]\s+/, "")
+            .replace(/\s+/g, " ")
+            .trim();
+        if (line === "")
+            continue;
+        return line.length <= SUMMARY_LENGTH
+            ? line
+            : `${line.slice(0, SUMMARY_LENGTH - 1).trimEnd()}…`;
+    }
+    return connector.description ?? `Usage guide for "${connector.id}".`;
+}
+/**
+ * Every fetchable skill: the built-in guides plus one entry per connector that
+ * carries a usage guide. Derived from the connector list passed in — the single
+ * place guide visibility is decided. The `skills` meta-tool passes its
+ * connection's `registry.listConnectors()`, so a toolkit-scoped session lists
+ * only in-scope guides, and `resolveSkill` below reports an out-of-scope
+ * `connector:<id>` exactly as it reports an unknown connector.
+ */
+export function listSkills(connectors) {
+    const listing = AVAILABLE_SKILLS.map((skill) => ({
+        name: skill.name,
+        description: skill.description,
+    }));
+    for (const connector of connectors) {
+        const guide = connectorGuide(connector);
+        if (!guide)
+            continue;
+        listing.push({
+            name: connectorSkillName(connector.id),
+            description: summarizeGuide(connector, guide),
+        });
+    }
+    return listing;
+}
+/**
+ * Resolve one skill name. Built-in names match exactly; connector guides are
+ * reachable only through the `connector:` prefix. Every miss — unknown name,
+ * unknown connector, connector without a guide — is an explicit error, never a
+ * silent fallback to the generic guide.
+ */
+export function resolveSkill(name, connectors) {
+    const builtIn = AVAILABLE_SKILLS.find((skill) => skill.name === name);
+    if (builtIn)
+        return { found: true, content: builtIn.content(connectors) };
+    const available = () => listSkills(connectors)
+        .map((skill) => skill.name)
+        .join(", ");
+    if (name.startsWith(CONNECTOR_SKILL_PREFIX)) {
+        const id = name.slice(CONNECTOR_SKILL_PREFIX.length);
+        const connector = connectors.find((c) => c.id === id);
+        if (!connector) {
+            return {
+                found: false,
+                message: `Unknown connector "${id}". Available skills: ${available()}.`,
+            };
+        }
+        const guide = connectorGuide(connector);
+        if (!guide) {
+            return {
+                found: false,
+                message: `Connector "${id}" has no usage guide. Available skills: ${available()}.`,
+            };
+        }
+        return { found: true, content: guide };
+    }
+    const bare = connectors.find((c) => c.id === name);
+    if (bare) {
+        return {
+            found: false,
+            message: connectorGuide(bare)
+                ? `Unknown skill "${name}". Connector guides are fetched as "${connectorSkillName(name)}". Available: ${available()}.`
+                : `Connector "${name}" has no usage guide. Available skills: ${available()}.`,
+        };
+    }
+    return {
+        found: false,
+        message: `Unknown skill "${name}". Available: ${available()}.`,
+    };
+}
 //# sourceMappingURL=skills.js.map

package/dist/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,WAAW;KACrB;CACO,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../src/skills.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,qBAAqB,GAChC,mqBAAmqB,CAAC;AAEtqB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD1B,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;CAIvC,CAAC;AAEF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,UAAgC;IACjE,OAAO,UAAU,CAAC,IAAI,CACpB,CAAC,SAAS,EAAE,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,SAAS,CACvD,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,OAAO,kBAAkB,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,WAAW,GAAG,wBAAwB;QACxC,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B;QACE,IAAI,EAAE,OAAO;QACb,WAAW,EACT,0FAA0F;QAC5F,OAAO,EAAE,UAAU;KACpB;CACO,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AAEnD,uDAAuD;AACvD,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,OAAO,GAAG,sBAAsB,GAAG,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,SAAoB;IACjD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,8EAA8E;AAC9E,MAAM,OAAO,GAAG,gCAAgC,CAAC;AAEjD,uCAAuC;AACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC;AAEnC;;;;GAIG;AACH,MAAM,cAAc,GAAG,gDAAgD,CAAC;AAExE,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAe;IACzC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IACnE,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,SAAoB,EAAE,KAAa;IACzD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,GAAG,IAAI,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,CAAC,OAAO,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,OAAO;YAAE,SAAS;QACtB,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5D,MAAM,IAAI,GAAG,GAAG;YACd,wEAAwE;YACxE,qDAAqD;aACpD,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;aAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;aAC3B,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACV,IAAI,IAAI,KAAK,EAAE;YAAE,SAAS;QAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,cAAc;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IACxD,CAAC;IACD,OAAO,SAAS,CAAC,WAAW,IAAI,oBAAoB,SAAS,CAAC,EAAE,IAAI,CAAC;AACvE,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,UAAgC;IACzD,MAAM,OAAO,GAAmB,gBAAgB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC,CAAC;IACJ,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,UAAgC;IAEhC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;IAC1E,MAAM,SAAS,GAAG,GAAG,EAAE,CACrB,UAAU,CAAC,UAAU,CAAC;SACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1B,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,IAAI,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,CAAC;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,SAAS,EAAE,GAAG;aACxE,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,cAAc,EAAE,2CAA2C,SAAS,EAAE,GAAG;aACnF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC;gBAC3B,CAAC,CAAC,kBAAkB,IAAI,uCAAuC,kBAAkB,CAAC,IAAI,CAAC,iBAAiB,SAAS,EAAE,GAAG;gBACtH,CAAC,CAAC,cAAc,IAAI,2CAA2C,SAAS,EAAE,GAAG;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,kBAAkB,IAAI,iBAAiB,SAAS,EAAE,GAAG;KAC/D,CAAC;AACJ,CAAC"}

package/dist/timeout.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Generous default bound for a single downstream probe/catalog call. High enough
+ * to trip only on a pathological hang, not a realistically slow probe.
+ */
+export declare const DEFAULT_PROBE_TIMEOUT_MS = 30000;
+/** A finite, positive integer number of milliseconds, or undefined. */
+export declare function normalizeTimeoutMs(value: number | undefined): number | undefined;
+/**
+ * Reject `promise` after `ms` if it has not settled, so one hung downstream
+ * cannot stall a whole fan-out. NOTE: this bounds only the caller-facing wait —
+ * the registry probe methods take no AbortSignal, so the underlying fetch is
+ * NOT cancelled and keeps running in the background. Real cancellation
+ * (AbortSignal plumbed through the registry) is a deferred follow-up.
+ */
+export declare function withTimeout<T>(promise: Promise<T>, ms: number, label: string): Promise<T>;
+//# sourceMappingURL=timeout.d.ts.map

package/dist/timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.d.ts","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,GAAG,SAAS,CAKpB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,CAAC,CAAC,CAgBZ"}

package/dist/timeout.js

@@ -0,0 +1,38 @@
+// The deadline vocabulary shared by every non-call downstream probe: the
+// discovery meta-tools' catalog fan-out (src/meta-tools.ts) and the credential
+// liveness checks (src/credential-health.ts). One definition so a "probe" means
+// the same thing, and is bounded the same way, wherever one is issued.
+/**
+ * Generous default bound for a single downstream probe/catalog call. High enough
+ * to trip only on a pathological hang, not a realistically slow probe.
+ */
+export const DEFAULT_PROBE_TIMEOUT_MS = 30_000;
+/** A finite, positive integer number of milliseconds, or undefined. */
+export function normalizeTimeoutMs(value) {
+    if (value === undefined || !Number.isFinite(value) || !(value > 0)) {
+        return undefined;
+    }
+    return Math.max(1, Math.trunc(value));
+}
+/**
+ * Reject `promise` after `ms` if it has not settled, so one hung downstream
+ * cannot stall a whole fan-out. NOTE: this bounds only the caller-facing wait —
+ * the registry probe methods take no AbortSignal, so the underlying fetch is
+ * NOT cancelled and keeps running in the background. Real cancellation
+ * (AbortSignal plumbed through the registry) is a deferred follow-up.
+ */
+export function withTimeout(promise, ms, label) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`${label} timed out after ${ms}ms`));
+        }, ms);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+//# sourceMappingURL=timeout.js.map

package/dist/timeout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeout.js","sourceRoot":"","sources":["../src/timeout.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,+EAA+E;AAC/E,gFAAgF;AAChF,uEAAuE;AAEvE;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAmB,EACnB,EAAU,EACV,KAAa;IAEb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,EAAE,IAAI,CAAC,CAAC,CAAC;QACxD,CAAC,EAAE,EAAE,CAAC,CAAC;QACP,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/toolkits.d.ts

@@ -0,0 +1,138 @@
+import type { Connector, InboundAuth, ToolkitBinding } from "./types.js";
+/** Toolkit names share the connector-id grammar: URL-safe, no separators. */
+export declare const TOOLKIT_NAME_RE: RegExp;
+/** One named scope, declared in `ConnectaConfig.toolkits` (config as code). */
+export interface ToolkitDefinition {
+    /** Connector ids this toolkit may see. Required, and at least one. */
+    connectors: string[];
+    /**
+     * Optional finer grain: full tool addresses (`"<connectorId>.<toolName>"`).
+     * Naming ANY address of a connector narrows that connector to exactly the
+     * addresses named; connectors with no entry here keep their whole tool list.
+     */
+    includeTools?: string[];
+    /** Optional tool addresses to hide, applied after `includeTools`. */
+    excludeTools?: string[];
+    /** Operator note. Never sent to clients — this is documentation for config. */
+    description?: string;
+}
+/** `ConnectaConfig.toolkits` — toolkit name → definition. */
+export type ToolkitConfig = Record<string, ToolkitDefinition>;
+/** A validated toolkit: the visibility predicate the scoped registry consults. */
+export interface Toolkit {
+    readonly name: string;
+    readonly description?: string;
+    /** True when `connectorId` is inside this toolkit's scope. */
+    hasConnector(connectorId: string): boolean;
+    /** True when `<connectorId>.<toolName>` is inside this toolkit's scope. */
+    hasTool(connectorId: string, toolName: string): boolean;
+}
+/**
+ * Split `"<connectorId>.<toolName>"` on the FIRST dot — connector ids contain
+ * no dots, so a downstream tool name may. Returns null for a malformed address.
+ */
+export declare function splitAddress(address: string): {
+    connectorId: string;
+    toolName: string;
+} | null;
+/**
+ * Validate every declared toolkit against the connector set. Returns undefined
+ * when no toolkits are configured, so an existing deployment keeps exactly its
+ * current (unscoped) behavior.
+ */
+export declare function resolveToolkits(toolkits: ToolkitConfig | undefined, connectors: readonly Connector[]): ReadonlyMap<string, Toolkit> | undefined;
+/**
+ * The binding half of an inbound-auth adapter's options — the shape every
+ * shipped adapter (`bearerToken`, `clerkAuth`) mixes into its own options so an
+ * operator writes one thing in one style, next to the credential it binds.
+ */
+export interface ToolkitBindingOptions {
+    /**
+     * Toolkit names this credential may select with `?toolkit=<name>`. Present ⇒
+     * the identity is BOUND: any other toolkit, and (unless `unscoped`) a
+     * connection with no `?toolkit=`, is refused at connect time. Absent ⇒
+     * unbound, exactly as before bindings existed.
+     */
+    toolkits?: readonly string[];
+    /**
+     * Also allow a connection with no `?toolkit=` (the full registry, and the
+     * deployment-wide operator surfaces). Only meaningful beside `toolkits`.
+     */
+    unscoped?: boolean;
+}
+/**
+ * Validate one adapter's binding options into a `ToolkitBinding`, or undefined
+ * when the adapter declares none. Structural mistakes THROW where the operator
+ * wrote them (adapter construction), for the same reason toolkit definitions do:
+ * a binding that does not say what its author meant is worse than none, because
+ * it is invisible until the day it denies — or admits — the wrong caller.
+ *
+ * Names are only checked against the *grammar* here; cross-checking them
+ * against the configured toolkits happens in `validateToolkitBindings`, which
+ * runs in `createConnecta` where both halves are finally in scope.
+ */
+export declare function resolveToolkitBinding(source: string, options: ToolkitBindingOptions): ToolkitBinding | undefined;
+/**
+ * Coerce an arbitrary value into a `ToolkitBinding`, or null when it is not one.
+ *
+ * The shipped adapters build bindings through `resolveToolkitBinding` above, but
+ * `InboundAuth` is an open interface and `AuthResult.toolkitBinding` arrives at
+ * REQUEST time from code connecta does not own — a custom adapter, or one
+ * mapping an IdP claim. Every field is therefore re-checked here rather than
+ * trusted from the type, because each way of being wrong fails OPEN if it is
+ * merely believed:
+ *
+ * - `unscoped` is compared to `true` by identity, so a truthy non-boolean (the
+ *   string `"false"` out of an env var, say) cannot grant the full registry;
+ * - `toolkits` must be a real array — a bare string would otherwise reach
+ *   `String.prototype.includes`, where `?toolkit=sup` would "match" `"support"`
+ *   by substring;
+ * - a missing/!array `toolkits` is not treated as an empty binding, because the
+ *   caller of a null return refuses the request outright.
+ *
+ * Returns a frozen, deduplicated copy: nothing downstream can be mutated by the
+ * adapter after the check, and every name is known to fit the grammar.
+ */
+export declare function normalizeToolkitBinding(value: unknown): ToolkitBinding | null;
+/**
+ * Resolve the binding one admitted identity is actually held to, from the
+ * provider's static declaration and whatever its `authorize` returned.
+ *
+ * - Neither ⇒ unbound (undefined), the pre-binding behavior.
+ * - Declaration only ⇒ the declaration.
+ * - Per-identity only ⇒ that binding, validated. This is the custom-adapter
+ *   seam: a provider that declares nothing is asserting it resolves membership
+ *   itself, so there is nothing to check it against.
+ * - Both ⇒ the **intersection**. The declaration is a CEILING, not a default: an
+ *   adapter that maps a user-writable IdP claim to toolkits must not be able to
+ *   widen the credential's own binding, which would turn "support token" into
+ *   "any toolkit, plus the full registry" for anyone who can set that claim.
+ *   Narrowing is fine and useful (per-user subsets of the team's view).
+ *
+ * A malformed binding on either side is not silently ignored — it returns
+ * `{ ok: false }` and the caller refuses the request, because the alternative
+ * (dropping it) is the fail-open reading.
+ */
+export declare function resolveIdentityBinding(declared: unknown, perIdentity: unknown): {
+    ok: true;
+    binding?: ToolkitBinding;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * Cross-check every statically declared binding against the deployment's
+ * toolkits, in `createConnecta`. A name that no toolkit declares is a typo, and
+ * a typo here fails CLOSED — the credential would be refused every connection
+ * with a 403 the client reads as a transport failure — so it throws at
+ * construction rather than becoming a support ticket. A structurally malformed
+ * declaration (only reachable from a hand-written `InboundAuth`, since the
+ * shipped adapters validate their own options) throws here too, rather than
+ * waiting to refuse every request at runtime.
+ *
+ * Bindings a provider mints per-identity (`AuthResult.toolkitBinding`) do not
+ * exist yet and cannot be checked here; they are validated on arrival and capped
+ * by the declaration (`resolveIdentityBinding`).
+ */
+export declare function validateToolkitBindings(auth: readonly InboundAuth[], toolkits: ReadonlyMap<string, Toolkit> | undefined): void;
+//# sourceMappingURL=toolkits.d.ts.map

package/dist/toolkits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolkits.d.ts","sourceRoot":"","sources":["../src/toolkits.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEzE,6EAA6E;AAC7E,eAAO,MAAM,eAAe,QAAkB,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,iBAAiB;IAChC,sEAAsE;IACtE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,6DAA6D;AAC7D,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAE9D,kFAAkF;AAClF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,8DAA8D;IAC9D,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3C,2EAA2E;IAC3E,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CACzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,MAAM,GACd;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAOlD;AAgID;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,GAAG,SAAS,EACnC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsB1C;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,qBAAqB,GAC7B,cAAc,GAAG,SAAS,CA2C5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAmB7E;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,OAAO,EACjB,WAAW,EAAE,OAAO,GAElB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoChC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,WAAW,EAAE,EAC5B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACjD,IAAI,CA2BN"}