@zackbart/connecta 0.5.0 → 0.6.1

package/dist/ui.d.ts

@@ -50,6 +50,47 @@ export declare function isSafeHttpUrl(url: unknown): boolean;
  * on its own it would accept an authority that happened to equal the probe host.
  */
 export declare function isSafeIconHref(href: unknown): boolean;
+/**
+ * True only for an absolute `https:` URL — the gate every `uiAuth` URL passes:
+ * `frontendApiUrl`, which becomes the `<script src>` of `/ui`'s sign-in loader,
+ * and `signInUrl`/`signUpUrl`, which ClerkJS uses as *navigation targets* when
+ * the operator signs in. With those three gated, no operator-config value
+ * reaches the browser in a URL position — attribute or navigation — without
+ * validation, and there is no exception left to remember.
+ *
+ * Stricter than `isSafeHttpUrl` on purpose: no `http:` carve-out, no loopback
+ * carve-out, and no relative form. Nobody types `frontendApiUrl` — the shipped
+ * Clerk adapter derives it from the publishable key, and Clerk's Frontend API is
+ * always https — and a cleartext script source on the dashboard would be a
+ * downgrade even where a browser's mixed-content rules had not already blocked
+ * it. `signInUrl`/`signUpUrl` *are* typed by the operator, but what belongs
+ * there is a hosted Account Portal address (`https://accounts.<domain>` or
+ * `https://<slug>.accounts.dev`), which is https as well; `http:` would carry a
+ * sign-in over cleartext, and a path relative to this origin is meaningless
+ * because this server hosts no sign-in page of its own. So the looser gate would
+ * buy nothing real, and the same strictness holds for all three.
+ */
+export declare function isSafeHttpsUrl(url: unknown): boolean;
+/**
+ * Names of the `uiAuth` URLs an inbound-auth provider supplied that failed their
+ * gate. Lives beside the gate for the same reason `droppedBrandingUrls` does: the
+ * startup warning cannot then drift from what rendering actually drops. Every
+ * field is read defensively rather than trusted, because a custom `InboundAuth`
+ * is untyped at a JS call site — `isSafeHttpsUrl` takes `unknown`, and a
+ * `uiAuth` that is not the clerk shape is reported as nothing to warn about.
+ *
+ * `frontendApiUrl` is required, so anything that fails its gate is a drop.
+ * `signInUrl` and `signUpUrl` are optional, so only a value the operator
+ * *supplied* and the gate then rejected is worth a warning — an unset field
+ * took no default away from anyone. `isSetUrlValue` decides that, the same way
+ * and for the same reasons it decides it for the branding URLs: a warning that
+ * fires for one and not the other would be reporting on the field rather than
+ * on the operator's intent. Rendering is not consulted for this: it drops on
+ * the gate alone, and a blank string fails that gate too — it is simply not
+ * *reported*, because a blank is indistinguishable from leaving the field
+ * alone.
+ */
+export declare function droppedUiAuthUrls(uiAuth?: UiAuthConfig): string[];
 export interface UiTool {
     name: string;
     address: string;
@@ -64,6 +105,17 @@ export interface UiConnector {
     authorizationUrl?: string;
     toolCount: number;
     tools: UiTool[];
+    /**
+     * Verdict of the last proactive credential liveness check (issue #24), for the
+     * connectors that hold a credential connecta stores. Shown beside the live
+     * status so an operator can tell "checked just now" from "last verified an
+     * hour ago", and see a dead credential the page's own probe may not reach.
+     */
+    credentialCheck?: {
+        state: "ok" | "auth_required" | "error";
+        checkedAt: string;
+        message?: string;
+    };
     credential?: {
         label: string;
         description?: string;

package/dist/ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEjE,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,gRAM1B,CAAC;AAER,UAAU,gBAAgB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAYnD,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CA0BlB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAkBzE;AAWD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQnD;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASrD;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,UAAU,EAAE,OAAO,CAAC;QACpB,+EAA+E;QAC/E,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EAAE,EACzB,KAAK,EAAE,MAAM,GACZ,mBAAmB,EAAE,CAuBvB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,CAAC,EAAE,eAAe,EACjC,eAAe,UAAQ,GACtB,OAAO,CAAC,MAAM,CAAC,CA4GjB;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,MAAM,SAAS,EACf,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAg1BR"}
+{"version":3,"file":"ui.d.ts","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAEjE,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,gRAM1B,CAAC;AAER,UAAU,gBAAgB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,eAAO,MAAM,oBAAoB,iBAAiB,CAAC;AAYnD,wBAAgB,eAAe,CAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,gBAAgB,CA0BlB;AAgBD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAgBzE;AAWD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAQnD;AAcD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CASrD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAOpD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,EAAE,CAWjE;AAED,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB;;;;;OAKG;IACH,eAAe,CAAC,EAAE;QAChB,KAAK,EAAE,IAAI,GAAG,eAAe,GAAG,OAAO,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,KAAK,CAAC;YACb,IAAI,EAAE,MAAM,CAAC;YACb,KAAK,EAAE,MAAM,CAAC;YACd,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;YACzC,UAAU,EAAE,OAAO,CAAC;YACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC,CAAC;QACH,UAAU,EAAE,OAAO,CAAC;QACpB,+EAA+E;QAC/E,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,MAAM;IACrB,UAAU,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9C,UAAU,EAAE,WAAW,EAAE,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,WAAW,CAAC;IACvB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,WAAW,EAAE,EACzB,KAAK,EAAE,MAAM,GACZ,mBAAmB,EAAE,CAuBvB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,EAC7C,eAAe,CAAC,EAAE,eAAe,EACjC,eAAe,UAAQ,GACtB,OAAO,CAAC,MAAM,CAAC,CA4HjB;AAiBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,MAAM,CAAC,EAAE,YAAY,EACrB,MAAM,SAAS,EACf,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,KAAK,CAAC,EAAE,MAAM,GACb,MAAM,CAy3BR"}

package/dist/ui.js

@@ -1,3 +1,4 @@
+import { credentialTestRule } from "./credentials.js";
 /** Connecta's default monochrome "C" mark. */
 export const CONNECTA_FAVICON_SVG = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
   <style>
@@ -40,6 +41,19 @@ export function resolveBranding(branding) {
         themeColor: trimmedString(branding?.themeColor) ?? "#ffffff",
     };
 }
+/**
+ * Whether the operator meant to supply a value here — the question every
+ * dropped-URL warning asks before naming a field, and one definition so the
+ * branding and `uiAuth` warnings cannot answer it differently. A non-string
+ * counts as set: the intent was there and is exactly what the warning reports
+ * on. A blank or whitespace-only string does not; that is indistinguishable
+ * from leaving the field alone, and both take the default silently.
+ */
+function isSetUrlValue(value) {
+    return typeof value === "string"
+        ? trimmedString(value) !== undefined
+        : value !== undefined && value !== null;
+}
 /**
  * Names of the branding URLs the operator set that failed their gate and were
  * replaced by a default. Lives beside the gates so the startup warning cannot
@@ -50,16 +64,15 @@ export function droppedBrandingUrls(branding) {
     if (!branding)
         return [];
     const resolved = resolveBranding(branding);
-    // A non-string still counts as "set": the operator meant to supply a URL, and
-    // that intent is exactly what the warning reports on. A blank string does not.
-    const isSet = (value) => typeof value === "string"
-        ? trimmedString(value) !== undefined
-        : value !== undefined && value !== null;
     const faviconHref = branding.favicon?.href;
     return [
-        ...(isSet(branding.productUrl) && !resolved.productUrl ? ["productUrl"] : []),
-        ...(isSet(branding.ownerUrl) && !resolved.ownerUrl ? ["ownerUrl"] : []),
-        ...(isSet(faviconHref) &&
+        ...(isSetUrlValue(branding.productUrl) && !resolved.productUrl
+            ? ["productUrl"]
+            : []),
+        ...(isSetUrlValue(branding.ownerUrl) && !resolved.ownerUrl
+            ? ["ownerUrl"]
+            : []),
+        ...(isSetUrlValue(faviconHref) &&
             trimmedString(faviconHref) !== resolved.faviconHref
             ? ["favicon.href"]
             : []),
@@ -132,6 +145,68 @@ export function isSafeIconHref(href) {
         return false;
     }
 }
+/**
+ * True only for an absolute `https:` URL — the gate every `uiAuth` URL passes:
+ * `frontendApiUrl`, which becomes the `<script src>` of `/ui`'s sign-in loader,
+ * and `signInUrl`/`signUpUrl`, which ClerkJS uses as *navigation targets* when
+ * the operator signs in. With those three gated, no operator-config value
+ * reaches the browser in a URL position — attribute or navigation — without
+ * validation, and there is no exception left to remember.
+ *
+ * Stricter than `isSafeHttpUrl` on purpose: no `http:` carve-out, no loopback
+ * carve-out, and no relative form. Nobody types `frontendApiUrl` — the shipped
+ * Clerk adapter derives it from the publishable key, and Clerk's Frontend API is
+ * always https — and a cleartext script source on the dashboard would be a
+ * downgrade even where a browser's mixed-content rules had not already blocked
+ * it. `signInUrl`/`signUpUrl` *are* typed by the operator, but what belongs
+ * there is a hosted Account Portal address (`https://accounts.<domain>` or
+ * `https://<slug>.accounts.dev`), which is https as well; `http:` would carry a
+ * sign-in over cleartext, and a path relative to this origin is meaningless
+ * because this server hosts no sign-in page of its own. So the looser gate would
+ * buy nothing real, and the same strictness holds for all three.
+ */
+export function isSafeHttpsUrl(url) {
+    if (typeof url !== "string")
+        return false;
+    try {
+        return new URL(url).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Names of the `uiAuth` URLs an inbound-auth provider supplied that failed their
+ * gate. Lives beside the gate for the same reason `droppedBrandingUrls` does: the
+ * startup warning cannot then drift from what rendering actually drops. Every
+ * field is read defensively rather than trusted, because a custom `InboundAuth`
+ * is untyped at a JS call site — `isSafeHttpsUrl` takes `unknown`, and a
+ * `uiAuth` that is not the clerk shape is reported as nothing to warn about.
+ *
+ * `frontendApiUrl` is required, so anything that fails its gate is a drop.
+ * `signInUrl` and `signUpUrl` are optional, so only a value the operator
+ * *supplied* and the gate then rejected is worth a warning — an unset field
+ * took no default away from anyone. `isSetUrlValue` decides that, the same way
+ * and for the same reasons it decides it for the branding URLs: a warning that
+ * fires for one and not the other would be reporting on the field rather than
+ * on the operator's intent. Rendering is not consulted for this: it drops on
+ * the gate alone, and a blank string fails that gate too — it is simply not
+ * *reported*, because a blank is indistinguishable from leaving the field
+ * alone.
+ */
+export function droppedUiAuthUrls(uiAuth) {
+    if (!uiAuth || uiAuth.kind !== "clerk")
+        return [];
+    return [
+        ...(isSafeHttpsUrl(uiAuth.frontendApiUrl) ? [] : ["uiAuth.frontendApiUrl"]),
+        ...(isSetUrlValue(uiAuth.signInUrl) && !isSafeHttpsUrl(uiAuth.signInUrl)
+            ? ["uiAuth.signInUrl"]
+            : []),
+        ...(isSetUrlValue(uiAuth.signUpUrl) && !isSafeHttpsUrl(uiAuth.signUpUrl)
+            ? ["uiAuth.signUpUrl"]
+            : []),
+    ];
+}
 /**
  * Filter by connector identity/description or tool name/description. A
  * connector-level match stays visible even when it currently exposes no tools
@@ -168,6 +243,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
     const requestScope = {};
     const connectors = await Promise.all(registry.listConnectors().map(async (c) => {
         const status = await registry.statusFor(c.id, baseUrl, requestScope);
+        const credentialCheck = await registry.credentialHealthFor(c.id);
         let tools = [];
         // `status()` on an unauthenticated remote connector starts OAuth and
         // stores its state + PKCE verifier. Probing listTools immediately
@@ -188,6 +264,10 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
         }
         let credential;
         if (c.credential && credentialVault) {
+            // One rule, shared with the test route: only the hook matching the
+            // declared credential shape can run, so the button is offered only
+            // where a click can succeed (src/credentials.ts).
+            const testable = credentialTestRule(c).mode !== null;
             const credentialFields = (metadata) => c.credential?.fields?.map((field) => {
                 const fieldMetadata = metadata?.fields?.[field.name];
                 return {
@@ -231,7 +311,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
                             updatedAt: metadata.updatedAt,
                         }
                         : {}),
-                    testable: Boolean(c.testCredential || c.testCredentials),
+                    testable,
                 };
             }
             catch {
@@ -247,7 +327,7 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
                     ...(fields?.length ? { fields } : {}),
                     configured: false,
                     removable: true,
-                    testable: Boolean(c.testCredential || c.testCredentials),
+                    testable,
                     error: "Stored credential could not be read.",
                 };
             }
@@ -263,6 +343,17 @@ export async function buildUiData(registry, baseUrl, serverInfo, credentialVault
                 : {}),
             toolCount: tools.length,
             tools,
+            ...(credentialCheck
+                ? {
+                    credentialCheck: {
+                        state: credentialCheck.state,
+                        checkedAt: credentialCheck.checkedAt,
+                        ...(credentialCheck.message
+                            ? { message: credentialCheck.message }
+                            : {}),
+                    },
+                }
+                : {}),
             ...(credential ? { credential } : {}),
         };
     }));
@@ -288,7 +379,34 @@ function jsonForInlineScript(value) {
  * retain the manual-token fallback.
  */
 export function renderUiHtml(uiAuth, mcpUrl = "/mcp", branding, nonce) {
-    const auth = uiAuth ?? { kind: "bearer" };
+    const clerk = uiAuth?.kind === "clerk" ? uiAuth : undefined;
+    // The Clerk loader's origin. A value that fails the gate is dropped rather
+    // than escaped into the page: the loader tag is simply not emitted, the gate
+    // reports that Clerk could not load, and the rest of the shell still renders —
+    // the same fallback-and-warn posture the branding URLs take, with the drop
+    // named in a startup warning (see `droppedUiAuthUrls`).
+    const clerkScriptOrigin = clerk && isSafeHttpsUrl(clerk.frontendApiUrl)
+        ? clerk.frontendApiUrl
+        : undefined;
+    // Enumerated field by field, because this object is serialized into the page's
+    // inline script: a rejected frontendApiUrl must not reach the document through
+    // `AUTH` after being kept out of the `<script src>`, and a rejected
+    // signInUrl/signUpUrl — which `AUTH` is the only path into the page for — must
+    // not reach it at all. Dropping one leaves the key absent, so `Clerk.load`
+    // falls back to its own default the same way it does for an unset value.
+    const auth = clerk
+        ? {
+            kind: clerk.kind,
+            publishableKey: clerk.publishableKey,
+            ...(clerkScriptOrigin ? { frontendApiUrl: clerkScriptOrigin } : {}),
+            ...(isSafeHttpsUrl(clerk.signInUrl)
+                ? { signInUrl: clerk.signInUrl }
+                : {}),
+            ...(isSafeHttpsUrl(clerk.signUpUrl)
+                ? { signUpUrl: clerk.signUpUrl }
+                : {}),
+        }
+        : (uiAuth ?? { kind: "bearer" });
     const brand = resolveBranding(branding);
     const title = brand.pageTitle;
     // When the /ui response ships a nonce-based CSP, every <script> it emits must
@@ -309,8 +427,8 @@ export function renderUiHtml(uiAuth, mcpUrl = "/mcp", branding, nonce) {
             ? `<a class="product navlink" href="${escapeHtmlAttr(brand.productUrl)}">${escapeHtmlAttr(brand.productName)}</a>`
             : `<span class="product">${escapeHtmlAttr(brand.productName)}</span>`
         : "";
-    const clerkScript = uiAuth?.kind === "clerk"
-        ? `<script${nonceAttr} defer crossorigin="anonymous" data-clerk-publishable-key="${escapeHtmlAttr(uiAuth.publishableKey)}" src="${escapeHtmlAttr(uiAuth.frontendApiUrl)}/npm/@clerk/clerk-js@6/dist/clerk.browser.js"></script>`
+    const clerkScript = clerk && clerkScriptOrigin
+        ? `<script${nonceAttr} defer crossorigin="anonymous" data-clerk-publishable-key="${escapeHtmlAttr(clerk.publishableKey)}" src="${escapeHtmlAttr(clerkScriptOrigin)}/npm/@clerk/clerk-js@6/dist/clerk.browser.js"></script>`
         : "";
     return `<!doctype html>
 <html lang="en">
@@ -888,6 +1006,19 @@ function render() {
     if (c.message) {
       head += '<p class="connector-message msg">' + esc(c.message) + "</p>";
     }
+    if (c.credentialCheck) {
+      const check = c.credentialCheck;
+      const verdict = check.state === "ok"
+        ? "credential verified"
+        : check.state === "auth_required"
+          ? "credential needs authorization"
+          : "credential check failed";
+      head += '<p class="connector-check meta">Credential check: ' +
+        esc(verdict) + " · " + esc(formatDate(check.checkedAt)) +
+        (check.message && check.message !== c.message
+          ? " — " + esc(check.message)
+          : "") + "</p>";
+    }
     if (c.authorizationUrl) {
       const safe = safeHttp(c.authorizationUrl);
       head += safe

package/dist/ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAIA,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;OAM7B,CAAC;AAeR,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAA2B;IAE3B,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,UAAU,CAAC;IACvE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrD,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO;QACL,WAAW;QACX,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,WAAW,EACT,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC;YACpC,4BAA4B,WAAW,sCAAsC;QAC/E,SAAS,EACP,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;YAClC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7D,WAAW,EACT,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;YACxC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,oBAAoB;QAC1B,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,SAAS;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE,CAC/B,OAAO,KAAK,KAAK,QAAQ;QACvB,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS;QACpC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;IAC5C,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;YACtB,aAAa,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,WAAW;YACjD,CAAC,CAAC,CAAC,cAAc,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoDD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,KAAa;IAEb,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG;YACpB,SAAS,CAAC,EAAE;YACZ,SAAS,CAAC,KAAK;YACf,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,MAAM;SACjB;aACE,IAAI,CAAC,GAAG,CAAC;aACT,WAAW,EAAE,CAAC;QACjB,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC;YACF,gBAAgB;YAChB,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAkB,EAClB,OAAe,EACf,UAA6C,EAC7C,eAAiC,EACjC,eAAe,GAAG,KAAK;IAEvB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAwB,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACrE,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,0CAA0C;QAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,KAAK,GAAG,CACN,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CACrD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,IAAI,UAAqC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,gBAAgB,GAAG,CACvB,QAA2D,EAC3D,EAAE,CACF,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,UAAU;oBACxC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;oBAClC,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC;4BACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,SAAS,EAAE,aAAa,CAAC,SAAS;yBACnC;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC1C,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,MAAM,EAAE,MAAM;wBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC3C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAC5B,GAAG,CAAC,QAAQ;wBACV,CAAC,CAAC;4BACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;yBAC9B;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC;iBACzD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,IAAI;oBACf,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,CAAC,eAAe,CAAC;oBACxD,KAAK,EAAE,sCAAsC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK;YACL,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAqB,EACrB,MAAM,GAAG,MAAM,EACf,QAA2B,EAC3B,KAAc;IAEd,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IAC9B,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,2EAA2E;IAC3E,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,kCAAkC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;YAC5G,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS;QACnE,CAAC,CAAC,KAAK,CAAC,UAAU;YAChB,CAAC,CAAC,kCAAkC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YAChH,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,UAAU;YAChB,CAAC,CAAC,oCAAoC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YAClH,CAAC,CAAC,yBAAyB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS;QACvE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GACf,MAAM,EAAE,IAAI,KAAK,OAAO;QACtB,CAAC,CAAC,UAAU,SAAS,8DAA8D,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,UAAU,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,yDAAyD;QAChO,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;oCAK2B,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;oCAChC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;yBAC5C,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;SAEjD,cAAc,CAAC,KAAK,CAAC;EAC5B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2QT,KAAK;;MAEH,OAAO;;;;;;;;;;;;;;;;WAgBF,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA4BH,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAkCjE,SAAS;eACH,mBAAmB,CAAC,IAAI,CAAC;kBACtB,mBAAmB,CAAC,MAAM,CAAC;6BAChB,kBAAkB,CAAC,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAwFZ,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAoX3E,CAAC;AACT,CAAC"}
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAKtD,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;OAM7B,CAAC;AAeR,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,QAA2B;IAE3B,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,UAAU,CAAC;IACvE,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACrD,0EAA0E;IAC1E,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,WAAW,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,OAAO;QACL,WAAW;QACX,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,WAAW,EACT,aAAa,CAAC,QAAQ,EAAE,WAAW,CAAC;YACpC,4BAA4B,WAAW,sCAAsC;QAC/E,SAAS,EACP,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC;YAClC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,WAAW,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QAC7D,WAAW,EACT,WAAW,IAAI,cAAc,CAAC,WAAW,CAAC;YACxC,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,oBAAoB;QAC1B,UAAU,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,SAAS;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;QAC9B,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,SAAS;QACpC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA2B;IAC7D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAC3C,OAAO;QACL,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU;YAC5D,CAAC,CAAC,CAAC,YAAY,CAAC;YAChB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACxD,CAAC,CAAC,CAAC,UAAU,CAAC;YACd,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC;YAC9B,aAAa,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,WAAW;YACjD,CAAC,CAAC,CAAC,cAAc,CAAC;YAClB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACrC,OAAO,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,+EAA+E;AAC/E,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAEvC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAAC,IAAa;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,MAAM,KAAK,iBAAiB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAqB;IACrD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAClD,OAAO;QACL,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAC3E,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC;YACtE,CAAC,CAAC,CAAC,kBAAkB,CAAC;YACtB,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AA+DD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAAyB,EACzB,KAAa;IAEb,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG;YACpB,SAAS,CAAC,EAAE;YACZ,SAAS,CAAC,KAAK;YACf,SAAS,CAAC,WAAW;YACrB,SAAS,CAAC,MAAM;SACjB;aACE,IAAI,CAAC,GAAG,CAAC;aACT,WAAW,EAAE,CAAC;QACjB,MAAM,gBAAgB,GAAG,OAAO,CAAC,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAClC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC;YACF,gBAAgB;YAChB,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CACrE,CAAC;QACF,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB;YAAE,SAAS;QAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAkB,EAClB,OAAe,EACf,UAA6C,EAC7C,eAAiC,EACjC,eAAe,GAAG,KAAK;IAEvB,MAAM,YAAY,GAAG,EAAE,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,GAAG,CAClC,QAAQ,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAwB,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,eAAe,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,qEAAqE;QACrE,kEAAkE;QAClE,wEAAwE;QACxE,oEAAoE;QACpE,0CAA0C;QAC1C,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,KAAK,GAAG,CACN,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,CACrD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE;oBAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;iBAC3B,CAAC,CAAC,CAAC;YACN,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;QACD,IAAI,UAAqC,CAAC;QAC1C,IAAI,CAAC,CAAC,UAAU,IAAI,eAAe,EAAE,CAAC;YACpC,mEAAmE;YACnE,mEAAmE;YACnE,kDAAkD;YAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;YACrD,MAAM,gBAAgB,GAAG,CACvB,QAA2D,EAC3D,EAAE,CACF,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAClC,MAAM,aAAa,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrD,OAAO;oBACL,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,KAAK,CAAC,WAAW;wBACnB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;wBACpC,CAAC,CAAC,EAAE,CAAC;oBACP,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,UAAU;oBACxC,UAAU,EAAE,OAAO,CAAC,aAAa,CAAC;oBAClC,GAAG,CAAC,aAAa;wBACf,CAAC,CAAC;4BACE,QAAQ,EAAE,aAAa,CAAC,QAAQ;4BAChC,SAAS,EAAE,aAAa,CAAC,SAAS;yBACnC;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC;YACJ,CAAC,CAAC,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAC1C,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,MAAM,EAAE,MAAM;wBACxB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;wBAC3C,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;oBACrB,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC;oBAC5B,GAAG,CAAC,QAAQ;wBACV,CAAC,CAAC;4BACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;4BAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;yBAC9B;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,QAAQ;iBACT,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;gBAClC,UAAU,GAAG;oBACX,KAAK,EAAE,CAAC,CAAC,UAAU,CAAC,KAAK;oBACzB,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW;wBAC1B,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,UAAU,EAAE,KAAK;oBACjB,SAAS,EAAE,IAAI;oBACf,QAAQ;oBACR,KAAK,EAAE,sCAAsC;iBAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,MAAM,EAAE,MAAM,CAAC,KAAK;YACpB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,gBAAgB,CAAC;gBACxC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACP,SAAS,EAAE,KAAK,CAAC,MAAM;YACvB,KAAK;YACL,GAAG,CAAC,eAAe;gBACjB,CAAC,CAAC;oBACE,eAAe,EAAE;wBACf,KAAK,EAAE,eAAe,CAAC,KAAK;wBAC5B,SAAS,EAAE,eAAe,CAAC,SAAS;wBACpC,GAAG,CAAC,eAAe,CAAC,OAAO;4BACzB,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE;4BACtC,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtC,CAAC;IACJ,CAAC,CAAC,CACH,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC;SAC1B,UAAU,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,MAAqB,EACrB,MAAM,GAAG,MAAM,EACf,QAA2B,EAC3B,KAAc;IAEd,MAAM,KAAK,GAAG,MAAM,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,2EAA2E;IAC3E,6EAA6E;IAC7E,+EAA+E;IAC/E,2EAA2E;IAC3E,wDAAwD;IACxD,MAAM,iBAAiB,GACrB,KAAK,IAAI,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC;QAC3C,CAAC,CAAC,KAAK,CAAC,cAAc;QACtB,CAAC,CAAC,SAAS,CAAC;IAChB,+EAA+E;IAC/E,+EAA+E;IAC/E,oEAAoE;IACpE,+EAA+E;IAC/E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC;YACE,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAChC,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC;gBACjC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE;gBAChC,CAAC,CAAC,EAAE,CAAC;SACR;QACH,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC;IAC9B,8EAA8E;IAC9E,oEAAoE;IACpE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,2EAA2E;IAC3E,qEAAqE;IACrE,8BAA8B;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS;QAC3B,CAAC,CAAC,KAAK,CAAC,QAAQ;YACd,CAAC,CAAC,kCAAkC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM;YAC5G,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS;QACnE,CAAC,CAAC,KAAK,CAAC,UAAU;YAChB,CAAC,CAAC,kCAAkC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YAChH,CAAC,CAAC,uBAAuB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,UAAU;YAChB,CAAC,CAAC,oCAAoC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM;YAClH,CAAC,CAAC,yBAAyB,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,SAAS;QACvE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GACf,KAAK,IAAI,iBAAiB;QACxB,CAAC,CAAC,UAAU,SAAS,8DAA8D,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,cAAc,CAAC,iBAAiB,CAAC,yDAAyD;QAC3N,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;;;;;oCAK2B,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;oCAChC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;yBAC5C,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;SAEjD,cAAc,CAAC,KAAK,CAAC;EAC5B,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2QT,KAAK;;MAEH,OAAO;;;;;;;;;;;;;;;;WAgBF,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;yCA4BH,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAkCjE,SAAS;eACH,mBAAmB,CAAC,IAAI,CAAC;kBACtB,mBAAmB,CAAC,MAAM,CAAC;6BAChB,kBAAkB,CAAC,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8CAwFZ,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAiY3E,CAAC;AACT,CAAC"}

package/dist/version.d.ts

@@ -4,5 +4,5 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export declare const CONNECTA_VERSION = "0.5.0";
+export declare const CONNECTA_VERSION = "0.6.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -4,5 +4,5 @@
  * a bump that forgets this file fails the build rather than shipping a stale
  * version to `/health` and to downstream MCP handshakes.
  */
-export const CONNECTA_VERSION = "0.5.0";
+export const CONNECTA_VERSION = "0.6.1";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zackbart/connecta",
-  "version": "0.5.0",
+  "version": "0.6.1",
   "type": "module",
   "sideEffects": false,
   "description": "One MCP to rule them all — a single MCP endpoint aggregating many downstream connectors behind nine meta-tools.",

package/src/auth/bearer.ts

@@ -1,3 +1,7 @@
+import {
+  resolveToolkitBinding,
+  type ToolkitBindingOptions,
+} from "../toolkits.js";
 import type { AuthResult, InboundAuth } from "../types.js";
 
 const encoder = new TextEncoder();
@@ -15,18 +19,48 @@ function timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {
   return r === 0;
 }
 
+export interface BearerTokenOptions extends ToolkitBindingOptions {
+  /** Stable identity for this credential, used on activity events. */
+  subjectId?: string;
+}
+
 /**
  * Static bearer-token inbound auth. Constant-time compares the Bearer token
  * against `secret`. Checked BEFORE the Clerk gate in the server; a mismatch
  * falls through so a co-configured Clerk provider can still admit the request.
+ *
+ * `toolkits` binds the token to named toolkits (§16): one `bearerToken(...)` per
+ * team credential, each naming the view that team may open. Omit it and the
+ * token stays unbound — every declared toolkit plus the full registry.
  */
 export function bearerToken(
   secret: string,
-  options: { subjectId?: string } = {},
+  options: BearerTokenOptions = {},
 ): InboundAuth {
   const secretBytes = encoder.encode(secret);
+  const toolkitBinding = resolveToolkitBinding(
+    options.subjectId
+      ? `bearerToken (subjectId "${options.subjectId}")`
+      : "bearerToken",
+    options,
+  );
+  if (toolkitBinding && !options.subjectId) {
+    // A bound token stands for one team, and both surfaces that report on it —
+    // the 403 refusal log (§16) and activity events (§15) — can only say
+    // "bearer" without a subjectId. With several bound tokens that makes an
+    // operator unable to tell which credential was refused, or whose call
+    // succeeded. console.warn (as the Clerk adapter does) because an adapter is
+    // constructed before `createConnecta` has a logger to hand it.
+    console.warn(
+      "[connecta] bearerToken is bound to toolkits " +
+        `(${toolkitBinding.toolkits.join(", ") || "unscoped only"}) but has no ` +
+        "subjectId: refusal logs and activity events cannot say which " +
+        "credential they came from. Pass { subjectId: \"<team>\" }.",
+    );
+  }
   return {
     kind: "bearer",
+    ...(toolkitBinding ? { toolkitBinding } : {}),
     authorize(request): AuthResult {
       const header = request.headers.get("authorization") ?? "";
       const match = /^Bearer\s+(.+)$/i.exec(header);