@zackbart/connecta 0.5.0 → 0.6.1

package/dist/auth/clerk.js

@@ -1,7 +1,8 @@
 // Clerk as the OAuth 2.1 authorization server; connecta is the resource server.
-// Single tenant, no tenant-tag requirement, optional gate() with ~60s identity
-// caching.
+// Single tenant, no tenant-tag requirement, optional allowedDomains/gate() with
+// ~60s identity caching.
 import { createClerkClient } from "@clerk/backend";
+import { resolveToolkitBinding, } from "../toolkits.js";
 const CORS_HEADERS = {
     "Access-Control-Allow-Origin": "*",
     "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
@@ -27,11 +28,118 @@ function fapiUrl(publishableKey) {
 }
 const GATE_ALLOWED_TTL_MS = 60 * 1000;
 const GATE_FORBIDDEN_TTL_MS = 30 * 1000;
+/**
+ * One label of a domain: ASCII letters/digits, interior hyphens only, 63
+ * characters at most. ASCII-only is deliberate — an internationalized domain
+ * must be in its punycode (`xn--…`) form, so a Unicode confusable can neither be
+ * typed into the allowlist nor arrive in an email address and pass for a domain
+ * the operator cannot tell from theirs by eye.
+ */
+const DOMAIN_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+/**
+ * Is this string a domain, before any case folding? Both sides of the
+ * comparison — the operator's allowlist entries and the domain read off a
+ * user's email — are checked against this one grammar, so neither side can be
+ * *repaired* into a match by the normalization that follows: `"acme.com\n"` and
+ * `" acme.com"` are malformed, not `acme.com`, and an `akme.com` spelled with a
+ * U+212A KELVIN SIGN is rejected here rather than folded to plain ASCII `k` by
+ * `toLowerCase`.
+ */
+function isDomain(domain) {
+    return (domain.length > 0 &&
+        domain.length <= 253 &&
+        domain.includes(".") &&
+        domain.split(".").every((label) => DOMAIN_LABEL_RE.test(label)));
+}
+/**
+ * Validate and lowercase `allowedDomains` at construction. Everything here
+ * throws rather than dropping the entry: an allowlist that does not say what
+ * its author meant is invisible until the day it admits the wrong caller.
+ */
+function normalizeAllowedDomains(value) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value)) {
+        throw new Error("clerkAuth: `allowedDomains` must be an array of domains.");
+    }
+    if (value.length === 0) {
+        // Fail-closed, an empty list admits nobody and the deployment is dead on
+        // arrival; read as "no restriction", it is the one shape here that fails
+        // OPEN. Neither is what anyone meant to write.
+        throw new Error("clerkAuth: `allowedDomains` is empty. List at least one domain, or " +
+            "drop the option to admit every authenticated user.");
+    }
+    const domains = new Set();
+    for (const entry of value) {
+        if (typeof entry !== "string") {
+            throw new Error(`clerkAuth: \`allowedDomains\` entry ${JSON.stringify(entry)} is not a string.`);
+        }
+        // Surrounding whitespace is the one thing forgiven, and only here: this is
+        // operator config read at construction, where a stray space is a typo the
+        // operator can see in the throw. Nothing is forgiven on the email side.
+        const domain = entry.trim();
+        if (!isDomain(domain)) {
+            const hint = domain.includes("@")
+                ? " Write the domain alone, with no `@` and no local part."
+                : "";
+            throw new Error(`clerkAuth: \`allowedDomains\` entry ${JSON.stringify(entry)} is not a ` +
+                `domain (expected something like "acme.com").${hint}`);
+        }
+        domains.add(domain.toLowerCase());
+    }
+    return domains;
+}
+/**
+ * Bounded, escaped form of the denied domain for the operator log — the same
+ * treatment `src/server.ts` gives a rejected toolkit name. An email domain is
+ * caller-influenced (anyone who controls a mailbox controls its domain): the
+ * bound is what a 253-byte domain needs, and the escaping — JSON.stringify plus
+ * the hand-rolled U+2028/U+2029 pass it leaves raw — is defense in depth behind
+ * `isDomain`, which has already ruled out the newline that would forge a line.
+ */
+function loggableDomain(domain) {
+    const bounded = domain.slice(0, 100);
+    const escaped = JSON.stringify(bounded).replace(/[\u2028\u2029]/g, (ch) => `\\u${ch.charCodeAt(0).toString(16)}`);
+    return escaped + (bounded.length < domain.length ? " (truncated)" : "");
+}
+/**
+ * The domain of an email address, lowercased for comparison, or null when the
+ * address does not have exactly one well-formed domain to read.
+ *
+ * Nothing here repairs the input. The domain is validated as it arrived and
+ * only then lowercased, so `dev@ acme.com`, `dev@acme.com\n` and `dev@acme.com.`
+ * are malformed addresses that DENY, rather than whitespace-trimmed or
+ * dot-stripped into a match for `acme.com`. The split is on the last `@`, the
+ * part a mail system routes on, so this reads the same domain that would
+ * receive the mail. (Under exact set matching a first-`@` split could not fail
+ * open either — it would just read a domain nobody delivers to.)
+ */
+function emailDomain(email) {
+    const at = email.lastIndexOf("@");
+    if (at <= 0 || at === email.length - 1)
+        return null;
+    const domain = email.slice(at + 1);
+    return isDomain(domain) ? domain.toLowerCase() : null;
+}
+/**
+ * Clerk inbound auth.
+ *
+ * `allowedDomains` and `gate` decide WHO is admitted (both must pass);
+ * `toolkits` decides WHICH view the admitted user gets.
+ *
+ * `toolkits` binds every user this provider admits to those toolkits (§16). For
+ * a per-team split, configure one `clerkAuth(...)` per team — the same keys, a
+ * `gate` naming that team's users, and that team's `toolkits`. The server tries
+ * providers in order and the first that admits the user supplies the binding, so
+ * a user one gate rejects falls through to the next.
+ */
 export function clerkAuth(opts) {
     const clerk = createClerkClient({
         secretKey: opts.secretKey,
         publishableKey: opts.publishableKey,
     });
+    const toolkitBinding = resolveToolkitBinding("clerkAuth", opts);
+    const allowedDomains = normalizeAllowedDomains(opts.allowedDomains);
     const scopes = opts.scopes ?? ["openid", "profile", "email"];
     const gateCache = new Map();
     const resolveBase = (baseUrl) => opts.publicUrl ?? baseUrl;
@@ -47,15 +155,63 @@ export function clerkAuth(opts) {
         });
     };
     const forbidden = () => new Response(JSON.stringify({ error: "forbidden" }), { status: 403, headers: { "Content-Type": "application/json" } });
+    /**
+     * The domain half of admission. Fails CLOSED on every uncertainty — no
+     * primary email, an unverified one, a malformed address, or the lookup
+     * itself failing — because "we could not tell" and "they belong here" must
+     * not be the same answer for a membership rule.
+     */
+    const checkDomain = async (userId) => {
+        if (!allowedDomains)
+            return true;
+        let email;
+        try {
+            const user = await clerk.users.getUser(userId);
+            const primary = user.emailAddresses?.find((address) => address.id === user.primaryEmailAddressId);
+            if (primary?.verification?.status === "verified") {
+                email = primary.emailAddress;
+            }
+        }
+        catch (error) {
+            console.warn(`[connecta] clerk email lookup failed for ${userId}: ${error instanceof Error ? error.message : String(error)} — denying`);
+            return false;
+        }
+        const domain = email ? emailDomain(email) : null;
+        if (!domain) {
+            // One line for three cases (no primary email, unverified, or an address
+            // with no readable domain) because the caller must not be able to tell
+            // them apart — but it must not claim the email is missing when it is
+            // there and malformed.
+            console.warn(`[connecta] clerk user ${userId} has no verified primary email with a ` +
+                "well-formed domain — denying");
+            return false;
+        }
+        if (!allowedDomains.has(domain)) {
+            // The domain, never the address: this is an operator log, not a place to
+            // spill the local part of someone's email on every denied request.
+            console.warn(`[connecta] clerk user ${userId} denied: email domain ` +
+                `${loggableDomain(domain)} is not on allowedDomains`);
+            return false;
+        }
+        return true;
+    };
+    /**
+     * Is this authenticated user admitted? The domain allowlist and `gate` both
+     * have to say yes, and the allowlist runs first so an outsider never reaches
+     * operator gate code. One cached verdict covers both, so composing them costs
+     * no more Clerk calls than `gate` alone did.
+     */
     const checkGate = async (userId) => {
-        if (!opts.gate)
+        if (!opts.gate && !allowedDomains)
             return true;
         const hit = gateCache.get(userId);
         if (hit && Date.now() < hit.exp)
             return hit.allowed;
         let allowed = false;
         try {
-            allowed = await opts.gate(userId, clerk);
+            allowed =
+                (await checkDomain(userId)) &&
+                    (opts.gate ? await opts.gate(userId, clerk) : true);
         }
         catch {
             allowed = false;
@@ -69,6 +225,7 @@ export function clerkAuth(opts) {
     };
     return {
         kind: "clerk",
+        ...(toolkitBinding ? { toolkitBinding } : {}),
         uiAuth: {
             kind: "clerk",
             publishableKey: opts.publishableKey,

package/dist/auth/clerk.js.map

@@ -1 +1 @@
-{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,WAAW;AAEX,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAoBnD,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;CACtD,CAAC;AAEF,oEAAoE;AACpE,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,WAAW,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEvE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAEnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,YAAqB,EAAY,EAAE;QACxE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,uCAAuC,CAAC;QAC5E,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,UAAU,KAAK,sBAAsB,IAAI,GAAG;aACjE;SACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IAEJ,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;YACpB,OAAO;YACP,GAAG,EACD,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QAED,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;YACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,uCAAuC;gBACpD,QAAQ,KAAK,2CAA2C,EACxD,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,QAAQ,EAAE,GAAG,IAAI,MAAM;oBACvB,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACrD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;oBACpC,gBAAgB,EAAE,MAAM;iBACzB,EACD,EAAE,OAAO,EAAE,YAAY,EAAE,CAC1B,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,yCAAyC,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,yCAAyC,CACzE,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO;YAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;oBACrD,mEAAmE;oBACnE,iEAAiE;oBACjE,qEAAqE;oBACrE,qEAAqE;oBACrE,+DAA+D;oBAC/D,mEAAmE;oBACnE,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;iBAC/C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;oBAC3B,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,MAAM,GAAG,KAA8C,CAAC;oBAC9D,OAAO,CAAC,IAAI,CACV,6CAA6C,KAAK,CAAC,MAAM,EAAE;wBACzD,WAAW,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE;wBACjE,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACvC,CAAC;oBACF,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;qBAC9C,CAAC;gBACJ,CAAC;gBACD,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAIb,CAAC;gBACF,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACpD,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,8CAA8C,GAAG,aAAa,MAAM,EAAE,CACvE,CAAC;wBACF,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;yBAC9C,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"clerk.js","sourceRoot":"","sources":["../../src/auth/clerk.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,yBAAyB;AAEzB,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EACL,qBAAqB,GAEtB,MAAM,gBAAgB,CAAC;AAgCxB,MAAM,YAAY,GAAG;IACnB,6BAA6B,EAAE,GAAG;IAClC,8BAA8B,EAAE,oBAAoB;IACpD,8BAA8B,EAC5B,mDAAmD;CACtD,CAAC;AAEF,oEAAoE;AACpE,SAAS,UAAU,CAAC,OAAgB;IAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,cAAc,CAAC;IACpD,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7C,OAAO,WAAW,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC;;;;;;GAMG;AACH,MAAM,eAAe,GAAG,yCAAyC,CAAC;AAElE;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,MAAc;IAC9B,OAAO,CACL,MAAM,CAAC,MAAM,GAAG,CAAC;QACjB,MAAM,CAAC,MAAM,IAAI,GAAG;QACpB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,KAAoC;IAEpC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,yEAAyE;QACzE,yEAAyE;QACzE,+CAA+C;QAC/C,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,oDAAoD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mBAAmB,CAChF,CAAC;QACJ,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAC/B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY;gBACtE,+CAA+C,IAAI,EAAE,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,MAAc;IACpC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAC7C,iBAAiB,EACjB,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAC9C,CAAC;IACF,OAAO,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,IAAsB;IAC9C,MAAM,KAAK,GAAG,iBAAiB,CAAC;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,qBAAqB,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAChE,MAAM,cAAc,GAAG,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEvE,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC;IAEnE,MAAM,YAAY,GAAG,CAAC,OAAe,EAAE,YAAqB,EAAY,EAAE;QACxE,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,uCAAuC,CAAC;QAC5E,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,EACzC;YACE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,UAAU,KAAK,sBAAsB,IAAI,GAAG;aACjE;SACF,CACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,GAAa,EAAE,CAC/B,IAAI,QAAQ,CACV,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,EACtC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CACjE,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,WAAW,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC7D,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,IAAI,CACvC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,qBAAqB,CACvD,CAAC;YACF,IAAI,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjD,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,4CAA4C,MAAM,KAChD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,YAAY,CACb,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,wEAAwE;YACxE,uEAAuE;YACvE,qEAAqE;YACrE,uBAAuB;YACvB,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wCAAwC;gBACrE,8BAA8B,CACjC,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAChC,yEAAyE;YACzE,mEAAmE;YACnE,OAAO,CAAC,IAAI,CACV,yBAAyB,MAAM,wBAAwB;gBACrD,GAAG,cAAc,CAAC,MAAM,CAAC,2BAA2B,CACvD,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF;;;;;OAKG;IACH,MAAM,SAAS,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC;YACH,OAAO;gBACL,CAAC,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;oBAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE;YACpB,OAAO;YACP,GAAG,EACD,IAAI,CAAC,GAAG,EAAE;gBACV,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qBAAqB,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE;YACN,IAAI,EAAE,OAAO;YACb,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD;QAED,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO;YACnC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,eAAe,CAAC;gBAAE,OAAO,IAAI,CAAC;YAEvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IACE,QAAQ,KAAK,uCAAuC;gBACpD,QAAQ,KAAK,2CAA2C,EACxD,CAAC;gBACD,OAAO,QAAQ,CAAC,IAAI,CAClB;oBACE,QAAQ,EAAE,GAAG,IAAI,MAAM;oBACvB,qBAAqB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;oBACrD,wBAAwB,EAAE,CAAC,QAAQ,CAAC;oBACpC,gBAAgB,EAAE,MAAM;iBACzB,EACD,EAAE,OAAO,EAAE,YAAY,EAAE,CAC1B,CAAC;YACJ,CAAC;YAED,IAAI,QAAQ,KAAK,yCAAyC,EAAE,CAAC;gBAC3D,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,yCAAyC,CACzE,CAAC;oBACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBACjB,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,oDAAoD,EAAE,EAC/D,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,YAAY,EAAE,CACvC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO;YAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;YACnE,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,OAAO,EAAE;oBACrD,mEAAmE;oBACnE,iEAAiE;oBACjE,qEAAqE;oBACrE,qEAAqE;oBACrE,+DAA+D;oBAC/D,mEAAmE;oBACnE,YAAY,EAAE,CAAC,aAAa,EAAE,eAAe,CAAC;iBAC/C,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC5B,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC;oBAC3B,4DAA4D;oBAC5D,uDAAuD;oBACvD,MAAM,MAAM,GAAG,KAA8C,CAAC;oBAC9D,OAAO,CAAC,IAAI,CACV,6CAA6C,KAAK,CAAC,MAAM,EAAE;wBACzD,WAAW,MAAM,CAAC,MAAM,IAAI,GAAG,YAAY,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE;wBACjE,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACvC,CAAC;oBACF,OAAO;wBACL,EAAE,EAAE,KAAK;wBACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;qBAC9C,CAAC;gBACJ,CAAC;gBACD,qEAAqE;gBACrE,oEAAoE;gBACpE,gEAAgE;gBAChE,MAAM,KAAK,GAAG,IAIb,CAAC;gBACF,IAAI,KAAK,CAAC,SAAS,KAAK,eAAe,EAAE,CAAC;oBACxC,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,EAAE,GAAG,CAAC;oBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACpD,IAAI,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;wBAC1B,OAAO,CAAC,IAAI,CACV,8CAA8C,GAAG,aAAa,MAAM,EAAE,CACvE,CAAC;wBACF,OAAO;4BACL,EAAE,EAAE,KAAK;4BACT,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC;yBAC9C,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CACV,+CACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,eAAe,UAAU,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;gBACF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC;YAC9C,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/connectors/remote-mcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CA8TvE"}
+{"version":3,"file":"remote-mcp.d.ts","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+CAA+C,CAAC;AAK/E,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,MAAM,EAEP,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,aAAa,GACrB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtB,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,SAAS,CAAC;CAC1D;AAwBD;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,SAAS,CAuUvE"}

package/dist/connectors/remote-mcp.js

@@ -233,6 +233,14 @@ export function remoteMcp(id, opts) {
         },
     };
     if (opts.auth?.type === "oauth") {
+        // The credential liveness checks (issue #24) probe only connectors that
+        // actually hold a stored grant: with no tokens there is nothing whose
+        // liveness could have lapsed, and a `status()` probe would kick off DCR +
+        // consent on a timer for a connector nobody has authorized yet.
+        connector.hasStoredCredential = async (ctx) => {
+            const state = stateFor(ctx);
+            return (await getProvider(ctx, state).tokens()) !== undefined;
+        };
         connector.verifyState = async (oauthState, ctx) => {
             const state = stateFor(ctx);
             return getProvider(ctx, state).verifyState(oauthState);

package/dist/connectors/remote-mcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAqDjD,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAsB;IAC1D,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAEtC,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,mBAAmB,GACvB,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,SAAS,IAAI,CAAC,GAAG,2EAA2E,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,yBAAyB,EAAE,iCAAiC,IAAI,CAAC,GAAG,kFAAkF,CACvJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,IAAI,kBAAkB,CACpB,eAAe,EACf,cAAc,EAAE,qEAAqE,EAAE,iCAAiC,EACxH,EAAE,KAAK,EAAE,CACV,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAmB,EAAE;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC;QACtC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;aAC1B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAsB,EACL,EAAE;QACnB,KAAK,CAAC,QAAQ,KAAK,IAAI,eAAe,CACpC,EAAE,EACF,GAAG,CAAC,OAAO,EACX,GAAG,GAAG,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,CACrB,GAAqB,EACrB,KAAsB,EACX,EAAE;QACb,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,IAAI,6BAA6B,CACtC,GAAG,EACH,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAsB,EAAE,EAAE;QACvC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,GAAqB,EACrB,KAAsB,EACP,EAAE;QACjB,4EAA4E;QAC5E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAClE,IACE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC5C,KAAK,CAAC,mBAAmB,EACzB,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,2EAA2E;YAC3E,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACxC,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,CAAC,GAAG,IAAI,MAAM,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC/C,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnB,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,mBAAmB,GAAG,UAAU,CAAC;gBACvC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,mEAAmE;gBACnE,mBAAmB;gBACnB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAc;QAC3B,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAE3B,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAClB,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;gBACpD,YAAY,EAAE,CAAC,CAAC,YAAuC;gBACvD,WAAW,EAAE,CAAC,CAAC,WAAqC;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAO,CAAC,QAAQ,CACjC;oBACE,IAAI;oBACJ,SAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACnD,EACD,SAAS,EACT,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;oBACzB,CAAC,CAAC;wBACE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;oBACpE,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,GAAG;wBACrB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS;gBACxB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAkC,CAAC;YAC/D,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,SAAS,CAAC,WAAW,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,SAAS,CAAC,SAAS,GAAG,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0BAA0B;gBAC1B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,yCAAyC;gBACzC,MAAM,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,MAAM,CAAC,CAAC,uBAAuB,EAAE;wBACnD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"remote-mcp.js","sourceRoot":"","sources":["../../src/connectors/remote-mcp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,2BAA2B,EAAE,MAAM,+CAA+C,CAAC;AAC5F,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAqDjD,SAAS,GAAG,CAAC,GAAY;IACvB,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,WAAW;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,IAAsB;IAC1D,sEAAsE;IACtE,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,OAAO,EAA2B,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAEtC,6EAA6E;IAC7E,6EAA6E;IAC7E,2EAA2E;IAC3E,yBAAyB;IACzB,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,mBAAmB,GACvB,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,yBAAyB,EAAE,SAAS,IAAI,CAAC,GAAG,2EAA2E,CACxH,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,yBAAyB,EAAE,iCAAiC,IAAI,CAAC,GAAG,kFAAkF,CACvJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAE,EAAE,CAC3C,IAAI,kBAAkB,CACpB,eAAe,EACf,cAAc,EAAE,qEAAqE,EAAE,iCAAiC,EACxH,EAAE,KAAK,EAAE,CACV,CAAC;IAEJ,MAAM,QAAQ,GAAG,CAAC,GAAqB,EAAmB,EAAE;QAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC;QACtC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG;gBACN,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,YAAY,EAAE,KAAK;gBACnB,QAAQ,EAAE,IAAI;gBACd,mBAAmB,EAAE,IAAI;aAC1B,CAAC;YACF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAClB,GAAqB,EACrB,KAAsB,EACL,EAAE;QACnB,KAAK,CAAC,QAAQ,KAAK,IAAI,eAAe,CACpC,EAAE,EACF,GAAG,CAAC,OAAO,EACX,GAAG,GAAG,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACtC,CAAC;QACF,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,yEAAyE;IACzE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,CACrB,GAAqB,EACrB,KAAsB,EACX,EAAE;QACb,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YAChC,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,OAAO,GACX,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,OAAO,IAAI,6BAA6B,CACtC,GAAG,EACH,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CACnD,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,CAAC,KAAsB,EAAE,EAAE;QACvC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;QACpB,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;QACxB,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;QAC3B,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC;IACnC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAC3B,GAAqB,EACrB,KAAsB,EACP,EAAE;QACjB,4EAA4E;QAC5E,uEAAuE;QACvE,kEAAkE;QAClE,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YAClE,IACE,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;gBAC5C,KAAK,CAAC,mBAAmB,EACzB,CAAC;gBACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,CAAC,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,MAAM,UAAU,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,2EAA2E;YAC3E,0EAA0E;YAC1E,oEAAoE;YACpE,0EAA0E;YAC1E,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACxC,wEAAwE;YACxE,gEAAgE;YAChE,wEAAwE;YACxE,wDAAwD;YACxD,MAAM,CAAC,GAAG,IAAI,MAAM,CAClB,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAC/C,EAAE,mBAAmB,EAAE,IAAI,2BAA2B,EAAE,EAAE,CAC3D,CAAC;YACF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACrC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACnB,uEAAuE;gBACvE,uEAAuE;gBACvE,oEAAoE;gBACpE,qEAAqE;gBACrE,kBAAkB;gBAClB,IAAI,QAAQ,IAAI,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,UAAU,EAAE,CAAC;oBAC7D,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;oBAClB,CAAC;oBAAC,MAAM,CAAC;wBACP,wBAAwB;oBAC1B,CAAC;oBACD,MAAM,IAAI,iBAAiB,CACzB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;gBACD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;gBACjB,KAAK,CAAC,mBAAmB,GAAG,UAAU,CAAC;gBACvC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC;YAC7B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,kEAAkE;gBAClE,mEAAmE;gBACnE,mBAAmB;gBACnB,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,SAAS,GAAc;QAC3B,EAAE;QACF,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,KAAK;QACX,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,UAAU,EAAE,IAAI,CAAC,UAAU;QAE3B,KAAK,CAAC,SAAS,CAAC,GAAG;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,MAAO,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAClB,CAAC,CAAC,EAAW,EAAE,CAAC,CAAC;gBACf,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,WAAqC;gBACpD,YAAY,EAAE,CAAC,CAAC,YAAuC;gBACvD,WAAW,EAAE,CAAC,CAAC,WAAqC;aACrD,CAAC,CACH,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC;gBACH,OAAO,MAAM,KAAK,CAAC,MAAO,CAAC,QAAQ,CACjC;oBACE,IAAI;oBACJ,SAAS,EAAE,CAAC,IAAI,IAAI,EAAE,CAA4B;iBACnD,EACD,SAAS,EACT,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,MAAM;oBACzB,CAAC,CAAC;wBACE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9C;oBACH,CAAC,CAAC,SAAS,CACd,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,IAAI,GAAG,YAAY,iBAAiB,EAAE,CAAC;oBACrC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;oBAC1B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBAC/B,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,uBAAuB,EAAE,CAAC;oBACpE,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,GAAG;wBACrB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG;YACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACzC,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,qEAAqE;YACrE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS;gBACxB,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAkC,CAAC;YAC/D,MAAM,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACzB,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC9B,mEAAmE;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QACf,CAAC;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;QAChC,wEAAwE;QACxE,sEAAsE;QACtE,0EAA0E;QAC1E,gEAAgE;QAChE,SAAS,CAAC,mBAAmB,GAAG,KAAK,EAAE,GAAG,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,SAAS,CAAC;QAChE,CAAC,CAAC;QAEF,SAAS,CAAC,WAAW,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACzD,CAAC,CAAC;QAEF,SAAS,CAAC,SAAS,GAAG,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE;YAC7C,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;gBACrB,mEAAmE;gBACnE,qEAAqE;gBACrE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,0BAA0B;gBAC1B,MAAM,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,4DAA4D;gBAC9D,CAAC;gBACD,mEAAmE;gBACnE,qEAAqE;gBACrE,6DAA6D;gBAC7D,MAAM,CAAC,CAAC,cAAc,EAAE,CAAC;gBACzB,wEAAwE;gBACxE,yCAAyC;gBACzC,MAAM,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;gBACrC,MAAM,CAAC,CAAC,YAAY,EAAE,CAAC;gBACvB,KAAK,CAAC,KAAK,CAAC,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,wEAAwE;gBACxE,uEAAuE;gBACvE,8CAA8C;gBAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,uBAAuB,EAAE,CAAC;gBAClD,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,OAAO;wBACzB,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBAClC,OAAO;oBACL,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,6CAA6C;iBACvD,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;oBACvB,OAAO;wBACL,KAAK,EAAE,eAAe;wBACtB,gBAAgB,EAAE,MAAM,CAAC,CAAC,uBAAuB,EAAE;wBACnD,OAAO,EAAE,mDAAmD;qBAC7D,CAAC;gBACJ,CAAC;gBACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/credential-health.d.ts

@@ -0,0 +1,220 @@
+import type { CredentialVault } from "./credentials.js";
+import type { Connector, ConnectorContext, ConnectorStatusState, KVStorage, Logger } from "./types.js";
+/** Verdict of one liveness check. Same vocabulary as `ConnectorStatus.state`. */
+export type CredentialCheckState = ConnectorStatusState;
+/** The stored verdict of the most recent liveness check of one connector. */
+export interface CredentialHealthRecord {
+    state: CredentialCheckState;
+    /** ISO timestamp of the check that produced this record. */
+    checkedAt: string;
+    /** Why, for a non-ok state — the connector's own reason, verbatim. */
+    message?: string;
+    /** Consent URL to open, when the connector reported one. */
+    authorizationUrl?: string;
+}
+/**
+ * Why a connector was not checked.
+ *
+ * - `not_found` — no connector with that id is registered. Only reachable
+ *   through an explicit `ids` request, and reported rather than dropped so a
+ *   typo in a scheduled check is visible instead of silent.
+ * - `not_checkable` — it stores no credential connecta manages, or exposes no
+ *   usable way to ask: neither `status()` nor a credential test hook the
+ *   declared credential shape can use (`credentialTestRule`), against a value
+ *   actually stored under it.
+ * - `no_credential` — checkable, but nothing is stored yet: there is no
+ *   credential whose liveness could be in question, and probing would start an
+ *   OAuth flow nobody asked for.
+ * - `fresh` — checked less than `intervalSeconds` ago (by any isolate — the
+ *   record is persisted), so this is the rate limit doing its job.
+ * - `in_flight` — another check of this connector is already running.
+ */
+export type CredentialCheckSkip = "not_found" | "not_checkable" | "no_credential" | "fresh" | "in_flight";
+/** One connector's outcome in a sweep. */
+export interface CredentialCheckResult {
+    connectorId: string;
+    /**
+     * The record now in force. Present for a completed check, and for a `fresh`
+     * skip (where the still-valid record is what the skip deferred to).
+     */
+    record?: CredentialHealthRecord;
+    /** Set when no check ran; `record` is then whatever was already stored. */
+    skipped?: CredentialCheckSkip;
+    /**
+     * The check ran, but its verdict was thrown away: the credential it judged
+     * was replaced or removed while it was in flight (see `clear`). `record` is
+     * what the check saw, not what is stored — nothing is.
+     */
+    discarded?: true;
+    /** How long the check took, when one ran. */
+    latencyMs?: number;
+}
+/** Deployment-wide tuning for credential liveness checks. */
+export interface CredentialHealthConfig {
+    /**
+     * Minimum seconds between checks of the same connector, across isolates (the
+     * verdict is persisted, so a Worker cron isolate and a request isolate share
+     * one clock). Default 900 (15 minutes). This is the bound on downstream cost:
+     * repeated status reads never each trigger a check.
+     */
+    intervalSeconds?: number;
+    /** Max checks in flight at once during one sweep. Default 4. */
+    concurrency?: number;
+    /** Per-check deadline. Default 30 000, the probe default. */
+    timeoutMs?: number;
+    /**
+     * Let inbound authenticated `/mcp` and `/ui/data` traffic trigger a *due*
+     * sweep in the background (`ctx.waitUntil` where the runtime has it). Default
+     * true — it is the trigger that makes stale-credential detection work with no
+     * scheduler wired at all, and it cannot slow a request down or change a
+     * result. Set false to check only from `Connecta.checkCredentials()`.
+     */
+    onRequest?: boolean;
+}
+export declare const DEFAULT_CREDENTIAL_CHECK_INTERVAL_SECONDS = 900;
+export declare const DEFAULT_CREDENTIAL_CHECK_CONCURRENCY = 4;
+/** What the checker needs from the registry, without depending on it. */
+export interface CredentialHealthDeps {
+    listConnectors(): Connector[];
+    getConnector(id: string): Connector | undefined;
+    contextFor(id: string, baseUrl: string, requestScope?: object): ConnectorContext;
+    storage: KVStorage;
+    logger: Logger;
+    credentialVault?: CredentialVault;
+}
+export interface CredentialCheckOptions {
+    /** Check even connectors whose verdict is still fresh. */
+    force?: boolean;
+    /** Restrict the sweep to these connector ids. Default: every connector. */
+    ids?: string[];
+    /** Request-scope identity to reuse a connector's per-request resources. */
+    requestScope?: object;
+}
+/**
+ * Whether a connector holds a credential connecta stores AND exposes a way to
+ * ask whether it still works.
+ *
+ * Deliberately narrow. `listTools`/`callTool` are NOT liveness probes here: a
+ * tool call may mutate downstream state, and the catalog path is already covered
+ * by the existing probe. So a connector is checkable only through the two hooks
+ * that exist to answer exactly this question — `testCredential(s)` (what /ui's
+ * Test button runs) and `status()` — and only when it has a credential of ours
+ * to be asked about: an operator-managed `credential`, or a stored downstream
+ * grant it reports via `hasStoredCredential`. A static-token connector stores
+ * nothing here and is never probed on a timer.
+ *
+ * Whether a test hook counts is `credentialTestRule`'s call, not this function's
+ * — the same rule /ui's Test button and the credential API read (issue #55), so
+ * a credential the operator cannot test by hand is not one a sweep tests behind
+ * their back. A connector whose only hook cannot test its declared shape is
+ * checkable only if it also implements `status()`.
+ */
+export declare function isCheckableConnector(connector: Connector): boolean;
+/**
+ * Runs and caches credential liveness checks. One instance per `Registry`.
+ *
+ * Cost is bounded four ways, because a status surface an agent polls must never
+ * become a way to hammer a downstream auth endpoint:
+ *
+ * 1. **Eligibility** — only connectors holding a credential of ours are probed
+ *    at all (`isCheckableConnector`), and only when something is actually stored.
+ * 2. **Freshness (cross-isolate)** — a persisted verdict younger than
+ *    `intervalSeconds` short-circuits the check, so every isolate and every
+ *    trigger share one budget.
+ * 3. **Sweep gate (per isolate)** — `sweepIfDue` runs at most one traffic-
+ *    triggered sweep per interval per isolate, and never two at once, so a burst
+ *    of requests costs one sweep, not one per request.
+ * 4. **Deadline + fan-out bound** — each check is bounded by `timeoutMs` and at
+ *    most `concurrency` run together (the same shape as the `probeTimeoutMs`
+ *    bound on the discovery fan-out, issue #19).
+ */
+export declare class CredentialHealthChecker {
+    private readonly deps;
+    private readonly store;
+    private readonly intervalMs;
+    private readonly concurrency;
+    private readonly timeoutMs;
+    private readonly onRequest;
+    /** Per-connector checks in flight in THIS isolate. */
+    private readonly inFlight;
+    /** Earliest a traffic-triggered sweep may run again in this isolate. */
+    private nextSweepAt;
+    private sweeping;
+    constructor(deps: CredentialHealthDeps, config?: CredentialHealthConfig);
+    /**
+     * The stored verdict, if any. No downstream I/O — and no storage read at all
+     * for a connector that stores no credential of ours, since only a checkable
+     * connector can ever have had a verdict written. That keeps
+     * `list_connectors({ probe: false })` exactly as cheap as it was for the
+     * deployments this feature does not apply to.
+     */
+    healthFor(connectorId: string): Promise<CredentialHealthRecord | undefined>;
+    /**
+     * Record a liveness verdict observed elsewhere — today, the live status a
+     * `list_connectors({ probe: true })` just performed. Filtered by the same
+     * eligibility rule as a check, so this stays a record of *credential* health
+     * rather than a general status cache, and so it also counts against the
+     * freshness budget: an operator who just probed live does not get swept again
+     * moments later.
+     */
+    record(connectorId: string, record: CredentialHealthRecord): Promise<void>;
+    /** Forget a connector's verdict — its credential just changed under us. */
+    clear(connectorId: string): Promise<void>;
+    /** Whether any connector in this deployment could be checked at all. */
+    hasCheckableConnectors(): boolean;
+    /**
+     * Check every (or the named) connector's stored credential and return one
+     * outcome per connector considered. Never rejects: a connector that throws,
+     * hangs past `timeoutMs`, or cannot be persisted becomes an `error` verdict.
+     */
+    check(baseUrl: string, opts?: CredentialCheckOptions): Promise<CredentialCheckResult[]>;
+    /**
+     * The traffic-triggered sweep: a promise to hand to `ctx.waitUntil`, or
+     * `undefined` when nothing is due (the common case, and free — no I/O). The
+     * gate is armed BEFORE the sweep starts, so a burst of concurrent requests
+     * produces one sweep.
+     */
+    sweepIfDue(baseUrl: string): Promise<CredentialCheckResult[]> | undefined;
+    private checkOne;
+    private recordOrNothing;
+    private runCheck;
+    /**
+     * `isCheckableConnector` re-asked against what is actually stored: the hook
+     * the declared shape selects, bound to a value that fits it (see
+     * {@link testHookFor}), or a `status()` to fall back on. Neither ⇒ there is no
+     * honest question to put to this connector.
+     */
+    private canAsk;
+    /**
+     * Ask the connector whether the credential it holds still works — with no
+     * downstream mutation and no tool call. A credential test is preferred for a
+     * vault credential because it validates the stored value itself; `status()` is
+     * the downstream-OAuth answer (it refreshes the grant, which is the liveness
+     * question for a token).
+     */
+    private probe;
+    private settle;
+}
+/**
+ * Whether a liveness verdict may DECIDE a connector's cached status.
+ *
+ * Only `auth_required` ever does, and only while nothing better has happened
+ * since. Two separate judgements:
+ *
+ * 1. **`error` is not credential evidence.** A check that timed out, threw, or
+ *    got a 502 from the provider's status endpoint failed to *complete* — it
+ *    learned nothing about the credential. Letting it set the status would flip
+ *    a connector whose calls are fine to `error` for a whole interval on a DNS
+ *    blip. Error verdicts stay visible in `credentialCheck` (an operator wants
+ *    to know checks are failing) but the status keeps coming from observed real
+ *    calls, which is evidence.
+ * 2. **A successful real call retires the verdict.** Traffic beats a background
+ *    probe, so a `lastSuccessAt` at or after `checkedAt` means the credential
+ *    demonstrably works whatever the check concluded. The next check re-decides.
+ *
+ * `auth_required` deliberately outranks an observed real-call *failure*: both
+ * say something is wrong, and only one of them carries the URL that fixes it.
+ * The failure stays visible as `lastError`.
+ */
+export declare function credentialVerdictApplies(record: CredentialHealthRecord | undefined, lastSuccessAt: string | undefined): boolean;
+//# sourceMappingURL=credential-health.d.ts.map

package/dist/credential-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-health.d.ts","sourceRoot":"","sources":["../src/credential-health.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,KAAK,EACV,SAAS,EACT,gBAAgB,EAEhB,oBAAoB,EAEpB,SAAS,EACT,MAAM,EACP,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAExD,6EAA6E;AAC7E,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,oBAAoB,CAAC;IAC5B,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,eAAe,GACf,eAAe,GACf,OAAO,GACP,WAAW,CAAC;AAEhB,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B;;;;OAIG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,6DAA6D;AAC7D,MAAM,WAAW,sBAAsB;IACrC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gEAAgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,yCAAyC,MAAM,CAAC;AAC7D,eAAO,MAAM,oCAAoC,IAAI,CAAC;AAuMtD,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,cAAc,IAAI,SAAS,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC;IAChD,UAAU,CACR,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,MAAM,GACpB,gBAAgB,CAAC;IACpB,OAAO,EAAE,SAAS,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,0DAA0D;IAC1D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAQlE;AA2DD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,uBAAuB;IAahC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAwB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;IACpC,sDAAsD;IACtD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,wEAAwE;IACxE,OAAO,CAAC,WAAW,CAAK;IACxB,OAAO,CAAC,QAAQ,CAA+C;gBAG5C,IAAI,EAAE,oBAAoB,EAC3C,MAAM,GAAE,sBAA2B;IAsBrC;;;;;;OAMG;IACH,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAQ3E;;;;;;;OAOG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC;IAMhB,2EAA2E;IAC3E,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,wEAAwE;IACxE,sBAAsB,IAAI,OAAO;IAIjC;;;;OAIG;IACG,KAAK,CACT,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,sBAA2B,GAChC,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAcnC;;;;;OAKG;IACH,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,GAAG,SAAS;YAa3D,QAAQ;YAoCR,eAAe;YAOf,QAAQ;IAwDtB;;;;;OAKG;IACH,OAAO,CAAC,MAAM;IAOd;;;;;;OAMG;YACW,KAAK;YA+BL,MAAM;CAcrB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,sBAAsB,GAAG,SAAS,EAC1C,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,OAAO,CAKT"}